Vigotek Reverse engineering by TheThomasD
-
-
Save X3msnake/08f35475036821f8387260659f5e8448 to your computer and use it in GitHub Desktop.
For some unknown reason a couple of vigotec offline controllers (VigoStick) from our VEVOR 3018 farm stopped working with a blank screen of death.
First thing was to try to reverse engineer the pins that had no name in the bottom of the controller, turns out these are the UART0 that can be used to upload sketches to the ESP32.
Then i followed the LCD pins to map out the GPIOs that controlled the SPI ST7735 1.8 inch screen that vigostick is using:
- TFT_CS 15, TFT_RST 2, TFT_DC 12, TFT_SCLK 13, TFT_MOSI 14
Installed Adafruit_ST7735 library in arduino IDE and used the inbuilt graphics text example modifying the following code to align with the pinouts
#else
// For the breakout board, you can use any 2 or 3 pins.
// These pins will also work for the 1.8" TFT shield.
#define TFT_CS 15
#define TFT_RST 2 // Or set to -1 and connect to Arduino RESET pin
#define TFT_DC 12
#define TFT_SCLK 13
#define TFT_MOSI 14
...
// For ST7735-based displays, we will use this call
Adafruit_ST7735 tft = Adafruit_ST7735(TFT_CS, TFT_DC, TFT_MOSI, TFT_SCLK, TFT_RST);
...
// (This one also works but with glitches on the edge of the screen)
// Use this initializer if using a 1.8" TFT screen:
// tft.initR(INITR_BLACKTAB); // Init ST7735S chip, black tab
// OR use this initializer if using a 1.8" TFT screen with offset such as WaveShare:
tft.initR(INITR_GREENTAB); // Init ST7735S chip, green tab
To upload the code there is a trick that one must do when the program tries to connect to the serial and that is to short the GPIO0 to ground to put the ESP32 in boot mode, in case of the ESP32-WROOM-32E it is the farthest pinst to the right of the chip like in the picture
Ok so the ESP is working and the LCD is fine... something else is messed up
A couple of websearches and found a video explaining how to use arduino idea to backup and restore a flash image on a esp32, a tool called esptool that is well documented. So next thing was to try copying the code from a working ESP and injecting it to the vigotec to see if it worked.
- https://community.blynk.cc/t/how-to-backup-restore-official-firmware-on-any-espressif-esp8266-esp32/34309
- https://www.youtube.com/watch?v=2GwzbBn7uRw
# IINSTALL ESPTOOL
pip install esptool
# RUN ESPTOOL
esptool.py
# Change COM3 to your own Port
## For 1M Flash:
python esptool.py -b 115200 --port COM3 read_flash 0x000000 0x100000 flash_1M.bin
python esptool.py -b 115200 --port COM3 write_flash --flash_freq 80m 0x000000 flash_1M.bin
## For 4M Flash:
python esptool.py -b 115200 --port COM3 read_flash 0x00000 0x400000 flash_4M.bin
python esptool.py -b 115200 --port COM3 write_flash --flash_freq 80m 0x000000 flash_4M.bin
that is all
## Erasing Flash
esptool.py -b 115200 --port COM7 erase_flash
you should get something like this for the 4M flash
## BACKING UP
C:\Users\Utilizador>esptool.py -b 115200 --port COM7 read_flash 0x00000 0x400000 vigostik_132_211123_flash_4M.bin
esptool.py v4.6
Serial port COM7
Connecting..........
Detecting chip type... Unsupported detection protocol, switching and trying again...
Connecting......
Detecting chip type... ESP32
Chip is ESP32-D0WD-V3 (revision v3.0)
Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
Crystal is 40MHz
MAC: e0:e2:e6:5a:1a:10
Uploading stub...
Running stub...
Stub running...
4194304 (100 %)
4194304 (100 %)
Read 4194304 bytes at 0x00000000 in 391.4 seconds (85.7 kbit/s)...
Hard resetting via RTS pin...
