https://github.com/misterblack1/HU-058_ESPHome

fork with NTC, LDR and buzzer

https://github.com/mrceedjay/HU-058_ESPHome-NTC-LDR-Buzzer

Latest code from 2026

• Iceman Fork - Proxmark3 https://github.com/RfidResearchGroup/proxmark3

dpavlin@nuc:/nuc/proxmark3$ cp Makefile.platform.sample Makefile.platform
# Uncomment the lines below in order to make a 256KB image
# and comment out the lines above

PLATFORM=PM3GENERIC
PLATFORM_SIZE=256
STANDALONE=
SKIP_LF=1
SKIP_HITAG=1
SKIP_EM4x50=1
SKIP_EM4x70=1
SKIP_ZX8211=1
SKIP_HF=1
SKIP_ISO15693=1
SKIP_LEGICRF=1
SKIP_ISO14443b=1
SKIP_ISO14443a=1
SKIP_ICLASS=1
SKIP_FELICA=1
SKIP_NFCBARCODE=1
SKIP_HFSNIFF=1
SKIP_HFPLOT=1

dpavlin@nuc:/nuc/proxmark3$ make

dpavlin@nuc:/nuc/proxmark3$ ./pm3
[=] Waiting for Proxmark3 to appear...

Cheap(er) China Proxmark

• http://www.xfpga.com/e_products/?big_id=17&small_id=7
• http://www.proxmark.org/forum/viewtopic.php?id=863

Mifare sniff/crack

http://code.google.com/p/crapto1/

http://www.youtube.com/watch?v=kTvb7tjbSTI
http://www.fuzzysecurity.com/tutorials/rfid/3.html

Proxmark firmware comparison on emulated Mifare 4k

Usage

proxmark3> hw version
#db# Prox/RFID mark3 RFID instrument                 
#db# bootrom: svn 816 2013-10-11 22:09:42                 
#db# os: svn 816 2013-10-11 22:09:43                 
#db# FPGA image built on 2012/ 1/ 6 at 15:27:56                 
uC: AT91SAM7S256 Rev B          
Embedded Processor: ARM7TDMI          
Nonvolatile Program Memory Size: 256K bytes          
Second Nonvolatile Program Memory Size: None          
Internal SRAM Size: 64K bytes          
Architecture Identifier: AT91SAM7Sxx Series          
Nonvolatile Program Memory Type: Embedded Flash Memory          

proxmark3> hw tune
#db# Measuring antenna characteristics, please wait...                 
#db# Measuring complete, sending report back to host                 
          
# LF antenna:  0.00 V @   125.00 kHz          
# LF antenna:  0.00 V @   134.00 kHz          
# LF optimal:  0.00 V @ 12000.00 kHz          
# HF antenna:  7.28 V @    13.56 MHz          
# Your LF antenna is unusable.          

proxmark3> hf 14a read
ATQA : 02 00          
 UID : ?? ?? ?? ??
 SAK : 38 [1]          
TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K          
 ATS : 0d 78 f7 b1 02 4a 43 4f 50 76 32 34 31 27 cc           
       -  TL : length is 13 bytes          
       -  T0 : TA1 is present, TB1 is present, TC1 is present, FSCI is 8          
       - TA1 : different divisors are NOT supported, DR: [2, 4, 8], DS: [2, 4, 8]          
       - TB1 : SFGI = 0, FWI = 8          
       - TC1 : NAD is NOT supported, CID is supported          
       -  HB : 4a 43 4f 50 76 32 34 31           

brute force 26-bit proxcard

• https://github.com/brad-anton/proxbrute

firmware version

According to http://wiki.radiowar.org/Proxmark3%E5%9B%BA%E4%BB%B6%E5%88%97%E8%A1%A8
firmwares newer than 617 have problems.

Google translated version

Please do not upgrade your firmware to the CDC Proxmark3 version r617 ~ r830 driver's! We found that because the problem will lead to Proxmark3 code appears unable to identify high-frequency card, and 816 will appear after Nested number of keys for 000000000000.

flashing update

dpavlin@blue:/blue-zfs/FPGA/proxmark/proxmark3$ make flash-all

Compile new version of firmware

All instructions below this are for old version of software see http://www.proxmark.org/forum/viewtopic.php?id=1668

http://code.google.com/p/proxmark3/wiki/Compiling je strgan http://www.proxmark.org/forum/post/3244/#p3244

sudo apt-get install build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config

dpavlin@t61p:/tank/proxmark3$ svn co http://proxmark3.googlecode.com/svn/trunk proxmark3

Boot loader

dpavlin@t61p:/tank/proxmark3/proxmark3$ ./client/flasher -b ./bootrom/obj/bootrom.elf 
Loading ELF file './bootrom/obj/bootrom.elf'...
Loading usable ELF segments:
0: V 0x00100000 P 0x00100000 (0x00000200->0x00000200) [R X] @0x94
1: V 0x00200000 P 0x00100200 (0x000017a8->0x000017a8) [R X] @0x294

Waiting for Proxmark to appear on USB...
Connected units:
        1. SN: ? [004/013]
 Found.
Entering bootloader...
(Press and release the button only to abort)
Waiting for Proxmark to reappear on USB....
Connected units:
        1. SN: ? [004/014]
 Found.

Flashing...
Writing segments for file: ./bootrom/obj/bootrom.elf
 0x00100000..0x001001ff [0x200 / 2 blocks].. OK
 0x00100200..0x001019a7 [0x17a8 / 24 blocks]........................ OK

Resetting hardware...
All done.

