A Tale of WiFi Secrets, UART Lockdowns, and a Scarred Flash Chip

By Adepts of 0xCC
Tags: #RED_TEAM #RESEARCH #EUFY #HARDWARE_HACKING #DOORBELL #OCEAN #HIDDEN_WIFI #FIRMWARE #HOMEBASE2 #UART #X-C3LL
Date: September 28, 2026

Greetings, fellow owls of the night. As foretold in our previous transmissions, the God Debugger has seen fit to illuminate our path—showering his humble servants in a divine rain of opcodes. We return to the temple to share a new homily.

Please, make yourselves comfortable and listen to the chronicle of how one of our owls, aided by his brother-in-law, set out to dissect the next piece of the Eufy puzzle: the Eufy HomeBase 2.

Disclaimer: We opted to analyze the HomeBase 2 rather than the HomeBase 3. As previously detailed in "From your doorbell to your home network," the version 2 is the one most prevalent in my city and was significantly easier to acquire.

The specific firmware under our microscope is version 3.4.2.2h (dated 2026-06-05 18:45:48). I must confess: this was my first foray into the realm of physical hardware. I have spent my life hunting vulnerabilities in firmware downloaded from the depths of the internet, so please forgive the sins I committed overlook my novice mistakes.

---

⚠️ Prerequisite

You must read the previous article in this series before proceeding with this one.

---

📜 Table of Contents

Because this journey covers a vast array of technical landscapes, some of you may wish to teleport directly to the sections that pique your curiosity. We offer this blessed roadmap:

• The Extraction Saga: How we pulled the firmware (and accidentally wounded the memory chip).
• The WiFi Cipher: Reverse engineering the algorithm for the OCEAN_XXXXXX management network.
• The UART Breach: Reflashing a modified U-Boot image to secure a shell.
• The Recovery Struggle: Navigating filesystem quirks to execute the main binary.

Note: I share the general malaise regarding the act of writing detailed articles in this era of AI dominance.

---

0x00: Firmware Extraction

In the previous chapter of this odyssey, I noted that we successfully dumped the doorbell's firmware, but the HomeBase proved more stubborn. Its flash memory was soldered directly to the PCB, offering no convenient pins for test hooks.

Initially, we sought to avoid the heat of the soldering iron. I waited to acquire specialized hardware: spring clips tailored for the Winbond 25Q256JWEQ (WSON8 8.6mm).

The First Attempt: The Makeshift Rig

I constructed a precarious setup, utilizing rubber bands to hold the clips in place while I attempted to read the data via the Raspberry Pi's SPI0 interface.

The Result: I performed three separate reads. Each time, the checksums differed. In the world of data extraction, inconsistent checksums are a flashing red light. Upon inspection, the dumps were nothing but digital noise—completely useless.

The Diagnosis: Unlike the doorbell, the power supplied during the read operation was inadvertently powering other components on the board. These components were fighting for control of the memory, corrupting the output. To win this war, the chip had to be isolated.

The Second Attempt: The "Brave" Approach

My brother-in-law, Óscar Lestón, stepped forward as the brave soul willing to desolder the flash memory (a task I was far too terrified to attempt).

![Image: A photo showing the desoldering process of the flash chip] Caption: The act of liberation (Desoldering)

![Image: The extracted Winbond chip] Caption: The extracted flash memory module

Once the chip was free, we replicated the Raspberry Pi SPI0 setup off-board. This time, the results were consistent: three dumps, three identical checksums, and a wealth of "interesting data."

The Cost of Victory

The process was not without a price. A block of $\approx 64\text{ KB}$ was either erased or became unreadable—most likely a casualty of the heat during the desoldering process.

Analyzing the Dump

Using binwalk, we were able to carve out the majority of the firmware from the binary file located at: /home/psyconauta/research/Eufy/homebase2-firmware/chipoff/STUFF/extractions/homestation2_firmware00.bin

The following table summarizes the findings: