WS85 WebFlasher

Firmware update tool for ECOWITT WS85 implemented with WebHID.
A good alternative for non-Windows users.

🔗 Demo

⚠️ This is not an official ECOWITT tool
Use at your own risk. If the update fails nothing bad will happen, just retry.

Based on reverse enineering with USBPcap traces of EcowittISPTool V1.0.0.exe

🗒 Protocol brief

Update is performed sending RAW HID data, so no special driver required.

Every message starts with 0x68 and ends with 0x16. The second last byte is a simple sum mod 256 over everything before

68 <CMD> <Length_MSB> <Length_LSB> <payload 0-32 bytes> <checksum> 16

Commands are:
CMD_INIT = 0x01
CMD_GET FW = 0x04
CMD_WRITE = 0x22
CMD_SET_TARGET = 0x30
CMD_FIN1 = 0x33
CMD_FIN2 = 0x23
CMD_FIN3 = 0x06
CMD_UUID = 0x0F

Response codes are:
ACK_OK = 0x9F
FW_RES = 0xA4
FIN_OK = 0xA5
NACK = 0xDF

Data example (all bytes being transmitted)

-> 68 01 0000 6916 (request)
<- 68 9f 0000 07160074 e916 (response)
-> 68 01 0000 6916
<- 68 9f 0000 07160074 e916
-> 68 01 0000 6916
<- 68 9f 0000 07160074 e916
-> 68 04 0000 6c16
<- 68 a4 0004 00650074 e916
-> 68 30 0004 08000800 ac16
<- 68 9f 0000 07160074 e916
-> 68 06 0000 6e16
<- 68 9f 0000 07160074 e916
// start sending the hex file contents in 32byte chunks
-> 68 22 0020 ecb8c904589df2afa037c3d16e704e7bec06cda5b2ade2cdec06cda5b2ade2cd a716
<- 68 9f 0000 07160074 e916
-> 68 22 0020 ec06cda5b2ade2cd07113a5a59582f51ec06cda5b2ade2cd7f12fb4aa36f2001 7416
<- 68 9f 0000 07160074 e916
<- [...]
-> 68 22 0020 0d794cc84c1115394dfd8ef2f251085f94df0840777990577ed3d3dea8601965 7d16
<- 68 9f 0000 07160074 e916
-> 68 22 0020 467820d5eefd05b4e925d4510a999f84cbfd010cd9a1231dce849fb481f3883d 6716
<- 68 9f 0000 07160074 e916
// send finalisation header/size + overall checksum. First 4 bytes is binary size, second 4 bytes is sum wrapped to 32 bit
-> 68 33 0008 000109a0 0084086d 4616
<- 68 9f 0000 07160074 e916
-> 68 23 0008 0600f5e000000010 7e16
<- 68 a5 0010 319aae04150000000d00ffff2700ffff df16
-> 68 30 0004 0803fe00 a516
<- 68 9f 0000 0716ae04150000000d00ffff2700ffff df16
-> 68 06 0000 6e16
<- 68 9f 0000 0716ae04150000000d00ffff2700ffff df16
-> 68 22 0010 ceae4931420d01f3eff667c83a2e0c99 f416
<- 68 9f 0000 0716ae04150000000d00ffff2700ffff df16
-> 68 0f 0000 7716 // get UUID
<- 68 9f 0000 0716ae04150000000d00ffff2700ffff df16