Have a nice day!

dpavlin@t61p:/tank/proxmark3/proxmark3$ ./client/flasher ./armsrc/obj/fullimage.elf 
Loading ELF file './armsrc/obj/fullimage.elf'...
Loading usable ELF segments:
0: V 0x00102000 P 0x00102000 (0x0000a4bc->0x0000a4bc) [R  ] @0xb4
1: V 0x00110000 P 0x00110000 (0x0000ba8c->0x0000ba8c) [R X] @0xa570
2: V 0x00200000 P 0x0011ba8c (0x00000004->0x00000004) [RW ] @0x15ffc
Note: Extending previous segment from 0xba8c to 0xba90 bytes

Waiting for Proxmark to appear on USB...
Connected units:
        1. SN: ? [004/015]
 Found.
Entering bootloader...
(Press and release the button only to abort)
Waiting for Proxmark to reappear on USB....
Connected units:
        1. SN: ChangeMe [004/016]
 Found.

Flashing...
Writing segments for file: ./armsrc/obj/fullimage.elf
 0x00102000..0x0010c4bb [0xa4bc / 165 blocks]..................................................................................................................................................................... OK
 0x00110000..0x0011ba8f [0xba90 / 187 blocks]........................................................................................................................................................................................... OK

Resetting hardware...
All done.

Have a nice day!

https://www.aliexpress.com/item/1005001308030569.html

from readme

Power-on:
        Voltage: 5V-12V can be used, (no Y3 crystal oscillator version must be 12V. Without Y3 crystal oscillator, it uses the 25M clock output by fpga)
        All three 20pin ports can be powered, pins 1 and 2 are power, 3 and 4 are GND, and the power position of the 3 ports is the same.
        The J4 position (the same as the 12V interface of the computer motherboard) can also be powered, but the D24 on the back of the board should be short-circuited. This is a diode. The default is not soldered.

start up:
        The default is nand startup, there is a linux system in nand, but there is no root password, so it can't be played, so it can only be changed to SD startup or JTAG emulation.
        Start the SD card, solder the sd card socket, remove the R2584 resistor on the back of the board, and solder to the R2577 position,
       Put the boot.bin of the image folder in the root directory of the SD card, and the SD card should be formatted as fat32 (maximum support for 32G cards).

Routine:
        Network, sd, buttons, leds are all in one project, and the routine is vivado2017.4 version
        The network is an echo server, the ip is automatically obtained, and when it is obtained, it will be printed on the serial port. The port is 7, what to send back to.
        Press the button once, the red light status is reversed. The green light flashes once for 1s.
        SD card, only one read and write test. Write 1M data to the card when power on.

If you have any questions, you can add q416159303.

Mir development board information,
https://pan.baidu.com/s/1PxlRdjQRTDXS30GbeJ9q3Q Extraction code: 2c01

vivado2017.4 software download
https://pan.baidu.com/s/1Q5ctriRVHzfFuHqHUw7P2g Extraction code: bd42

links

https://github.com/Elrori/EBAZ4205

https://gitee.com/actionchen/ebaz4205_hw/blob/master/Doc/ebaz4205_introduce.md

https://github.com/blkf2016/ebaz4205

https://github.com/tomorrow56/EBAZ4205_tutorial

boot mode

https://hhuysqt.github.io/zynq1/

The R2577 and R2584 resistors of this board are used to configure the starting device. Solder R2584 to R2577 and change the original nand boot to SD card boot.

JTAG start

https://github.com/Leungfung/ebaz4205_hw/blob/master/Doc/ebaz4205_introduce.md

Connect the end of resistor R2578 close to NAND to ground

English version: https://github.com/xjtuecho/EBAZ4205

buildroot: https://github.com/blkf2016/ebaz4205

Amlogic Quad-core A55
RAM: 4GB
ROM: 64GB
WIFI: 2.4/5Ghz
2A@5V DC

F3X S905X3

internal photos:

https://fccid.io/2AVBM-A95XF3AIR/Internal-Photos/Internal-photos-4583382.pdf

armbian

https://www.armbian.com/amlogic-s9xx-tv-box/

boot from sd card doesn't work, button is hidden inside phone connector, and is very stiff.

scdard

dpavlin@nuc:~$ sudo fdisk -l /dev/mmcblk0
Disk /dev/mmcblk0: 14.88 GiB, 15978201088 bytes, 31207424 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x2a327079

Device         Boot   Start     End Sectors  Size Id Type
/dev/mmcblk0p1         8192 1056767 1048576  512M ea Linux extended boot
/dev/mmcblk0p2      1056768 4218879 3162112  1.5G 83 Linux


dpavlin@nuc:~$ sudo mount /dev/mmcblk0p1 /tmp/a95x-boot/
[Tue Sep  2 19:53:40 2025] mmc0: cannot verify signal voltage switch
dpavlin@nuc:~$ cd /tmp/a95x-boot/
dpavlin@nuc:/tmp/a95x-boot$ [Tue Sep  2 19:53:50 2025] mmc0: cannot verify signal voltage switch

dpavlin@nuc:/tmp/a95x-boot$ ls
[Tue Sep  2 19:53:54 2025] mmc0: cannot verify signal voltage switch
aml_autoscript                  dtb              initrd.img-6.12.43-current-meson64  u-boot-s905x2-s922     uInitrd
boot.bmp                        emmc_autoscript  s905_autoscript                     u-boot-s905x3
build-u-boot                    extlinux         System.map-6.12.43-current-meson64  u-boot-s905x3-ugoosx3
config-6.12.43-current-meson64  Image            u-boot-s905                         u-boot-s905x-s912

root@nuc:/tmp/a95x-boot/extlinux# ls -al ../dtb/amlogic/*x3*
-rwxr-xr-x 1 root root 40278 Aug 22 05:10 ../dtb/amlogic/meson-gxl-s905w-tx3-mini.dtb
-rwxr-xr-x 1 root root 77285 Aug 22 05:10 ../dtb/amlogic/meson-sm1-ugoos-x3.dtb

root@nuc:/tmp/a95x-boot/extlinux# vi extlinux.conf

root@nuc:/tmp/a95x-boot# cp  u-boot-s905x3-ugoosx3 u-boot.ext

dead

device draws only 70mA from 5.2V 2A power supply (verified using DPS5005).

