Sonoff that does not advertise ITEAD- WiFi #20

ageorgios · 2017-09-15T11:34:16Z

What is the procedure for sonoff devices (like B1) that do not advertise a WiFi SSID ITEAD-*?

One can use dnsspoof with a hosts file
192.168.X.X eu-disp.coolkit.cc

https://null-byte.wonderhowto.com/how-to/hack-like-pro-spoof-dns-lan-redirect-traffic-your-fake-website-0151620/
dnsspoof -i -f

Can I use the SonOTA when the sonoff device is connected to my local network?
If so what is the command?

Thank you.

The text was updated successfully, but these errors were encountered:

sillyfrog · 2017-09-21T02:58:48Z

If the DNS spoof works, you should be able to run sonota with the --legacy mode (so it's on the standard ports), and it should work in theory (but is untested). If it does, if you have a chance to put a page up on the Wiki for others that would be great.

It may also need to skip the first step (as SonOTA won't be configuring it, you'll be using the EWeLink app to do that), so if you comment out stage1() on line 624 in sonota.py, that should get it going at stage2.

Let me know if it works, and I can also add a command line option to start at stage 2 automatically.

ageorgios · 2017-09-21T08:47:30Z

I am willing to test the procedure you said.

I did:

connect sonoff device to local network with ewlink app
comment line 624
Spoof DNS and redirect eu-disp.coolkit.cc to Machine-to-run-SonOTA-IP
sudo ./sonota.py --legacy

testing with ping

$ ping eu-disp.coolkit.cc
PING eu-disp.coolkit.cc (192.168.178.54) 56(84) bytes of data.
64 bytes from ubuntu.fritz.box (192.168.178.54): icmp_seq=1 ttl=64 time=0.032 ms
64 bytes from ubuntu.fritz.box (192.168.178.54): icmp_seq=2 ttl=64 time=0.045 ms
64 bytes from ubuntu.fritz.box (192.168.178.54): icmp_seq=3 ttl=64 time=0.031 ms
64 bytes from ubuntu.fritz.box (192.168.178.54): icmp_seq=4 ttl=64 time=0.027 ms

and this happens:

Select IP address of the WiFi interface:
    0: 192.168.178.54
Select IP address [0]: 0
WiFi SSID: MYWIFISSID
WiFi Password: MYWIFIPASSWORD

Using the following configuration:
	Server IP Address: 192.168.178.54
	WiFi SSID: MYWIFISSID
	WiFi Password: MYWIFIPASSWORD
Starting stage2...
~~ Starting web server (HTTP port: 8080, HTTPS port 443)
~~ Waiting for device to connect


*** IMPORTANT! ***
** AFTER the first download is COMPLETE, with in a minute or so you should connect to the new SSID "FinalStage" to finish the process.
** ONLY disconnect when the new "FinalStage" SSID is visible as an available WiFi network.
This server should automatically be allocated the IP address: 192.168.4.2.
If you have successfully connected to "FinalStage" and this is not the IP Address you were allocated, please ensure no other device has connected, and reboot your Sonoff.
..........

No FinalStage WiFi advertised though

sillyfrog · 2017-09-21T22:45:23Z

Hmm, that’s not connecting at all. Are you able to run dnsspoof on your router.
I tried doing DNS spoofing some time ago and they only way I could make it work was to run the DHCP and DNS server on the router (which for me is a Linux box anyway - this is from memory, I may have also been trying some arp spoofing as well).
If possible the, ideal debug step now is to do a tcpdump on both the host running Sonota and the router for the traffic coming from the IP allocated to the Sonoff.

ageorgios · 2017-09-22T07:08:40Z

I used this method for DNS spoofing:
https://www.youtube.com/watch?v=_O_IeyQj2fA&t=94s

When I got time I will try the tcpdump. What should I check?
The SonOTA runs on a VM (Ubuntu on Parallels) by the way

rajil · 2017-09-24T02:25:01Z

I also did a dns spoof on B1 and was able to flash the device.

$./sonota.py --legacy --no-prov


Starting stage2...
~~ Starting web server (HTTP port: 8080, HTTPS port 443)
~~ Waiting for device to connect


*** IMPORTANT! ***
** AFTER the first download is COMPLETE, with in a minute or so you should connect to the new SSID "FinalStage" to finish the process.
** ONLY disconnect when the new "FinalStage" SSID is visible as an available WiFi network.
This server should automatically be allocated the IP address: 192.168.4.2.
If you have successfully connected to "FinalStage" and this is not the IP Address you were allocated, please ensure no other device has connected, and reboot your Sonoff.
.........<< HTTP POST /dispatch/device
>> /dispatch/device
>> {
    "error": 0,
    "reason": "ok",
    "IP": "172.16.1.38",
    "port": 443
}
2017-09-23 21:07:15,083 (INFO) 200 POST /dispatch/device (172.16.1.176) 0.95ms
.

