Download Firmware from device?

Configuration Zigbee
1

I have 4 downlights with the model

TS0505B
by _TZ3210_s9lumfhn

that I got from Aliexpress. 2 of them have firmware
Firmware: 0x00000065
and the other 2 have firmware
Firmware: 0x10003607

They act differently when switching colors and whatnot, the first 2 fade between colors, the other 2 are harsh jumps. The last 2 also have some configuration options that the first 2 do not.

My question is, can I pull the firmware off of one of the devices and install it on another one? Either through Z2M or ZHA?

2

Look at the devices Entity if the item ‘firmware update’ exist,
if not exist, it’s probably not possible to upgrade the firmware via HA.

3

They both have firmware update entities. But I am not seeing any firmware downloads on the internet. So I was wondering if there was a way to pull the firmware off one light and upload it to another.

4

Not that I know

5

Do you mean to dump (extract/export) firmware image or simply get metadata info for version number?

If you mean to somehow dump (extract/export) the already flashed firmware image from a device then no, you can not do that from ZHA or Zigbee2MQTT (or any other Zigbee gateway either for that matter). There is no over-the-air way to dump (extract/export) an already flashed firmware image from any Zigbee device (or any other embedded SoC either that I am aware of).

There are several other ways to manually dump the firmware on embedded systems by connecting directly to the flash chip. The most common ways to connect directly to a flash chip are JTAG/SWD, UART, USB-to-UART bridge, or DFU. The available methods that can be used depend in the exact chip and bootloader that is on it. It also depends on bootloader uses secure boot or not and if the existing flashed firmware image is signed (encrypted) or not. See example:

If device do not have secure boot enabled and the firmware is not signed/encrypted it can be easy. ex:

Search online using keywords like “dumping iot firmware” and “extracting iot firmware” for more info.

PS: Off-topic; there are also some various other ways to get or capture a not yet flashed OTA (Over-The-AIR) firmware images from manufacturer’s official Zigbee Gateways before it get flashed. Like for example wired Ethernet sniffing as the manufacturer sends OTA traffic to manufacturer official Zigbee Gateway, or via wireless sniffing if you can sniff and record the OTA communication packages being sent to a Zigbee device and manufacturer’s official Zigbee Gateway that it is paired to, and then you can then use tools like zigpy-cli to reconstruct OTA images from a series of captured PCAP files. Zigbee2MQTT project get many of their OTA images using such different ways:

6

You might be able to extract the firmware and upload it again to another device, but will it work?
The difference in firmware might be due to hardware changes, like another chip or electrical component.

1 Like
7

I was afraid of that, I may go down that road then. Before I do though, are there any secret repos that may have those firmware files ready to just download? My searches came up empty but maybe there’s a lesser known one that may have them that I don’t know about.

8

The Chinese marketplaces have a host of 1-month lifetime firms, so any support for those products are slim.

1 Like
9

You get what you pay for goes there, so for cheap Chinese devices you will mostly be out of luck finding images (and finding correct ones even if you find any). You will brick the device if flash wrong image.

Anyway, theonly larger Zigbee OTAU collections I know of is Koenkk’s collection of Zigbee OTA files (which is the one used by default in Zigbee2MQTT) and the dresden-elektronik collection (which is used by default in deCONZ/Phoscon), but both of those mostly cover more known brands from Europe and North America. See:

And