[Contribution] Extend supported hardware to IPSTube

[Holbormon]

Hi, and thanks for sharing your work !

I was gifted a Chinese copy of the EleksTube, and decided to see if I could reverse-engineer it. Doing some light USB probing (lsusb + see below) reveals that it is very probably using some kind of ESP chip behind a CH340 USB-to-serial converter. Further disassembly shows what I believe to be an ESP32 chip (circled in red), wired to a USB port and a button (circled in green).

All this has me thinking that your firmware might be applicable, unfortunately I lack knowledge about the programming flow of such IOT devices. In particular, I have looked up documentation about and succesfully setup ESP-IDF and ESPtool on my linux machine, but I can't get these programs to communicate with the clock over USB (despite getting some data as shown below)

Output of /dev/ttyUSB0 when resetting the clock via button long press:

ets Jul 29 2019 12:21:46

rst:0xc (SW_CPU_RESET),boot:0x12 (SPI_FAST_FLASH_BOOT)
configsip: 153911750, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:2
load:0x3fff0030,len:1184
load:0x40078000,len:13232
load:0x40080400,len:3028
entry 0x400805e4
E (826) esp_core_dump_flash: No core dum‚…ÉÑÑœ¹found!
E (826) esp_core_dump_flash: No core dump partition found!
Software reset CPU
Software reset CPU

Is there anyone interested in extending support to this new device and can point me in the right direction ? Thanks in advance

[aly-fly]

Interesting hardware. They opted to place ESP32 and supporting components directly onto the PCB instead of the readily available module.

What you need to do:

1. Install esptool and download the existing firmware from the clock. Check flash size (4 or 8 MB) and load complete image.
2. Delete IDF and install PlatformIO.
3. Read the part number of the RTC chip next to 32 kHz crystal.
4. Build the clock version that supports your RTC chip.
5. Load and test. If not working, you will have to do signal tracing of the complete PCB, report here and then we can include it.

[Holbormon]

Sorry if this is a trivial question, but as mentioned I have no experience with ESP32 chips, so I don't know how to boot mine in bootloader mode. I found these instructions but I don't have the necessary hardware skills to process them. In particular, how do I control the RTS and DTR Serial pins of my computer ?

More generally, do you happen to have more detailed instructions of all the steps you mentioned, targeted at someone still learning about ESPs ?

[aly-fly]

The ESPtool software will handle all the RTS and DTR lines for you (if properly wired on the board by the Chinese guys). And it will automatically reboot the clock into the bootloader mode. Read the manuals how to use ESPtool (on Linux). Or google it. I can't offer much help, because on Windows everything is a bit different. I think if you put correct phrases into your fav search engine, it should give you the correct path directly. Ex: "save flash image esptool linux". For windows the path is somewhat similar, see here: https://github.com/SmittyHalibut/EleksTubeHAX?tab=readme-ov-file#backup-first for which switches and settings are needed to save your backup. It seems it will be a bit steep learning curve for you, but over one weekend you will be able to google and learn all of it :)

[eku]

I could backup the original firmware with esptool. It's 4MB.

Detecting chip type... ESP32
Chip is ESP32-D0WDR2-V3-V3 (revision v3.1)
Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
Crystal is 40MHz

[Holbormon]

The ESPtool software will handle all the RTS and DTR lines for you (if properly wired on the board by the Chinese guys). And it will automatically reboot the clock into the bootloader mode.

Every time I try to use ESPTool I get "No serial data received". According to their documentation, this means the hardware is not properly wired, hence my earlier question of whether I need to do something more to put the chip in bootloader mode ?

The device has one button only (Shown on my PCB picture earlier). Pressing it for 5s resets the chip, which is the only time I'm able to read any data from the serial port (Using a basic cat /dev/ttyUSB0 on repeat).

[Martinius79]

Hello Holbormon!

I assume, you get the "No serial data received" message, while you are trying to write your backuped firmware back to the clock again? So something like "esptool --port /dev/ttyUSB0 --baud 921600 write_flash --erase-all 0x0000 backup1.bin", right? Or you wasn't able to read out the firmware yet at all? Means, no backup file of the orginal firmware yet? Did you try to lower the Baud-rate like to 115200?

