Hi everyone,
I have a device that is very similar to yours — mine is the PGA07A from Myko.
I opened it the same way you did and removed the SLM22014 module, which is based on the ESP32-U4WD.
According to the ESP32 datasheet, it should be possible to program it through GND, 3.3V, TX, RX, and by pulling GPIO0 low during reset to enter boot mode.
After checking the PCB connections, I created a small pinout table and connected my programming cable.
I was able to see some serial output, but nothing more.
2mI (789) heap_init: At 3FFB9A20 len 00004108 (16 KiB): DRAMe[0m
e[0;32mI (795) heap_init: At 3FFD54D8 len 0000AB28 (42 KiB): DRAMe[0m
e[0;32mI (802) heap_init: At 3FFE0440 len 0001FBC0 (126 KiB): D/IRAMe[0m
e[0;32mI (808) heap_init: At 40078000 len 00008000 (32 KiB): IRAMe[0m
e[0;32mI (814) heap_init: At 4009A474 len 00005B8C (22 KiB): IRAMe[0m
e[0;32mI (820) heap_init: At 3FF80064 len 00001D8C (7 KiB): RTCRAMe[0m
Brownout detector was triggered
ets Jul 29 2019 12:21:46
rst:0xc (SW_CPU_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
configsip: 188777542, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:1
load:0x3fff25a0,len:12988
ho 0 tail 12 room 4
load:0x40078000,len:22336
load:0x40080400,len:13388
entry 0x400807f4
e[0;32mI (32) boot: ESP-IDF 2nd stage bootloadere[0m
e[0;32mI (32) boot: compile time 00:43:58e[0m
e[0;32mI (32) boot: chip revision: 3e[0m
e[0;32mI (34) boot_comm: chip revision: 3, min. bootloader chip revision: 0e[0m
e[0;32mI (41) qio_mode: Enabling default flash chip QIOe[0m
e[0;32mI (47) boot.esp32: SPI Speed : 80MHze[0m
e[0;32mI (51) boot.esp32: SPI Mode : QIOe[0m
e[0;32mI (56) boot.esp32: SPI Flash Size : 4MBe[0m
e[0;32mI (60) boot: Enabling RNG early entropy source...e[0m
e[0;32mI (66) boot: Partition Table:e[0m
e[0;32mI (69) boot: ## Label Usage Type ST Offset Lengthe[0m
e[0;32mI (77) boot: 0 app1_header unknown 50 06 0000f000 00001000e[0m
e[0;32mI (84) boot: 1 app1 factory app 00 00 00010000 001d0000e[0m
e[0;32mI (92) boot: 2 phy_init RF data 01 01 001e0000 00001000e[0m
e[0;32mI (99) boot: 3 vhsm unknown 52 06 001e4000 00004000e[0m
e[0;32mI (107) boot: 4 coredump Unknown data 01 03 001e8000 00006000e[0m
e[0;32mI (114) boot: 5 app2_header unknown 50 06 001ef000 00001000e[0m
e[0;32mI (122) boot: 6 app2 factory app 00 00 001f0000 001d0000e[0m
e[0;32mI (129) boot: 7 profiles unknown 51 06 003c0000 00014000e[0m
e[0;32mI (137) boot: 8 nvs WiFi data 01 02 003d4000 00008000e[0m
e[0;32mI (144) boot: End of partition tablee[0m
Download mode is disabled. Restart with GPIO0 high.
It turns out the module is in secure mode, which explains why I wasn’t able to flash any firmware. I tried many different methods, but it seems everything is locked, so re-programming is not possible through the normal interface.
I’m now considering designing a small PCB that I can solder onto the module to load my own firmware directly.
If anyone has experience with this device or has found a workaround for the secure-mode restrictions, I’d really appreciate any advice.
Thanks!