Flash Shelly Plus 1 Original Firmware

I put this in the ESPHome category because I couldn’t find anything more suitable. if this doesn’t fit please correct me. Here is a small instruction for flashing the Shelly firmware.
Use the instructions at your own risk, I had to try a lot and was probably lucky in the end that I could get the addresses out this way.

maybe someone who has flashed his shelly with ESPHome (e.g. with the manual Shelly Plus 1 flashing and setup guide/ tutorial) and wants to go back can find his way this way.

After I have dealt with the Shelly a little and had installed on a shelly ESPhome I wanted to go back to the original firmware. Unfortunately I have not found any instructions for the Plus 1 (ESP32).

For the ESP8266 there seems to be a way via tasmota, mgos and then shelly.


Step 1 the firmware can be downloaded from the updates.
https://updates.shelly.cloud/update/Plus1

Step 2 the ESP32 Flash Download Tool is necessary

Step 3 I then loaded the 5 files (.bin or .img) into the tool and set the addresses as I took them from the Manifest.json. Unfortunately, it only contains the addresses for the bootloader and the partitioning.
When I tried to flash the files, I got the message that the files were overlapping. I then simply flashed them individually. This of course caused the esp to not work properly and constantly reset, but I was able to see the partition table in the serial port.

Step 4 From the serial port I then took the addresses for otadata.bin, Plus1.bin (is then “app_0 / OTA app” in the console) and fs.img (is then “fs_0 / FS” in the console). I then set these addresses in the Flash tool and successfully transferred the firmware.


The addresses for flashing were in my case as you can see in the picture

bootloader.bin 0x1000
partition-table.bin 0x8000
partition-table.bin 0x8000
otadate.bin 0xD000
Plus1.bin 0x10000
fs.img 0x1a0000


although this may not seem to me to be the final solution, as I still have problems integrating it into the HA add-on and I have the following log entries in the diagnostics

shelly_factory_data:111 Could not open factory data partition: 4354 23:24:11
shelly_factory_data.:37 Factory data missing or version -1 unsupported 23:24:11
shelly_factory_data:204 UNABLE TO LOAD FACTORY DATA 23:24:11

this could be logical, as the factory data may have been overwritten by the previous programming and does not appear to be included in the updates. i will probably find out over time whether this is a problem in operation.



I’ve just reverted Shelly PM Mini Gen3 to original firmware after having a change of heart. I didn’t wipe the complete flash during flashing of the custom firmware so my factory data partition remained intact (it is at the end of the flash area).

Contents of the partition are listed when somebody accesses the web console:

[15:02:13]shelly_factory_data.:58 Factory data (config): version 2, model=S3PM-001PCEU16 batch=2347-Broadwell key=<base64-encoded key>

The key appears similar to JWT keys in structure but with additional appendices - it is of form xxx.yyy.zzz-www-qqq-ppp-

I do not know how this will affect the functionality of your device but I suppose it is used when accessing some remote service (hence JWT-like format). Check whether your Shelly Cloud connection works?

Anyway, the offsets for Shelly PM Mini Gen3 device, firmware 1.4.4, are as follows:

0x00000000 bootloader.bin
0x0000F000 partition-table.bin
0x00011000 otadata.bin
0x00020000 MiniPMG3.bin
0x002a0000 fs.img

Or in esptool.py command line format:

esptool.py --port /dev/ttyACM0 --baud 115200 write_flash --flash_mode dio --flash_size 8MB 0x0 bootloader.bin 0xF000 partition-table.bin
esptool.py --port /dev/ttyACM0 --baud 115200 write_flash --flash_mode dio --flash_size 8MB 0x00011000 otadata.bin 0x00020000 MiniPMG3.bin 0x002a0000 fs.img

NVS partition is filled with 49152 repetitions of character 0xFF (according to the manifest):

"nvs": {
   "type": "nvs",
   "size": 49152,
   "fill": 255,
   "ptn": "nvs"
}

As a side note: Manifest lists several partitions as “encrypted” but esptool.py was not able to encrypt the data, complaining that flash-encryption key is not present (fuses not configured for it). My particular device apparently works without flash encryption.