*** IMPORTANT! ***
** AFTER the first download is COMPLETE, with in a minute or so you should connect to the new SSID "FinalStage" to finish the process.
** ONLY disconnect when the new "FinalStage" SSID is visible as an available WiFi network.
This server should automatically be allocated the IP address: 192.168.4.2.
If you have successfully connected to "FinalStage" and this is not the IP Address you were allocated, please ensure no other device has connected, and reboot your Sonoff.
2017-09-23 21:07:15,506 (INFO) 101 GET /api/ws (172.16.1.176) 0.91ms
2017-09-23 21:07:15,506 (DEBUG) << WEBSOCKET OPEN
2017-09-23 21:07:15,517 (DEBUG) << WEBSOCKET INPUT
2017-09-23 21:07:15,517 (DEBUG) << {
    "userAgent": "device",
    "apikey": "79184011-3117-33bf-10f-9623d8db62f9",
    "deviceid": "1000109276",
    "action": "register",
    "version": 2,
    "romVersion": "2.0.2",
    "model": "PSF-BLB-GL",
    "ts": 744
}
~~~ device sent action request,  acknowledging / answering...
2017-09-23 21:07:15,517 (INFO) We are dealing with a PSF-BLB-GL model.
~~~~ register
>> {
    "error": 0,
    "deviceid": "1000109276",
    "apikey": "49723a01-1f0c-46ca-9a71-1e8c0beaddgg",
    "config": {
        "hb": 1,
        "hbInterval": 145
    }
}
2017-09-23 21:07:15,543 (DEBUG) << WEBSOCKET INPUT
2017-09-23 21:07:15,543 (DEBUG) << {
    "userAgent": "device",
    "apikey": "49723a01-1f0c-46ca-9a71-1e8c0beaddgg",
    "deviceid": "1000109276",
    "action": "date"
}
~~~ device sent action request,  acknowledging / answering...
~~~~ date
>> {
    "error": 0,
    "deviceid": "1000109276",
    "apikey": "49723a01-1f0c-46ca-9a71-1e8c0beaddgg",
    "date": "2017-09-23T21:07:15.543Z"
}
2017-09-23 21:07:15,556 (DEBUG) << WEBSOCKET INPUT
2017-09-23 21:07:15,557 (DEBUG) << {
    "userAgent": "device",
    "apikey": "49723a01-1f0c-46ca-9a71-1e8c0beaddgg",
    "deviceid": "1000109276",
    "action": "update",
    "params": {
        "fwVersion": "2.0.2",
        "rssi": -38,
        "staMac": "60:01:94:8B:DB:90",
        "channel0": "255",
        "channel1": "255",
        "channel2": "0",
        "channel3": "0",
        "channel4": "0",
        "state": "on"
    }
}
~~~ device sent action request,  acknowledging / answering...
~~~~ update
>> {
    "error": 0,
    "deviceid": "1000109276",
    "apikey": "49723a01-1f0c-46ca-9a71-1e8c0beaddgg"
}
>> {
    "action": "update",
    "deviceid": "1000109276",
    "apikey": "49723a01-1f0c-46ca-9a71-1e8c0beaddgg",
    "userAgent": "app",
    "sequence": "1506218835557",
    "ts": 0,
    "params": {
        "switch": "off"
    },
    "from": "hackepeter"
}
>> {
    "action": "update",
    "deviceid": "1000109276",
    "apikey": "49723a01-1f0c-46ca-9a71-1e8c0beaddgg",
    "userAgent": "app",
    "sequence": "1506218835558",
    "ts": 0,
    "params": {
        "switch": "on"
    },
    "from": "hackepeter"
}
>> {
    "action": "update",
    "deviceid": "1000109276",
    "apikey": "49723a01-1f0c-46ca-9a71-1e8c0beaddgg",
    "userAgent": "app",
    "sequence": "1506218835558",
    "ts": 0,
    "params": {
        "switch": "off"
    },
    "from": "hackepeter"
}
>> {
    "action": "update",
    "deviceid": "1000109276",
    "apikey": "49723a01-1f0c-46ca-9a71-1e8c0beaddgg",
    "userAgent": "app",
    "sequence": "1506218835559",
    "ts": 0,
    "params": {
        "switch": "on"
    },
    "from": "hackepeter"
}
>> {
    "action": "update",
    "deviceid": "1000109276",
    "apikey": "49723a01-1f0c-46ca-9a71-1e8c0beaddgg",
    "userAgent": "app",
    "sequence": "1506218835559",
    "ts": 0,
    "params": {
        "switch": "off"
    },
    "from": "hackepeter"
}
>> {
    "action": "upgrade",
    "deviceid": "1000109276",
    "apikey": "49723a01-1f0c-46ca-9a71-1e8c0beaddgg",
    "userAgent": "app",
    "sequence": "1506218835562",
    "ts": 0,
    "params": {
        "binList": [
            {
                "downloadUrl": "http://172.16.1.38:8080/ota/image_user1-0x01000.bin",
                "digest": "97fe70d737390bbde7b8d208c79d590e29fc76962623c7bd198ee210210ea616",
                "name": "user1.bin"
            },
            {
                "downloadUrl": "http://172.16.1.38:8080/ota/image_user2-0x81000.bin",
                "digest": "e6d0cbb641542bd0a27e6c4628fc9331f1f5d3ac3afa42c9307569cf4d70fcdc",
                "name": "user2.bin"
            }
        ],
        "model": "PSF-BLB-GL",
        "version": "23.42.5"
    }
}
2017-09-23 21:07:15,590 (DEBUG) ~~ websocket close
2017-09-23 21:07:15,606 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1812158119&sign=9d62d276fb96fb688188f66ba08ff733148bb9bdb0cfb31d078182bae3295493 (172.16.1.176) 10.23ms
2017-09-23 21:07:15,711 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=147699711&sign=aa0a5acb1daf0d82c788751b491a9010f98617ef9d82e01be38f3c4f2bb2ca78 (172.16.1.176) 1.60ms
2017-09-23 21:07:15,817 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=880268351&sign=399762ea7f78abc582c70a3b3f6b5f92b5edda8bb68dc2f942ae6785ade4b673 (172.16.1.176) 1.76ms
