Difference between revisions of "Whirlybird"

From RECESSIM, A Reverse Engineering Community
Jump to navigation Jump to search
m (-.-6eau moved page DF Whirly Gig Blinky to Whirlybird: Renaming with dictionary word)
(initial bring up)
Line 1: Line 1:
 +
[EXPERIMENTAL]
 
Direction Finding (DF)
 
Direction Finding (DF)
 +
 +
This is an exercise that started with up-cycling some e-waste that contains 32 RGBW LEDs and an ESP32-S3-WROOM2. There is a myriad of other components presumably intended to interface with other control circuits.
 +
 +
The primary objective here is not to reverse engineer its previously intended purpose, rather invent a new purpose. The objective is to utilize the outer ring of 24 blinkies as a 360 degree direction indicator. The ESP32 module, which appears to never have been flashed with functioning firmware, is erased and flashed with a current Octal SPI build of Micropython.
 +
 +
For the most part the components on the PCB are not directly connected to the ESP32. Rather there is a number of connectors they are wired to for an alternative "main" processor. This includes the addressable RGBWs that are some variant of [https://cdn-shop.adafruit.com/product-files/2757/p2757_SK6812RGBW_REV01.pdf SK6812RGBW]. Additionally for some reason even though these are individually addressable in series of over a hundred, they are broken in to two independent chains of 24 spaced in an outer circular pattern and 8 more arranged inside that circle.
 +
 +
The board is likely designed as some sort of prototype of an evolution of a production product. It is unknown if it was intended to be a technical evaluation of various features, in ongoing development or a one off experiment. I have ended up with several dozen of these, there are many unknown and some number of issues. The majority of them have thus far had an issue with enabling "Boot Mode" and power on only to continually restart themselves.
 +
 +
== ESP32-S3-WROOM2 ==
 +
 +
=== Pin Layout ===
 +
 +
[[File:ESP32-S3-WROOM2 Pin Layout.png]]
 +
 +
 +
=== Firmware ===
 +
 +
When connecting to a linux machine, the following can be seen via <code>dmesg | tail</code>.
 +
<pre>
 +
new full-speed USB device number 99 using xhci_hcd
 +
New USB device found, idVendor=303a, idProduct=1001, bcdDevice= 1.01
 +
New USB device strings: Mfr=1, Product=2, SerialNumber=3
 +
Product: USB JTAG/serial debug unit
 +
Manufacturer: Espressif
 +
SerialNumber: 68:B6:B3:##:##:##
 +
cdc_acm 3-2:1.0: ttyACM0: USB ACM device
 +
</pre>
 +
 +
While the device enumerates as USB and has capacity to facilitate serial communications, it is not really feasible with the constant reboot cycle. However connecting to the <code>Tx</code> pin with a USB/Serial UART converter the following can be captured. Additionally holding the ESP32 in reset and monitoring the UART you can capture the following by briefly releasing the reset and then re-enabling reset, othrewise you will get a continuous flood of the same messages at <code>115200 baud</code>.
 +
<pre>
 +
ESP-ROM:esp32s3-20210327
 +
Build:Mar 27 2021
 +
rst:0x1 (POWERON),boot:0x8 (SPI_FAST_FLASH_BOOT)
 +
invalid header: 0xa5ff005a
 +
invalid header: 0xa5ff005a
 +
invalid header: 0xa5ff005a
 +
invalid header: 0xa5ff005a
 +
</pre>

Revision as of 16:44, 25 September 2024

[EXPERIMENTAL] Direction Finding (DF)

This is an exercise that started with up-cycling some e-waste that contains 32 RGBW LEDs and an ESP32-S3-WROOM2. There is a myriad of other components presumably intended to interface with other control circuits.

The primary objective here is not to reverse engineer its previously intended purpose, rather invent a new purpose. The objective is to utilize the outer ring of 24 blinkies as a 360 degree direction indicator. The ESP32 module, which appears to never have been flashed with functioning firmware, is erased and flashed with a current Octal SPI build of Micropython.

For the most part the components on the PCB are not directly connected to the ESP32. Rather there is a number of connectors they are wired to for an alternative "main" processor. This includes the addressable RGBWs that are some variant of SK6812RGBW. Additionally for some reason even though these are individually addressable in series of over a hundred, they are broken in to two independent chains of 24 spaced in an outer circular pattern and 8 more arranged inside that circle.

The board is likely designed as some sort of prototype of an evolution of a production product. It is unknown if it was intended to be a technical evaluation of various features, in ongoing development or a one off experiment. I have ended up with several dozen of these, there are many unknown and some number of issues. The majority of them have thus far had an issue with enabling "Boot Mode" and power on only to continually restart themselves.

ESP32-S3-WROOM2

Pin Layout

ESP32-S3-WROOM2 Pin Layout.png


Firmware

When connecting to a linux machine, the following can be seen via dmesg | tail.

new full-speed USB device number 99 using xhci_hcd
New USB device found, idVendor=303a, idProduct=1001, bcdDevice= 1.01
New USB device strings: Mfr=1, Product=2, SerialNumber=3
Product: USB JTAG/serial debug unit
Manufacturer: Espressif
SerialNumber: 68:B6:B3:##:##:##
cdc_acm 3-2:1.0: ttyACM0: USB ACM device

While the device enumerates as USB and has capacity to facilitate serial communications, it is not really feasible with the constant reboot cycle. However connecting to the Tx pin with a USB/Serial UART converter the following can be captured. Additionally holding the ESP32 in reset and monitoring the UART you can capture the following by briefly releasing the reset and then re-enabling reset, othrewise you will get a continuous flood of the same messages at 115200 baud.

ESP-ROM:esp32s3-20210327
Build:Mar 27 2021
rst:0x1 (POWERON),boot:0x8 (SPI_FAST_FLASH_BOOT)
invalid header: 0xa5ff005a
invalid header: 0xa5ff005a
invalid header: 0xa5ff005a
invalid header: 0xa5ff005a