I have a Deye Sun 600 Inverter and I am not very satisfied with the monitoring capabilities. It seems like there are a fairly high delay for measurements written to the registers. Anyway I want to Reverse Engineer the firmware and wanted to start using binwalk. However there is nothing so I tried using "strings" and there is only one useable string which is the text in my title "HF-LPBX300 Image". Does anyone know what this means? Is this something like an encryption algorithm or a specific binary image format?
Useful Information:
- Bin File: Deye Sun 600 Firmware V.1.53 ()
- Deye doesn't want to send any information or the firmware as editable code
2 Answers
I'm also interested in the same issue.
As far as I found out, the Deye micro inverters use electronics from Hi-Flying.com.
Edit:
This has the same "HF-LPBX300 Image" in the firmware:
Edit2: The actual "payload" of the firmware bin starts at file position 0x100 as an lzma packed archive.
2I believe this is an image for the HF-LPX30 Series Low Power WiFi Module, indeed from Hi-Flying: Looking into that description shows configuration web pages (e.g. p54) that are identical to the Deye device. Downloading the firmware from here: shows the head of the upgrade images is exactly what you see:
birger@AMDDesktop:~/Downloads$ hd LPB130_UPGRADE_HFV4.13.35_2MB_20221222.bin|head
00000000 48 46 2d 4c 50 42 58 33 30 30 20 49 6d 61 67 65 |HF-LPBX300 Image|Taking out the big gun in the form of ghidra also shows the image's language is ARM Cortex (little endian) as for the HF-LPX30 architecture and not MIPS as is it would be for the wport-w30 according to it's datasheet.