https://photos.google.com/photo/AF1QipMGlbI49ukEsx0OgqaPwIROT3cjvUe-7qfEOt3-

LED display

this device has interesting DVD-like LED display with HT1628 DVD driver chip and some transistors (maybe level shifters since chip is 5V ?)

https://photos.google.com/photo/AF1QipOfJtafYiOvS0QW2uX-rFwruJ3wCz7pZtsZ6qNq

LED strip

https://photos.google.com/photo/AF1QipMqXN8R4eBN2uQCzwUvn2ZtoBKnsJgQAE1ctr9J

it has three wire led strip of 15 leds (ws2812 meybe?) with three wires and SOIC8 chip on it.

serial

4 pins on bottom of board

1. GND (pin marked with square on board)
2. TX
3. RX
4. 3V3 (?)

serial output:

SM1:BL:511f6b:81ca2f;FEAT:B2F839B2:202B2060;POC:F;RCY:0;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:20000;USB:8;
LOOP:1;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:20000;USB:8;
LOOP:2;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:20000;USB:8;
LOOP:3;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:20000;USB:8;
LOOP:4;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:20000;USB:8;
LOOP:5;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:20000;USB:8;
LOOP:6;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:20000;USB:8;

with sd card inserted

SM1:BL:511f6b:81ca2f;FEAT:B2F839B2:202B2060;POC:F;RCY:0;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:0;SD:0;READ:0;CHK:1F;USB:8;
LOOP:1;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:0;SD:0;READ:0;CHK:1F;USB:8;
LOOP:2;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:0;SD:0;READ:0;CHK:1F;USB:8;
LOOP:3;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:0;SD:0;READ:0;CHK:1F;USB:8;
LOOP:4;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:0;SD:0;READ:0;CHK:1F;USB:8;
SM1:BL:511f6b:81ca2f;FEAT:B2F839B2:202B2060;POC:F;RCY:0;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:0;SD:0;READ:0;CHK:1F;USB:8;
SM1:BL:511f6b:81ca2f;FEAT:B2F839B2:202B2060;POC:F;RCY:0;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:0;SD:0;READ:0;CHK:1F;USB:8;

u-boot

https://github.com/hexdump0815/u-boot-misc/blob/master/readme.gxy

usb boot

https://github.com/superna9999/pyamlboot/tree/master

soc bypass

https://fredericb.info/2016/10/amlogic-s905-soc-bypassing-not-so.html

android image unpack in search for bootloader

dpavlin@nuc:/nuc/amlogic/utils$ git remote -v
origin	https://github.com/khadas/utils.git (fetch)
origin	https://github.com/khadas/utils.git (push)


dpavlin@nuc:/nuc/amlogic/utils$ ./aml_image_v2_packer -d ~/Downloads/a95x/A95X_F3_AIR_20191024senk.img A95X_F3_AIR_20191024senk
[Msg]Image package version 0x2
[Msg]Unpack item [USB         ,              DDR] to (A95X_F3_AIR_20191024senk/DDR.USB) size:1330032 bytes
[Msg]Unpack item [USB         ,          DDR_ENC] to (A95X_F3_AIR_20191024senk/DDR_ENC.USB) size:65536 bytes
[Msg]Backup item [USB         ,            UBOOT] backItemId[0][USB, DDR]
[Msg]Unpack item [USB         ,        UBOOT_ENC] to (A95X_F3_AIR_20191024senk/UBOOT_ENC.USB) size:1330176 bytes
[Msg]Unpack item [PARTITION   ,         _aml_dtb] to (A95X_F3_AIR_20191024senk/_aml_dtb.PARTITION) size:79872 bytes
[Msg]Unpack item [UBOOT       ,     aml_sdc_burn] to (A95X_F3_AIR_20191024senk/aml_sdc_burn.UBOOT) size:1330544 bytes
[Msg]Unpack item [UBOOT.ENC   ,     aml_sdc_burn] to (A95X_F3_AIR_20191024senk/aml_sdc_burn.UBOOT.ENC) size:1330688 bytes
[Msg]Unpack item [ini         ,     aml_sdc_burn] to (A95X_F3_AIR_20191024senk/aml_sdc_burn.ini) size:602 bytes
[Msg]Unpack item [PARTITION   ,             boot] to (A95X_F3_AIR_20191024senk/boot.PARTITION) size:9620480 bytes
[Msg]Unpack item [PARTITION   ,       bootloader] to (A95X_F3_AIR_20191024senk/bootloader.PARTITION) size:1330176 bytes
[Msg]Unpack item [PARTITION   ,             dtbo] to (A95X_F3_AIR_20191024senk/dtbo.PARTITION) size:438 bytes
[Msg]Unpack item [PARTITION   ,             logo] to (A95X_F3_AIR_20191024senk/logo.PARTITION) size:1020176 bytes
[Msg]Unpack item [dtb         ,           meson1] to (A95X_F3_AIR_20191024senk/meson1.dtb) size:78383 bytes
[Msg]Backup item [dtb         ,       meson1_ENC] backItemId[4][PARTITION, _aml_dtb]
[Msg]Unpack item [PARTITION   ,              odm] to (A95X_F3_AIR_20191024senk/odm.PARTITION) size:536652 bytes
[Msg]Unpack item [conf        ,         platform] to (A95X_F3_AIR_20191024senk/platform.conf) size:155 bytes
[Msg]Unpack item [PARTITION   ,          product] to (A95X_F3_AIR_20191024senk/product.PARTITION) size:14745676 bytes
[Msg]Unpack item [PARTITION   ,         recovery] to (A95X_F3_AIR_20191024senk/recovery.PARTITION) size:16307200 bytes
[Msg]Unpack item [PARTITION   ,           system] to (A95X_F3_AIR_20191024senk/system.PARTITION) size:1377898716 bytes
[Msg]Unpack item [PARTITION   ,           vbmeta] to (A95X_F3_AIR_20191024senk/vbmeta.PARTITION) size:4096 bytes
[Msg]Unpack item [PARTITION   ,           vendor] to (A95X_F3_AIR_20191024senk/vendor.PARTITION) size:204157052 bytes
[Msg]Write config file "A95X_F3_AIR_20191024senk/image.cfg" OK!
Image unpack OK!

