Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works.
- ARM soc/mcu/processor
- WI-FI (broadcom)
- LCD touch screen + 16bit STM mcu.
- EEPROM 4Kbyte on i2c bus
- 1 Giga bit NAND flash memory.
- 125 M byte of RAM
- I2C bus on the motherboard.
Lacks features: i would like to start the timer only after the device reach the target temperature: with meats, it is ok to add food to the water as it heats. Not for Poached eggs!
I downloaded the firmware update payload motorola srecord SREC format concatenated with a big blob of data like BMP & i18n files. i used ghidra to look inside the code SREC : ARM 32bit/16bit big endian.
Qemu emulation with unicorn framework: i traced mcr instructions. it seems the firmware is configuring the MPU this way:
Recon Then i was able to id "Boot_console_put(char *)" function and a memory address where the firmware write char by char all the boot message related strings: 0x3402f404
Console Output Then the emulated firmware update payload seems to be stuck on a loop when trying to acces and I2C slave (could be the eeprom) printing this:
[boot] entering HW_MCASIC_init [boot NVM] I2C: SDA seems stuck low! [boot NVM] I2C: SDA seems stuck low! [boot NVM] I2C: SDA seems stuck low!
the code dealing with I2C seem a bit too much convoluted for a rapid understanding
The question : i would like to guess What are all the others address the firmware is referencing in the code. Searching google and github for similar constant/base address & offsets didn't help... google search result returning off topic commercial links.