Backup & Restore Official Firmware of Sonoff WiFi Smart Switches

Contents:

Controlling Sonoff Smart Switches without internet over Local Area Network is hot topic for Sonoff enthusiasts. After loading any custom firmware to Sonoff, you cannot go back to the official firmware but now you can!!. Just backup your official firmware by following the instructions below and you can restore it later if you want. So Let’s get started..

Hardware Requirements:

Software Requirements:

Step-by-Step Procedure:

Step A:

Download and install Python 2.x or 3.x from https://www.python.org/downloads. Download Esptool from https://github.com/espressif/esptool/releases. Extract the contents of esptool compressed file to C:\. All the contents of esptool should be under  c:\esptool.

Step B:

  • Open Command Prompt (Start > Run > cmd) and navigate to esptool folder.
  • Install the esptool by issuing the command below.
It takes few seconds to upload firmware and output will be shown as follows.

Step C:

Now We are just one step behind to download / upload any firmware to our Sonoff Smart Switch. Connect FTDI to Sonoff Smart Switch (For detailed information about each Sonoff Switch, visit Sonoff Smart Switch LAN Control without Internet) and start Sonoff device in programming mode. Now find the port under Control Panel > System > Device Manager > Ports at which Sonoff device is connected.

Determine the Flash Size:

  • Change COM5 to your own Port.
  • Wait few seconds and it outputs the flash size as shown in picture below Detected flash size: 4MB.

Backup / Download Official Firmware:

1MB Flash:

4MB Flash:

  • Change COM5 to your own Port.
  • Change flash size parameter  0x100000  for 1MB and  0x400000  for 4MB flash.
  • Wait a minute and firmware binary file will be downloaded and saved in to  c:\esptool

It takes few seconds to upload firmware and output will be shown as follows.

Official Sonoff Firmware Binary Files:

Step D:

Erase Flash Memory:

Erase the custom firmware from flash memory before uploading any new firmware.

  • Change COM5 to your own Port.

It takes few seconds to erase firmware and output will be shown as follows.

Upload Official / Third Party Firmware:

Determine the flash size as discussed in Determine the Flash Size section. Copy the official / any third party firmware binary file to  c:\esptool folder if it is not already there and upload it by issuing the command below.

1MB Flash:

4MB Flash:

  • Change COM5 to your own Port.
  • Change flash size parameter  -fs 1MB  for 1MB and  -fs 4MB  for 4MB flash.
  • Change sonoff.bin to the name of your firmware file inside  c:\esptool folder.

It takes few seconds to upload firmware and output will be shown as follows.

Troubleshooting:

  • Choosing Wrong COM Port will cause the following error.

  • If following output is shown, Sonoff is not correctly connected to FTDI, Check wire configuration or terminals.

  • After restoring the official firmware, if led does not blink, It means you have problem with backup image
    • either backup image is corrupt – Check 3.3v power supply during backup
    • Chose wrong flash size during backup – See Determine the Flash Size Section

 

59 thoughts on “Backup & Restore Official Firmware of Sonoff WiFi Smart Switches

  1. mcarav says:

    Hello, just for confirmation: I just downloaded the original firmware (previously updated to 3.3.0) using your perfectly working procedure, flashed tasmota, restored the original firmware and repaired with ewelink. Everything ok and flawless.

    I have a hunch……this is the md5 of the firmware of an original sonoff basic R2 3.3.0 52304de643cbf9539ccc9b0fbe8368a6

    if anyone has any other device from iteac still working with the original firmware. Can you try to download it and see if it is has the same md5?

    I see no point in having so many different firmware, maybe the firmware is the same, depending only on chip’s size.

    Please report back if it is the case.

    Thank you.

  2. Francisco Javier Rojas Osorio says:

    I did everything correctly and I already copied the fimware of a new device to the device to recover successfully. BUT when I try to use the eWelink application and try to add the device it says in a state of synchronization that a second generation device has been found, an error box pops up in the app saying: Invalid Data. And the operation is canceled

  3. Alex says:

    Hi to all, i’m trying to restore a Sonoff th 16 with the original fw but, even if the entire procedure is correctly completed, i cannot see the blue led blink….
    i’m trying different .bin files…my original and yours..
    any suggestions?