And you can also try to press this little button on your PCB, while plugging-in the "power cord" to the clock and hold it for a few seconds while the device is booting. Sometimes, this brings the ESP into the bootloader mode (depends on the wiring).

And like aly-fly indirectly mentioned, you need to identify the hardware used on the clock, so make pictures of the chips with labels/prints on them, so the letters can be read. Smartphone camera with zoom and different angles and light mostly will do the trick here. Most interesting for you is the ESP and the clock chip.

If you are really interested, you can also try to get the wiring of the PCB by taking photos from both sides, a multi-meter, some time and interest :) Then you can identify, how the ESP is soldered and if you can/need to solder some "helper" pins to put it into bootloader mode, if needed.

Bye Martinius

[eku]

AFAIR the button next to the usb connector has to be pressed and hold while connecting the usb cable. Then start esptool to backup the original firmare. Same for writing any firmware to the device.

See also https://github.com/SmittyHalibut/EleksTubeHAX/blob/main/pre-built-firmware/_ESP32%20save%20flash%204MB.cmd.

[Martinius79]

AFAIR the button next to the usb connector has to be pressed and hold while connecting the usb cable. Then start esptool to backup the original firmare. Same for writing any firmware to the device.

See also https://github.com/SmittyHalibut/EleksTubeHAX/blob/main/pre-built-firmware/_ESP32%20save%20flash%204MB.cmd.

Hello eku,

I already wnated to ask, how you was able to work with the clock, but you was faster ;)

But will still ask my questions:

Do you have the same clock like Holbormon is mententing? And you was successfull with uploading a custom firmware? So which one did you use? One of the pre-builded ones? Just for taking this device into the "supported" ones, if everthing is working.

Bye Martinius

[Holbormon]

AFAIR the button next to the usb connector has to be pressed and hold while connecting the usb cable. Then start esptool to backup the original firmare. Same for writing any firmware to the device.

See also https://github.com/SmittyHalibut/EleksTubeHAX/blob/main/pre-built-firmware/_ESP32%20save%20flash%204MB.cmd.

Thank you for the precision. This seems to indeed boot the clock in a different mode (All screens are backlit but blank). I also had to use a different USB Cable because the one shipped with the chinese clock resulted in constant pySerial I/O errors. I have finally succeeded in running flash_id:

esptool.py v4.7.0
Serial port /dev/ttyUSB0
Connecting.....
Detecting chip type... Unsupported detection protocol, switching and trying again...
Connecting...
Detecting chip type... ESP32
Chip is ESP32-D0WDR2-V3-V3 (revision v3.1)
Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
Crystal is 40MHz
MAC: e4:65:b8:cd:1d:44
Uploading stub...
Running stub...
Stub running...
Manufacturer: 0b
Device: 4017
Detected flash size: 8MB
Hard resetting via RTS pin...

I have also succesfully dumped the memory from 0x00000 to 0x400000 as previously advised, but a quick inspection of the resulting 4.0MB file shows empty regions at the beginning and start, suggesting that the actual firmware may be smaller ?

Now that my dev environment is finally setup properly I will proceed with the repo's steps and report back.

[eku]

but a quick inspection of the resulting 4.0MB file shows empty regions at the beginning and start, suggesting that the actual firmware may be smaller

The flash is partioned. Don't know how to read the partition table back, but I guess there are at least 2 OTA and a FFS partition.

[Holbormon]

The flash is partioned. Don't know how to read the partition table back, but I guess there are at least 2 OTA and a FFS partition.

Just did thanks to these instructions and gen_esp32part.py from esp-idf. Memory is actually 8MiB (which is consistent with the output of flash_id posted earlier):

Name	Type	SubType	Offset	Size	Flags
nvs	data	nvs	0x9000	20K
otadata	data	ota	0xe000	8K
app0	app	ota_0	0x10000	2M
app1	app	ota_1	0x210000	2M
spiffs	data	spiffs	0x410000	4028K
eeprom	data	nvs	0x7ff000	4K

I have attached the raw csv for reference

[eku]

@Holbormon thanks for the info. Looks like we need to dump 8MB to also safe the original pictures in spiffs.

