a1k0n
commented
2 years ago This is super weird. It asks for bytes 0-63, then bytes 253815-505866/505867 of upgrade.bin in the two requests.
Closed a1k0n closed 2 years ago
a1k0n
commented
2 years ago This is super weird. It asks for bytes 0-63, then bytes 253815-505866/505867 of upgrade.bin in the two requests.
a1k0n
commented
2 years ago Hooked up a serial terminal at 74480 baud, seems the firmware doesn't boot or it crashes before flashing it. Hm.
[notice]smart_wf_frame.c:3721 firmware self detect upgrade start...
[notice]smart_wf_frame.c:3736 fw_url:http://10.42.42.1/files/upgrade.bin
[notice]smart_wf_frame.c:3737 fw_md5:9aeeb1f7b6dacb6f251445aac49181a9
[notice]smart_wf_frame.c:3738 serv_sw_ver:9.0.0
[notice]smart_wf_frame.c:3754 serv_sw_ver:90000 sw_ver:10004
[notice]smart_wf_frame.c:978 smt_frm_cntl.fw_ug.tp:1
[notice]mqtt_client.c:484 DNS START 08-17 16:35:58
[notice]mqtt_client.c:515 who_fir:0 ip:10.42.42.1
[notice]mqtt_client.c:525 DNS END 08-17 16:35:58
[notice]mqtt_client.c:531 MQTT CONN START 08-17 16:35:58
[err]mqtt_client.c:536 op_ret:42.errno:0
[notice]mqtt_client.c:531 MQTT CONN START 08-17 16:35:59
[err]mqtt_client.c:536 op_ret:42.errno:0
Fatal exception (20):
epc1=0x00000000
epc2=0x00000000
epc3=0x4000e1ee
epcvaddr=0x00000000
depc=0x00000000
rtn_add=0x402536bc^M<FA>"@<8A>R^EdP151<EB>mt%<C4><D2>W<8C>@<C9>y.)Q*^A<EB>L8<C1>^@<CA>I
T1^Q )D<D0>5<C3> 5Y*^E^B<FC>NZA<EE>^@ i<ED>~<D8> <C8><DE>T1R<97>
1^Q@<CA>|^]u
5Y
9 <F8>NzA<EE>^@ i<CD>~v <C8><DE>tR<97>*5@<EA>|^YE*5Y
9 <F8>NzA<EC>^@)I<CD>~1r <B8><F2><A7>^H1<8A>^B^X^A-^G<C9>y.=<84><D2>y^K^U<D2>8!! J^U!^A5^Y a"@h<E2>^E Q
^A^A!^U1eN<88>h<C2>^E^MI-AEa
-)<84>X1%Z^Gn^U^H<DA>EM^A<C8> <E9>^P<B7>^HVAnV<9B>^H<D0>!"<FC>OS SDK ver: 1.4.2(78f3caf) compiled @ Oct 23 2017 13:45:35
phy v[notice]user_main.c:294 SDK version:1.4.2(78f3caf)
[notice]user_main.c:298 fireware info name:esp_kt_kmc_dltj version:1.0.4
[notice]user_main.c:301 tuya sdk compiled at May 12 2018 15:21:21
[notice]user_main.c:303 BV:5.28 PV:2.1 LPV:3.1
reset reason: 2
Fatal exception (20):
epc1=0x00000000, epc2=0x00000000, epc3=0x40240d19, excvaddr=0x00000000,depc=0x00000000
mode : softAP(82:7d:3a:47:9f:9b)
dhcp server start:(ip:192.168.4.1,mask:255.255.255.0,gw:192.168.4.1)
add if1
bcn 100
[notice]gw_intf.c:240 Authorization success
bcn 0
del if1
usl
mode : sta(80:7d:3a:47:9f:9b)```Since I went to the trouble to wire up serial, I ended up just reflashing it that way, but it's a bummer that the OTA method didn't work. Could be the result of a firmware update via the KMC app. Closing for now; doesn't look like anyone else has run into this exact crash and I don't feel like reverse engineering the stock firmware to debug. Sorry if someone else runs into this later; you'll have to open it up and solder some wires.
Stock KMC 70011. Seems to come up just fine on the access point, but after that, web.log just continuously repeats this about every 15 seconds, as it attempts to fetch upgrade.bin (strangely, it does it with two Accept-Ranges GETs rather than the HEAD/GET that I see elsewhere):
The device is effectively bricked (can't connect with stock app) but it isn't running the intermediate firmware either, because then it'd come up on 10.42.42.42, right? It also appears to be in a boot loop -- if I manually turn on the relay, it turns itself off after a little, and it disconnects/reconnects to the AP every 15 seconds or so.
udp.log:
relevant mqtt.log:
only complaints about no shared cipher (probably my phone) in psk.log.
wifi.log has
for each reboot.