      • Jonny says:

        Same here with my Pow R2…. I did everything as described, flashing worked well but the Sonoff is dead.

        c:\esptool>esptool.py --port COM5 write_flash -fs 4MB -fm dout 0x0 sonoff.bin
        esptool.py v2.6
        Serial port COM5
        Connecting....
        Detecting chip type... ESP8266
        Chip is ESP8266EX
        Features: WiFi
        MAC: cc:50:e3:54:1c:21
        Uploading stub...
        Running stub...
        Stub running...
        Configuring flash size...
        Flash params set to 0x0340
        Compressed 4194304 bytes to 320857...
        Wrote 4194304 bytes (320857 compressed) at 0x00000000 in 28.5 seconds (effective 1176.4 kbit/s)...
        Hash of data verified.

        Leaving...
        Hard resetting via RTS pin...

        Btw flashing the restored tasmota works well with this method… Please help!!

      • carozoynarizota says:

        I think everyone trying to backup/restore their FW should be testing their backup in an alternative device before erasing their original itself. It should work on Sonoff Basic/RF, also in Sonoff TH but I haven´t got the chance to test this one . I didn´t analyze the Sonoff POW schematic, but if it is based on an ESP8266 as the others you shoud give it a try in the same way. In my case o tried all Basic/RF FW in an ESP-01 without problem, also a Shelly FW file found on the internet runs at least showing in my WiFi networks for the initial setup running on NodeMCU (4M).

  4. Leon says:

    Anyone have a working backup of a SonOff Basic R2?
    I need to know where i must put the chipid.
    I found the deviceid and apikey locations, but i need to put my chipid back for it to be restored to the “Original” SonOff state.

    • Leon says:

      So, after a lot of struggling i got it to work, this is what i did.
      1. I used another unit and update to the latest firmware Ver. 3.3.0
      2. Read the flash and save it – esptool.py –port COM5 read_flash 0x00000 0x100000 image1M.bin – in my case
      3. Now edit the file in HEX and change the values as follow: – if you do not have the following two set of numbers, you can NEVER go back to the SonOff firmware. If you made a backup of your original firmware, you can get it or if you put you SonOff unit in Pairing mode, connect to it with your mobile or any device that has wifi and send the following from a browser:
      “http://10.10.7.1/device” see this post – https://blog.ipsumdomus.com/sonoff-switch-complete-hack-without-firmware-upgrade-1b2d6632c01
      3.1 – deviceid – this is the value that start with 1000xxxxxx, same as the SSID of your SonOff unit at locations in HEX:
      3.1.1 – HEX location 7807c to 78085 and the same at HEX location 7907c to 79085
      3.2 – api – If you don’t have your original api, you can NEVER go back to SonOff
      3.2.1 – HEX location 78087 to 780aa and the same at HEX location 79087 to 790aa
      4. Save your HEX file, erase the flash and upload as described in the instructions above

  5. D. Mora says:

    The only problem I saw running this directions is that the ID flashed in the device is the one coming in the .bin file, which belongs to a real device, so it means that once flashed, the device will have a duplicated id, and when registered into eWelink cloud it will dump the real one, or even worst, all the people downloading this file will be deleting the registry of the device from each one.

    So, How to generate a unique Device ID to edit with hex in the bin?

    • carozoynarizota says:

      D.Mora you are right, but both the Device ID and the MAC-ADDRESS are found as seen on eWelink on the HEX file. So you can edit the file before uploading to your new device. With that you can have any ESP module running at least Sonoff Basic and RF as if they were originals.

        • carozoynarizota says:

          vickeymalikpc I´ve done everything through my desktop PC, procedure explained here to flash Sonoff devices is the same for every ESP8266 you come across. Once the right FW version flashed on your device it is supposed to work according to what is it in there. For example if you pick an ESP-01 and flash that device with Sonoff Basic R2 FW, then you can make it go up on ewelink in your phone (that can be downloaded from play store). D.Mora points here that you will be replicating the ID found on you FW file, then my answer that it can be modified with a simple hex editor on a PC before flashing it.

