Skip to content

Instantly share code, notes, and snippets.

@X3msnake
Last active June 5, 2023 13:14
Show Gist options
  • Save X3msnake/08f35475036821f8387260659f5e8448 to your computer and use it in GitHub Desktop.
Save X3msnake/08f35475036821f8387260659f5e8448 to your computer and use it in GitHub Desktop.

FIXING VEVOR 3018 VIGOSTICK OFFLINE CONTROLLER

It's dead Jim!

image

For some unknown reason a couple of vigotec offline controllers (VigoStick) from our VEVOR 3018 farm stopped working with a blank screen of death.

image

Let's find out what makes it tick

First thing was to try to reverse engineer the pins that had no name in the bottom of the controller, turns out these are the UART0 that can be used to upload sketches to the ESP32.

image

Then i followed the LCD pins to map out the GPIOs that controlled the SPI ST7735 1.8 inch screen that vigostick is using:

  • TFT_CS 15, TFT_RST 2, TFT_DC 12, TFT_SCLK 13, TFT_MOSI 14

image image

Lets install a LCD library and see if things works with a new firmware

Installed Adafruit_ST7735 library in arduino IDE and used the inbuilt graphics text example modifying the following code to align with the pinouts

#else
  // For the breakout board, you can use any 2 or 3 pins.
  // These pins will also work for the 1.8" TFT shield.
  #define TFT_CS        15
  #define TFT_RST       2 // Or set to -1 and connect to Arduino RESET pin
  #define TFT_DC        12
  #define TFT_SCLK      13
  #define TFT_MOSI      14
  
  ...
  
  // For ST7735-based displays, we will use this call
  Adafruit_ST7735 tft = Adafruit_ST7735(TFT_CS, TFT_DC, TFT_MOSI, TFT_SCLK, TFT_RST);
  
  ...
  // (This one also works but with glitches on the edge of the screen)
  // Use this initializer if using a 1.8" TFT screen: 
  // tft.initR(INITR_BLACKTAB);      // Init ST7735S chip, black tab
  
  // OR use this initializer if using a 1.8" TFT screen with offset such as WaveShare:
  tft.initR(INITR_GREENTAB);      // Init ST7735S chip, green tab

To upload the code there is a trick that one must do when the program tries to connect to the serial and that is to short the GPIO0 to ground to put the ESP32 in boot mode, in case of the ESP32-WROOM-32E it is the farthest pinst to the right of the chip like in the picture

image

It kind of works... butt

Ok so the ESP is working and the LCD is fine... something else is messed up

vevor_vigotec_vigostick

A couple of websearches and found a video explaining how to use arduino idea to backup and restore a flash image on a esp32, a tool called esptool that is well documented. So next thing was to try copying the code from a working ESP and injecting it to the vigotec to see if it worked.

How to Backup & Restore Official Firmware on any Espressif ESP8266 & ESP32

Using ESPTOOL

  # IINSTALL ESPTOOL
  pip install esptool
  
  # RUN ESPTOOL
  esptool.py
  
  # Change COM3 to your own Port

  ## For  1M Flash:
  python esptool.py -b 115200 --port COM3 read_flash 0x000000 0x100000 flash_1M.bin 
  python esptool.py -b 115200 --port COM3 write_flash --flash_freq 80m 0x000000 flash_1M.bin 

  ## For  4M Flash:
  python esptool.py -b 115200 --port COM3 read_flash 0x00000 0x400000 flash_4M.bin
  python esptool.py -b 115200 --port COM3 write_flash --flash_freq 80m 0x000000 flash_4M.bin
  that is all
  
  ## Erasing Flash
  esptool.py -b 115200 --port COM7 erase_flash
  
  you should get something like this for the 4M flash

    ## BACKING UP
    
    C:\Users\Utilizador>esptool.py -b 115200 --port COM7 read_flash 0x00000 0x400000 vigostik_132_211123_flash_4M.bin
    esptool.py v4.6
    Serial port COM7
    Connecting..........
    Detecting chip type... Unsupported detection protocol, switching and trying again...
    Connecting......
    Detecting chip type... ESP32
    Chip is ESP32-D0WD-V3 (revision v3.0)
    Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
    Crystal is 40MHz
    MAC: e0:e2:e6:5a:1a:10
    Uploading stub...
    Running stub...
    Stub running...
    4194304 (100 %)
    4194304 (100 %)
    Read 4194304 bytes at 0x00000000 in 391.4 seconds (85.7 kbit/s)...
    Hard resetting via RTS pin...
    