Could you please provide a more sharp foto of the pcb, so we could read the component identifiers?

[Holbormon]

Looks like we need to dump 8MB to also safe the original pictures in spiffs.

Done.

Could you please provide a more sharp foto of the pcb, so we could read the component identifiers?

Speaking of the PCB, can anyone advise whether my hardware looks susceptible to the power problem that the original Elekstube has (5V being fed to the ESP32 as described here) ?

[eku]

Flash is XT25F64 from XTX Technology Limited, which is 64x1024kBit = 8MB. RTC is a DS1302 replica.

So far so good.

It would be interesting to know which LCDs are used and how they are connected. Can you find out?

[eku]

@Martinius79

And you was successfull with uploading a custom firmware? So which one did you use? One of the pre-builded ones?

I'm still on original firmware and waiting for more hardware details.

I generally have the confidence to compile the software myself once I have all the details for the configuration.

[Holbormon]

Flash is XT25F64 from XTX Technology Limited, which is 64x1024kBit = 8MB. RTC is a DS1302 replica.

So far so good.

It would be interesting to know which LCDs are used and how they are connected. Can you find out?

Again, I am much more versed in software than I am in hardware. Also, I don't have access to basic tools such as multimeters and soldering irons. Would more pictures of the other side of the PCB suffice to tell ?

[Martinius79]

Flash is XT25F64 from XTX Technology Limited, which is 64x1024kBit = 8MB. RTC is a DS1302 replica. So far so good. It would be interesting to know which LCDs are used and how they are connected. Can you find out?

Again, I am much more versed in software than I am in hardware. Also, I don't have access to basic tools such as multimeters and soldering irons. Would more pictures of the other side of the PCB suffice to tell ?

It is about the six little TFT-LCD panels, which are displaying the "digits" of the clock. Can you take photos of them as well or identify the manufacturer or model number? Then you can watch for the datasheet and check if the resolution is the same like for other models and which driver is needed for them. So yes, more pictures are always helpful ;)

[aly-fly]

It is required to get full reverse-engineering of the hardware, all the chip details, which pin of which component is connected to which pin on the other component(s). There are only two options, either one of the clock owners does the detailed hardware reverse engineering, or send the clock to someone that can do that.

Because the clock has 8 MB flash (double of what everyone else has) there are two ways forward:

1. keep this project as-is and only use half of available flash (simple, but ineffective), or
2. reworking the partition table for larger flash for this build type only. Firmware should be able to automatically count number of uploaded clock fonts.

Regarding the voltage issue from the original clock - best is to measure the supply voltage of the USB chip. If it is 3.3V then it is ok. If it is 5V, you have to search for any resistors in series with the Data TX line.

[Holbormon]

Got some more pics of the PCB/LCDs. Unfortunately unable to determine screen manufacturer/model by mere visual inspection. Glare on the last one shows a bit of LCD wiring. Does this help ?

[Martinius79]

Hello again Holbormon,

If the link is right in your first post, the clock is from "IPSTube" and it is model "401". If I search for it on the usual suscpect websites for china tec, it seems, as there are two versions of this clock available. One with LCD Lights on the bottom and one without (see the screenshots).

Which one of them do you own?

Bye Martinius

[Holbormon]

Which one of them do you own?

It's a bit misleading because the case of mine looks like the bottom picture (black and gold lines), but the base is most definitely not lit up with LEDs. I'd say it's the top model, cheaper, no lights.

Are you hoping to find datasheets somewhere ? The manufacturer's website looking like it does in my first link (that is, terribly bare), I'll admit I didn't hope to find any helpful tech specifications anywhere else.

[Martinius79]

Ah, my bad, the first one seems to be the model 402. Your is like this one, I guess:

[Martinius79]

Got some more pics of the PCB/LCDs. Unfortunately unable to determine screen manufacturer/model by mere visual inspection. Glare on the last one shows a bit of LCD wiring. Does this help ?