2017-09-23 21:07:15,923 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1889772843&sign=31879975c68c32139ba9abf48d476c2a9c0f345d81ec0cfce20ca06f4c8cb4af (172.16.1.176) 2.19ms
2017-09-23 21:07:16,029 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=686078705&sign=c873ab43d3d273b7468e001beb4b33d7c3668c1b559d62e21a6db6922ced8824 (172.16.1.176) 2.29ms
2017-09-23 21:07:16,132 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=2105754108&sign=5f5adc958abc6982d9a780ab64320a0234de21ccba04dd078dc593bcce7292c1 (172.16.1.176) 1.67ms
2017-09-23 21:07:16,251 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=182546393&sign=a0f5d88a23cf6825213e1145a9138ad5e870c44da165be1c8d85b34a5c67d55b (172.16.1.176) 1.32ms
2017-09-23 21:07:16,360 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1949118330&sign=bdfe29f18fcbeb1109dbae21d166385ff06d4910f9a41f7737a5d28ad846ebc2 (172.16.1.176) 1.79ms
2017-09-23 21:07:16,464 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=220137366&sign=594d2a4527480d467f75671fc9de35aaf96f6e469c66b4ed1a71faeb5b5d532b (172.16.1.176) 2.11ms
2017-09-23 21:07:16,583 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1979932169&sign=4a57bec12b2119d1572fc26f7367954b26322f3a0e31dee24e36ddaa5d5e8326 (172.16.1.176) 2.96ms
2017-09-23 21:07:16,689 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1089957932&sign=536987ed23ccee0cbee268af43ccb5dbc3cfade4ab053ec103cbe2106bb2f42a (172.16.1.176) 0.93ms
2017-09-23 21:07:16,792 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1873226917&sign=1fdb3572b3435c2cf19e8016d4062a5930880d2aaa85dc100c7a74700c1a87b5 (172.16.1.176) 0.67ms
2017-09-23 21:07:16,904 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=715669847&sign=35d0dcd3fc28b9c6b87ba91e92d493b4f02cd7165124bf4071209b8788ed2302 (172.16.1.176) 2.10ms
2017-09-23 21:07:17,025 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1486937972&sign=a796aed00549388f5f371c2e54bfb414c1e5be696e433bd0b1343424db5f5ed4 (172.16.1.176) 3.06ms
2017-09-23 21:07:17,129 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1196032868&sign=087d124b0b3ead5e42d353178f4a0f9e64c9c686b545300f69e5172428a31a87 (172.16.1.176) 0.76ms
.2017-09-23 21:07:17,233 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=777206980&sign=21eb05c1e3c36bd6b6818c146132a2d830d1af932293dbf97e0321a48b382e25 (172.16.1.176) 1.04ms
2017-09-23 21:07:17,336 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=68706223&sign=e984d742d3b4ff7d71db90687e70e9f671bd063768f3eba9e6aec97d5560a62c (172.16.1.176) 0.65ms
2017-09-23 21:07:17,440 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1843638549&sign=5f6e9c28f7d48fc5ff80d15f58e17374ba74ce89e2d406933e622bf36124efe1 (172.16.1.176) 1.65ms
2017-09-23 21:07:17,551 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=212567592&sign=6c5e4e5a0bb6d99cd2cfa4ecfeef2d304bb5689093567d2118136fc5665d960e (172.16.1.176) 0.77ms
2017-09-23 21:07:17,655 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1883488164&sign=265592d7405e8023a4787b22c53ecbb0cf230497487bfbf0f0f93d2a486d4a99 (172.16.1.176) 0.68ms
2017-09-23 21:07:17,762 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=964776169&sign=0ac5c16f9395621b19d9eba87b4c3b5cfa1b0965938d766452b7039b93242a2a (172.16.1.176) 2.41ms
2017-09-23 21:07:17,866 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=928126551&sign=4a0f62a0dc46a87516f2b8ffcbea762b6634ad415da121cd2af92de1b8124333 (172.16.1.176) 2.11ms
2017-09-23 21:07:17,970 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1301950427&sign=259abe59dc57c3628f729614bfb73a9ddb4369cf62b503d8d5b710c89c2896e2 (172.16.1.176) 1.83ms
2017-09-23 21:07:18,077 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1992516190&sign=dae0d1b57718c8e2ea052cef3039da32d053e0e0a53ac5c2e17819d298a0a052 (172.16.1.176) 0.68ms
2017-09-23 21:07:18,196 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1426542624&sign=ab7c6cf2a6d7eccbe009922a697746d85f8d2f22ddc594553c3a388ed4bbd73a (172.16.1.176) 0.78ms
2017-09-23 21:07:18,320 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=849040635&sign=b02fc95cb158a7e1a46cb268365f1962abd445b75c8fe38b0ba767b9c092ca4f (172.16.1.176) 0.93ms
2017-09-23 21:07:18,430 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=941604920&sign=9fa950f6edb28050cc64a5e80203841dcf088c883f4ea4e31989c22bc5f61a0c (172.16.1.176) 2.83ms
2017-09-23 21:07:18,537 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1400427944&sign=3dad8d6e39c9776900d33befff231d1eb6e085280c0068e38cdd3fb5947b0841 (172.16.1.176) 2.02ms
2017-09-23 21:07:18,643 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1994719310&sign=36bc868231fd19fdd6d0f453361b51a01fd5c2d5389e59f409082a98efa7f19e (172.16.1.176) 0.62ms
2017-09-23 21:07:18,756 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=2038269862&sign=759c8445d27591f17435c071cd70da52e0dbbca789260c556c470aad918ec181 (172.16.1.176) 0.74ms
2017-09-23 21:07:18,867 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=659998484&sign=ed1607f2eed36e796b231a99abb5ce88c3d1945776c438adc01e70ccad16454e (172.16.1.176) 0.65ms
