3 ms·
Interesting timing, I have spent the last week with Claude reverse engineering the on-air protocol and I'm getting pretty close to building a secondary "listene
by Ductapemaster 2mo ago
Interesting timing, I have spent the last week with Claude reverse engineering the on-air protocol and I'm getting pretty close to building a secondary "listener" receiver that will collect measurements from my bridge + sensor pair locally.
To Flume's credit, it required me to dump the firmware from the bridge device's ESP8266 in order to extract my key. I didn't consider an approach like this article took, given I have direct access to the HW and there's no flash protection on the 8266.
- elmoret 2mo agoIf you document this somewhere I'd love to read about it! I took the approach of sniffing the packets between the radio and mcu on the bridge board, got most of the way into reverse engineering that, then helped build this instead: https://github.com/tronikos/esphome-magnetometer-water-gas-meter https://github.com/tronikos/esphome-magnetometer-water-gas-m... But I always wanted to finish pulling flume data to home assistant, without the cloud.
- Ductapemaster 2mo agoI am planning a write up once I get it working. I'd be happy to share. My setup is a logic analyzer tap on the SPI bus between 8266 and the RFM69 on the bridge device to log raw traffic, and my secondary RX (ESP32 + RFM69) for over-the-air traffic. Also, I have a gas meter sensor based on your work half-built on my workbench. I plan to set that up once I finish my Flume distraction. Great work, thank you!
- elmoret 2mo ago> My setup is a logic analyzer tap on the SPI bus between 8266 and the RFM69 on the bridge device I'd done exactly the same, though my efforts were pre-Claude. If you want my logs/data, username at gmail.
- mrloopex 2mo agoHow did you get the epoxy off the ESP? I use a mill but I only have a 30% success rate.
- Ductapemaster 2mo agoNo need — I simply plugged into the exposed programming header on the gateway. The sensor has an Atmel SAMD part which I assume has the security bit set. I didn't need to dump that firmware directly as it exists within the gateway flash.
- mrloopex 2mo agoThe gateway had an open debug port?!?!
- Ductapemaster 2mo agoThe 8266 has no flash readout protection, and the UART is exposed on a programming header. It was very easy to dump the firmware.