[SOLVED] Shelly device did automatic factory reset - script is lost - recovery possible?

Hi,

i implemented a 600 lines Shelly script (about 40h of work) to implement a logic to control a coldwhite/warmwhite LED Strip with a Shelly rgbw2.

The Script was enabled (automatically started after the shelly boot). This was running fine - until i made a small modification that prevented the script running ... it crashed the shelly every time when it booted. After some minutes the Shelly i4 seems to be not connected to my Wifi (the LED blinking signature indicated that). Pinging the device was not possible during this restarts - also my DHCP Server did not provide a new DHCP lease (or served a old one). So i took my phone, started the shelly app and got also the "device not responding"-error... i searched for a new device and there was it.

my Question: is there any possible way to read the eeprom of the shelly to restore the script. It was hard work, had many control-commands and a really complicated logic that i don't want to recreate.

I am familiar with ESP32 and other microcontrollers, but have no Schematics of the shelly to know how i could read the eeprom with a microcontroller programmer. Is it possible to use the provided pins? i have no fear to extract the script from a hex dump!

Shelly i4:

Firmware version: 0.10.3

Firmware build ID: 20220617-113130/0.10.3-g7c89a05

Web build ID: 1.5.5-b3d94f1

any hint would be appreciated!!!!!

Thanks in advance!

i was able to solve this with some further information from Shelly Support Team - massive shoutout to them!!!!

first the information from Shelly - the Pinout from Shelly i4 Debug interface:

Pinout Shelly i4.png

Using this information and a USB-to-Serial module from Olimex (that supports 3,3 and 5V Logic level / you can use every Converter that uses 3,3V logic level) it is possible with some shell commands to extract the content of the ESP32 Flash memory and there you can find the the procedure to do this.

HOWTO: How this is done in Detail:

ATTENTION: This is for experienced Users only with good knowledge about flashing Microcontrollers like ESP32/ESP8266

Part 1: dry run

1) create the ESPTOOL Read command - how to do this can be seen in this video: How To Read from ESP32 - CLONE/BACKUP Everything

2) connect the programmer without the Shelly connected to the programmer!

3) run the command -> this has to fail!

this was my command:

C:\Users\pichl\AppData\Local\Arduino15\packages\esp32\tools\esptool_py\2.6.1/esptool.exe --port COM3 --baud 115200 read_flash 0 0xF00000 versuch1.bin

Part 2: real backup

4) disconnect the Programmer from the computer

5) disconnect every power Source from Shelly (ideally remove all connected wires - just to be sure! if some other power source is connected to Shelly while powered via the debug pins you will brick your Shelly)

6) create some really thin wires that fit the tiny shelly debug pins

7) write up the programmer with Shelly:

GND to GND

3,3 V to 3,3V

GND to Shelly-GPIO0

TX to RX

RX to TX

the result my look like this:
how not to wire it.JPG

double check that everything is wired up correctly AND no wires are touching!

9) connect programmer to USB Port on your computer - ensure that GPIO0 is connected to GND

10) execute the command again and after half an hour you get your backup (i changed Serial to 115200 baud - with higher rates i got transfer errors)

11) if everything worked fine you have this output:

esptool output.png

now be really happy

Part 3: extract the script

12) copy the result-file "versuch1.bin" to a different location to have a backup if you have problems during restore

13) open "versuch1.bin" with a good text editor like Notepad++ (good means: does not get frightened when opening binary files)

14) Search for anything that was located in your script but keep the following notes in mind:

The shelly stores the script on every save in a different location in flash memory - i have 35 versions of my script that were incomplete and partly overwritten and 1 version that was complete.

Be patient and take your time in finding the right version in the flash memory dump. My Script was saved at least 100 times and this is shown good in the dump. I found even a version with just a short part (just a few bytes!) of the script overwritten by something binary.

Part 4: Tips/Hints in reconstructing the script

• i had all my data at least 4 times in the dump - so maybe the shelly has only 4 MB eeprom - the dump contains some ssl certificates - they can be used to identify the repeating dump
• copy your data to a different location after one step was successful
• Scroll through the whole dump and save every part of the script that you can find in a seperate Textfile - try to be absolutly correct in seperating your script from garbage bytes!
• search for duplicates in the Textfile and delete them (can be done in Linux with "fdupes ." and "fdupes . --delete --noprompt" - but keep a copy before running this!)
• review all textfiles and see if it contains only one piece, or if it contains two (not directly connected) parts of the script - if needed seperate them
• The Script is saved in parts - each part differs in size (at least in my dump)
• try to reconstruct the script from the parts - in my case it took me about 6 hours to assemble a 550 lines script out of finally 7 parts - but i extracted 139 parts from the dump.

Hopefully you never need it, but if you need it you hopefully find this thread using your favorite search engine.

If you find it useful or may saved your life leave a short comment and may share your experience.

i will also do a automatic Backup Script for all my Shellies, but this will need some time and will also be posted in this Thread.

Hi Mircho,

you are correct - i really like to explore things, go to the limits and push it over the limit without breaking the system - usally this can be done, but sometimes things break

Purpose of the script:

it connects two Shellies working together... a i4 that is connected to two pushbuttons (role: sensing/input device) and a rgbw2 (acting device - in mode white - coldwhite on channel 1 / warmwhite on channel 2) that controls a LED strip (coldwhite and warmwhite LEDs) and a 1 pm that controls some accent lighting.

The rgbw2 reports back it's status to i4 to ensure correct handling at the inputs (initially via HTTP-Calls, but when this break happend i was preparing a change to move this backfeeding to mqtt to have more HTTP-Calls for controling functionality)

a short description what the script is doing:

it registers a Callback Shelly.addStatusHandler() to detect every button push and differentiates if it is a short press or a long press. Based on this events a Logic-Class controls the LED strip:

a short press toggles the LED strip on or off.

a long press on the left button ramps the light to max and then to min, then to max (depending how long it is pressed)

a long press on the right button moves the light color from cold to warm and cold and warm (depending how long it is pressed)

as a special feature for the future is that i want depending on the daytime the light-color and brightness automatically set. Colder and brighter when working at home and warm and getting dimmer during the evening.

yes i will provide this to you - i was last week on vacation, returned yesterday and i am currently getting back to regular life - please send me your Email where i can provide you the dump with some explanation.

best regards from Austria,

Alex

i edited the 2. post to add some tips/hints how the restore can be done - things that i wish that i have known before