X3msnake/fixing-vevor-3018-offline-controller.md

## fixing-vevor-3018-offline-controller.md

      
    Raw
  

              fixing-vevor-3018-offline-controller.md
            
          
    FIXING VEVOR 3018 VIGOSTICK OFFLINE CONTROLLER

It's dead Jim!


For some unknown reason a couple of vigotec offline controllers (VigoStick) from our VEVOR 3018 farm stopped working with a blank screen of death.

Let's find out what makes it tick

First thing was to try to reverse engineer the pins that had no name in the bottom of the controller, turns out these are the UART0 that can be used to upload sketches to the ESP32.

Then i followed the LCD pins to map out the GPIOs that controlled the SPI ST7735 1.8 inch screen that vigostick is using:

TFT_CS 15, TFT_RST 2, TFT_DC 12, TFT_SCLK 13, TFT_MOSI 14


Lets install a LCD library and see if things works with a new firmware

Installed Adafruit_ST7735 library in arduino IDE and used the inbuilt graphics text example modifying the following code to align with the pinouts
#else
  // For the breakout board, you can use any 2 or 3 pins.
  // These pins will also work for the 1.8" TFT shield.
  #define TFT_CS        15
  #define TFT_RST       2 // Or set to -1 and connect to Arduino RESET pin
  #define TFT_DC        12
  #define TFT_SCLK      13
  #define TFT_MOSI      14
  
  ...
  
  // For ST7735-based displays, we will use this call
  Adafruit_ST7735 tft = Adafruit_ST7735(TFT_CS, TFT_DC, TFT_MOSI, TFT_SCLK, TFT_RST);
  
  ...
  // (This one also works but with glitches on the edge of the screen)
  // Use this initializer if using a 1.8" TFT screen: 
  // tft.initR(INITR_BLACKTAB);      // Init ST7735S chip, black tab
  
  // OR use this initializer if using a 1.8" TFT screen with offset such as WaveShare:
  tft.initR(INITR_GREENTAB);      // Init ST7735S chip, green tab

To upload the code there is a trick that one must do when the program tries to connect to the serial and that is to short the GPIO0 to ground to put the ESP32 in boot mode, in case of the ESP32-WROOM-32E it is the farthest pinst to the right of the chip like in the picture

It kind of works... butt

Ok so the ESP is working and the LCD is fine... something else is messed up

A couple of websearches and found a video explaining how to use arduino idea to backup and restore a flash image on a esp32, a tool called esptool that is well documented. So next thing was to try copying the code from a working ESP and injecting it to the vigotec to see if it worked.
How to Backup & Restore Official Firmware on any Espressif ESP8266 & ESP32


https://community.blynk.cc/t/how-to-backup-restore-official-firmware-on-any-espressif-esp8266-esp32/34309
https://www.youtube.com/watch?v=2GwzbBn7uRw

Using ESPTOOL

  # IINSTALL ESPTOOL
  pip install esptool
  
  # RUN ESPTOOL
  esptool.py
  
  # Change COM3 to your own Port

  ## For  1M Flash:
  python esptool.py -b 115200 --port COM3 read_flash 0x000000 0x100000 flash_1M.bin 
  python esptool.py -b 115200 --port COM3 write_flash --flash_freq 80m 0x000000 flash_1M.bin 

  ## For  4M Flash:
  python esptool.py -b 115200 --port COM3 read_flash 0x00000 0x400000 flash_4M.bin
  python esptool.py -b 115200 --port COM3 write_flash --flash_freq 80m 0x000000 flash_4M.bin
  that is all
  
  ## Erasing Flash
  esptool.py -b 115200 --port COM7 erase_flash
  
  you should get something like this for the 4M flash

    ## BACKING UP
    
    C:\Users\Utilizador>esptool.py -b 115200 --port COM7 read_flash 0x00000 0x400000 vigostik_132_211123_flash_4M.bin
    esptool.py v4.6
    Serial port COM7
    Connecting..........
    Detecting chip type... Unsupported detection protocol, switching and trying again...
    Connecting......
    Detecting chip type... ESP32
    Chip is ESP32-D0WD-V3 (revision v3.0)
    Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
    Crystal is 40MHz
    MAC: e0:e2:e6:5a:1a:10
    Uploading stub...
    Running stub...
    Stub running...
    4194304 (100 %)
    4194304 (100 %)
    Read 4194304 bytes at 0x00000000 in 391.4 seconds (85.7 kbit/s)...
    Hard resetting via RTS pin...
    
