OnbrightFlasher

Background

This is intended to allow flashing 8051 based OBS38S003 microcontrollers as a target.

An external ESP8266/ESP32 module or similar serves as the flasher.

For manual programming each HEX line must be pasted into the serial monitor individually.
For automatic programming a Python script has been contributed that supports file upload.
thanks to :- [@matlab22] (https://www.github.com/matlab22)

The sketch has successfully flashed a simple blink program.

External Flashers

| Board | Status | Note | | ------------- | ------------- | ------------- | | ESP8265 (e.g. in Sonoff) | WORKING | none | | ESP8266 (e.g. Wemos D1 Mini) | WORKING | none | | ESP-WROOM-32 | WORKING | none | | ESP32S3 | WORKING | none | | Arduino Mega 2560 board | WORKING | 5V to 3.3V level translation recommended |

Known Issues

Multiple ESP32 users reported downgrading library versions to allow I2C to work properly:
https://github.com/espressif/arduino-esp32/issues/11374

Status

| Item | Status | Note | | ------------- | ------------- | ------------- | | Write flash memory | DONE | Manually one byte or one hex line at a time | | Read flash memory | DONE | Manually one byte at a time | | Reading/writing configuration bits | PARTIAL | Need read-modify-write scheme | | Verify flash memory | TODO | checksums displayed as a basic check |

Usage

Preparing the external flasher

1. Grab an external ESP8266 (NodeMCU/D1 mini), ESP32, or Arduino Mega 2560 board
2. Download the current source code, open "OnbrightFlasher.ino" into arduino IDE, and then compile and upload it to the external flasher
3. Done

Flashing the radio chip

1. Connect ESP828x/32 or Arduino I2C/GPIO pins to the microcontroller while unpowered.
2. Target microcontroller can be powered by an independent supply, from 3.3V output regulator on Arduino board, or by powering the RFbridge via its USB port.
3. Using output regulators on Arduino boards can lead to power up glitches (e.g., recommend erasing ESP8285 first and confirm regulator can supply 100 mA or greater).
4. Target should remain unpowered until handshake is started.
5. Excute "FlashScript.py" and choose the desired firmware to upload. When prompted, supply power to the radio chip.
6. Wait for flashing to finish.
7. Done

Script Mode:

1. Copy the desired hex file from GitHub Releases to the script directory.
2. Run flashScript.py and follow the instructions in the console.
3. For blink.ihx, the red LED on the Sonoff target should begin blinking with a one-second period.
4. For RF-Bridge-OB38S003_PassthroughMode.hex, the red LED on Sonoff should light up once at startup.
5. If the script seems to fail the first flash, try erase as in the Manual Mode and then return to use the script.

Manual Mode:

1. Set serial monitor to "Both NL & CR" at 115200 baud.
2. Type "handshake" into the serial monitor.
3. Power on the target microcontroller with 3.3V.
4. If chip is protected, chip read will appear to fail due to NACK but chip type reported should be (0xA). Proceed to 'erase' step to unprotect chip.
5. If chip is unprotected, serial monitor should display 'Handshake succeeded' along with chip type as (0xA). If handshake worked, try to erase anyway even if chip read fails.
6. Type 'erase' command since the microcontroller is likely protected (this erases flash, cannot be recovered!).
7. Type "setfuse 18 249" (sets reset pin as reset functionality rather than GPIO).
8. Copy-paste hex lines starting with ':' into the serial monitor and hit the enter key.
9. Successful or failed writes should be displayed in the serial monitor.
10. If all successful, type "mcureset" to reset the microcontroller.
11. For blink.ihx, the red LED on the Sonoff target should begin blinking with a one-second period.
12. For RF-Bridge-OB38S003_PassthroughMode.hex, the red LED on Sonoff should light up once at startup.

Web Upload Mode (WARNING: NEEDS TESTING!):

Not included at this time.

More in depth flashing guide by example.

Flashing using the Sonoff's internal ESP8285

The ESP8285 present in the Sonoff RF Bridge R2 v2.2 could theoretically serve as the flasher. For example the USBRXD pin is bridged to SCL, while the USBTXD pin is bridged to SDA. The reset pad would need to be soldered with a wire, though the datasheet is unclear if reset is active low or active high.

Note however, that the reset function on the reset pin of the stock Sonoff RF Bridge is probably disabled. In other words, the pin is configured as general purpose input/output by fuse setting when originally programmed and thus the target cannot be held in reset by this pin. Handshaking is apparently performed at microcontroller power up or restart. Finally therefore, for the first flash the flasher needs to first be unpowered prior to a power source being applied to the target during handshake retries.

Once setfuse is changed (see below) the ESP8285 on the Sonoff itself could be used to reflash the microcontroller. However, again, this would require soldering a wire to the reset pad. The original Sonoff black case with EFM8BB1 allowed microcontroller reset by a long pulse on an C2D pin but that is not available here. Therefore it is ultimately probably easiest to just use an external flasher.

Special Thanks

Special thanks to @matlab22 for writing the flasher python script.
This script allowed flashing of large hex firmware automatically.
This not only allowed firmware development to proceed but made end user flashing much easier.