2017-09-23 21:07:18,976 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1280937363&sign=a423cc4c97b2d04dd6b620c796cc59b79cfa38a37e8ca8a07c324184b8bea282 (172.16.1.176) 1.12ms
2017-09-23 21:07:19,080 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1681643301&sign=c9526806c74c89f0c7dfda03d31641c7aedeced10d0ec3d89e600736e76185be (172.16.1.176) 2.31ms
2017-09-23 21:07:19,188 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=725914710&sign=b24bbf522bbc66b5f676f1fab6521b35651679da70282314dbee20c62d70df95 (172.16.1.176) 3.52ms
.2017-09-23 21:07:19,292 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1729267236&sign=6265e86b12e7ab1c79fabfde76e588c38521140ee0dd97026aebd2a396894734 (172.16.1.176) 1.10ms
2017-09-23 21:07:19,395 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=2023351876&sign=e4cc55e00d9f23484e71892c7eae70ded96ef1f6a64180fe2e2d9ae2faebf707 (172.16.1.176) 0.77ms
2017-09-23 21:07:19,503 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=142750431&sign=7217767461fd6f37d8eadd50bd36e9b6ecac028c2f69d7421e352c8ff9db0ef1 (172.16.1.176) 1.98ms
2017-09-23 21:07:19,609 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1840579929&sign=3b9ca1884b01e844a413db7664ff992d159b821f79ee314abb45b1e22bff7767 (172.16.1.176) 1.15ms
2017-09-23 21:07:19,712 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=2098560397&sign=c2fee932ab825ac430bd01ad0de6274ae50b3879b4b668754da3f7061fbb3e51 (172.16.1.176) 0.62ms
2017-09-23 21:07:19,820 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1910500675&sign=60f5dec9768dada9c3405fd25e7b44690fb4bc5a0792cadb79f69a1cedd318dc (172.16.1.176) 1.32ms
2017-09-23 21:07:19,940 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1170970491&sign=6ac039eafefdda140dad3c41398f37ac828618df3e47d1c8bc5691e53c9a7ad6 (172.16.1.176) 0.69ms
2017-09-23 21:07:20,045 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1856224190&sign=47f749f90721eb130b9345b9d9fb28aefe4e2a2d595d0e7ca1a9a909d56c88a2 (172.16.1.176) 0.91ms
2017-09-23 21:07:20,149 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=983059344&sign=62305223ce02d7c298464dee35c8d925e0bf1f1a4c1b5cb75cc0a61c76a1a24d (172.16.1.176) 1.94ms
2017-09-23 21:07:20,257 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1718458134&sign=716b1e9ebe6f33a3718e35a426f02ce3ef696de0cac67d53dcf9ed7c6d1401e7 (172.16.1.176) 3.36ms
2017-09-23 21:07:20,371 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1876268425&sign=963c785afbf97e76e262c42c0e3d5d3c40339e69a1ddf772d9fa1f17e9816e77 (172.16.1.176) 2.24ms
2017-09-23 21:07:20,478 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1764841629&sign=d97b5ef496033097b8f2693a861c4428706561d3bd443a8e1ab77c9f18845bdf (172.16.1.176) 1.84ms
2017-09-23 21:07:20,584 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=398844030&sign=b5f4b10daccfadf7365cfa7601324dbbd4e214fd71216f57689156b92b3fd70e (172.16.1.176) 1.64ms
2017-09-23 21:07:20,687 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=185252727&sign=dfbf915da7a7d430fa9b9f3d75bdbfe5c17094a9940a0b2f6707cdcc3d86364d (172.16.1.176) 0.62ms
2017-09-23 21:07:20,791 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1370429126&sign=6fb5f7e47e74fa7a30b1458182a7b4bcac7c692eae9150343481e6d7952d428f (172.16.1.176) 1.53ms
2017-09-23 21:07:20,895 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=502141743&sign=ca8aca9292e7ac0282dc855e67416696b45636326f340a86a04d1c79f8598f39 (172.16.1.176) 1.12ms
2017-09-23 21:07:20,999 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=993687334&sign=93f78c5a69bf30849d20139369186a3e99982076666d6f9ba424b5885be68334 (172.16.1.176) 0.64ms
2017-09-23 21:07:21,109 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=15934104&sign=a3d99394af8a017421cf478b0b91ec6fe326727628204cee8fd6f7b0f8900e73 (172.16.1.176) 0.93ms
2017-09-23 21:07:21,219 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1363674760&sign=a91059d75934946e70be224e7663c80f193ac3947890762c17800263958bea2e (172.16.1.176) 2.12ms
.2017-09-23 21:07:21,324 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=904629749&sign=9e05a311ff541081121580b7cbb14ecc04ffd8c564919aa24442ef2db849a522 (172.16.1.176) 1.84ms
2017-09-23 21:07:21,430 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=2047965620&sign=13fca496432b6bd7366ffa2691ef317a402792a1d6f6c4af3f0abf5a8ce5cc15 (172.16.1.176) 2.43ms
2017-09-23 21:07:21,532 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=451230256&sign=44109c689592e914e0f8bc78649f8ba4fbefb4c7dc4e2671d693f09efdcbea64 (172.16.1.176) 0.73ms
2017-09-23 21:07:21,636 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=2084670932&sign=f65e4243278af174aba354c6e26fc29dd90bc3f3f669549181a5835609dbcc24 (172.16.1.176) 0.62ms
2017-09-23 21:07:21,742 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=561035572&sign=f3980b14c2e8f646c46f3439b4467f4af30017920749c4ac8960d9ad6d3e7685 (172.16.1.176) 2.21ms
2017-09-23 21:07:21,847 (INFO) 206 GET /ota/image_user2-0x81000.bin?deviceid=1000109276&ts=1840531613&sign=66738ef420611776bf46b8fad27e8a59215fde35f913adeff5e4721714828c8e (172.16.1.176) 0.96ms
.......

*** IMPORTANT! ***
** AFTER the first download is COMPLETE, with in a minute or so you should connect to the new SSID "FinalStage" to finish the process.
** ONLY disconnect when the new "FinalStage" SSID is visible as an available WiFi network.
This server should automatically be allocated the IP address: 192.168.4.2.
If you have successfully connected to "FinalStage" and this is not the IP Address you were allocated, please ensure no other device has connected, and reboot your Sonoff.
..........

*** IMPORTANT! ***
** AFTER the first download is COMPLETE, with in a minute or so you should connect to the new SSID "FinalStage" to finish the process.
** ONLY disconnect when the new "FinalStage" SSID is visible as an available WiFi network.
This server should automatically be allocated the IP address: 192.168.4.2.
If you have successfully connected to "FinalStage" and this is not the IP Address you were allocated, please ensure no other device has connected, and reboot your Sonoff.
..........

*** IMPORTANT! ***
** AFTER the first download is COMPLETE, with in a minute or so you should connect to the new SSID "FinalStage" to finish the process.
** ONLY disconnect when the new "FinalStage" SSID is visible as an available WiFi network.
This server should automatically be allocated the IP address: 192.168.4.2.
If you have successfully connected to "FinalStage" and this is not the IP Address you were allocated, please ensure no other device has connected, and reboot your Sonoff.
.


The "FinalStage" SSID will disappear when the device has been fully flashed and image_arduino.bin has been installed
Once "FinalStage" has gone away, you can stop this program
2017-09-23 21:08:36,864 (INFO) 200 GET /ota/image_arduino.bin (192.168.4.1) 20274.93ms



The "FinalStage" SSID will disappear when the device has been fully flashed and image_arduino.bin has been installed
Once "FinalStage" has gone away, you can stop this program
^C2017-09-23 21:09:15,021 (INFO) Quitting.

