Sonoff S60TPG (UK Version) Successfully Flashed

[MalSmalley]

The Sonoff S60 is a great product. Looks good, has power monitoring and is cheap but its a sealed unit so not apparently easy to flash.
A good description and partial teardown by Mat Zolnierczyk [here] gets inside the unit by breaking the glued seal but there are not very accessible access points for flashing.
I totally destroyed one unit (by trying to access points on the processor daughter board) and took this a bit further.
The underside of the main board has some very useful pads available.

Tx & Rx are obvious. But the first pin on the connection to the processor board is +5V. (And it is +5V and not 3.3V as there is a voltage regulator or divider on the processor board). 0V is also at the far end of the connection but this is easier accessed by use of the Neutral pin on the plug itself.

On a new, un broken into, unit I accessed these points by drilling a couple of 3.5mm holes in the base and expanding the access to about 5mm x 10mm and was able to solder connecting wires to these 3 points fairly easily. I did protect the plastic casing with some foil!

I used a usb serial converter from a Pi400. Note that I powered the S60 from a separate 5V rail but the Rx/Tx from the serial converter were at 3.3V as this is what the esp32 chip requires.

Flashed using esptool. Holding the button on the side of the S60 on power up to enter boot mode. This does not have to be held down long. Flashed with tasmota32c3.factory.bin.
My normal process is (as per the esptool instructions)

$esptool.py --port /dev/ttyUSB0 read_mac    (to test connection)
$esptool.py --port /dev/ttyUSB0 read_flash 0x00000 0x10000 s60backup.bin    (in case we need to go back!)
$esptool.py --port /dev/ttyUSB0 erase_flash
$esptool.py --port /dev/ttyUSB0 write_flash -fm out 0x0 tasmota32c3.factory.bin   (where the bin has already been downloaded)

Flashing took about 90 seconds and , after a repower, the AP point showed up.

The template I used was the same as from the discussion & progress on the [European version.] (#21255) - Thank You !!

{"NAME":"S60UK","GPIO":[1,1,1,1,224,544,1,3104,1,32,1,0,0,0,0,0,0,0,1,1,1,1],"FLAG":0,"BASE":1}

And finally a bit of 0.5mm Plasticard was cut to shape and glued onto the base to cover the access hole and tidy up the unit.

[sfromis]

Nice way of doing it.

I spotted one detail:

read_flash 0x00000 0x10000 s60backup.bin

Only backing up 64 KB of flash won't give you the opportunity of going back. With ESP32-C3, I usually backup the full 4 MB of flash, up to 0x00400000

[MalSmalley]

Oooh thanks for that! I've never 'gone back' yet. But this has saved some head scratching (& swearing!) if I ever do.

[JBFUK]

I brought the same devices and opened one up with the same goal. I have not been able to flash it. I just get nothing back from the ESP32. It might be going into boatloader mode as when simply applying 5v one of the LEDs flashes slownly, when applying power with the button pressed the LED does not come on or flash. I've now gone so far as to remove the ESP32 daughter board and solder wires on to the test pads to allow me to use the reset pin with a button.

I've tried two different USB to serial adapters, both in 3.3v mode. I've tried with the USB adapter providing the 5v for the chip and with an external battery pack providing 5v.

Not sure what's left to try really. Perhaps I'm unlucky and have somehow damaged the TX port, or it has a pre-existing fault.

[MalSmalley]

That's interesting. I'd love to see how you get it all back together again when you do flash it!
I found the same- just powering on gave the blue led flashing approx once a second. But power up with button pressed and no leds illuminate. This is definitely in boatload mode.

Useful photos of the processor board. Ive just taken the one I 'nadgered' out to compare and can see where I have damaged it. It may be easier to use the connector pins rather than the test points. The left most on the processor side is Tx & the 2nd left Rx. 5V, Gnd & Key are quire clear on your photos.

