Dump maestro+

[MrCableYolo]

Hi Robbe,

I have extract firmware from the esp32 in my RAY Comfort Air 8 XUP! maeastro+.
The application communicates with the MCZ servers using MQTT.

Are you interested?

best regards,

[Robbe-B]

@MrCableYolo, Very much, letsgooo !!

[Robbe-B]

Is this a M1 or M2 stove ?

[MrCableYolo]

Could you send me the email address to share the dump? I found some unencrypted credentials.

Version : M2S.AIR.24.20, Panel:16

[Robbe-B]

RB_Projects@hotmail.com

[MrCableYolo]

Please examine the files.

Do you think it will work if I replace "mqtts://m.maestro.mcz.it" with "mqtt://mylocalserver" in the bin file after recalculating and updating the checksum and SHA256 hash ?

[mottobug]

From what i've seen the firmware uses certificate pinning. I've tried to redirect the requests from the oven to the cloud to my own servers but failed because of certificate problems. I'm also interested in the firmware files. I'm highly interested to "uncloud" my ovens.

[MrCableYolo]

Hi,
you can find the .bin in the swisstransfert

I asked Claude Code to reverse engineer the .bin and create a web page so that I could modify the bin using my own mqtt server. Unfortunately due to lack of time I was not able to inject the firmware to test.

you will also find attached a photo of the esp pines.

EN is not necessary and IO0 connect to gnd at boot.

[mottobug]

Very interesting. I assumed they protected the firmware getting from the ESP. You'll might consider taking down the links because your credentials are found in the Firmware files.

Thanks for the files, it helps a lot!

[MrCableYolo]

You're absolutely right :) I've already taken the precaution of changing my Wi-Fi password since that dump.

[Robbe-B]

I'm not interested in customizing the firmware here.
Especially not for this repo. (It still remains a stove, don't want it to burn down my house 😄).
What is truly interesting for this integration, is trying to figure out on how to control this stove over bluetooth.
I would really like to implement the bluetooth as an option. Combined with bluetooth proxies, this would be truly gold here.
Kind Regards,
Robbe

[MrCableYolo]

I agree with you Robbe, as long as we can get out of the cloud :)

Using the firmware dump (certificate) and %s (serial number?), I tried to connect to the MCZ server via MQTT Explorer, but without success.

[ParalaXEngineering]

This is huge news! I've just pulled the trigger on a stove and it will be installed in august if everything goes well, so I might help too. Leaving a comment here so I can follow the dicussion :) Maybe an option is to add an other ESP on the debug UART? I guess this must be a debug access, hence probably a custom protocol to read/write.