          • D. Mora says:

            Yes, it can be modified, the problem is that the Device ID is linked to a unique API key, so if you modify the device ID to any random number (or even the original one), it will register to the eWelink cloud, but it will never achieve the connection to work without the correspondent API Key.

            The only way to restore a Sonoff device to its original with this firmware, can happen if you know your original, Device ID (or anyone not used) and it’s API key; the MAC is not problem as it is not related to the firmware, it is burned in the NIC portion of the chip, similar like the chip ID.

          • mcgyver83 says:

            How can I get the Device ID if I already flashed the tasmota and I want to come back to original?

          • carozoynarizota says:

            Did you flash it inmedately before testing your device with the original FW in the ewelink APP? If registered may be you can get the original ID from there. If not you can edit the files shared here to give them a different ID to see if the ewelink app recognises your device.

          • carozoynarizota says:

            Good point, they might be doing some kind of verification through their servers. But at least we know that the IDs are not linked to device type (as I was able to run a Basic like an RF module). Did you tried to change the device ID to see if it is rejected by the ewelink platform?

          • dslade47 says:

            Could you please describe how to modify the firmware through Hexa editor (as HxD) to be able to use it on another device (for sonoff basic and RF) ?
            In my case i have backup sonoff basic firmware and i want to install in on Sonoff RF R2.
            I tried using the firmware provided here above (without any change in the file), it allows adding the device in Ewelink but it never go online so it cannot be used.
            Thanks in advance for your help.

        • carozoynarizota says:

          Check the MAC on your device and open then the .bin in an hex editor and search for the string in it. There you can change it.

    • dslade47 says:

      Hi D.Mora, Did you find a solution to generate a unique accepted by ewelink platform ? I tried to backup sonoff basic firmware, changing deviceID (incrementing number) in HxD editor and download firmware on other sonoff basic but it didn’t work.

  6. carozoynarizota says:

    Hi, I was doing some tests with Sonoff Basic and RF. Downloading their FW and then uploading the files to a different device, also to an ESP-07 stand alone module. This way I was able to make a Sonoff Basic or an ESP-07 run as a Sonoff RF on Ewelink. I tried the same with the RF image shared here and it runs OK, but if I upload the TH10/16 images nothing happens. I power the device, put GPIO to GND for a few seconds but the ITEAD Wifi doesn´t appear. Any clue?

  7. Vlad says:

    Great write up, thanks!

    I have one residual question. Is it possible to write the official firmware, read from a 1M flash onto a 4M flash?

    The reason I ask is that I have swapped the flash chips (from 1M with 4M flash) on most of my Sonoff basic’s. I would like to restore the original firmware onto the 4M flash chips.

  8. LD Taylor says:

    I have two SONOFF basic switches both loaded with custom firmware. Using your backup/restore processes, I backed up factory firmware and restored to these two switches. The backup, erase, then restore worked perfectly. However, when I powered up both restored switches, nothing, no lights. What am I missing here. Does backup/restore only work with the same switch? Thanks for your guidance.

    • Stan says:

      I have same issue with sonoff POW after succesfull backup/restore it is dead no light. The flash size is correct 4MB

      Source POW:

      C:\esptool-2.6>esptool.py –port COM3 flash_id
      esptool.py v2.6
      Serial port COM3
      Connecting….
      Detecting chip type… ESP8266
      Chip is ESP8266EX
      Features: WiFi
      MAC: 5c:cf:7f:92:2d:34
      Uploading stub…
      Running stub…
      Stub running…
      Manufacturer: e0
      Device: 4016
      Detected flash size: 4MB
      Hard resetting via RTS pin…

