WB8P - LEDVANCE Smart+ WW/CW Classic A60 B27 Tunable White Light Bulb

I’ve attached the bin dump of one of these WB8P bulbs. ledvance_wwcw.bin.zip

Dumped with bk7231tools python bk7231tools.py read_flash -d /dev/tty.usbserial-0001 -s 0 -c 512 dump.bin

This is how it went:

Connected! Chip info: BK7231S_1.0.5
Flash read start address 0x0 is not greater than 0x10000 - adding 0x2000000 to bypass bootloader checks
Reading 4k page at 0X2000000 (0.00%)
Reading 4k page at 0X2001000 (0.20%)
Reading 4k page at 0X2002000 (0.39%)
...
Reading 4k page at 0X21FE000 (99.61%)
Reading 4k page at 0X21FF000 (99.80%)

I’ve also tried dissecting but it went like this:

~# python bk7231tools.py dissect_dump -e -O dump_extract_dir dump.bin
RBL containers:
	0x10f9a: bootloader - [encoding_algorithm=NONE, size=0xdd20] - extracted to dump_extract_dir/dump_bootloader_1.00.bin
Missing app RBL container. Using a scan pattern instead
	0x11000: app - [NO RBL, size=0x0] - written to dump_extract_dir/dump_app_pattern_scan.bin

PS. I tested it with “test_device_exploitable.py” but it did not stop the flash.

Thanks!

[ihrapsa]

It works. You guys are awesome! 😄 Thank you!!

[troy-f]

yeah it’s indeed different. 95be7 is the payload target on that 1.0.8 fw version, looking for the register values. may have a profile for you soon.