I connected to the FinalStage SSID, and it eventually disappeared. I can see on the router that the bulb has an arp entry with hostname ESP_xxxx, but it does not respond to ping. The router shows that it is still asking for a DHCP lease

Sep 23 22:36:33 | dhcpd |   | DHCPDISCOVER from 60:01:94:8b:xx:xx via lan
Sep 23 22:36:34 | dhcpd |   | DHCPOFFER on 172.16.1.176 to 60:01:94:8b:xx:xx (ESP_xxxx) via lan

Is there any way to revive this?

rajil · 2017-09-24T04:16:27Z

I did not realise that B1 had changed into an AP, and was broadcasting the Sonoff SSID. I was able to connect to it and update to the latest Tasmotta. B1 can be flashed by SonOTA!

sillyfrog · 2017-09-24T04:32:51Z

Thanks @rajil - I was just going to suggest that when you replied :)
I have put that on the wiki as well with a note about DNS spoofing. Was your DNS server on the same host as your DHCP and gateway? I had some weird issues when I was first messing with it, but all my Sonoff's are now flashed so I can't test again. Using `--no-prov' is of course the best thing to do rather than commenting lines out (that will simplify things for you @ageorgios) - I have put a now in the help to clarify this.

@ageorgios If we can get the DNS spoofing working like we want, this shows it should work :)

Cheers.

rajil · 2017-09-24T04:34:00Z

Yes, both DHCP and gateway are on a pfsense router.

ageorgios · 2017-09-24T08:20:27Z

I installed a new DNS server (dnsmasq) on raspberry pi to make sure the DNS resolves ok.
I run
sudo ./sonota.py --legacy --no-prov
on an ubuntu VM with IP 192.168.178.54 (ethernet)
and the B1 is on 192.168.178.63 (wifi connected from ewilink app)
but same happens!!

Select IP address of the WiFi interface:
    0: 192.168.178.54
Select IP address [0]: 0
WiFi SSID: MYWIFISSID
WiFi Password: MYWIFIPASSWORD

Using the following configuration:
	Server IP Address: 192.168.178.54
	WiFi SSID: MYWIFISSID
	WiFi Password: MYWIFIPASSWORD
Starting stage2...
~~ Starting web server (HTTP port: 8080, HTTPS port 443)
~~ Waiting for device to connect


*** IMPORTANT! ***
** AFTER the first download is COMPLETE, with in a minute or so you should connect to the new SSID "FinalStage" to finish the process.
** ONLY disconnect when the new "FinalStage" SSID is visible as an available WiFi network.
This server should automatically be allocated the IP address: 192.168.4.2.
If you have successfully connected to "FinalStage" and this is not the IP Address you were allocated, please ensure no other device has connected, and reboot your Sonoff.
..........

What do I do wrong?

rajil · 2017-09-24T14:38:06Z

@sillyfrog, I can also confirm that BN-SZ01 works. The instructions are the same as B1. Start pairing with eWeLink and then computer takes over,

2017-09-24 09:27:26,751 (DEBUG) << {
    "userAgent": "device",
    "apikey": "xx-yy",
    "deviceid": "1000119cc5",
    "action": "register",
    "version": 2,
    "romVersion": "1.6.2",
    "model": "PSF-B01-GL",
    "ts": 744
}

sillyfrog · 2017-09-26T05:55:03Z

@ageorgios, my only suggestion is to use the Pi as your DHCP server and gateway as well as @rajil did. I had something similar (from memory, so not 100% sure), were that was the only way I could inspect the traffic. I ended up setting up a spare WiFi AP I had just so I could get inline to mess with the traffic when doing the initial reverse engineering (before finding this project).

sillyfrog · 2017-09-26T05:55:21Z

@rajil Thanks for the update, I have put that on the Wiki as well!

jptrsn · 2017-11-09T18:33:18Z

I'm not able to get this to work with my Sonoff B1. I'm spoofing eu-disp.coolkit.cc to my machine on 192.168.2.100, and using wireshark, I can see the sonoff hitting it with a request, but the sonota.py output never logs anything received, and I never see FinalStage as an available wireless network.

I also tried spoofing all calls to *.coolkit.cc to the machine running sonota, and logged the output. Attached is the text output, and the pcapng file is at this link.

sonoff_b1.txt

sillyfrog · 2017-11-13T06:31:27Z

@jptrsn Can you include your debug_######.log file as well? Looking at the traffic dump something appears to be dropping the link, so please also ensure all firewalls are turned off.

oglodyte · 2017-11-15T04:30:45Z

Worked well for me to flash B1. Couple of things:

if in US need to spoof us-disp.coolkit.cc. (I simply added "address=/us-disp.coolkit.cc/192.168.X.X" to my tomato router DNS server config
had to run "sudo ./sonota.py --legacy --no-prov --serving-host 192.168.X.X" - it wanted that serving-host param
Hope this helps someone.

dony71 · 2017-12-03T06:44:36Z

I have openwrt chaos calmer router and sonoff basic, trying to flash from host 158.168.1.53
Anybody can tell me what I should do to spoof DNS on this router?
I add below in /etc/config/dhcp, but sonoff not advertised ssid @'finalstage'
What am I missing?