In fact on my trashed board I don't get continuity between the connector pins and the on-board test points. That could be because of the damage to my board - but worth checking. The Tx/Rx test points I used on the underside of the main board are definitely connected to the connecting pins 1 & 2. It may be you get some success using these instead.

I've done flashed two of these now, so its definitely possible.

[JBFUK]

Well, no luck with flashing the chip in question. I checked the resistors on the RX/TX pins, they were fine. I can only conclude the chip is damaged.

Subsequently I've successfully flashed the other three units - so my serial adapter is fine. For the first I used your method of drilling holes to provide access to the TX/RX/5v terminals. This worked 'ok', filling the hole with hot glue afterwards. For the remaining two I opened the plug up, flashed via the pads and the glued the cases closed again. I found this much cleaner. It's really no bother opening up the case - you have to apply pressure using an engineering vice, no too much but enough to just slightly deform it. Release the pressure and rotate 45', apply pressure, repeat until eventually the glue joint shears and the case pops open. To reassemble the two parts will meet up perfectly so it can be glued back together with no visible evidence of it having been opened.

I'll probably replace the esp32-c3 chip on the faulty board - a dev board can be had for £1.40 from which I can take the processor and have a bunch of spare parts left over.

Now is it worth the effort? At the price I brought them on sale - £10 each, it's just about worthwhile if you need some devices in a hurry. If not, or at a higher price point the it's better to simply buy 'athom' devices pre-flashed with Tasmota32 from aliexpress.

[vtraveller]

This is great work by all of you. What I'd like to do is 3D print a jig and use pogo pins to go in. I'm struggling to accurately target the points to drill as I'm using the photos to judge. I suspect V1 will end up hacked up as I work this out.

Dimensionally my estimates are in mm, all using the side for the earth pin for X, and the top of the earth pin for Y:

Rx = 5.6,  7.2
Tx = 8.4,  6.2
5V = 10.8, 4.8

The pic isn't great as getting the camera aligned makes things look off, but I wanted to show you where I'm measuring from. The idea is to make the jig fit over the power pins so there's no margin for error.

I estimate the pad areas are approximately 1.6mm is diameter. I want to go in with a 1mm diameter bit, but unless I pop it open and reglue it, or go for a larger hole on V1 I'm afraid I'll miss. I want to keep it glued simply due to the forces when you pull the plug out of the socket.

Still - I think the idea is solid, and it would mean the holes don't need filling, and can remain for any boot issues down the line. If anyone has any clues I could use before attempting this crazy idea, please let me know.

[JBFUK]

I had a similar idea but as the plug is so easy to open and re-seal with no sign its ever been modified - I concluded it's not worth the effort. You'll only need to physically access the hardware once to flash and after that all updates (even between Tamara/esp-home) will be OTA.

[vtraveller]

What glue did you use or will it push clip?

[JBFUK]

I used a little bit of medium CA (thickish superglue).

[techiris]

@vtraveller - I used @JBFUK's method of slowly applying pressure on the glue join and they pop open quite easily, used a set of shifting pliers to do the work with a cloth as padding while rotating after each "snap" of separation, then glued back as @JBFUK mentioned above.
I really don't think the effort is needed for templates or drilling.

I have even used this project ( tasmota-blerry ) to add BLE gateway features to one of the S60's to receive and forward BLE signals to MQTT broker from other devices such as Govee H5075.

I have 12 flashed and operating with no visible sign of change.

[vtraveller]

I'm glad it worked for you. I'm flashing and updating a fair bit as I refine my fw. So I wanted a solution where I could dip in and flash or monitor serial as needed.

It's also a 1min mod now without any visible intrusion, which I like for the cleanliness of the solution. It was also fun to hack where I don't need to solder wires on the original board.

That said, I have specialist gear. Not everyone will have that. I expect most people will find the vice method easier. So I'm not dissing it, just didn't meet my needs.

[MalSmalley]

Hi @vtraveller
That was my first thought too. I spent days trying to get pins lined up and with good contacts.
I was trying to build a jig that fitted over the 'rounded triangle' shape of the plug. Gave up & drilled a bigger hole!
Attached some photos that might help you in your quest from my dissasembled unit.