let's write bootloader to sdcard

root@nuc:/nuc/amlogic/utils/A95X_F3_AIR_20191024senk# ~dpavlin/dd.sh aml_sdc_burn.UBOOT.ENC /dev/mmcblk0
+ dd iflag=fullblock oflag=direct conv=fsync status=progress bs=1M if=aml_sdc_burn.UBOOT.ENC of=/dev/mmcblk0
1+1 records in
1+1 records out
1330688 bytes (1.3 MB, 1.3 MiB) copied, 0.491506 s, 2.7 MB/s

power up, 230-300 mA power draw, leds are cyan with blue vertical strip, passing from right to left, and LCD screen has boot on it.

Problem

After first install with official Android app it broke account so hard, that web login to xiaomi just reloaded page in loop, and fan dissipated from Android app.

wifi reset

power + m button for 7 seconds.

token

I created local xiaomi account, which is useful, since you need password for this tool to work.

https://github.com/PiotrMachowski/Xiaomi-cloud-tokens-extractor

dpavlin@nuc:/nuc/Xiaomi-cloud-tokens-extractor$ git remote -v
origin	https://github.com/PiotrMachowski/Xiaomi-cloud-tokens-extractor (fetch)
origin	https://github.com/PiotrMachowski/Xiaomi-cloud-tokens-extractor (push)

dpavlin@nuc:/nuc/Xiaomi-cloud-tokens-extractor$ . venv/bin/activate

(venv) dpavlin@nuc:/nuc/Xiaomi-cloud-tokens-extractor$ python token_extractor.py


   ---------
   NAME:     Xiaomi Smart Tower Fan 2
   ID:       897218688
   MAC:      AC:8C:46:C9:2C:B4
   IP:       192.168.3.120
   TOKEN:    REDACTED
   MODEL:    xiaomi.fan.p45
   ---------

code

https://github.com/rytilahti/python-miio/issues/1544 - doesn't seem to login into xiaomi cloud for me

home assistant

https://github.com/syssi/xiaomi_fan/issues/282 - doesn't support my model

2025-07-29 09:23:06.378 ERROR (MainThread) [custom_components.xiaomi_miio_fan.fan] Unsupported device found! Please create an issue at https://github.com/syssi/xiaomi_fan/issues and provide the following data: xiaomi.fan.p45

https://github.com/XiaoMi/ha_xiaomi_home - doesn't work for me

Finally, Xiaomi Miot Auto works.

https://github.com/syssi/xiaomi_fan/issues/214

https://github.com/al-one/hass-xiaomi-miot

no need to patch local home assistant installation.

teardown video

https://www.youtube.com/watch?v=8GoeoD_eyvk

BalCCon 2k24 badge

https://www.youtube.com/watch?v=4waDha2DxK8

https://ch405-labs.com/mc-0o00/

https://gitlab.com/ch405labs/badgelife/mcd-0o00/mcd-0o00-hardware-design

CH32V003

https://github.com/cnlohr/ch32v003fun

esp32s2 programmer

https://github.com/cnlohr/esp32s2-cookbook/tree/master/ch32v003programmer

flash programmer to esp32s2

dpavlin@nuc:/nuc/Balccon2k24/esp32s2-cookbook/ch32v003programmer$ /nuc/esp8266/esptool/esptool.py --port /dev/ttyUSB2 -b 460800 write_flash --flash_mode dio --flash_freq 80m --flash_size 4MB 0x1000 build/bootloader/bootloader.bin 0x10000 build/usb_sandbox.bin 0x8000 build/partition_table/partition-table.bin
esptool.py v4.7-dev
Serial port /dev/ttyUSB2
Connecting.....
Detecting chip type... Unsupported detection protocol, switching and trying again...
Detecting chip type... ESP32-S2
Chip is ESP32-S2 (revision v0.0)
Features: WiFi, No Embedded Flash, No Embedded PSRAM, ADC and temperature sensor calibration in BLK2 of efuse V1
Crystal is 40MHz
MAC: 7c:df:a1:02:81:de
Uploading stub...
Running stub...
Stub running...
Changing baud rate to 460800
Changed.
Configuring flash size...
Flash will be erased from 0x00001000 to 0x00004fff...
Flash will be erased from 0x00010000 to 0x00041fff...
Flash will be erased from 0x00008000 to 0x00008fff...
Compressed 13376 bytes to 9327...
Wrote 13376 bytes (9327 compressed) at 0x00001000 in 0.4 seconds (effective 244.8 kbit/s)...
Hash of data verified.
Compressed 201568 bytes to 111748...
Wrote 201568 bytes (111748 compressed) at 0x00010000 in 2.6 seconds (effective 614.4 kbit/s)...
Hash of data verified.
Compressed 3072 bytes to 119...
Wrote 3072 bytes (119 compressed) at 0x00008000 in 0.1 seconds (effective 391.6 kbit/s)...
Hash of data verified.

Leaving...
Hard resetting via RTS pin...

Connect SWIO (Pin D1) on CH32V003 to GPIO6 on the ESP32S2.

