I have a Deye Sun 600 Inverter and I am not very satisfied with the monitoring capabilities. It seems like there are a fairly high delay for measurements written to the registers. Anyway I want to Reverse Engineer the firmware and wanted to start using binwalk. However there is nothing so I tried using "strings" and there is only one useable string which is the text in my title "HF-LPBX300 Image". Does anyone know what this means? Is this something like an encryption algorithm or a specific binary image format?

Useful Information:

• Bin File: Deye Sun 600 Firmware V.1.53 ()
• Deye doesn't want to send any information or the firmware as editable code

2 Answers

I'm also interested in the same issue.

As far as I found out, the Deye micro inverters use electronics from Hi-Flying.com.

Edit:

This has the same "HF-LPBX300 Image" in the firmware:

Edit2: The actual "payload" of the firmware bin starts at file position 0x100 as an lzma packed archive.

2

I believe this is an image for the HF-LPX30 Series Low Power WiFi Module, indeed from Hi-Flying: Looking into that description shows configuration web pages (e.g. p54) that are identical to the Deye device. Downloading the firmware from here: shows the head of the upgrade images is exactly what you see:

birger@AMDDesktop:~/Downloads$ hd LPB130_UPGRADE_HFV4.13.35_2MB_20221222.bin|head
00000000 48 46 2d 4c 50 42 58 33 30 30 20 49 6d 61 67 65 |HF-LPBX300 Image|

Taking out the big gun in the form of ghidra also shows the image's language is ARM Cortex (little endian) as for the HF-LPX30 architecture and not MIPS as is it would be for the wport-w30 according to it's datasheet.

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.