This is another one of those quick “I wish that was easier to find when I was googling it” posts.
For a project, I needed a small relay module to switch a few mains loads.
I chose this generic looking relay module from AliExpress because it was powered by an ESP32 and featured ethernet connectivity.
AliExpress is full of generic looking relay modules but this one is branded dingtian-tech
The device came with an obvious programming header right next to the ESP32 so I thought it would be a 5 minute job to flash Tasmota and probe the GPIOs.
This post is a super condensed version of my notes that I’m posting in the off chance that they’re useful for somebody else.
ESP32 Secure Boot
No matter what I did to flash the ESP32 module, it would always boot loop with output like this:
rst:0x1 (POWERON_RESET),boot:0x7 (DOWNLOAD_BOOT(UART0/UART1/SDIO_REI_REO_V2))␍␊
waiting for download␍␊
<0xff>ets Jun 8 2016 00:22:57␍␊
I knew that I didn’t brick anything because the ESP would boot right up as soon as i re-flashed the original dump.
Because at least a decent chunk of the flash dump I took was in plain text, I didn’t thing that there was any flash protection in place but sure enough, at least some of the protection features have been enabled:
It was late and I was tired so I didn’t bother with trying to reverse engineer the flash dump or trying to figure out if there was a way to disable the protections.
Nothing was going to compete with 10 minute to heat-soak and remove the ESP module so I just did that.
And a better look at some of the PCB traces to the ethernet PHY:
With a “fresh” ESP module installed, figuring out th GPIO assignments wasn’t particularly difficult.
Normally at 3.3V. Pull to ground to trigger.
Same as Input 1.
This is the FACTORY button. Same as Input 1.
This is the second little red LED next to the FACTORY button. Inverted.
esp32:# See: https://docs.platformio.org/en/latest/boards/espressif32/esp32dev.htmlboard:esp32dev# Above the "FACTORY" button there are two LEDs. One is wired in series with the switch and the other is controllable via GPIO. Use the second one as a status indicator.status_led:pin:number:GPIO32inverted:trueethernet:type:JL1101mdc_pin:GPIO23mdio_pin:GPIO18phy_addr:0clk_mode:GPIO17_OUT# The PHY chip has a pin labeled TX_EN that goes to GPIO 21 on ESP# and the RSTn pin on the phy goes to GPIO0### Datasheet indicates the RSTn should be LOW to disable the phy and default is highpower_pin:GPIO0binary_sensor:# The "factory reset" button- platform:gpioname:"User Button"pin:number:GPIO34inverted:true# The two sets of contacts for manual trigger# input is pulled up to 3.3V by default.- name:"User Input 1"platform:gpiopin:number:GPIO36inverted:true- name:"User Input 2"platform:gpiopin:number:GPIO39inverted:trueswitch:- name:"Relay 1"platform:gpiopin:GPIO2- name:"Relay 2"platform:gpiopin:GPIO16