Well, no luck, the MGM chip seems to be stuck in firmware upgrade mode or something. I am trying to decipher the data it is sending the ESP32. I may set it up as a UART to serial proxy so I can get all the data.
Here is some data I am working on ATM:
# partial struct captures that happen from wireless log viewing via esphome dashboard
0x6f 0x61 0x64 0x20 0x67 0x62 0x6c 0xd
# Full structs
0xa 0x32 0x2e 0x20 0x72 0x75 0x6e 0xd
0xa 0x30 0xd
0xa 0x31 0x2e 0x6c 0x6f 0x61 0x64 0x65 0x72 0x20 0x64 0x20 0x67 0x6c 0xd
0x32 0x2e 0x75 0x6e 0xd
0xa 0x2e 0x20 0x6f 0xa 0x42 0x0 0xd
0x63 0x62 0x20 0x69 0x6e 0x66 0x6f 0x61 0x64 0x33 0x2e 0x20 0x20 0x6e 0x61 0xa 0xa 0x31 0x2e 0x20 0x6f 0x61 0x64 0x20 0x67 0x62 0x6c 0xd
0xa 0x32 0x2e 0x20 0x72 0x75 0xd
0x33 0x69 0x6e 0xd
0x42 0x4c 0x20 0x6e 0xd
0xa 0x33 0x2e 0x20 0x31 0x20 0x75 0x70 0x6c 0x6f 0x2e 0xa 0x42 0x4c 0x20 0x20 0x6f 0xa 0xa 0x47 0x65 0x63 0x6b 0x0 0xd
0xa 0x47 0x65 0x6f 0x69 0x6e 0x4c 0x20 0x75 0x6e 0xd
0xa 0x33 0x75 0x70 0x6c 0x6f 0x61 0x64 0x31 0x2e 0x39 0x2e 0x30 0xd
0xa 0x31 0x2e 0x20 0x75 0x70 0x6c 0x6f 0x64 0x20 0x67 0x62 0x6c 0xd
0xa 0x32 0x2e 0x20 0x72 0x6e 0xd
0xa 0x33 0x20 0x65 0x62 0x6c 0x20 0x66 0x6f 0xd
0xa 0x42 0x4c 0x20 0x3e 0x20 0x0 0xd
From a cursory glance, it seems to have structs that start with 0xa (line feed) and end with 0xd (carriage return). Maybe ive glitched it and something wonderful can come of it (imagine if its dumping its unencrypted firmware out rn, lol) or maybe i bricked it, lol. Either way, it was the emporia firmware that bricked it, so hopefully they can do something about it.
Edit: I’ve flashed it back and forth between stock and esphome while erasing flash completely between each flash a few times now trying to be able to set up the device in the emporia app again, no bueno.
Somehow the emporia firmware still shows 3 solid LED’s for PWR, wifi, and meter link even after an esp32 erase and reflash. I can also ping the esp32 wifi interface and it is grabbing an IP from DHCP. This leads me to believe that the wifi creds are stored in the MGM flash, how else would it be connecting to the AP and grabbing an IP?. I am very confused on whats going on and doing some wild guessing.
When the emporia firmware is flashed onto the device, the 3 LEDs are solid, the reset button does not respond and I can not see the device in my bluetooth scans. Meaning, I cant factory reset it to try and add it back again to restart the zigbee firmware upgrade. The wifi interface is up, grabs an IP from DHCP and is pingable. It seems frozen as the MGM is just blasting data out.
When I flash esphome, only the power LED is solid, the wifi and meter LED’s are off. The esp32 wifi interface is up, grabs an IP from DHCP and is pingable. The MGM chip is sending the data I posted in that gist and the data above. I tried the v7 header file and the data in the code block above is from esphome running the v7 header file, the data in the gist is from the repo header file.
So with emporia and esphome firmware:
- wifi interface is up, grabs an IP from DHCP and is pingable from the LAN.
- MGM UART is blasting data out and seems to inhibit functions on both firmwares.
Keep in mind I am completely erasing the esp32 flash between flashing the firmwares and I have gone back and forth a few times now with the same behaviour. How the hell is the esp32 still connecting to my AP and pulling an IP via DHCP? Is the MGM chip controlling things? I am perplexed.
Edit 2: Seems promising →
Hex to ASCII from the code block above:
oad gbl\r
\n2. run\r
\n0\r
\n1.loader d gl\r
2.u\r
\n. o\nB\r
cb infoad3. na\n\n1. oad gbl\r
\n2. ru\r
3in\r
BL n\r
\n3. 1 uplo.\nBL o\n\nGeck\r
\nGeoinL un\r
\n3upload1.9.0\r
\n1. upload gbl\r
\n2. rn\r
\n3 ebl fo\r
\nBL > \r
Yeah, its stuck in bootloader mode:
Gekko Bootloader v1.9.0
1. upload gbl
2. run
3. ebl info
BL >
Gekko Bootloader v1.9.0
1. upload gbl
2. run
3. ebl info
BL >
Gekko Bootloader v1.9.0
1. upload gbl
2. run
3. ebl info
BL >
Gekko Bootloader v1.9.0
1. upload gbl
2. run
3. ebl info
BL >
Gekko Bootloader v1.9.0
1. upload gbl
2. run
3. ebl info
BL >
Gekko Bootloader v1.9.0
1. upload gbl
2. run
3. ebl info
BL >
Gekko Bootloader v1.9.0
1. upload gbl
2. run
3. ebl info
Going to see if i can get a tty to connect to the serial tcp stream and fix things.