config domain
option name 'us-disp.coolkit.cc'
option ip '158.168.1.53'

oglodyte · 2017-12-03T07:30:10Z

@dony71 - I use tomato not openwrt, but I'd guess you just need to add
address=/us-disp.coolkit.cc/192.168.1.53
to /etc/dnsmasq.conf

dony71 · 2017-12-03T08:12:57Z

@oglodyte your suggestion is working. thanks

czyz · 2017-12-06T19:23:48Z

I managed to flash the Sonoff B1 using the instructions provided above. DNS spoofed by adding the line mentioned by 'oglodyte' above (plus a few more general ones like coolkit.cc and coolkit.cn to be sure) to dnsmasq.conf in my Almond Plus, and then running the command stated by ageorgios.

Then afterward I compiled the latest development branch of sonoff-Tasmota (5.10.0a) which supports configuring the module as a Sonoff B1. I uploaded the minimal firmware to the bulb, then after that loaded I uploaded the full firmware. It's now working!

ahzazou · 2017-12-20T11:56:22Z

so if you comment out stage1() on line 624 in sonota.py can you attach modified sonata.py as i am not able to understand what should i do clearly

sillyfrog · 2017-12-21T02:45:00Z

@ahzazou In the current release, you can do the same thing by running it with --no-prov this will skip the stage1 step.

bennnnnnnn · 2018-01-05T15:36:56Z

Hi guys,

I'm unable to flash mine. I've followed the steps by @oglodyte, to no avail.

I've done a packet capture, it seems the B1 is doing a DNS lookup and retrieves the spoofed response, but still connects to a (hardcoded?) IP address: 52.28.157.61.

Packet capture in attach: Sonoff B1: 10.9.8.70, DNS/GW: 10.9.8.254, Laptop running SonOTA: 10.9.8.4
packetcapture.zip
Firmware of the B1 is 2.0.3

Does anyone have any ideas?

Thanks!
Ben

JacoFourie · 2018-01-05T17:29:49Z

Just want to say a big thank you to all who worked on this. I just flashed 4 units. 2 X T1 Gang 2 units and 2 X T1 Gang 3 units. I saw that the version of firmware on the units according to the app was 2.0.1.
I flashed all 4 without any problems. Thanks a lot. You saved ma a lot of soldering and effort.

oglodyte · 2018-01-07T06:08:12Z

@bennnnnnnn I may be having similar problem trying to flash RF Bridge. Looks like it is trying to connect to my spoofed server few times, but it does not result in firmware update. Then it connects to AWS server IP (also w/out DNS query) and works with WEeLink app.

Sonoff RF Bridge firmware is 1.1.0 (latest today). Attached log and packet capture. RF Bridge 192.168.5.150. SonOTA server 192.168.5.3
log&pcap.zip

also out of ideas, but hope @sillyfrog can see something there.

laDanz · 2018-01-10T17:58:56Z

same issue here as @bennnnnnnn.

Maybe it checks the server certificate?

I notice, that on my spoofed server there is just a "Client Hello" and a "Server Hello, Certificate, Server Hello Done" as response over TLSv1.2 (three times).
While on the real IP there is also a "Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message" (from B1) and a "Change Cipher Spec, Encrypted Handshake Message" as response from server.
So maybe the client (B1) is rejecting the server certificate?

Update:
When running sonota on a linux machine from source i get the following error messages while SSL certificate exchange:

SSL Error on 14 ('192.168.178.1', 54580): [SSL: SSLV3_ALERT_CERTIFICATE_UNKNOWN] sslv3 alert certificate unknown (_ssl.c:600)

tyjtyj · 2018-01-15T07:05:38Z

@oglodyte, can you try generate self sign certificate from here
http://www.selfsignedcertificate.com/ with server name "eu-disp.coolkit.cc" and replace the crt/key in SSL folder ?

laDanz · 2018-01-15T18:48:03Z

@tyjtyj i tried locally with new self signed certificate(from your mentioned site), seems it didn't made a difference...

tyjtyj · 2018-01-16T00:15:12Z

Thx @laDanz, I hate the fact that the ssl error shown above means there is a cert install on the client device(the sonoff) which will match with the server.

I can only think of spoofing the ip address 52.28.157.61 itself which might not worry as it client cert still dont match the server cert but worth a try

laDanz · 2018-01-16T19:24:17Z

@tyjtyj spoofing the ip wasn't working for me either: still not a successful SSL handshake:

tyjtyj · 2018-01-29T23:19:48Z

Hi,

As you can see the sonoff send fin, ack means asking to close the connection.

Seems it found the server cert does not match the one it has.

I tried to clone all i can from the cert hoping something works

Can you try cert below

this is the cert/crt.