    ## UPLOADING
    
    C:\Users\Utilizador>esptool.py -b 115200 --port COM7 write_flash --flash_freq 80m 0x000000 vigostik_132_211123_flash_4M.bin
    esptool.py v4.6
    Serial port COM7
    Connecting.....................
    Detecting chip type... Unsupported detection protocol, switching and trying again...
    Connecting......
    Detecting chip type... ESP32
    Chip is ESP32-D0WD-V3 (revision v3.0)
    Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
    Crystal is 40MHz
    MAC: 34:ab:95:4a:a2:50
    Uploading stub...
    Running stub...
    Stub running...
    Configuring flash size...
    Flash will be erased from 0x00000000 to 0x003fffff...
    Compressed 4194304 bytes to 1351601...
    Wrote 4194304 bytes (1351601 compressed) at 0x00000000 in 189.5 seconds (effective 177.1 kbit/s)...
    Hash of data verified.
    Leaving...
    Hard resetting via RTS pin...

The cloning worked for the graphic demo but when i cloned a working vigostick to the non working one the blank screen returned... What now? I opened the binary file that i had just backed up in HxD to see if the file was encripted and it does not seem so, since there is unencripted text showing including M and G commands

image

Slap in the forehead!

Turns out i had not power cycled the ESP properly, so the cloning works but now this error:

    Fatal Error
    VigoStick 1.32 211123
    Run Error!

image

Go deep into the rabbit hole...

My next guess is that the eeprom, that holds the webfiles is corrupted or mismatched, maybe filesystem upload is missing or maybe i messed up the memory size on the backup ???

Ok so dropping the image into a wemos with a similar EPS32-WROOM-32E chip and having easy acess to the enable button mi managed to get this debug list on the arduino serial monitor...

    rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
    flash read err, 1000
    Falling back to built-in command interpreter.
    OK
    >ets Jun  8 2016 00:22:57

    rst:0x10 (RTCWDT_RTC_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
    configsip: 0, SPIWP:0xee
    clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
    mode:DIO, clock div:1
    load:0x3fff0018,len:4
    load:0x3fff001c,len:1044
    load:0x40078000,len:8896
    load:0x40080400,len:5816
    entry 0x400806ac
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
    [E][sd_diskio.cpp:775] sdcard_mount(): f_mount failed: (3) The physical drive cannot work
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed

    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    VIGO-STKBAAN-n9EQQuh5bP
    Connecting to VIGOTEC with 12345678... Disconnected
    .. Disconnected

    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    Local AP VIGO-STKBAAN started, 192.168.0.1
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    HTTP server started
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
    [E][sd_diskio.cpp:775] sdcard_mount(): f_mount failed: (3) The physical drive cannot work
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
    Get start...
    [E][WiFiGeneric.cpp:739] hostByName(): DNS Failed for www.vigotec.cn
    Get failed.
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    VigoStick 1.32 Build:211123 Start

image

And shorting enable to ground on the vigostick board i got this debug

image

    rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
    configsip: 0, SPIWP:0xee
    clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
    mode:DIO, clock div:1
    load:0x3fff0018,len:4
    load:0x3fff001c,len:1044
    load:0x40078000,len:8896
    load:0x40080400,len:5816
    entry 0x400806ac
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
    [E][sd_diskio.cpp:775] sdcard_mount(): f_mount failed: (3) The physical drive cannot work
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed

    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    VIGO-STKBKBH-tgVwL:iKVA
    Connecting to VIGOTEC with 12345678... Disconnected
    .. Disconnected

    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    Local AP VIGO-STKBKBH started, 192.168.0.1
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    HTTP server started
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
    [E][sd_diskio.cpp:775] sdcard_mount(): f_mount failed: (3) The physical drive cannot work
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
    Get start...
    [E][WiFiGeneric.cpp:739] hostByName(): DNS Failed for www.vigotec.cn
    Get failed.
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    VigoStick 1.32 Build:211123 Start

So the error is most likely just the fact that there is no GRBL board since the ESP is creating the Access Point and the control page can be accessed via the IP/Password that the serial dump shows.