## UPLOADING
C:\Users\Utilizador>esptool.py -b 115200 --port COM7 write_flash --flash_freq 80m 0x000000 vigostik_132_211123_flash_4M.bin
esptool.py v4.6
Serial port COM7
Connecting.....................
Detecting chip type... Unsupported detection protocol, switching and trying again...
Connecting......
Detecting chip type... ESP32
Chip is ESP32-D0WD-V3 (revision v3.0)
Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
Crystal is 40MHz
MAC: 34:ab:95:4a:a2:50
Uploading stub...
Running stub...
Stub running...
Configuring flash size...
Flash will be erased from 0x00000000 to 0x003fffff...
Compressed 4194304 bytes to 1351601...
Wrote 4194304 bytes (1351601 compressed) at 0x00000000 in 189.5 seconds (effective 177.1 kbit/s)...
Hash of data verified.
Leaving...
Hard resetting via RTS pin...
The cloning worked for the graphic demo but when i cloned a working vigostick to the non working one the blank screen returned... What now? I opened the binary file that i had just backed up in HxD to see if the file was encripted and it does not seem so, since there is unencripted text showing including M and G commands
Turns out i had not power cycled the ESP properly, so the cloning works but now this error:
Fatal Error
VigoStick 1.32 211123
Run Error!
My next guess is that the eeprom, that holds the webfiles is corrupted or mismatched, maybe filesystem upload is missing or maybe i messed up the memory size on the backup ???
Ok so dropping the image into a wemos with a similar EPS32-WROOM-32E chip and having easy acess to the enable button mi managed to get this debug list on the arduino serial monitor...
rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
flash read err, 1000
Falling back to built-in command interpreter.
OK
>ets Jun 8 2016 00:22:57
rst:0x10 (RTCWDT_RTC_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
configsip: 0, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:1
load:0x3fff0018,len:4
load:0x3fff001c,len:1044
load:0x40078000,len:8896
load:0x40080400,len:5816
entry 0x400806ac
[E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
[E][sd_diskio.cpp:775] sdcard_mount(): f_mount failed: (3) The physical drive cannot work
[E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
VIGO-STKBAAN-n9EQQuh5bP
Connecting to VIGOTEC with 12345678... Disconnected
.. Disconnected
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
Local AP VIGO-STKBAAN started, 192.168.0.1
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
HTTP server started
[E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
[E][sd_diskio.cpp:775] sdcard_mount(): f_mount failed: (3) The physical drive cannot work
[E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
Get start...
[E][WiFiGeneric.cpp:739] hostByName(): DNS Failed for www.vigotec.cn
Get failed.
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
VigoStick 1.32 Build:211123 Start
And shorting enable to ground on the vigostick board i got this debug
rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
configsip: 0, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:1
load:0x3fff0018,len:4
load:0x3fff001c,len:1044
load:0x40078000,len:8896
load:0x40080400,len:5816
entry 0x400806ac
[E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
[E][sd_diskio.cpp:775] sdcard_mount(): f_mount failed: (3) The physical drive cannot work
[E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
VIGO-STKBKBH-tgVwL:iKVA
Connecting to VIGOTEC with 12345678... Disconnected
.. Disconnected
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
Local AP VIGO-STKBKBH started, 192.168.0.1
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
HTTP server started
[E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
[E][sd_diskio.cpp:775] sdcard_mount(): f_mount failed: (3) The physical drive cannot work
[E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
Get start...
[E][WiFiGeneric.cpp:739] hostByName(): DNS Failed for www.vigotec.cn
Get failed.
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
VigoStick 1.32 Build:211123 Start
So the error is most likely just the fact that there is no GRBL board since the ESP is creating the Access Point and the control page can be accessed via the IP/Password that the serial dump shows.
