From 3b450d2a129e1a18595893b8962ab929339d0218 Mon Sep 17 00:00:00 2001 From: "a.edenhauser" Date: Mon, 19 Oct 2026 09:31:33 +0200 Subject: [PATCH] doc0 - adjust image sizes --- Document0-Initial_Information_Gathering.md | 26 +++++++++++++--------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/Document0-Initial_Information_Gathering.md b/Document0-Initial_Information_Gathering.md index 987c68b..b07560a 100644 --- a/Document0-Initial_Information_Gathering.md +++ b/Document0-Initial_Information_Gathering.md @@ -42,7 +42,7 @@ The packaging contains: The lock is surrounded by a plastic packaging with molds for eah component. Within the box it is kept in place with some cardboard. The box itself is held shut by a small magnet. -![Contents of the box](img/unpacking.jpg) +Contents of the box ## 1.2 || 2.2 Outer Inspection @@ -50,11 +50,11 @@ The lock is surrounded by a plastic packaging with molds for eah component. With The outer module is a touch sensor surrounded by a plastic shell with two screws and one cable inside. -![Back of the touch module](img/touch_back.jpg) +Back of the touch module During installation, the cable is supposed to connect to the motor module. -![Cable position of the touch module](img/touch_cable.jpg) +Cable position of the touch module ### Inner Module @@ -62,7 +62,7 @@ The inner module includes the motor module, which is connected using cables to: - the power supply - the touch module -![The inner module including the motor module](img/inner.jpg) +The inner module including the motor module Unopened, it is surrounded by a metal shell which can easily be removed by pulling a plastic strap, as this is necessary during installation. @@ -71,7 +71,7 @@ Unopened, it is surrounded by a metal shell which can easily be removed by pulli The bridge is to be placed within 3 meters of the lock. It is used to connect the lock to the app. It features a reset button. -![The bridge](img/bridge.jpg) +The bridge ## 1.3 && 1.4 Open Casing / HW Inspection @@ -85,29 +85,29 @@ What you can spot immediately is: - WiFi & Bluetooth/BLE capable - [Datasheet](docs/esp32_datasheet.pdf) -![PCB inside the bridge](img/bridge_pcb.jpg) +PCB inside the bridge Under the PCB is HW for the power supply. -![Power supply beneath PCB](img/bridge_under_pcb.jpg) +Power supply beneath PCB ### Outer Module There are three screws on the back of the touch module, however, it's additonally glued together. It can't be opened without being (probably) permanently damaged. -![Back of the touch module with screws removed](img/touch_inside.jpg) +Back of the touch module with screws removed ### Inner Module As I'm working with an already opened device, I'm not interiley sure hw many screws were intially needed to open the motor module, but I'm assuming it were four. After unscrewing these the plastic shell can be removed by gently wiggling it until it comes loose. -![Inside of the motor module](img/motor_inside.jpg) +Inside of the motor module Once again you can immedatiely spot UART. After unplugging all cables, the PCB can be leveraged out of the shell with a flat screwdriver, without causing any damage. -![Other side of the motor module PCB](img/motor_inside_2.jpg) +Other side of the motor module PCB Here you can see: - UART @@ -118,9 +118,13 @@ Here you can see: ## 1.5 Software Components from Firmware Analysis -## 1.6 Collect "fresh" Firmware Dump +## 1.6 Collect "Fresh" Firmware Dump +As the lock has been tampered with before, the FW dump is not entirely "fresh." +### Bridge + +### Outer Module ## 1.7 && 2.3 Initial setup