So most likely this is done and fixed. I should probably extract the 1.5v from the newer controller if the error is the board connections, since the newer version handles that error more greacefully allowing full controll of the standalone controller instead of showing a blocking error like this version does :)

image image image

Nope!

... It was not. I am out of ideas for a couple of days


VigoStick backed up binaries from working units

The backed up vigostick firmware for the ESP32 can be downloaded here:

This is the full boot cycle of a healthy VigoStick when connected to the GRBL board

    rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
    configsip: 0, SPIWP:0xee
    clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
    mode:DIO, clock div:1
    load:0x3fff0018,len:4
    load:0x3fff001c,len:1044
    load:0x40078000,len:8896
    load:0x40080400,len:5816
    entry 0x400806ac
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed

    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    VIGO-STKPTTM-8QUR6h45FM
    Connecting to VIGOTEC with 12345678... Disconnected
    .. Disconnected

    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    Local AP VIGO-STKPTTM started, 192.168.0.1
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    Grbl 1.1f ['$' for help]
    VIGOTEC.SDEM1.1.0.220328

    VigoStick 1.5 Build:220504 Start
    $0=8
    $1=25
    $2=0
    $3=0
    $4=0
    $5=0
    $6=0
    $10=1
    $11=0.010
    $12=0.002
    $13=0
    $20=0
    $21=0
    $22=0
    $23=0
    $24=25.000
    $25=500.000
    $26=250
    $27=1.000
    $30=1000
    $31=0
    $32=0
    $33=0
    $100=800.000
    $101=800.000
    $102=800.000
    $110=1000.000
    $111=1000.000
    $112=1000.000
    $120=50.000
    $121=50.000
    $122=20.000
    $130=200.000
    $131=200.000
    $132=200.000
    <Idle|MPos:0.000,0.000,0.000|FS:0,0|WCO:0.000,0.000,0.000>

Lateral thinking and a new approach finally fixed it

So seems the cloning is missing some thing, well these stick supposedly upgrade Over The Air (OTA) so i got inside the webpage, added the network credentials, it rebooted and then i was able to check for updates...

image

After issuing the upgrade command and being greeted with the Update message on the ESP screen i waited for it to "UPDRADE..." as seen in the picture :P

image image

It rebooted and it was working... probably china also has my gues wifi password now :P I'll just make a honeypot full of wasps out of it, just in case...

image image

Either way it is fixed and hopefully it will help someone in a near future Last but not least, popped up inside the VigoStick portal one last time to change back the wifi ID and password. I dont want these things connected to the web nor i want everyone that can boot a machine to read my guest wifi and password at the boot screen so i used that to send a subliminal message

image

Gatering resources for further resarch

Wireshark newtwork traffic capture

image

¶®+2*ÂbÀE7UÿÀ¨8/[¤ÈÜ3æòÊ©LßPpɹGET /Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin HTTP/1.0
Host: www.vigotec.cn:8080
User-Agent: ESP32-http-Update
Connection: close
Cache-Control: no-cache
x-ESP32-STA-MAC: 24:0A:C4:0E:13:C0
x-ESP32-AP-MAC: 24:0A:C4:0E:13:C1
x-ESP32-free-space: 1966080
x-ESP32-sketch-size: 1219392
x-ESP32-sketch-md5: 7556c1d8633fa6e0db9c42133ab9922e
x-ESP32-sketch-sha256: 9D09C4488A84B6F53EB54F88211DFF35B681E6706E16BBB270D1BBCA8232580A
x-ESP32-chip-size: 4194304
x-ESP32-sdk-version: v3.3.5-1-g85c43024c
x-ESP32-mode: sketch