So most likely this is done and fixed. I should probably extract the 1.5v from the newer controller if the error is the board connections, since the newer version handles that error more greacefully allowing full controll of the standalone controller instead of showing a blocking error like this version does :)
... It was not. I am out of ideas for a couple of days
The backed up vigostick firmware for the ESP32 can be downloaded here:
- https://github.com/X3msnake/my-gists-files/blob/main/vigostik_132_211123_flash_4M.bin
- https://github.com/X3msnake/my-gists-files/blob/main/vigostik_150_220504_flash_4M.bin
This is the full boot cycle of a healthy VigoStick when connected to the GRBL board
rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
configsip: 0, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:1
load:0x3fff0018,len:4
load:0x3fff001c,len:1044
load:0x40078000,len:8896
load:0x40080400,len:5816
entry 0x400806ac
[E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
VIGO-STKPTTM-8QUR6h45FM
Connecting to VIGOTEC with 12345678... Disconnected
.. Disconnected
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
Local AP VIGO-STKPTTM started, 192.168.0.1
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
[E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
Grbl 1.1f ['$' for help]
VIGOTEC.SDEM1.1.0.220328
VigoStick 1.5 Build:220504 Start
$0=8
$1=25
$2=0
$3=0
$4=0
$5=0
$6=0
$10=1
$11=0.010
$12=0.002
$13=0
$20=0
$21=0
$22=0
$23=0
$24=25.000
$25=500.000
$26=250
$27=1.000
$30=1000
$31=0
$32=0
$33=0
$100=800.000
$101=800.000
$102=800.000
$110=1000.000
$111=1000.000
$112=1000.000
$120=50.000
$121=50.000
$122=20.000
$130=200.000
$131=200.000
$132=200.000
<Idle|MPos:0.000,0.000,0.000|FS:0,0|WCO:0.000,0.000,0.000>
So seems the cloning is missing some thing, well these stick supposedly upgrade Over The Air (OTA) so i got inside the webpage, added the network credentials, it rebooted and then i was able to check for updates...
After issuing the upgrade command and being greeted with the Update message on the ESP screen i waited for it to "UPDRADE..." as seen in the picture :P
It rebooted and it was working... probably china also has my gues wifi password now :P I'll just make a honeypot full of wasps out of it, just in case...
Either way it is fixed and hopefully it will help someone in a near future Last but not least, popped up inside the VigoStick portal one last time to change back the wifi ID and password. I dont want these things connected to the web nor i want everyone that can boot a machine to read my guest wifi and password at the boot screen so i used that to send a subliminal message
- (https://github.com/BlackVS/ESP32-reversing) good list with tools to reverse engineer the ESP32
¶®+2*ÂbÀE7UÿÀ¨8/[¤ÈÜ3æòÊ©LßPpɹGET /Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin HTTP/1.0
Host: www.vigotec.cn:8080
User-Agent: ESP32-http-Update
Connection: close
Cache-Control: no-cache
x-ESP32-STA-MAC: 24:0A:C4:0E:13:C0
x-ESP32-AP-MAC: 24:0A:C4:0E:13:C1
x-ESP32-free-space: 1966080
x-ESP32-sketch-size: 1219392
x-ESP32-sketch-md5: 7556c1d8633fa6e0db9c42133ab9922e
x-ESP32-sketch-sha256: 9D09C4488A84B6F53EB54F88211DFF35B681E6706E16BBB270D1BBCA8232580A
x-ESP32-chip-size: 4194304
x-ESP32-sdk-version: v3.3.5-1-g85c43024c
x-ESP32-mode: sketch
https://chat.openai.com/share/07823223-60d1-42bf-b99b-918c91ff5116
🧔 User: GET /Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin HTTP/1.0
Host: www.vigotec.cn:8080
User-Agent: ESP32-http-Update
Connection: close
Cache-Control: no-cache
x-ESP32-STA-MAC: 24:0A:C4:0E:13:C0
x-ESP32-AP-MAC: 24:0A:C4:0E:13:C1
x-ESP32-free-space: 1966080
x-ESP32-sketch-size: 1219392
x-ESP32-sketch-md5: 7556c1d8633fa6e0db9c42133ab9922e
x-ESP32-sketch-sha256: 9D09C4488A84B6F53EB54F88211DFF35B681E6706E16BBB270D1BBCA8232580A
x-ESP32-chip-size: 4194304
x-ESP32-sdk-version: v3.3.5-1-g85c43024c
x-ESP32-mode: sketch
🤖 Assistant: The provided text appears to be an example of an HTTP request header. It includes various fields that provide information about the client making the request and the desired resource.