Sadly, not really. It just shows us, that the LCD panels are not "plugable" and not using a socket, like it is for the most Eleksmaker IPS clock copies. And it shows also, that they "glued" some stickers with a dragon on it :)

Most of these clock manufactures are just copycats, so the chance, that they are using nearly the same panels with the ST7789 driver as all the others, are high. But most of these small panels using 8 lines, so you can't be sure. This device is definetly different from the usal copies. Other ESP32 with bigger flash chip (as eku mentioned).

The only way, is to follow the wirings to find the right pins ;) and then try and error, if the usual driver is working.

If you are willing to risk to damage the device, you can "unplug" one panel and try to remove it and use an ardiuno board to communicate with it :) Or try to remove the stickers, but that will probably damage the panel and there is no gurantee that you will find any model numbers under it.

So it depends, on how much time you want to invest and if you want to risk damaging the device to go on from here.

Bye Martinius

[eku]

I'm currently setting up the development enviroment to build and test self comiled firmware with the IPS Tube.

The instructions recommend the use of VSCode with plug-in for PlatformIO. As a fan of the command line, I prefer to use Makefiles. Can anyone help me with this?

[Holbormon]

As a fan of the command line, I prefer to use Makefiles. Can anyone help me with this?

I was actually also working on this myself. For now I have succesfully followed these instructions up to the point of having to run idf.py build. Now I figure it's just a matter of cramming the source code of this repo's pio folder into an idf project and linking the relevant libraries. Will report back if I manage to do that, but this might take a while as I'm still learning about the whole ESP component ecosystem.

[Martinius79]

I'm currently setting up the development enviroment to build and test self comiled firmware with the IPS Tube.

The instructions recommend the use of VSCode with plug-in for PlatformIO. As a fan of the command line, I prefer to use Makefiles. Can anyone help me with this?

Even if you don't want to use Visual Studio Code (which I can highly recommend for every OS), there is the CLI of PlatformIO (see https://docs.platformio.org/en/stable/core/index.html). It is doing all the "magic" in the backgound. You should be able to use it without any GUI (see https://docs.platformio.org/en/stable/core/installation/shell-commands.html#piocore-install-shell-commands). The platformio.ini is the "make file" for this tool and can be used to get the depenencies, build, link and upload the firmware. Of course, you can try to build all tools and libraries locally and with the belonging compiler or interpreter, but I don't see the use of it, except you really want to learn a lot :) If you analyse the source code of PlatformIO or put it the PIO system on verbose logging you will see, what it is doing in the background. Actually nothing spectecular. Grabbing the dependencies you definded and put them on the right place, compile your code with the right includes and the right switches for the target architecture and to run the linker. The binary is then uploaded with a variant of the ESP32 tool in this project. PlatformIO makes it WAY easier, then doing all the single steps in seperate tools/consoles. And with the GUI in Visual Studio Code it is all integrated in one place.

Bye Martinius

[eku]

The instructions for building the firmware yourself need a little revision. The chapter "Configure the TFT_eSPI library" comes before "Configure, Build and Upload New Firmware", although it requires files from the following step.

The Pythen scripts do not contain a shebang and it is not clear whether they require version 2 or 3.

I'm still fighting my way through it. To be continued...

[eku]

Configuring the firmware is tricky.

I only see 5 circuits, ESP32, Flash, RTC, CH340 and voltage regulator. No shift register for selecting the LCDs. No control buttons.

Any ideas?

[aly-fly]

The Pythen scripts do not contain a shebang and it is not clear whether they require version 2 or 3.

PY comes together with PlatformIO + VScode bundle. Therefore no need to know which revision is it. If you still insist on going barebones (CLI), this is up to you to figure out.

I only see 5 circuits, ESP32, Flash, RTC, CH340 and voltage regulator. No shift register for selecting the LCDs. No control buttons.

Probably everything is connected directly to the ESP32. If there are no buttons, this frees additional IO pins, so there might be enough of free pins for all displays. If there are no buttons, how do you operate the clock with stock firmware?

[eku]

If there are no buttons, how do you operate the clock with stock firmware?

They provide an Android App that connects via Bluetooth. No registration is required for simple settings. Registration is required to install and select additional clock images.