    Optionally use 10k pull-up on SWIO.
    Optional Clock Synthesizer is on GPIO2 "Multi2" / "M0"
    VCC Output on GPIO11/12 on ESP32S2.

hmm... doesn't seem to work for me

dpavlin@nuc:/nuc/Balccon2k24/ch32v003fun/minichlink$ ./minichlink -3i
Found ESP32S2-Style Programmer
Interface Setup
Error: Failed to get chip details

that's because I didn't turn on switch on badge!

dpavlin@nuc:/nuc/Balccon2k24/ch32v003fun/minichlink$ ./minichlink -i
[Fri Feb 21 14:38:00 2025] usb 3-3.3.4.4: input irq status -75 received
[Fri Feb 21 14:38:00 2025] usb 3-3.3.4.4: input irq status -75 received
[Fri Feb 21 14:38:00 2025] usb 3-3.3.4.4: input irq status -75 received
Found ESP32S2-Style Programmer
[Fri Feb 21 14:38:00 2025] usb 3-3.3.4.4: input irq status -75 received
Interface Setup
USER/RDPR  : e817/5aa5
DATA1/DATA0: ff00/ff00
WRPR1/WRPR0: 00ff/00ff
WRPR3/WRPR2: 00ff/00ff
[Fri Feb 21 14:38:00 2025] usb 3-3.3.4.4: input irq status -75 received
Flash Size: 16 kB
R32_ESIG_UNIID1: 4f29abcd
R32_ESIG_UNIID2: b7cabcd4
R32_ESIG_UNIID3: ffffffff

flash

dpavlin@nuc:/nuc/Balccon2k24$ ./minichlink -w functest.bin 0 -b

ardulink

https://gitlab.com/BlueSyncLine/arduino-ch32v003-swio

Various infrared links collected here

Ir Send

Updated for HVAC Mitsubishi & Panasonic IR

• https://github.com/r45635/HVAC-IR-Control

Tasmota IR

Configure module

Generic

D4 GPIO2 - AM2301

D6 GPIO12 - IN - IRrecv

D7 GPIO13 - Switch1 - reed relay to gnd

D5 GPIO14 - OUT - IRsend

Configure WIFI

AP1 SSID, AP1 password
hostname - ir

Configure MQTT

Host: rpi2

Topic: ir

Configure Logging

Telemetry period: 10

Configure Other

Device Name: IR

Friendly Name 1: IR

Console

SerialLog 3 - turn serial log output https://tasmota.github.io/docs/Commands/

reed sensor

switch 2 gpio 13

https://tasmota.github.io/docs/Buttons-and-Switches/#switchmode-15

expose gpio 13 in homeassistant as lodja_vrata sensor, remove connection with relay

SwitchText2 lodja_vrata
Setoption114 1
SwitchMode2 15

ESP IR TR

https://templates.blakadder.com/ESP_IR_TR.html

{"NAME":"Tasmota IR-Gateway","GPIO":[0,0,0,0,1056,0,0,0,0,0,1088,0,0,0],"FLAG":0,"BASE":18}

GPIO04 IRsend
GPIO14 IRrecv

AM2301 + IR

module pinout

(it's on GPIO13, ignore picture name which is wrong)

addition AM2301 on GPIO13 - requires custom tasmota ir build with USE_DHT enabled for IR_FIRMWARE build

(venv) dpavlin@nuc:/nuc/esp8266/Tasmota$ git diff
diff --git a/tasmota/include/tasmota_configurations.h b/tasmota/include/tasmota_configurations.h
index 1260892a0..c64d1ac1e 100644
--- a/tasmota/include/tasmota_configurations.h
+++ b/tasmota/include/tasmota_configurations.h
@@ -503,7 +503,8 @@
 #undef USE_PROJECTOR_CTRL                        // Disable support for LCD/DLP Projector serial control interface
 #undef USE_LOX_O2                                // Disable support for LuminOx LOX O2 Sensor

-#undef USE_DHT                                   // Disable support for DHT11, AM2301 (DHT21, DHT22, AM2302, AM2321) and SI7021 Temperature and Humidity sensor
+// XXX FIXME dpavlin -- keep DHT11
+//#undef USE_DHT                                   // Disable support for DHT11, AM2301 (DHT21, DHT22, AM2302, AM2321) and SI7021 Temperature and Humidity sensor
 #undef USE_MAX31855                              // Disable MAX31855 K-Type thermocouple sensor using softSPI
 #undef USE_MAX31865                              // Disable support for MAX31865 RTD sensors using softSPI
 #undef USE_TM1638                                // Disable support for TM1638 switches copying Switch1 .. Switch8

template:

{"NAME":"Tasmota IR-Gateway","GPIO":[0,0,0,0,1056,0,0,0,0,0,1088,1216,0,0],"FLAG":0,"BASE":18}

https://milkv.io/docs/duo/overview

Duo S

https://milkv.io/docs/duo/getting-started/duos

[Thu Jan 23 16:32:35 2025] usb 3-3.3.4.4: new high-speed USB device number 28 using xhci_hcd
[Thu Jan 23 16:32:36 2025] usb 3-3.3.4.4: device descriptor read/64, error -71
[Thu Jan 23 16:32:36 2025] usb 3-3.3.4.4: New USB device found, idVendor=3346, idProduct=1009, bcdDevice= 5.10
[Thu Jan 23 16:32:36 2025] usb 3-3.3.4.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[Thu Jan 23 16:32:36 2025] usb 3-3.3.4.4: Product: RNDIS
[Thu Jan 23 16:32:36 2025] usb 3-3.3.4.4: Manufacturer: Cvitek
[Thu Jan 23 16:32:36 2025] usb 3-3.3.4.4: SerialNumber: 0123456789
[Thu Jan 23 16:32:36 2025] rndis_host 3-3.3.4.4:1.0 eth0: register 'rndis_host' at usb-0000:00:14.0-3.3.4.4, RNDIS device, 7a:f4:9f:e4:50:82
[Thu Jan 23 16:32:36 2025] usbcore: registered new interface driver rndis_host
[Thu Jan 23 16:32:36 2025] rndis_host 3-3.3.4.4:1.0 enx7af49fe45082: renamed from eth0

dpavlin@nuc:/nuc/milkv-duo$ sudo dhclient enx7af49fe45082

dpavlin@nuc:/nuc/milkv-duo$ /sbin/ifconfig enx7af49fe45082
enx7af49fe45082: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.42.94  netmask 255.255.255.0  broadcast 192.168.42.255
        inet6 fe80::78f4:9fff:fee4:5082  prefixlen 64  scopeid 0x20<link>
        ether 7a:f4:9f:e4:50:82  txqueuelen 1000  (Ethernet)
        RX packets 7  bytes 816 (816.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 31  bytes 6008 (5.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

dpavlin@nuc:/nuc/milkv-duo$ ssh root@192.168.42.1.
The authenticity of host '192.168.42.1. (192.168.42.1)' can't be established.
ED25519 key fingerprint is SHA256:sfqq5/VjPb++J6gD4Q8/JxUn6u2geewQcqPwIjJHiF4.
This host key is known by the following other names/addresses:
    ~/.ssh/known_hosts:809: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.42.1.' (ED25519) to the list of known hosts.
root@192.168.42.1.'s password: ### milkv
[root@milkv-duo]~#