Looking up the Domain IP and the IP location

image image

Asking CHAT-GPT how to download the firmware binary

https://chat.openai.com/share/07823223-60d1-42bf-b99b-918c91ff5116

🧔 User: GET /Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin HTTP/1.0
Host: www.vigotec.cn:8080
User-Agent: ESP32-http-Update
Connection: close
Cache-Control: no-cache
x-ESP32-STA-MAC: 24:0A:C4:0E:13:C0
x-ESP32-AP-MAC: 24:0A:C4:0E:13:C1
x-ESP32-free-space: 1966080
x-ESP32-sketch-size: 1219392
x-ESP32-sketch-md5: 7556c1d8633fa6e0db9c42133ab9922e
x-ESP32-sketch-sha256: 9D09C4488A84B6F53EB54F88211DFF35B681E6706E16BBB270D1BBCA8232580A
x-ESP32-chip-size: 4194304
x-ESP32-sdk-version: v3.3.5-1-g85c43024c
x-ESP32-mode: sketch

🤖 Assistant: The provided text appears to be an example of an HTTP request header. It includes various fields that provide information about the client making the request and the desired resource.

Here is a breakdown of the different fields in the request:

bash
Copy code
GET /Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin HTTP/1.0
This line specifies the HTTP method (GET), the path to the requested resource ("/Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin"), and the HTTP version (HTTP/1.0).

makefile
Copy code
Host: www.vigotec.cn:8080
The "Host" field indicates the target host and port ("www.vigotec.cn:8080") where the request is being sent.

sql
Copy code
User-Agent: ESP32-http-Update
The "User-Agent" field identifies the user agent or client software used to make the request. In this case, it is "ESP32-http-Update," suggesting that the request is originating from an ESP32 device using an HTTP update mechanism.

arduino
Copy code
Connection: close
The "Connection" field specifies the desired connection behavior. "close" indicates that the client wants to close the connection after the response is received.

yaml
Copy code
Cache-Control: no-cache
The "Cache-Control" field provides directives for caching mechanisms. "no-cache" indicates that the client prefers a fresh response and doesn't want to use a cached version.

makefile
Copy code
x-ESP32-STA-MAC: 24:0A:C4:0E:13:C0
x-ESP32-AP-MAC: 24:0A:C4:0E:13:C1
x-ESP32-free-space: 1966080
x-ESP32-sketch-size: 1219392
x-ESP32-sketch-md5: 7556c1d8633fa6e0db9c42133ab9922e
x-ESP32-sketch-sha256: 9D09C4488A84B6F53EB54F88211DFF35B681E6706E16BBB270D1BBCA8232580A
x-ESP32-chip-size: 4194304
x-ESP32-sdk-version: v3.3.5-1-g85c43024c
x-ESP32-mode: sketch
These are custom headers (prefixed with "x-ESP32-") that provide additional information about the ESP32 device. They include the STA (Station) MAC address, AP (Access Point) MAC address, free space available, sketch size, sketch MD5 and SHA256 checksums, chip size, SDK version, and mode (sketch).

Overall, this request seems to be fetching the binary file "VigoStick.v1_v1.5.220504.bin" from the server "www.vigotec.cn" on port 8080. The additional headers provide specific information about the ESP32 device and its current state.

🧔 User: is there a way to download that file in chrome browser?

🤖 Assistant: Yes, you can download the file in the Chrome browser by following these steps:

Open the Chrome browser on your computer.
Copy the URL of the file you want to download: http://www.vigotec.cn:8080/Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin.
Paste the URL into the address bar of the Chrome browser and press Enter.
Chrome will recognize that the URL points to a file and initiate the download automatically.
The file download will start, and you'll see the progress in the Chrome downloads bar at the bottom of the browser window.
Once the download is complete, you can access the downloaded file by clicking on the down arrow icon in the Chrome downloads bar or by going to the Downloads folder on your computer.
Note: The successful download of the file depends on the accessibility and permissions set on the server hosting the file. If you encounter any issues during the download, it may be due to server restrictions or connectivity problems.