This is the key

sillyfrog · 2018-01-30T04:39:02Z

Based on the last few posts, it sounds like #58 unfortunately... :(

halaszj · 2018-08-08T18:41:00Z

Any update on this, like, I am on a mac, I have a router that I was going to use with DDWRT, and I have the ATT router which is useless, so that is the reason for the DDWRT. Is there any step by step on how to spoof in this configuration? I went into my MAC settings and set the dns to the DDWRT, and was able to ping us-disp.coolkit.cc and eu just in case, no problem, on the DDWRT i used dnsmasq and did address=/us-disp.coolkit.cc/192.168.1.XXX
address=/eu-disp.coolkit.cc/192.168.1.XXX
from there, I did a telnet session, made sure the dnsmasq.conf and even updated the hosts file to point everything to my mac.

I this command

sudo ./sonota.py --legacy --wifi-ssid mywifi --wifi-password mypassword --serving-host 192.168.1.XXX

I never see the ITEAD ssid pop up, nothing, so, I guess I am at step 1. Can anyone lend a hand here, I really dont want to solder a header on all this bulbs

TomDII · 2018-10-04T00:30:18Z

Hey all, I have a B1-v2 with 2.0.3 on it in the US. I have been hitting a wall with this since last night...

My pi-hole is masking...

C:\Windows\system32>ping us-disp.coolkit.cc
Pinging us-disp.coolkit.cc [192.168.1.47] with 32 byt
Reply from 192.168.1.47: bytes=32 time=252ms TTL=128

"sonota.exe --legacy --no-prov" just does the ..... then the message and .... over and over.

I removed my bulb from the app and re-added it with doing the on-off-on-off-on with 2 sec pause between and it just adds it to the app and starts working from the itead cloud.

Looking for blue skies (No clouds) without solder being I want to get a few more of these if it works out.

Thanks in Advance,
Tom

tonycwhite · 2018-11-19T11:34:03Z

does anyone have any update on this issue, Like a chump, i spent the day learning to spoof / masq, then eventually when it didnt work, i scrolled down to find security cert issues. :-/ If anyone has a way ahead, it would be appreciated, as i have a b1 with a lifted pad, stopping me soldering.

federom · 2019-01-19T20:16:35Z

I have the same issue as Tom, The bulb is in pairing mode, i ran the command, but nothing happens

cnxsoft mentioned this issue Oct 2, 2017

Sonoff B1 AP mode? arendst/Tasmota#951

Closed

czyz mentioned this issue Dec 6, 2017

Open/flash Sonoff B1 Light Bulb arendst/Tasmota#676

Closed

oglodyte mentioned this issue Jan 15, 2018

Compatible with Sonoff RF Bridge #67

Closed

ageorgios closed this as completed Mar 14, 2018

Sonoff that does not advertise ITEAD- WiFi #20

Sonoff that does not advertise ITEAD- WiFi #20

Comments

ageorgios commented Sep 15, 2017

sillyfrog commented Sep 21, 2017

ageorgios commented Sep 21, 2017 • edited Loading

sillyfrog commented Sep 21, 2017 • edited Loading

ageorgios commented Sep 22, 2017 • edited Loading

rajil commented Sep 24, 2017 • edited Loading

rajil commented Sep 24, 2017 • edited Loading

sillyfrog commented Sep 24, 2017

rajil commented Sep 24, 2017

ageorgios commented Sep 24, 2017 • edited Loading

rajil commented Sep 24, 2017 • edited Loading

sillyfrog commented Sep 26, 2017

sillyfrog commented Sep 26, 2017

jptrsn commented Nov 9, 2017

sillyfrog commented Nov 13, 2017

oglodyte commented Nov 15, 2017

dony71 commented Dec 3, 2017 • edited Loading

oglodyte commented Dec 3, 2017

dony71 commented Dec 3, 2017

czyz commented Dec 6, 2017

ahzazou commented Dec 20, 2017

sillyfrog commented Dec 21, 2017

bennnnnnnn commented Jan 5, 2018

JacoFourie commented Jan 5, 2018

oglodyte commented Jan 7, 2018

laDanz commented Jan 10, 2018 • edited Loading

tyjtyj commented Jan 15, 2018

laDanz commented Jan 15, 2018

tyjtyj commented Jan 16, 2018

laDanz commented Jan 16, 2018

tyjtyj commented Jan 29, 2018 • edited Loading

sillyfrog commented Jan 30, 2018

halaszj commented Aug 8, 2018

TomDII commented Oct 4, 2018

tonycwhite commented Nov 19, 2018

federom commented Jan 19, 2019

ageorgios commented Sep 21, 2017 •

edited

Loading

sillyfrog commented Sep 21, 2017 •

edited

Loading

ageorgios commented Sep 22, 2017 •

edited

Loading

rajil commented Sep 24, 2017 •

edited

Loading

rajil commented Sep 24, 2017 •

edited

Loading

ageorgios commented Sep 24, 2017 •

edited

Loading

rajil commented Sep 24, 2017 •

edited

Loading

dony71 commented Dec 3, 2017 •

edited

Loading

laDanz commented Jan 10, 2018 •

edited

Loading

tyjtyj commented Jan 29, 2018 •

edited

Loading