Here is a breakdown of the different fields in the request:
bash
Copy code
GET /Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin HTTP/1.0
This line specifies the HTTP method (GET), the path to the requested resource ("/Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin"), and the HTTP version (HTTP/1.0).
makefile
Copy code
Host: www.vigotec.cn:8080
The "Host" field indicates the target host and port ("www.vigotec.cn:8080") where the request is being sent.
sql
Copy code
User-Agent: ESP32-http-Update
The "User-Agent" field identifies the user agent or client software used to make the request. In this case, it is "ESP32-http-Update," suggesting that the request is originating from an ESP32 device using an HTTP update mechanism.
arduino
Copy code
Connection: close
The "Connection" field specifies the desired connection behavior. "close" indicates that the client wants to close the connection after the response is received.
yaml
Copy code
Cache-Control: no-cache
The "Cache-Control" field provides directives for caching mechanisms. "no-cache" indicates that the client prefers a fresh response and doesn't want to use a cached version.
makefile
Copy code
x-ESP32-STA-MAC: 24:0A:C4:0E:13:C0
x-ESP32-AP-MAC: 24:0A:C4:0E:13:C1
x-ESP32-free-space: 1966080
x-ESP32-sketch-size: 1219392
x-ESP32-sketch-md5: 7556c1d8633fa6e0db9c42133ab9922e
x-ESP32-sketch-sha256: 9D09C4488A84B6F53EB54F88211DFF35B681E6706E16BBB270D1BBCA8232580A
x-ESP32-chip-size: 4194304
x-ESP32-sdk-version: v3.3.5-1-g85c43024c
x-ESP32-mode: sketch
These are custom headers (prefixed with "x-ESP32-") that provide additional information about the ESP32 device. They include the STA (Station) MAC address, AP (Access Point) MAC address, free space available, sketch size, sketch MD5 and SHA256 checksums, chip size, SDK version, and mode (sketch).
Overall, this request seems to be fetching the binary file "VigoStick.v1_v1.5.220504.bin" from the server "www.vigotec.cn" on port 8080. The additional headers provide specific information about the ESP32 device and its current state.
🧔 User: is there a way to download that file in chrome browser?
🤖 Assistant: Yes, you can download the file in the Chrome browser by following these steps:
Open the Chrome browser on your computer.
Copy the URL of the file you want to download: http://www.vigotec.cn:8080/Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin.
Paste the URL into the address bar of the Chrome browser and press Enter.
Chrome will recognize that the URL points to a file and initiate the download automatically.
The file download will start, and you'll see the progress in the Chrome downloads bar at the bottom of the browser window.
Once the download is complete, you can access the downloaded file by clicking on the down arrow icon in the Chrome downloads bar or by going to the Downloads folder on your computer.
Note: The successful download of the file depends on the accessibility and permissions set on the server hosting the file. If you encounter any issues during the download, it may be due to server restrictions or connectivity problems.
I have backed up firmware from vigotec here One can now do a offline installation of this code by using the OTA arduino sketch as described in https://randomnerdtutorials.com/esp32-over-the-air-ota-programming/ and https://www.pangodream.es/esp32-ota-in-ap-mode-esp2sota
@luisfcorreia unsubscibe all but @ you on the thread.
I am not sharing it with you lol... there is no @ in that reply/post
I also dont understand what you mean... The AI response is real, now if what is suggested is crap... that is very likely true.
@luisfcorreia thanks for the suggestion was not aware of mitmproxy.
I presume it will work like wireshark i still need a pc with dual wifi or a wifi and a cable to serve the web to the ESP right?
@luisfcorreia for some reason the dam things do not want to connect to any of my pc hotspots...
@X3msnake you need me to come over with a Linux laptop?
now please explain how are you setting up that hotspot
@luisfcorreia found the bug using a router. dam things only accept 2.4Ghz and must be the old WPA protocol. and that cannot be set on the Windows hotspot feature. i will connect the router bridge to the pc hotspot and the esps to the router 😸
🧔: How do I capture and backup an OTA update on an ESP32?
🤖: To capture and backup an OTA update on an ESP32, you can follow these general steps:
Set up an OTA server: First, you need to set up an OTA server that will serve the firmware updates to the ESP32 devices. You can use platforms like ArduinoOTA or your custom server implementation.
Prepare your ESP32: Make sure your ESP32 is properly set up for OTA updates. This involves configuring the network connection and enabling OTA updates in your code.
Capture the OTA update: Once your ESP32 is connected to the network and set up for OTA updates, you can capture the update by intercepting the network traffic. One common method is to use a packet capture tool like Wireshark.
a. Install and open Wireshark on a computer connected to the same network as your ESP32.
b. Set up a filter to capture the network traffic from the ESP32. For example, you can filter by the IP address of the ESP32.
c. Initiate an OTA update from your ESP32.
d. Monitor the network traffic in Wireshark, and you should be able to capture the firmware update file.
Backup the OTA update: Once you have captured the OTA update file, you can save it as a backup for future use. You can save it on your computer or in cloud storage.
It's important to note that capturing OTA updates should be done for legitimate purposes, such as backup or analysis, and should not be used for any unauthorized activities or copyright infringement. Make sure to comply with any licensing or legal requirements associated with the OTA update you capture.
🧔: Is there a way to capture it directly inside the ESP32 by creating a program that requests the OTA but does not install it, something one can download via a web portal on the ESP32?
🤖: Yes, it is possible to capture an OTA update directly inside the ESP32 without installing it by creating a program that requests the update but saves it instead of applying it immediately. You can achieve this by implementing a custom web portal on the ESP32 that allows you to download the update file.
Here's a high-level overview of the steps involved:
Set up a web server: Implement a simple web server on the ESP32 that serves a web page with a download link for the OTA update file. You can use libraries like ESPAsyncWebServer or WebServer to handle the web server functionality.
Handle the OTA request: When the user clicks the download link on the web page, the ESP32 should initiate an OTA update request to the OTA server. To achieve this, you can make an HTTP request to the OTA server's URL using the appropriate library, such as ESPAsyncHTTPClient or HTTPClient. This request should retrieve the firmware update file from the OTA server.
Save the OTA update file: Once you receive the OTA update file from the OTA server, you can save it to the ESP32's file system, such as SPIFFS or SD card. This allows you to store the update file for backup or later installation.
Provide download link: After saving the OTA update file, update the web page on the ESP32 to provide a download link for the saved update file. This allows you to access and download the captured OTA update file directly from the ESP32.
By following this approach, you can create a program on the ESP32 that requests OTA updates from the OTA server but saves them locally instead of applying them immediately.
🧔: Can you write me the code for such a portal?
🤖: Certainly! Here's an example code for creating a web
portal on the ESP32 that allows you to capture and download OTA update files:
Make sure to replace
"YourNetworkSSID"
and"YourNetworkPassword"
with the appropriate credentials for your Wi-Fi network. Also, update the OTA server URL in theclient.begin()
function within the/update
route.The code sets up a web server on port 80 and defines two routes:
/
and/update
. The root route displays a basic HTML page with a link to the/update
route. When you click the link, it triggers an OTA update request to the specified OTA server URL. The received OTA update file is saved as"firmware.bin"
(you can change the name) in the preferred file system, such as SPIFFS or SD card.Please note that this is a basic example, and you may need to modify it according to your specific requirements and use appropriate libraries for file system access and OTA updates based on your chosen hardware and frameworks.
🧔: Copy ipsis verbis our conversation and format it with markdown to use in a github gist.
Start with a emoji of a bearded user and another of your choice for the the assistant add "---" between everytime the user or the ai reply
Stop after this reply to avoid a infinite loop.