Downloaded firmware

I have backed up firmware from vigotec here One can now do a offline installation of this code by using the OTA arduino sketch as described in https://randomnerdtutorials.com/esp32-over-the-air-ota-programming/ and https://www.pangodream.es/esp32-ota-in-ap-mode-esp2sota

Binvis firmware analysis

image

@X3msnake
Copy link
Author

X3msnake commented May 31, 2023

💬 ESP32 Flash Memory Overview

<!--🧔 User-->

I want to understand how an ESP32 works, namely the flash memory. Does it have internal memory or does it use the EEPROM to flash to?

<!--🤖 Assistant-->

The ESP32 has its own internal flash memory for storing program code and data. It typically ranges from 4MB to 16MB. The flash memory is non-volatile and is commonly used to store firmware or program code.


<!--🧔 User-->

So, does the ESP32 resemble an FPGA, not having internal memory and always loading from external memory? Or is it more like an ATmega328P that stores the runtime code inside its internal memory?

<!--🤖 Assistant-->

Apologies for the confusion. The ESP32 does have its own internal flash memory, unlike an FPGA. It resembles an ATmega328P in terms of storing the runtime code inside its internal memory. The ESP32 has both internal flash memory and internal RAM.


<!--🧔 User-->

When popping the cover on an ESP32 shield, we can see two components: the IC and an EEPROM. Is the EEPROM used for flashing?

<!--🤖 Assistant-->

I apologize for the confusion again. The ESP32 does not have a built-in EEPROM. The component you see is likely an external EEPROM module, which is optional and not part of the ESP32 itself. It can be used for additional storage.


<!--🧔 User-->

So, that extra memory is where one stores the SPIFFS file system, for example?

<!--🤖 Assistant-->

Yes, that's correct. If an external EEPROM or other non-volatile storage component is present, it can be used to store the SPIFFS file system. SPIFFS is a lightweight file system designed for small embedded systems like the ESP32.


<!--🧔 User-->

If I want to do a full backup including SPIFFS, is there a way?

<!--🤖 Assistant-->

Yes, if you want to perform a full backup that includes the SPIFFS (SPI Flash File System) data along with the firmware, you can use a combination of tools and techniques.

Here's a general approach to achieve a full backup:

  1. Backup the firmware: Use the esptool to backup the firmware from the internal flash memory of the ESP32, as described earlier. This will capture the bootloader, partition table, and the user application code.

  2. Backup the SPIFFS data: To back up the SPIFFS data, you will need to access the SPIFFS partition directly. The specific steps may vary depending on the framework or SDK you are using for ESP32 development (e.g., Arduino, ESP-IDF). In general, you'll need to mount the SPIFFS partition and read the files from it. Here's a high-level outline of the process:

    a. Identify the SPIFFS partition: Determine the partition used for SPIFFS storage. This information is typically defined in the partition table configuration.

    b. Mount the SPIFFS partition: Mount the SPIFFS partition in your ESP32 code. This allows you to access the files stored in the SPIFFS.

    c. Read and copy the SPIFFS files: Iterate through the files in the SPIFFS partition, read their contents, and save them to your backup location. You can use file system APIs provided by the framework or SDK you are using to access and copy the files.

By following these steps, you can create a backup that includes both the firmware (captured using esptool) and the SPIFFS data. This way, you'll have a complete snapshot of the ESP32's internal flash memory, including both the program code and the files stored in the SPIFFS file system.


<!--🧔 User-->

Thanks. One last thing, is there a way to download and share this conversation in markdown format for use on GitHub?

<!--🤖 Assistant-->

Yes, you can download and share the full conversation in a markdown format to use on GitHub or any other platform that supports markdown. Here's how you can do it:

  1. Scroll to the beginning of the conversation and make sure all the desired content is visible on your screen.

  2. Select and copy the entire conversation by either right-clicking and selecting "Copy" or using the keyboard shortcut (Ctrl+C or Command+C).

  3. Open a text editor or a markdown editor of your choice.

  4. Paste the copied conversation into the text editor by either right-clicking and selecting "Paste" or using the keyboard shortcut (Ctrl+V or Command+V).

