a.edenhauser/Shelly-Loqed-Touch
1
1
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity

add: swd/uart attempts on inner module

Browse Source
This commit is contained in:
a.edenhauser
2026-11-02 10:05:00 +01:00
parent ebaead60be
commit 434b733f58
3 changed files with 460 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Document0-Initial_Information_Gathering.md
+7 -3
View File
@@ -222,11 +222,15 @@ Interesting findings:
### Inner Module
Using UART with a baud rate of 15200, I was able to log the boot process, you can find it [here](firmware/inner_module/boot.txt).
Using UART with a baud rate of 115200, I was able to log the boot process & runtime traffic.
It seems that the UART link is used for displaying text onto the touch module's display, as you can see it writing whatever the touch module is currently showing. E.g.: "Touch To Lock" or "Locking". Inspect the data [here](firmware/inner_module/inner_module_uart.txt).
In picocom, the device didn't react to any text-based commands.
The boot log contains repeating binary control structures rather than scrolling text, indicating there is no active console listening in that UART interface.
I also wasn't able to obtain the FW using the test clip from the H451 chip (unknown by mini programmer) or the NOR flash (couldn't grab it).
I tried SWD using the j-link mini, but it kept resulting in an error.
I also wasn't able to obtain the FW using the "Kralle" from the H451 chip or the NOR flash.
It seems the extraction of the motor module FW exceeds this test.
## 1.9 && 2.4 Firmware Update / 1.10 Collect Updated Firmware Dump