[root@milkv-duo]~# cat /proc/cpuinfo
processor	: 0
hart		: 0
isa		: rv64imafdvcsu
mmu		: sv39

[root@milkv-duo]~# uname -a
Linux milkv-duo 5.10.4-tag- #1 PREEMPT Thu Jun 6 14:28:13 CEST 2024 riscv64 GNU/Linux
[root@milkv-duo]~# free
              total        used        free      shared  buff/cache   available
Mem:         330960       22516      296692         148       11752      300580
Swap:             0           0           0

buildroot

dpavlin@nuc:/nuc/milkv-duo/duo-buildroot-sdk$ ./build.sh milkv-duos-sd

...

 create partition mounting points and move sytems to read-write partitions
  [TARGET] br-rootfs-pack
make -C /nuc/milkv-duo/duo-buildroot-sdk/buildroot-2021.05 milkv-duos-sd_musl_riscv64_defconfig BR2_TOOLCHAIN_EXTERNAL_PATH=/nuc/milkv-duo/duo-buildroot-sdk/host-tools/gcc/riscv64-linux-musl-x86_64
make[1]: Entering directory '/nuc/milkv-duo/duo-buildroot-sdk/buildroot-2021.05'
  GEN     /nuc/milkv-duo/duo-buildroot-sdk/buildroot-2021.05/output/milkv-duos-sd_musl_riscv64/Makefile
#
# configuration written to /nuc/milkv-duo/duo-buildroot-sdk/buildroot-2021.05/output/milkv-duos-sd_musl_riscv64/.config
#
make[1]: Leaving directory '/nuc/milkv-duo/duo-buildroot-sdk/buildroot-2021.05'
/nuc/milkv-duo/duo-buildroot-sdk/buildroot-2021.05/utils/brmake -j16 -C /nuc/milkv-duo/duo-buildroot-sdk/buildroot-2021.05
2025-01-24T13:36:30 >>> host-util-linux 2.36.2 Building
Done in 10s  (error code: 2)
make: *** [Makefile:597: br-rootfs-pack] Error 2
Error: Build board milkv-duos-sd failed!
dpavlin@nuc:/nuc/milkv-duo/duo-buildroot-sdk$

huh, Debian sid build doesn't work. Build with docker and Ubuntu 22.04 works.

docker run --privileged -itd --name duodocker -v $(pwd):/home/work milkvtech/milkv-duo:latest /bin/bash

docker exec -it duodocker /bin/bash -c "cd /home/work && cat /etc/issue && ./build.sh milkv-duos-musl-riscv64-sd"

Duo 256M

debian

https://community.milkv.io/t/debian-images-for-duo256-duos/1715

https://github.com/Fishwaldo/sophgo-sg200x-debian

persisatnt cdc ncm mac address

[root@milkv-duos]~# grep -C 2 c0:ff /etc/run_usb.sh
  if [ "$CLASS" = "ncm" ] ; then
    # FIXME dpavlin
    echo c0:ff:e0:00:00:44 >$CVI_GADGET/functions/$CLASS.usb$FUNC_NUM/host_addr
    ln -s $CVI_FUNC/ncm.usb$FUNC_NUM $CVI_GADGET/configs/c.1
  fi

• isb rom mode

dpavlin@nuc:/nuc/milkv-duo/duo-buildroot-sdk-v2/build$ ./tools/cv181x/usb_dl/rom_usb_dl/cv181x_rom_usb_download.py
fip_path: /nuc/milkv-duo/duo-buildroot-sdk-v2/build/fip.bin
CV181X USB download start
Connecting to ROM

camera

raspberry pi camera

It does not work as well as gc2083

[root@milkv-duo]/mnt/data# uname -a
Linux milkv-duo 5.10.4-tag- #1 SMP PREEMPT Mon Dec 9 10:20:52 CST 2024 aarch64 GNU/Linux
[root@milkv-duo]/mnt/data# ls -al
total 28
drwxr-xr-x 2 root root 4096 Dec  6  2024 .
drwxr-xr-x 6 root root 4096 Dec  6  2024 ..
lrwxrwxrwx 1 root root   21 Dec  6  2024 sensor_cfg.ini -> sensor_cfg_GC2083.ini
-rw-r--r-- 1 root root  262 Dec  6  2024 sensor_cfg_GC2083.ini
-rw-r--r-- 1 root root  259 Dec  6  2024 sensor_cfg_OV5647_J1.ini
-rw-r--r-- 1 root root  259 Dec  6  2024 sensor_cfg_OV5647_J2.ini
-rw-r--r-- 1 root root  263 Dec  6  2024 sensor_cfg_SC035HGS.ini
-rw-r--r-- 1 root root  259 Dec  6  2024 sensor_cfg_SC200AI.ini


root@milkv-duo]~# i2cdetect -y 1
Warning: Can't use SMBus Quick Write command, will skip some addresses
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:
10:
20:
30: -- -- -- -- -- -- -- --
40:
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60:
70:
[root@milkv-duo]~# i2cdetect -y 2
Warning: Can't use SMBus Quick Write command, will skip some addresses
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:
10:
20:
30: -- -- -- -- -- -- 36 --
40:
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60:
70:
[root@milkv-duo]~# cd /mnt/data/
[root@milkv-duo]/mnt/data# ls
sensor_cfg.ini         sensor_cfg_OV5647_J1.ini  sensor_cfg_SC035HGS.ini
sensor_cfg_GC2083.ini  sensor_cfg_OV5647_J2.ini  sensor_cfg_SC200AI.ini
[root@milkv-duo]/mnt/data# grep 36 *
sensor_cfg_OV5647_J1.ini:sns_i2c_addr = 36
sensor_cfg_OV5647_J2.ini:sns_i2c_addr = 36

