smalcom

Yes. Let's just few examples. But file has more gaps. 1. Initialisation procedure. In "gap" placed needed constants or functions for indirect calls: gap1. png. 2. Even more gaps. One of it its a "bootstrap loader" (2.png). When you start updating procedure: a) handler called by command ":28062" stop PWMs and go to "bootstrap loader"; b) "bootstrap loader" transfer himself (or part) to RAM, call CSM_Unlock and update firmware using FAPI. 3. This gaps not a bug of IDA. Lets see BIN/HEX. For convenience i show tmp.txt, which contain HEX with commands for FirmwareUpdater (gap_in_hex.png). Row contain: 25 - write to flash command; address for writing 20 - count of data ----- Yes, i can use this HEX and write it to inverter, and "bootstrap loader" write only needed pages. But taking in account that i have clone of Axpert so chance to have a "brick" is not zero. Thats why i use "Plan B" - ask at forum. I have "Plan C" ))) - write very little dumper which will be writen where initialisation function placed. But that way take some time - month or two: i need two learn TMS320 ans assembly for it. ----- Thanks for advance, but it was first idea to use different settings. I even use "User defined battery". Firmware in inverter looks like buggy: yesterday fans without "line power" are off, today they is on. Battery code - the same. One time its disabled at 22 V (as in settings), another time... Thats why i think to patch firmware. I guess some peace of code from low power models (12 V) still exist in firmware, so in some cases inverter think that he is 12 V model. That's why it disabled at 10 V - its low voltage for 12 V battery. --- I can research fan and charger code, but stop at bootloader because not sure I can use the result of the work. Anway, thanks for advance.

Good day, everyone. I bought an inverter half a year ago: Sako Sunon-E 3KVA. Before this I had no experience of owning an inverter. Problems with him began immediately: 1. It can drain the battery completely. I have two lead batteries connected in series. The minimum voltage that I noticed on the inverter is 10 volts. That is, an inverter discharged them to 5 volts each. 2. Fans! The fans are always on when there is mains voltage or the solar battery is connected. The fans turn off only when powered by the battery and not for long. These fans consume about 20 watts. My electricity bill has gone up because of them. 3. Requires high voltage from solar panel. It's my fault, I didn't look at the instructions carefully. But more on that below. 4. Constant battery charge. Charging is turned off only after the balancing procedure. 5. Low efficiency. I checked the power from the battery. Connected a 60 watt load. The inverter consumed 100-120 watts from the battery. I decided to fix an important problem - power from a solar battery. I fixed shunts inside in three places so that voltage and current could be measured differently. MCU begins to see the battery and turns on the voltage converter. But the converter does not reach full power and delivers no more than 10-20 watts. I looked at what was happening at the gate of the control transistor. The pulse width does not increase when a load is connected: the inverter takes a little from the solar battery, and everything else from the lead battery. As I understand it, in the microprogram the maximum pulse width is recorded: it is expected that a source with a voltage of more than 130 volts will be connected, and not 30 - like mine. Wrote in tech. support, said: “I will correct all the errors myself, just give me the program”. They didn't even answer. ) It was a whole adventure connecting a laptop to this inverter. As a result, I found out that it pretends to be Voltronic Axpert VMII (I hope I wrote it correctly), the program version is 20.45. Found here the firmware version 20.43 and found out that access to reading the firmware is password protected. Let's explore it. After some research, I discovered that not everything was read, there are empty spaces that are accessed by the initialization routines. Because of this, I don’t risk writing this 20.43 into my inverter yet - I’m afraid to get a brick. I decided to take a different route - I started researching the recording program - UPSReflashTool. And here too there is a failure: after the handshake session, UPSReflashTool simply sends the BIN file (but extended with commands). No passwords are transferred, which means all this is stored in the bootloader (means updater in firmware, not the BootROM) in the MCU... I found of executing the update command. It turned out that the bootloader was cut from the HEX-file. Maybe the bootloader will erase only writable sectors - this is the protocol provides. But I'm afraid to be left without an inverter; I don't have a spare one. ) If anyone has an uncut file, please share. I'll share version 20.45 later, and some fixes in the future. I have attached the research results, maybe someone will be interested. https://drive.google.com/file/d/13MGUTm-alYNtocGUblPuyy715jGnq0IA/view?usp=sharing