    ## UPLOADING
    
    C:\Users\Utilizador>esptool.py -b 115200 --port COM7 write_flash --flash_freq 80m 0x000000 vigostik_132_211123_flash_4M.bin
    esptool.py v4.6
    Serial port COM7
    Connecting.....................
    Detecting chip type... Unsupported detection protocol, switching and trying again...
    Connecting......
    Detecting chip type... ESP32
    Chip is ESP32-D0WD-V3 (revision v3.0)
    Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
    Crystal is 40MHz
    MAC: 34:ab:95:4a:a2:50
    Uploading stub...
    Running stub...
    Stub running...
    Configuring flash size...
    Flash will be erased from 0x00000000 to 0x003fffff...
    Compressed 4194304 bytes to 1351601...
    Wrote 4194304 bytes (1351601 compressed) at 0x00000000 in 189.5 seconds (effective 177.1 kbit/s)...
    Hash of data verified.
    Leaving...
    Hard resetting via RTS pin...

The cloning worked for the graphic demo but when i cloned a working vigostick to the non working one the blank screen returned...
What now? I opened the binary file that i had just backed up in HxD to see if the file was encripted and it does not seem so, since there is unencripted text showing including M and G commands

Slap in the forehead!

Turns out i had not power cycled the ESP properly, so the cloning works but now this error:
    Fatal Error
    VigoStick 1.32 211123
    Run Error!


Go deep into the rabbit hole...

My next guess is that the eeprom, that holds the webfiles is corrupted or mismatched, maybe filesystem upload is missing or maybe i messed up the memory size on the backup ???
Ok so dropping the image into a wemos with a similar EPS32-WROOM-32E chip and having easy acess to the enable button mi managed to get this debug list on the arduino serial monitor...
    rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
    flash read err, 1000
    Falling back to built-in command interpreter.
    OK
    >ets Jun  8 2016 00:22:57

    rst:0x10 (RTCWDT_RTC_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
    configsip: 0, SPIWP:0xee
    clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
    mode:DIO, clock div:1
    load:0x3fff0018,len:4
    load:0x3fff001c,len:1044
    load:0x40078000,len:8896
    load:0x40080400,len:5816
    entry 0x400806ac
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
    [E][sd_diskio.cpp:775] sdcard_mount(): f_mount failed: (3) The physical drive cannot work
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed

    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    VIGO-STKBAAN-n9EQQuh5bP
    Connecting to VIGOTEC with 12345678... Disconnected
    .. Disconnected

    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    Local AP VIGO-STKBAAN started, 192.168.0.1
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    HTTP server started
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
    [E][sd_diskio.cpp:775] sdcard_mount(): f_mount failed: (3) The physical drive cannot work
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
    Get start...
    [E][WiFiGeneric.cpp:739] hostByName(): DNS Failed for www.vigotec.cn
    Get failed.
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    VigoStick 1.32 Build:211123 Start


And shorting enable to ground on the vigostick board i got this debug

    rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
    configsip: 0, SPIWP:0xee
    clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
    mode:DIO, clock div:1
    load:0x3fff0018,len:4
    load:0x3fff001c,len:1044
    load:0x40078000,len:8896
    load:0x40080400,len:5816
    entry 0x400806ac
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
    [E][sd_diskio.cpp:775] sdcard_mount(): f_mount failed: (3) The physical drive cannot work
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed

    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    VIGO-STKBKBH-tgVwL:iKVA
    Connecting to VIGOTEC with 12345678... Disconnected
    .. Disconnected

    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    Local AP VIGO-STKBKBH started, 192.168.0.1
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    HTTP server started
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
    [E][sd_diskio.cpp:775] sdcard_mount(): f_mount failed: (3) The physical drive cannot work
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed
    Get start...
    [E][WiFiGeneric.cpp:739] hostByName(): DNS Failed for www.vigotec.cn
    Get failed.
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    VigoStick 1.32 Build:211123 Start

So the error is most likely just the fact that there is no GRBL board since the ESP is creating the Access Point and the control page can be accessed via the IP/Password that the serial dump shows.
So most likely this is done and fixed. I should probably extract the 1.5v from the newer controller if the error is the board connections, since the newer version handles that error more greacefully allowing full controll of the standalone controller instead of showing a blocking error like this version does :)


Nope!

... It was not. I am out of ideas for a couple of days

VigoStick backed up binaries from working units

The backed up vigostick firmware for the ESP32 can be downloaded here:

https://github.com/X3msnake/my-gists-files/blob/main/vigostik_132_211123_flash_4M.bin
https://github.com/X3msnake/my-gists-files/blob/main/vigostik_150_220504_flash_4M.bin

This is the full boot cycle of a healthy VigoStick when connected to the GRBL board
    rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
    configsip: 0, SPIWP:0xee
    clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
    mode:DIO, clock div:1
    load:0x3fff0018,len:4
    load:0x3fff001c,len:1044
    load:0x40078000,len:8896
    load:0x40080400,len:5816
    entry 0x400806ac
    [E][sd_diskio.cpp:123] sdSelectCard(): Select Failed

    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    VIGO-STKPTTM-8QUR6h45FM
    Connecting to VIGOTEC with 12345678... Disconnected
    .. Disconnected

    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND

    Local AP VIGO-STKPTTM started, 192.168.0.1
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    [E][Preferences.cpp:49] begin(): nvs_open failed: NOT_FOUND
    Grbl 1.1f ['$' for help]
    VIGOTEC.SDEM1.1.0.220328

    VigoStick 1.5 Build:220504 Start
    $0=8
    $1=25
    $2=0
    $3=0
    $4=0
    $5=0
    $6=0
    $10=1
    $11=0.010
    $12=0.002
    $13=0
    $20=0
    $21=0
    $22=0
    $23=0
    $24=25.000
    $25=500.000
    $26=250
    $27=1.000
    $30=1000
    $31=0
    $32=0
    $33=0
    $100=800.000
    $101=800.000
    $102=800.000
    $110=1000.000
    $111=1000.000
    $112=1000.000
    $120=50.000
    $121=50.000
    $122=20.000
    $130=200.000
    $131=200.000
    $132=200.000
    <Idle|MPos:0.000,0.000,0.000|FS:0,0|WCO:0.000,0.000,0.000>

Lateral thinking and a new approach finally fixed it

So seems the cloning is missing some thing, well these stick supposedly upgrade Over The Air (OTA) so i got inside the webpage, added the network credentials, it rebooted and then i was able to check for updates...

After issuing the upgrade command and being greeted with the Update message on the ESP screen i waited for it to "UPDRADE..." as seen in the picture :P


It rebooted and it was working... probably china also has my gues wifi password now :P
I'll just make a honeypot full of wasps out of it, just in case...


Either way it is fixed and hopefully it will help someone in a near future
Last but not least, popped up inside the VigoStick portal one last time to change back the wifi ID and password. I dont want these things connected to the web nor i want everyone that can boot a machine to read my guest wifi and password at the boot screen so i used that to send a subliminal message

Gatering resources for further resarch


(https://github.com/BlackVS/ESP32-reversing) good list with tools to reverse engineer the ESP32


## z-backing-up-the-OTA-firmware-update.md

      
    Raw
  

              z-backing-up-the-OTA-firmware-update.md
            
          
    Wireshark newtwork traffic capture


¶®+2*ÂbÀE7UÿÀ¨8/[¤ÈÜ3æòÊ©LßPpÉ¹GET /Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin HTTP/1.0
Host: www.vigotec.cn:8080
User-Agent: ESP32-http-Update
Connection: close
Cache-Control: no-cache
x-ESP32-STA-MAC: 24:0A:C4:0E:13:C0
x-ESP32-AP-MAC: 24:0A:C4:0E:13:C1
x-ESP32-free-space: 1966080
x-ESP32-sketch-size: 1219392
x-ESP32-sketch-md5: 7556c1d8633fa6e0db9c42133ab9922e
x-ESP32-sketch-sha256: 9D09C4488A84B6F53EB54F88211DFF35B681E6706E16BBB270D1BBCA8232580A
x-ESP32-chip-size: 4194304
x-ESP32-sdk-version: v3.3.5-1-g85c43024c
x-ESP32-mode: sketch