# this is error prodced on v2 sdk which doesn't work

[root@milkv-duo]/mnt/system/usr/bin# ./sample_sensor_test
[sys_vi_init]-59: MMF Version:7d0dea0a1-64bit
[SAMPLE_COMM_SNS_ParseIni]-2168: Parse /mnt/data/sensor_cfg.ini
[parse_source_devnum]-1761: devNum =  1
[parse_sensor_name]-1842: sensor =  OV_OV5647_MIPI_2M_30FPS_10BIT
[parse_sensor_busid]-1871: bus_id =  3
[parse_sensor_i2caddr]-1882: sns_i2c_addr =  36
[parse_sensor_mipidev]-1893: mipi_dev =  0
[parse_sensor_laneid]-1904: Lane_id =  2, 0, 1, -1, -1
[parse_sensor_pnswap]-1915: pn_swap =  0, 0, 0,  0,  0
[sys_vi_init]-70: Parse complete
[sys_vi_init]-129: set VBpool [0] 1920:1080, BlkCnt= 3, Size = 3133440
family ID request : receive error
ISP Vipipe(0) Allocate pa(0x962f1000) va(0x0x7f9bba3000) size(284104)
stSnsrMode.u16Width 1920 stSnsrMode.u16Height 1080 30.000000 wdrMode 0 pstSnsObj 0x5dcd00
[SAMPLE_COMM_VI_StartMIPI]-494: sensor 0 stDevAttr.devno 0
[sys_vi_init]-163: vi init failed. s32Ret: 0xffffffff !

[root@milkv-duo]/mnt/data# ln -sf sensor_cfg_OV5647_J2.ini sensor_cfg.ini

# this is working output on v1 sdk

[root@milkv-duo]~# /mnt/system/usr/bin/sensor_test
[sys_vi_init]-41: MMF Version:7e0cc6a08-musl_riscv64
[SAMPLE_COMM_SNS_ParseIni]-1950: Parse /mnt/data/sensor_cfg.ini
[parse_source_devnum]-1605: devNum =  1
[parse_sensor_name]-1686: sensor =  OV_OV5647_MIPI_2M_30FPS_10BIT
[parse_sensor_busid]-1714: bus_id =  2
[parse_sensor_i2caddr]-1725: sns_i2c_addr =  36
[parse_sensor_mipidev]-1736: mipi_dev =  0
[parse_sensor_laneid]-1747: Lane_id =  5, 3, 4, -1, -1
[parse_sensor_pnswap]-1758: pn_swap =  0, 0, 0,  0,  0
[SAMPLE_PLAT_SYS_INIT]-72: common pool[0] BlkSize 3133440
ISP Vipipe(0) Allocate pa(0x97b1f000) va(0x0x3fda046000) size(291120)
stSnsrMode.u16Width 1920 stSnsrMode.u16Height 1080 30.000000 wdrMode 0 pstSnsObj 0xef898
[SAMPLE_COMM_VI_StartMIPI]-483: sensor 0 stDevAttr.devno 0
awbInit ver 6.8@2021500
0 R:1400 B:3100 CT:2850
1 R:1500 B:2500 CT:3900
2 R:2300 B:1600 CT:6500
Golden 1024 1024 1024
WB Quadratic:0
isWdr:0
19700101 02:29:34.620 2892 E isp setNoiseProfile:3460 Noise profile get fail. Please check
ViPipe:0,===OV5647 1080P 30fps 10bit LINE Init OK!
********************************************************************************
cvi_bin_isp message
gerritId:      36403          commitId:      c69c5863e
md5:           cab880835a2ad5184de5ed7762404b84
sensorNum      1
sensorName0    22087

PQBIN message
gerritId:      80171          commitId:      5c9d8fc5d
md5:           ba5a510e093ad42db6788e6c2d13169e
sensorNum      3
sensorName0    2053

author:        wanqiang.he    desc:          思博慧CV1812H_GC2083_RGB_mode_V1.0.0
createTime:    2023-08-04 16:48:08version:       V1.1
tool Version:       v3.0.5.24           mode:
********************************************************************************
sensorName(0) mismatch, mwSns:22087 != pqBinSns:2053
[SAMPLE_COMM_ISP_Thread]-95: ISP Dev 0 running!
0 R:1165 B:3087 CT:2688
1 R:1464 B:2327 CT:3937
2 R:1974 B:1613 CT:7225
Golden 1464 1024 2327
wdrLEOnly:1
[main]-578: ---Basic------------------------------------------------
[main]-579: 1: dump vi raw frame
[main]-580: 2: dump vi yuv frame
[main]-581: 3: set chn flip/mirror
[main]-582: 4: linear wdr switch
[main]-583: 5: AE debug
[main]-584: 6: sensor dump
[main]-585: 7: sensor proc
[main]-586: 255: exit
[main]-587: input your choice: 255
ISP Vipipe(0) Free pa(0x97b1f000) va(0x0x3fda046000)

[root@milkv-duo]~# camera-test.sh

This only works with original v1 version of sdk https://github.com/milkv-duo/duo-buildroot-sdk/releases

gc2083

[root@milkv-duos]~# i2cdetect -y 3
Warning: Can't use SMBus Quick Write command, will skip some addresses
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:
10:
20:
30: -- -- -- -- -- -- -- 37
40:
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60:
70:

[root@milkv-duos]~# ls -al /mnt/data/sensor_cfg.ini
lrwxrwxrwx 1 root root 21 Jan  1 00:01 /mnt/data/sensor_cfg.ini -> sensor_cfg_GC2083.ini

[root@milkv-duos]~# which camera-test.sh
/mnt/system/usr/bin/camera-test.sh

[root@milkv-duos]~# cat /mnt/system/usr/bin/camera-test.sh
#!/bin/sh

export LD_LIBRARY_PATH=/mnt/system/lib

sample_vi_fd /mnt/cvimodel/scrfd_768_432_int8_1x.cvimodel

run yolo model

[root@milkv-duos]~# ./sample_vi_od yolov3 yolov3.cvimodel

[SAMPLE_COMM_SNS_ParseIni]-1950: Parse /mnt/data/sensor_cfg.ini
[parse_source_devnum]-1605: devNum =  1
[parse_sensor_name]-1686: sensor =  GCORE_GC2083_MIPI_2M_30FPS_10BIT
[parse_sensor_busid]-1714: bus_id =  3
[parse_sensor_i2caddr]-1725: sns_i2c_addr =  37
[parse_sensor_mipidev]-1736: mipi_dev =  0
[parse_sensor_laneid]-1747: Lane_id =  2, 0, 1, -1, -1
[parse_sensor_pnswap]-1758: pn_swap =  0, 0, 0,  0,  0
MMF Version:7e0cc6a08-musl_riscv64
Create VBPool[0], size: (3110400 * 3) = 9331200 bytes
Create VBPool[1], size: (3110400 * 3) = 9331200 bytes
Create VBPool[2], size: (2359296 * 1) = 2359296 bytes
Total memory of VB pool: 21021696 bytes
Initialize SYS and VB
Initialize VI
ISP Vipipe(0) Allocate pa(0x9680e000) va(0x0x3fbd57e000) size(291120)
stSnsrMode.u16Width 1920 stSnsrMode.u16Height 1080 25.000000 wdrMode 0 pstSnsObj 0x3fbe3d0860
[SAMPLE_COMM_VI_StartMIPI]-483: sensor 0 stDevAttr.devno 0
awbInit ver 6.8@2021500
0 R:1400 B:3100 CT:2850
1 R:1500 B:2500 CT:3900
2 R:2300 B:1600 CT:6500
Golden 1024 1024 1024
WB Quadratic:0
isWdr:0
ViPipe:0,===GC2083 1080P 30fps 10bit LINE Init OK!===
********************************************************************************
cvi_bin_isp message
gerritId:      36403          commitId:      c69c5863e      
md5:           cab880835a2ad5184de5ed7762404b84
sensorNum      1              
sensorName0    2083           

PQBIN message
gerritId:      80171          commitId:      5c9d8fc5d      
md5:           ba5a510e093ad42db6788e6c2d13169e
sensorNum      3              
sensorName0    2053           

author:        wanqiang.he    desc:          思博慧CV1812H_GC2083_RGB_mode_V1.0.0
createTime:    2023-08-04 16:48:08version:       V1.1           
tool Version:       v3.0.5.24           mode:      
********************************************************************************
sensorName(0) mismatch, mwSns:2083 != pqBinSns:2053
[SAMPLE_COMM_ISP_Thread]-95: ISP Dev 0 running!
Initialize VPSS
---------VPSS[0]---------
Input size: (1920x1080)
Input format: (19)
VPSS physical device number: 1
Src Frame Rate: -1
Dst Frame Rate: -1
    --------CHN[0]-------
    Output size: (1920x1080)
    Depth: 1
    Do normalization: 0
        Src Frame Rate: -1
        Dst Frame Rate: -1
    ----------------------
    --------CHN[1]-------
    Output size: (1920x1080)
    Depth: 1
    Do normalization: 0
        Src Frame Rate: -1
        Dst Frame Rate: -1
    ----------------------
------------------------
Bind VI with VPSS Grp(0), Chn(0)
Attach VBPool(0) to VPSS Grp(0) Chn(0)
Attach VBPool(1) to VPSS Grp(0) Chn(1)
Initialize VENC
venc codec: h264
venc frame size: 1920x1080
Initialize RTSP
rtsp://169.254.72.208/h264
prio:0
version: 1.4.0
yolove416opt Build at 2024-12-03 01:10:02 For platform cv181x
Max SharedMem size:8306688
Enter TDL thread
Enter encoder thread
0 R:1165 B:3087 CT:2688
1 R:1464 B:2327 CT:3937
2 R:1974 B:1613 CT:7225
Golden 1464 1024 2327
wdrLEOnly:1
obj count: 0, take 473.42,width:1920 ms
obj count: 2, take 474.43,width:1920 ms
^Chandle signal, signo: 2
Exit encoder thread
Exit TDL thread
destroy middleware
ISP Vipipe(0) Free pa(0x9680e000) va(0x0x3fbd57e000)
stop VPSS (0)
[root@milkv-duos]~# 

tdl

https://milkv.io/docs/duo/application-development/tdl-sdk/tdl-sdk-introduction

OV5647 15 pin FPC

python

• https://github.com/waveform80/picamera

motion tracking

• https://github.com/YggdrasiI/RPIMotionDetection
• https://www.raspberrypi.org/forums/viewtopic.php?p=556717#p556717

https://zigbee.blakadder.com/index.html

rodret dimmer

To pair the device, reset the device by pressing the pair button exactly 4 times quickly. Then trigger the configuration of the zigbee-device by holding the pair button for 10 seconds.

traderi led

pair by turning it off and on 6 times in quick succession

https://www.youtube.com/watch?v=mJm9YpPrGzk

vallhorn pir

push the vallhorn device link button 4 times in max 5 sec

Stoftmoln light

urn off and on 1 second between 6 times I think or 5.