  5. Save the file with a .md extension (e.g., conversation.md).

Now you have the conversation saved in a markdown file. You can upload this file to GitHub or any other platform that supports markdown and use it to display the conversation with the desired layout.

In a markdown file, you can further enhance the formatting by adding section headers, bullet points, code blocks, or any other markdown syntax to structure and style the conversation content as needed.

Please note that the markdown representation of the conversation will not retain the interactive aspects of the conversation with the AI model. It will only capture the textual content of the conversation.


<!--🧔 User-->

Create a full transcription of our chat to markdown for use in github gist, each interaction should be in a comment box and start with a emoji of a bearded user and another of your choice for the the assistant add "---" when the actor changes

Do not transcribe past this prompt


End of conversation.

@luisfcorreia
Copy link

you can program and protect code from being read from it.

however, all I guess that all code "written" to an ESP chip is stored on external flash so theoretically you could swap those chips

(I didn't read any bot generated stupidity)

@X3msnake
Copy link
Author

X3msnake commented Jun 1, 2023

@luisfcorreia
Copy link

Prepare a MITM proxy sniffer and get the download URL

https://mitmproxy.org/

@X3msnake
Copy link
Author

X3msnake commented Jun 1, 2023

🧔: How do I capture and backup an OTA update on an ESP32?


🤖: To capture and backup an OTA update on an ESP32, you can follow these general steps:

  1. Set up an OTA server: First, you need to set up an OTA server that will serve the firmware updates to the ESP32 devices. You can use platforms like ArduinoOTA or your custom server implementation.

  2. Prepare your ESP32: Make sure your ESP32 is properly set up for OTA updates. This involves configuring the network connection and enabling OTA updates in your code.

  3. Capture the OTA update: Once your ESP32 is connected to the network and set up for OTA updates, you can capture the update by intercepting the network traffic. One common method is to use a packet capture tool like Wireshark.

    a. Install and open Wireshark on a computer connected to the same network as your ESP32.
    b. Set up a filter to capture the network traffic from the ESP32. For example, you can filter by the IP address of the ESP32.
    c. Initiate an OTA update from your ESP32.
    d. Monitor the network traffic in Wireshark, and you should be able to capture the firmware update file.

  4. Backup the OTA update: Once you have captured the OTA update file, you can save it as a backup for future use. You can save it on your computer or in cloud storage.

It's important to note that capturing OTA updates should be done for legitimate purposes, such as backup or analysis, and should not be used for any unauthorized activities or copyright infringement. Make sure to comply with any licensing or legal requirements associated with the OTA update you capture.


🧔: Is there a way to capture it directly inside the ESP32 by creating a program that requests the OTA but does not install it, something one can download via a web portal on the ESP32?


🤖: Yes, it is possible to capture an OTA update directly inside the ESP32 without installing it by creating a program that requests the update but saves it instead of applying it immediately. You can achieve this by implementing a custom web portal on the ESP32 that allows you to download the update file.

Here's a high-level overview of the steps involved:

  1. Set up a web server: Implement a simple web server on the ESP32 that serves a web page with a download link for the OTA update file. You can use libraries like ESPAsyncWebServer or WebServer to handle the web server functionality.

  2. Handle the OTA request: When the user clicks the download link on the web page, the ESP32 should initiate an OTA update request to the OTA server. To achieve this, you can make an HTTP request to the OTA server's URL using the appropriate library, such as ESPAsyncHTTPClient or HTTPClient. This request should retrieve the firmware update file from the OTA server.

  3. Save the OTA update file: Once you receive the OTA update file from the OTA server, you can save it to the ESP32's file system, such as SPIFFS or SD card. This allows you to store the update file for backup or later installation.

  4. Provide download link: After saving the OTA update file, update the web page on the ESP32 to provide a download link for the saved update file. This allows you to access and download the captured OTA update file directly from the ESP32.

By following this approach, you can create a program on the ESP32 that requests OTA updates from the OTA server but saves them locally instead of applying them immediately.


🧔: Can you write me the code for such a portal?


