A wire repair turned into a full firmware replacement. When PRBS23 opened a Gravity 800 Grill controller, they found an ESP32 with a labeled programming header. That header made dumping the original firmware trivial using the espflash utility. The result is FreeFall 800, open source firmware now published on GitLab.
The reverse engineering uncovered specifics worth knowing. Four thermistor inputs and a fan driver connect through an unidentified 16-pin chip running 9600 baud UART, likely a cheap MCU acting as an analog frontend. The original firmware contains an ADC correction function that adjusts readings by up to 40 degrees Fahrenheit, and its purpose is still not fully understood. The CS1621 segmented display driver had actual datasheets, making it the easiest part of the whole operation.
The finished firmware ships with PID-controlled temperature management, over-the-air updates, and a real-time web interface. The full writeup on PRBS23's site documents every step of the schematic reconstruction and firmware analysis. If you want to understand how a commodity IoT device is taken apart from first principles, this is a clean, well-documented example of exactly that process.
[READ ORIGINAL →]