I found an amazon basics color changing smart light bulb attached to a lamp my neighbor threw in the apartment dumpster.

[ftg@mastodon.radio]

@MLE_online
Oh cool. A new ESP32 board source.
It's even on a desolderable module.
And ESP32 is more hackable than the Silabs EFR32 in IKEA Trodfri's.
At least until I port the Gekkokapula firmware to the module I pulled form one and get on 2.4GHz FM with one.

[mle_online@social.afront.org]

@ftg I'm not getting anywhere with connecting to the module, however. I've got it wired up to an FTDI device, but esptools fails to connect to it, and I don't know why

[steter@mastodon.stevesworld.co]

@MLE_online Someone could sniff the bluetooth to see what it sends/receives, then create code for phone or PC (if it has bluetooth installed) to mimic transfers. Such a person would probably want a working app to watch, so they know which data each command sends/receives. Without that, it would be difficult. Unless the bulb came with an API, which should make it very easy.

[realgene@hachyderm.io]

@MLE_online @ftg
There's probably a requirement to pull a particular pin down at power on to enable the ROM loader.

[bytex64@awesome.garden]

@MLE_online You could probably just throw tasmota32.factory.bin on there but I can’t see anything that says it supports the BP1838. http://ota.tasmota.com/tasmota32/release/

[mhkohne@mastodon.social]

@SnoopJ @MLE_online Even if they set the 'no read' bit, what matters is the processor's approach to it. Some processors will still let you clear that bit (and thus wipe the on-board flash), while others won't, making the stupid thing e-waste (I'm scowling at you to Infineon). I've not done esp32, so I don't know their approach.

[ruenahcmohr@infosec.exchange]

@projectgus @MLE_online From what I see, its an esp32. which, IS halarious.

[scribblesonnapkins@mastodon.social]

@MLE_online @SnoopJ
It's not as complicated as it sounds. Is it something you want to explore?

[ruenahcmohr@infosec.exchange]

RE: https://social.afront.org/@MLE_online/116116635764812056

@projectgus @MLE_online

https://infosec.exchange/@MLE_online@social.afront.org/116116636177916057

[rcgj_oxphys@floss.social]

@MLE_online In case it's of interest to anyone reading this: the datasheet indicates these can be locked down using eFuse bits that "can't be unset" (paraphrase) I would expect these to be set on an IoT device (tho' some of the products I've seen written about here… yeesh. so you never know)

I didn't find info for ESP32 about resetting these, but for AVR chips this has reportedly been possible, with some detail here: https://web.archive.org/web/20210506151334/https://sites.google.com/site/pbykec/projects/index/hvsp
hopefully it gives some helpful clues.

[scribblesonnapkins@mastodon.social]

@SnoopJ @MLE_online That's one way. There are also fast dips and spikes in the power rails and glitches of other forms.

You can also make micro probes and with the chip decapped probe the chip directly. Those fuses have been know to be made at larger feature sizes.

[maehw@chaos.social]

@MLE_online You'd need to find UART TX/RX + GND + BOOT signal for serial bootloader access. And a USB/serial converter on your PC. But I don't really want to drag you into that rabbit hole. Still got an IoT device on my desk myself.

[ruenahcmohr@infosec.exchange]

@projectgus @MLE_online the question might be - did they leave an arduino boot loader on it. I'm thinking yes.

[vxo@digipres.club]

@MLE_online
Does she have the "Karen" haircut?
@botvolution