🤖: Certainly! Here's an example code for creating a web

portal on the ESP32 that allows you to capture and download OTA update files:

#include <WiFi.h>
#include <ESPAsyncWebServer.h>
#include <HTTPClient.h>

const char* ssid = "YourNetworkSSID";
const char* password = "YourNetworkPassword";

AsyncWebServer server(80);

void setup() {
  Serial.begin(115200);

  // Connect to Wi-Fi
  WiFi.begin(ssid, password);
  while (WiFi.status() != WL_CONNECTED) {
    delay(1000);
    Serial.println("Connecting to WiFi...");
  }

  Serial.println("Connected to WiFi");

  // Initialize web server
  server.on("/", HTTP_GET, [](AsyncWebServerRequest *request){
    String html = "<html><body>";
    html += "<h1>OTA Update Portal</h1>";
    html += "<a href=\"/update\">Capture OTA Update</a>";
    html += "</body></html>";
    request->send(200, "text/html", html);
  });

  server.on("/update", HTTP_GET, [](AsyncWebServerRequest *request){
    // Perform OTA update request
    HTTPClient client;
    client.begin("http://your-ota-server.com/firmware.bin"); // Replace with your OTA server URL
    int httpCode = client.GET();
    if (httpCode == HTTP_CODE_OK) {
      // Save OTA update file
      File updateFile = SPIFFS.open("/firmware.bin", FILE_WRITE); // Replace with your preferred file system
      if (updateFile) {
        client.writeToStream(&updateFile);
        updateFile.close();
        request->send(200, "text/plain", "OTA update captured and saved");
      } else {
        request->send(500, "text/plain", "Failed to save OTA update");
      }
    } else {
      request->send(500, "text/plain", "Failed to fetch OTA update");
    }
    client.end();
  });

  server.begin();
}

void loop() {
  // Handle incoming client requests
  server.handleClient();
}

Make sure to replace "YourNetworkSSID" and "YourNetworkPassword" with the appropriate credentials for your Wi-Fi network. Also, update the OTA server URL in the client.begin() function within the /update route.

The code sets up a web server on port 80 and defines two routes: / and /update. The root route displays a basic HTML page with a link to the /update route. When you click the link, it triggers an OTA update request to the specified OTA server URL. The received OTA update file is saved as "firmware.bin" (you can change the name) in the preferred file system, such as SPIFFS or SD card.

Please note that this is a basic example, and you may need to modify it according to your specific requirements and use appropriate libraries for file system access and OTA updates based on your chosen hardware and frameworks.


🧔: Copy ipsis verbis our conversation and format it with markdown to use in a github gist.
Start with a emoji of a bearded user and another of your choice for the the assistant add "---" between everytime the user or the ai reply

Stop after this reply to avoid a infinite loop.

@luisfcorreia
Copy link

luisfcorreia commented Jun 1, 2023 via email

@X3msnake
Copy link
Author

X3msnake commented Jun 1, 2023

@luisfcorreia unsubscibe all but @ you on the thread.

I am not sharing it with you lol... there is no @ in that reply/post

I also dont understand what you mean... The AI response is real, now if what is suggested is crap... that is very likely true.

@X3msnake
Copy link
Author

X3msnake commented Jun 1, 2023

@luisfcorreia thanks for the suggestion was not aware of mitmproxy.
I presume it will work like wireshark i still need a pc with dual wifi or a wifi and a cable to serve the web to the ESP right?

@luisfcorreia
Copy link

luisfcorreia commented Jun 1, 2023 via email

@X3msnake
Copy link
Author

X3msnake commented Jun 1, 2023 via email

@X3msnake
Copy link
Author

X3msnake commented Jun 2, 2023

@luisfcorreia for some reason the dam things do not want to connect to any of my pc hotspots...

@luisfcorreia
Copy link

@X3msnake you need me to come over with a Linux laptop?

now please explain how are you setting up that hotspot

@X3msnake
Copy link
Author

X3msnake commented Jun 2, 2023

@luisfcorreia found the bug using a router. dam things only accept 2.4Ghz and must be the old WPA protocol. and that cannot be set on the Windows hotspot feature. i will connect the router bridge to the pc hotspot and the esps to the router 😸

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment