Sonoff S60TPG (UK Version) Successfully Flashed

[MalSmalley]

The Sonoff S60 is a great product. Looks good, has power monitoring and is cheap but its a sealed unit so not apparently easy to flash.
A good description and partial teardown by Mat Zolnierczyk [here] gets inside the unit by breaking the glued seal but there are not very accessible access points for flashing.
I totally destroyed one unit (by trying to access points on the processor daughter board) and took this a bit further.
The underside of the main board has some very useful pads available.

Tx & Rx are obvious. But the first pin on the connection to the processor board is +5V. (And it is +5V and not 3.3V as there is a voltage regulator or divider on the processor board). 0V is also at the far end of the connection but this is easier accessed by use of the Neutral pin on the plug itself.

On a new, un broken into, unit I accessed these points by drilling a couple of 3.5mm holes in the base and expanding the access to about 5mm x 10mm and was able to solder connecting wires to these 3 points fairly easily. I did protect the plastic casing with some foil!

I used a usb serial converter from a Pi400. Note that I powered the S60 from a separate 5V rail but the Rx/Tx from the serial converter were at 3.3V as this is what the esp32 chip requires.

Flashed using esptool. Holding the button on the side of the S60 on power up to enter boot mode. This does not have to be held down long. Flashed with tasmota32c3.factory.bin.
My normal process is (as per the esptool instructions)

$esptool.py --port /dev/ttyUSB0 read_mac    (to test connection)
$esptool.py --port /dev/ttyUSB0 read_flash 0x00000 0x10000 s60backup.bin    (in case we need to go back!)
$esptool.py --port /dev/ttyUSB0 erase_flash
$esptool.py --port /dev/ttyUSB0 write_flash -fm out 0x0 tasmota32c3.factory.bin   (where the bin has already been downloaded)

Flashing took about 90 seconds and , after a repower, the AP point showed up.

The template I used was the same as from the discussion & progress on the [European version.] (#21255) - Thank You !!

{"NAME":"S60UK","GPIO":[1,1,1,1,224,544,1,3104,1,32,1,0,0,0,0,0,0,0,1,1,1,1],"FLAG":0,"BASE":1}

And finally a bit of 0.5mm Plasticard was cut to shape and glued onto the base to cover the access hole and tidy up the unit.

[sfromis]

Nice way of doing it.

I spotted one detail:

read_flash 0x00000 0x10000 s60backup.bin

Only backing up 64 KB of flash won't give you the opportunity of going back. With ESP32-C3, I usually backup the full 4 MB of flash, up to 0x00400000

[MalSmalley]

Oooh thanks for that! I've never 'gone back' yet. But this has saved some head scratching (& swearing!) if I ever do.

[JBFUK]

I brought the same devices and opened one up with the same goal. I have not been able to flash it. I just get nothing back from the ESP32. It might be going into boatloader mode as when simply applying 5v one of the LEDs flashes slownly, when applying power with the button pressed the LED does not come on or flash. I've now gone so far as to remove the ESP32 daughter board and solder wires on to the test pads to allow me to use the reset pin with a button.

I've tried two different USB to serial adapters, both in 3.3v mode. I've tried with the USB adapter providing the 5v for the chip and with an external battery pack providing 5v.

Not sure what's left to try really. Perhaps I'm unlucky and have somehow damaged the TX port, or it has a pre-existing fault.

[MalSmalley]

That's interesting. I'd love to see how you get it all back together again when you do flash it!
I found the same- just powering on gave the blue led flashing approx once a second. But power up with button pressed and no leds illuminate. This is definitely in boatload mode.

Useful photos of the processor board. Ive just taken the one I 'nadgered' out to compare and can see where I have damaged it. It may be easier to use the connector pins rather than the test points. The left most on the processor side is Tx & the 2nd left Rx. 5V, Gnd & Key are quire clear on your photos.

In fact on my trashed board I don't get continuity between the connector pins and the on-board test points. That could be because of the damage to my board - but worth checking. The Tx/Rx test points I used on the underside of the main board are definitely connected to the connecting pins 1 & 2. It may be you get some success using these instead.

I've done flashed two of these now, so its definitely possible.

[JBFUK]

Well, no luck with flashing the chip in question. I checked the resistors on the RX/TX pins, they were fine. I can only conclude the chip is damaged.

Subsequently I've successfully flashed the other three units - so my serial adapter is fine. For the first I used your method of drilling holes to provide access to the TX/RX/5v terminals. This worked 'ok', filling the hole with hot glue afterwards. For the remaining two I opened the plug up, flashed via the pads and the glued the cases closed again. I found this much cleaner. It's really no bother opening up the case - you have to apply pressure using an engineering vice, no too much but enough to just slightly deform it. Release the pressure and rotate 45', apply pressure, repeat until eventually the glue joint shears and the case pops open. To reassemble the two parts will meet up perfectly so it can be glued back together with no visible evidence of it having been opened.

I'll probably replace the esp32-c3 chip on the faulty board - a dev board can be had for £1.40 from which I can take the processor and have a bunch of spare parts left over.

Now is it worth the effort? At the price I brought them on sale - £10 each, it's just about worthwhile if you need some devices in a hurry. If not, or at a higher price point the it's better to simply buy 'athom' devices pre-flashed with Tasmota32 from aliexpress.