micahriley88
commented
1 year ago Since the time I posted this, I ended up using an alternative method to achieve a flash dump.
I've also discovered there's a some overall issues with the N variation. Hence, why my T variations worked fine.
I'll go ahead and close this.
After running this on my Globe E26/G25 lightbulbs and uploading the profile, I've tried following the same process for a Doogan E12. Link: https://www.amazon.com/dp/B07WGL5L8Q?ref=ppx_yo2ov_dt_b_product_details&th=1
Outside documentation indicates that these bulbs went from ESP to BK7231N. For testing purposes, I was able to flash ESP Kickstart using cloudcutter with the 7231N build. Before flashing this one, I retrieved the firmware from SmartLife (1.3.21).
The bulb itself has never connected to SmartLife AFAIK. It was purchased new from Amazon.
Because the firmware version seems to be used with N/T, I've tried running the app multiple times across all lightleak profiles. The only one that makes it past "Check if device is exploitable" is the "BK7231N-Type 2 / Addr 1 (Standard)" option.
Using this profile, it will actually provide this message message at the usual failure point: "Good news, your device is exploitable" I'm assuming this affirms that this is the correct profile? Especially since the others repeatedly fail at this step.
Here's a screen capture showing the failure point from the GUI:
Here's the log for showing how each session plays out:
I've observed the following after "Check if device is exploitable":
Worst case scenario—I'll crack one of these open and dump the flash using UART if needed, but it would be pretty neat to avoid sacrificing a device and soldering.