Add images for Bosch BTH-RM

[burmistrzak]

Includes the following OTA images:

• v0.3.7 for Bosch BTH-RM (230V)
• v0.2.8 for Bosch BTH-RM (battery)

[burmistrzak]

Both OTA images were extracted using ZigbeeOtaExtractor from dedicated packet captures.

The tool gave me an error for the v0.3.7 image, but reconstructed a file with the correct size. Don't know what happened here. Just FYI.

[Koenkk]

thanks!

[DerDreschner]

Just for documentation reasons: Both firmware updates were released on 14th of may (Release Notes).

[mrrstux]

Thanks for pushing these images! I tried the one for BTH-RM 230v, from ZHA but it fails to apply it with an invalid image error:

homeassistant.exceptions.HomeAssistantError: Update was not successful: <Status.INVALID_IMAGE: 150>

[DerDreschner]

@mrrstux : Did you tried it only once? I had the same error message with one of my BSP-FZ2 from Bosch. Didn't happened on the second try.

[mrrstux]

@DerDreschner No, I tried it 4 times already, with the same result.

[DerDreschner]

@mrrstux : Mhm, then I would guess it might have something to do with using ZHA instead of Z2M? But I don't have any BTH-RM to test the provided images.

[mrrstux]

@DerDreschner I do have a successful ota with ZHA, using one of the firmware from this repository, on a Bosch Radiator Thermostat II, thus it could be some issue with the BTH-RM (230v) image. Just tried it again on a different BTH-RM (230v), unfortunately with the same result - I see the successful upload, but after 27 seconds, the invalid image error appears.

[burmistrzak]

@mrrstux Hmm, maybe that one image is corrupted after all? 🤔

I unfortunately can't capture another OTA image because all our thermostats are already up-to-date...

Really did my best to get a super clean packet capture, better condition are nearly impossible. I still have the *.pcapng file around, so we might be able to use another tool to reconstruct a working image. @DerDreschner Do you know any other tools that could work here?

[DerDreschner]

@burmistrzak : You could try https://github.com/zigpy/zigpy-cli. I didn't used it yet (only ZigbeeOtaExtractor as you did), but according to this comment, it looks more robust and advanced as it would be able to detect missing frames and generate an uncorrupted ota file from multiple capture files.

If you need any help just let me know.

[burmistrzak]

@DerDreschner Just found that too, will give it a try. At least no .NET required. 😅

I also noticed that the OTA images aren't encrypted, but I would be surprised if they're also not signed.

Anyhow, we'll probably have to continue to extract OTA files for the foreseeable future, because Bosch seems to only ship them with SHC updates. Even if we dump the eMMC, we likely only get a single batch of updates because there's seemingly no online repository of OTA files. The only upside of that approach would be that it could be automated.

[burmistrzak]

Welp... There we have it. 2024-06-16 05:31:23.241 zigpy_cli.ota WARNING Image is invalid 0x1209_0x3011_0x03076a30.ota: Image CRC-32 is invalid: expected 0x2144DF1C, got 0xB453550B

[burmistrzak]

Welp... There we have it. 2024-06-16 05:31:23.241 zigpy_cli.ota WARNING Image is invalid 0x1209_0x3011_0x03076a30.ota: Image CRC-32 is invalid: expected 0x2144DF1C, got 0xB453550B

I checked the pcap and sure enough, the Image Block Response for 0x00008D30 is simply missing?!

Guess, we'll have to pull that image until we figure something out...

[burmistrzak]

@mrrstux Do you have a Bosch SHC?

[mrrstux]

@burmistrzak Sadly, I do not have a SHC. Thanks again for trying to capture and share these images - really appreciated!

[burmistrzak]

@mrrstux That's fine, was worth a shot.

Maybe someone else has the required parts laying around? 👀