Gabor Somogyi

August 29, 2019·5 min read

Sonoff S20 (ESP8266) wireless smart switch flash memory upgrade

Warning

Absolutely no warranty that the things here will work and I discourage to follow these steps since high voltage and extremely hot soldering machines are involved. Use it on your own risk!

Background

So first of all some info why this post created. When I’m not writing software then I like playing with hardware. I’ve created several projects in the home automation area and now wanted to extend my system. Namely I wanted to turn cameras on/off in my home while I’m away in a secure way.

Yeah, security is quite important to me. There are several devices on the market which connect to a server but don’t know where exactly and do some kind of authentication. Personally I don’t trust them. I’ve reversed a couple of such products and found quite interesting things. Not mentioning all the problems but it’s quite common issue that the authentication key is somehow hardcoded on the device (if it authenticates at all). In the worst case I’ve found the same key on all devices 😉

So to achieve this I’ve decided to buy a smart socket which:

After some exploration I’ve found the Sonoff S20 smart plug:

Sonoff S20

There are several forums/posts where such tutorials are partially described but all of them miss the debugging part (what if it’s not working). Since I’ve faced several issues I thought it worth to make this post which contains:

Hardware

After opening the cover one sees 4 holes on the PCB. Headers have to be installed for programming. See the pinout on the picture.

Sonoff S20 pinout

The original flash (XTX PN25F08B 1725XDG) is only 1MB which is not enough to compile Sonoff-Tasmota with Webserver + SSL + MQTT (over the air upgrade also fails). So this had to be changed with a bigger one. I’ve chosen WINBOND W25Q32FVSIG 1416 which is a 4MB flash.

Original vs new chip

Here came the first problem during desoldering. I thought I’m doing this hobby for really long time and am advanced enough to skip bringing up the hot air gun (I was damn lazy) and able to desolder it with a normal hot iron. The main problem was that I’ve applied a little bit more force than needed and the result can be seen here 😒

Wrong desolder result

It can be definitely done with a hot iron but needs some patience (I’ve ordered only 2 switches so brought up the air gun because didn’t want to make further risk) 😆 The WINBOND chip is bigger in physical size so the legs have to be adjusted a bit. The changed board looks like this:

Changed chip

The soldering is a bit ugly but it will do 😄

Software

So now we need the Sonoff-Tasmota firmware which can be burned into the hardware. The source code can be found here: https://github.com/arendst/Sonoff-Tasmota/

There are 2 ways to get the binary:

Since MQTT and SSL is not a pre-compiled feature the source code has to be compiled.

So I’ve checked out the code and used the latest development branch to compile. I was standing at commit SHA f5646d6bbe88d2ea59118ab786901dbcace39aad. Before compiling the code, a couple of modifications in sonoff/my_user_config.h have to be made. Namely the following 2 compile flags have to be enabled:

When the file is modified, nothing else is left but to compile the project. To do that PlatformIO has to be installed:

e:\projects\Sonoff-Tasmota> "pio --version"
PlatformIO, version 3.5.4

e:\projects\Sonoff-Tasmota> "pio run -e sonoff"
...

At the end of compilation the following file must be created:

e:\projects\Sonoff-Tasmota\.pioenvs\sonoff> "dir firmware.bin"
 Volume in drive E is Storage
 Volume Serial Number is XXXX-XXXX

 Directory of e:\projects\Sonoff-Tasmota\.pioenvs\sonoff

2019-08-29  21:22 PM           603,440 firmware.bin
               1 File(s)        603,440 bytes
               0 Dir(s)  XXX bytes free

Flash

There are multiple ways to flash it:

I’ve chosen the first one because I think the arduino stuff is complicated (roughly the same cabling but installing all the tools is hell). In order to connect to the board one needs a 3.3V USB to TTL Serial Adapter. I’ve bought an FT232RL (€2.14):

FT232RL adapter

And here is the cabling:

Cabling

Please notice that the FT232RL board supports 3.3V and 5V as well and now 3.3V must be chosen (the jumper next to the output pins). After it’s connected esptool has to be cloned and used.

First of all one needs to check that the upgrade was successful and the flash memory is responding:

e:\projects\esptool> "esptool.py --port COM3 flash_id"
...

Here I’ve faced several problems:

  1. The flash reading was timing out — The board circuit was broken because I’ve used a hot iron with more power than needed (see the picture above).
  2. With a new board the flash reading was timing out — I’ve desoldered the chip, used a logic analyzer and it turned out the chip was dead initially (it’s cheap stuff and a couple of pieces are initially dead).
  3. Until now I didn’t mention the esptool version, and for good reason. The latest 2.7 version provided constant timeout when trying to read the dead/badly soldered chips. This makes sense because the chip was dead or not connected. At that stage I’ve downgraded to 2.4.1 which connected but read ID 0xFF back. This was the breakthrough. Googling the problem, somebody had written that ID 0xFF means the chip is not responding (I’d done so many things that I didn’t know whether I’d killed the whole board or not). So this is not really a problem — it just led me in the right direction. After the soldering was fixed and the chip was functioning, both versions are able to communicate properly.

Finally the board can be flashed properly (the button on the Sonoff must be pressed while the serial adapter is plugged in — this puts the board into flash mode):

e:\projects\esptool> "esptool.py --port COM3 write_flash -fs 4MB -fm dout 0x0 firmware.bin"
...