[MalSmalley]

I think the radial distance from the casing too would be a good triangulation.
Using a vernier I'm measuring 4.7mm for the centre point of the Rx & Tx pads (from outside of casing)
and 8.4mm to the centre of the Vcc. Also 3.2mm centre to centre between the Rx & Tx pads.

Good luck!

[vtraveller]

If you're interested, I'm going to import the pcb+case pic into FreeCAD, scale to your super helpful 0.1mm scale, overlay a design, print it.

Then drill for oil and hope. 🤣

[vtraveller]

Everything scaled and aligned: +1 degree rotation needed. When I started adding reference points I noticed that the pcb has different diameters in different places. I use a measurement of my own case as a way to cross-reference.

I aligned your measurements with mine - they're close. Except the Vcc which is so off, I'm wondering who's wrong.

[MalSmalley]

You are correct. I am wrong. I forgot which pin on the processor board it was, didn't think to check, and measured to the inner side.
Should be 5.5mm by my (new) measurement to the correct pin!!

[vtraveller]

Awesome. Means I'm zoning in. 😆

[vtraveller]

Well I think I have a candidate. @MalSmalley if you want to give it a go feel free. As you have an open one you can see how off I am. I did struggle getting enough material around Rx, and had to nudge it slightly off centre by a fraction of a mm.

https://www.printables.com/model/1172012-sonoff-s60-test-jig

[vtraveller]

Very neat job. I've just ordered 2 more units. I'm tempted to give @JBFUK 's 'vice' method a go.

Don't possess a 3D printer......

Oh the torment. I use my 3D specifically for problem solving. I'm a lousy carpenter and a 3D printer gives me that Swiss-watch precision I craved.

You could technically online print or join a maker club. I know people that do that to work out if 3D printing is for them.

[vtraveller]

@MalSmalley DM as vtraveller on discord. I may be able to help.

[MalSmalley]

Thanks. My two new ones popped open no problem & all flashed & working.
A bit cautions with the first one until you calibrate how hard to squeeze the vice but after that its pretty plain sailing.

@vtraveller did you solve your OTA update issue?

[vtraveller]

Not yet. I'll look at the weekend. I need to change from SSDP client/server code over to a new UPnP version as discovery is acting up.

But it's on my list. I think an efuse needs flipping. I'm just hoping they didn't do a perm change otherwise I'm walking around to reflash every time I mod with a jig.

[vtraveller]

ooooh this gets well dicey. Basically I'm trying to track down a newer second stage boot loader (i.e. flash programming mode).

https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-guides/startup.html#second-stage-bootloader

You can download the factory flashing tool here.

If you want a reading arc:

https://docs.espressif.com/projects/esp-idf/en/v5.0/esp32c3/api-reference/system/efuse.html?form=MG0AV3
https://docs.espressif.com/projects/esp-idf/en/stable/esp32c3/api-reference/system/ota.html?form=MG0AV3
https://docs.espressif.com/projects/esp-test-tools/en/latest/esp32/production_stage/tools/flash_download_tool.html
https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-guides/bootloader.html

If you have more smarts than me, and know where this is, or whether that's the part of the problem I'm trying to solve, let me know. Either the secondary boot loader needs updating at address 0x1000, or the OTA partition table needs configuring at 0x8000.

There's interesting reading for eFuse rollback at the end of this page. I wondering if its caught by this and compatibility within the table:

https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-reference/system/ota.html

I think my best bet is to run the otatool.py and see what it says. Fortunately the entire ESP-IDF is open source, so I could also reverse engineer the error code back to something sane.

https://github.com/espressif/esp-idf

So that's where I am at the moment. Don't you long for the days of a one button fix?

[MalSmalley]

@ChrisVonFrosta
It's html/css/js using UIBuilder component within NodeRed.
It's integrated with Light Switches, various environmental sensors & some other controls I have.