Looking up the Domain IP and the IP location


Asking CHAT-GPT how to download the firmware binary

https://chat.openai.com/share/07823223-60d1-42bf-b99b-918c91ff5116
🧔 User: GET /Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin HTTP/1.0
Host: www.vigotec.cn:8080
User-Agent: ESP32-http-Update
Connection: close
Cache-Control: no-cache
x-ESP32-STA-MAC: 24:0A:C4:0E:13:C0
x-ESP32-AP-MAC: 24:0A:C4:0E:13:C1
x-ESP32-free-space: 1966080
x-ESP32-sketch-size: 1219392
x-ESP32-sketch-md5: 7556c1d8633fa6e0db9c42133ab9922e
x-ESP32-sketch-sha256: 9D09C4488A84B6F53EB54F88211DFF35B681E6706E16BBB270D1BBCA8232580A
x-ESP32-chip-size: 4194304
x-ESP32-sdk-version: v3.3.5-1-g85c43024c
x-ESP32-mode: sketch

🤖 Assistant: The provided text appears to be an example of an HTTP request header. It includes various fields that provide information about the client making the request and the desired resource.

Here is a breakdown of the different fields in the request:

bash
Copy code
GET /Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin HTTP/1.0
This line specifies the HTTP method (GET), the path to the requested resource ("/Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin"), and the HTTP version (HTTP/1.0).

makefile
Copy code
Host: www.vigotec.cn:8080
The "Host" field indicates the target host and port ("www.vigotec.cn:8080") where the request is being sent.

sql
Copy code
User-Agent: ESP32-http-Update
The "User-Agent" field identifies the user agent or client software used to make the request. In this case, it is "ESP32-http-Update," suggesting that the request is originating from an ESP32 device using an HTTP update mechanism.

arduino
Copy code
Connection: close
The "Connection" field specifies the desired connection behavior. "close" indicates that the client wants to close the connection after the response is received.

yaml
Copy code
Cache-Control: no-cache
The "Cache-Control" field provides directives for caching mechanisms. "no-cache" indicates that the client prefers a fresh response and doesn't want to use a cached version.

makefile
Copy code
x-ESP32-STA-MAC: 24:0A:C4:0E:13:C0
x-ESP32-AP-MAC: 24:0A:C4:0E:13:C1
x-ESP32-free-space: 1966080
x-ESP32-sketch-size: 1219392
x-ESP32-sketch-md5: 7556c1d8633fa6e0db9c42133ab9922e
x-ESP32-sketch-sha256: 9D09C4488A84B6F53EB54F88211DFF35B681E6706E16BBB270D1BBCA8232580A
x-ESP32-chip-size: 4194304
x-ESP32-sdk-version: v3.3.5-1-g85c43024c
x-ESP32-mode: sketch
These are custom headers (prefixed with "x-ESP32-") that provide additional information about the ESP32 device. They include the STA (Station) MAC address, AP (Access Point) MAC address, free space available, sketch size, sketch MD5 and SHA256 checksums, chip size, SDK version, and mode (sketch).

Overall, this request seems to be fetching the binary file "VigoStick.v1_v1.5.220504.bin" from the server "www.vigotec.cn" on port 8080. The additional headers provide specific information about the ESP32 device and its current state.

🧔 User: is there a way to download that file in chrome browser?

🤖 Assistant: Yes, you can download the file in the Chrome browser by following these steps:

Open the Chrome browser on your computer.
Copy the URL of the file you want to download: http://www.vigotec.cn:8080/Iot/esp32_bin/VigoStick.v1_v1.5.220504.bin.
Paste the URL into the address bar of the Chrome browser and press Enter.
Chrome will recognize that the URL points to a file and initiate the download automatically.
The file download will start, and you'll see the progress in the Chrome downloads bar at the bottom of the browser window.
Once the download is complete, you can access the downloaded file by clicking on the down arrow icon in the Chrome downloads bar or by going to the Downloads folder on your computer.
Note: The successful download of the file depends on the accessibility and permissions set on the server hosting the file. If you encounter any issues during the download, it may be due to server restrictions or connectivity problems.

Downloaded firmware

I have backed up firmware from vigotec here
One can now do a offline installation of this code by using the OTA arduino sketch as described in
https://randomnerdtutorials.com/esp32-over-the-air-ota-programming/ and https://www.pangodream.es/esp32-ota-in-ap-mode-esp2sota
Binvis firmware analysis