      C:\esptool-2.6>esptool.py –port COM3 read_flash 0x00000 0x400000 image4M.bin
      esptool.py v2.6
      Serial port COM3
      Connecting….
      Detecting chip type… ESP8266
      Chip is ESP8266EX
      Features: WiFi
      MAC: 5c:cf:7f:92:2d:34
      Uploading stub…
      Running stub…
      Stub running…
      4194304 (100 %)
      4194304 (100 %)
      Read 4194304 bytes at 0x0 in 378.4 seconds (88.7 kbit/s)…
      Hard resetting via RTS pin…

      Destination POW:

      C:\esptool-2.6>esptool.py –port COM3 flash_id
      esptool.py v2.6
      Serial port COM3
      Connecting….
      Detecting chip type… ESP8266
      Chip is ESP8266EX
      Features: WiFi
      MAC: 5c:cf:7f:92:d2:15
      Uploading stub…
      Running stub…
      Stub running…
      Manufacturer: e0
      Device: 4016
      Detected flash size: 4MB
      Hard resetting via RTS pin…

      C:\esptool-2.6>esptool.py –port COM3 erase_flash
      esptool.py v2.6
      Serial port COM3
      Connecting….
      Detecting chip type… ESP8266
      Chip is ESP8266EX
      Features: WiFi
      MAC: 5c:cf:7f:92:d2:15
      Uploading stub…
      Running stub…
      Stub running…
      Erasing flash (this may take a while)…
      Chip erase completed successfully in 10.7s
      Hard resetting via RTS pin…

      C:\esptool-2.6>esptool.py –port COM3 write_flash -fs 4MB -fm dout 0x0 origPOWimage4M.bin
      esptool.py v2.6
      Serial port COM3
      Connecting….
      Detecting chip type… ESP8266
      Chip is ESP8266EX
      Features: WiFi
      MAC: 5c:cf:7f:92:d2:15
      Uploading stub…
      Running stub…
      Stub running…
      Configuring flash size…
      Flash params set to 0x0340
      Compressed 4194304 bytes to 598623…
      Wrote 4194304 bytes (598623 compressed) at 0x00000000 in 53.1 seconds (effective 631.5 kbit/s)…
      Hash of data verified.

      Leaving…
      Hard resetting via RTS pin…

  9. Smax says:

    For Martin do you need press button to your sonoff pow and connect power for programming and read.
    This is error cpu not in programming mode.9

  10. Smax says:

    Programmatiin working. I change firmware ok . Test espurna and espeasy work. Revert original with new flash not work . Old flash is burned..
    I have double backup. One 1mb and one 4mb. Memory flash is 4mbyte this is Pow sonoff.
    Tedted ftdi and board ch340

  11. Martin Hardoy says:

    If you keep getting this:
    esptool.py v2.3.1
    Connecting…….._____….._____….._____….._____….._____….._____….._____….._____….._____….._____

    A fatal error occurred: Failed to connect to Espressif device: Timed out waiting for packet header

    Try to disconnect the esp from the PC and start Sonoff device in programming mode again

  12. Smax says:

    I have dump for my original sonoff pow i have dumped 1mb and 4mb . My fflash type original is 25q32.
    I have burned original switch in the sonoff pow. And have replaced with 4.5V power supply. And have changed many time to original and espurna.Working fine for 60 day. If reprogramming flash a this day not work. Error md5.
    A this time have replaced flash with qh32bhig brand xmd, recovered by old lolin board. New test with new flash i have uploaded espurna and work fine. Router ap and work fine. If reinstall original sonoff pow firmware not work. Reply is 2nd boot version boot @1000 If upload firmware at 0x0. If upload firmware ad 0x7e000 have reply ets_main.c ??
    Is possible upload picture?

  13. Smax says:

    Hello dear i have bakup but not working? I have replaced new flash , uploaded my backup and not work. I have error boot @1000 or boot @81000
    Help for backup?
    Oter firmware working fine.

  14. zweistein says:

    Hi,
    Great article. Thanks for it.
    But I have a problem in reading flash:
    “A fatal error occured: Corrupt data, expected 0x1000 bytes but received 0xffd bytes”
    Do you have any idea about this error?

    Thanks

Leave a Reply

Your email address will not be published. Required fields are marked *