ct-Open-Source / tuya-convert

A collection of scripts to flash Tuya IoT devices to alternative firmwares
MIT License
4.66k stars 500 forks source link

Vtrust-Recovery #665

Open Gimno opened 4 years ago

Gimno commented 4 years ago

Hello, I wanted to flash my Gosund SP111 on Tasmota. After the backup it stuck, the new software did not load. Now I have vtrust-recovery in the wlan and the socket does not light up, when I plug it in again it lights up blue for a short time. Restarting the procedure does not help, if I select tasmota in the options and start, it says that it does not work.

`Starting smart config pairing procedure Waiting for the device to install the intermediate firmware Put device in EZ config mode (blinking fast) Sending SSID vtrust-flash Sending wifiPassword
Sending token 00000000 Sending secret 0101 . IoT-device is online with ip 10.42.42.42 Stopping smart config Fetching firmware backup % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 1024k 100 1024k 0 0 29085 0 0:00:36 0:00:36 --:--:-- 16809 curl: Saved to filename 'firmware-39ae46.bin'

Getting Info from IoT-device VTRUST-FLASH 1.5 (c) VTRUST GMBH https://www.vtrust.de/35c3/ READ FLASH: http://10.42.42.42/backup ChipID: 39ae46 MAC: 24:62:AB:39:AE:46 BootVersion: 7 BootMode: normal FlashMode: 1M DOUT @ 40MHz FlashChipId: 144051 FlashChipRealSize: 1024K Active Userspace: user2 0x81000

Ready to flash third party firmware!

For your convenience, the following firmware images are already included in this repository: Tasmota v8.1.0.2 (wifiman) ESPurna 1.13.5 (base)

You can also provide your own image by placing it in the /files directory Please ensure the firmware fits the device and includes the bootloader MAXIMUM SIZE IS 512KB

Available options: 0) return to stock 1) flash espurna.bin 2) flash tasmota.bin q) quit; do nothing Please select 0-2: 2 Are you sure you want to flash tasmota.bin? This is the point of no return [y/N] y Attempting to flash tasmota.bin, this may take a few seconds... Flashing http://10.42.42.1/files/tasmota.bin failed after 34ms, HTTP 404 Do you want to try something else? [y/N] y

milothomas commented 4 years ago

I had a bulb that did failed to flash the first time, but I restarted tuya-convert (start_flash.sh) and it was able to connect and flash tasmota on it.

In fact this happened to two of my bulbs and I was able to recover both like this.

Gimno commented 4 years ago

It doesn’t function for me.

kueblc commented 4 years ago
Flashing http://10.42.42.1/files/tasmota.bin failed after 34ms, HTTP 404

Strange that this should be a 404 error. Have you modified any of the included firmware files? Can you confirm that http://10.42.42.1/files/tasmota.bin exists?

Gimno commented 4 years ago
Flashing http://10.42.42.1/files/tasmota.bin failed after 34ms, HTTP 404

Strange that this should be a 404 error. Have you modified any of the included firmware files? Can you confirm that http://10.42.42.1/files/tasmota.bin exists?

I haven’t modify any firmware. How can I check this http://10.42.42.1/files/tasmota.bin ?

kueblc commented 4 years ago

When connected to vtrust-flash you should be able to open that address in a web browser.

Gimno commented 4 years ago

When connected to vtrust-flash you should be able to open that address in a web browser.

At vtrust-recovery http://10.42.42.42/backup is a file firmware-39ae46.bin

At vtrust-flash is tasmota.bin

Dragon57220 commented 4 years ago

Hello,

I have the same problem with a LSC socket.

My LSC socket created a WIFI network called "vtrust-recovery" after the tuya-convert procedure.

At vtrust-recovery http://10.42.42.42/backup is a file firmware-906223.bin

Who has a solution to my problem?

Thank you

Dragon57220 commented 4 years ago

I found a solution to go back and put the Tuya OS.

http://10.42.42.42/undo

xsrf commented 2 years ago

Hey, I kinda have the same issue. I have Gosund EP2 Smart Sockets which came with firmware 1.0.4. tuya-convert was able to connect these to the vtrust-flash network with the SmartConfig but (Socket turned solid green) but failed the steps afterwards. I knew this would happen, as I've read about it and the proposed solution was to upgrade to firmware 1.0.6 through manufacturer support. So I upgraded to 1.0.6 and tried again. tuya-convert again was able to connect the device and began downloading the backup. At 99% it failed and asked if I wanted to continue anyways. I hit N and tuya-convert closed.

SmartConfig complete.
Resending SmartConfig Packets
..................................................................................................
IoT-device is online with ip 10.42.42.42
Fetching firmware backup
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
 99 1024k   99 1022k    0     0  25616      0  0:00:40  0:00:40 --:--:-- 17151
curl: (18) transfer closed with 1460 bytes remaining to read
Could not fetch a complete backup
Do you want to continue anyway? [y/N] N
======================================================
Cleaning up...
Closing AP
Exiting...

The socket was not responding to a button press anymore. I powerecycled it. It turns on/green for a second and turns off and becomes unresponsive. However, it opens a "vtrust-recovery". I connected to it and get this:

┌──(kali㉿kali)-[~]
└─$ curl -i "http://10.42.42.42/"
HTTP/1.1 200 OK
Content-Type: text/plain
Content-Length: 273
Connection: close
Access-Control-Allow-Origin: *

VTRUST-FLASH 1.5
(c) VTRUST GMBH https://www.vtrust.de/35c3/
READ FLASH: http://10.42.42.42/backup
ChipID: 3aa116
MAC: C4:DE:57:3A:A1:16
BootVersion: 7
BootMode: normal
FlashMode: 1M DOUT @ 40MHz
FlashChipId: 144051
FlashChipRealSize: 1024K
Active Userspace: user1 0x01000

┌──(kali㉿kali)-[~]
└─$ curl -i "http://10.42.42.42/backup"
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Disposition: attachment; filename="firmware-3aa116.bin"
Content-Length: 1048576
Connection: close
Access-Control-Allow-Origin: *

Warning: Binary output can mess up your terminal. Use "--output -" to tell 
Warning: curl to output it to your terminal anyway, or consider "--output 
Warning: <FILE>" to save to a file.

┌──(kali㉿kali)-[~]
└─$ curl -o backup.bin "http://10.42.42.42/backup"
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--       0 1024k    0  1240    0     0   1819      0  0:09:36 --:--:--  0:09:36  181  0 1024k    0  1460    0     0   2115      0  0:08:15 --:--:--  0:08:15  2115
curl: (18) transfer closed with 1047116 bytes remaining to read

┌──(kali㉿kali)-[~]
└─$ curl -i "http://10.42.42.42/undo"  
^C

I tried downloading the backup multiple times, it fails... I tried the /undo two times, it returns nothing, seems to disable the wifi but nothing really happens.

When I powercycle the plug I still get vtrust-recovery, but connecting to it gets pretty hard. Works maybe 1 out of 10 tries. Looks like wifi is constantly interrupted.

I didn't realize the device already gets permanently modified before tuya-convert even was able to download the backup.

Any ideas?

Edit: /undo finally worked when I connected from my smartphone. Got "Rebooting into userspace 2". (/backup also did not finish downloading on the smartphone)

Edit: After many tries and sudo airmon-ng check kill it worked. I guess something was interfering with the HostAP.

dy008 commented 1 year ago

After reconnecting to Vtrust-flash, I tried the command curl -i "http://10.42.42.42/flash?url=http://10.42.42.1/files/tasmota.bin" and glad it worked