[Ductapemaster]

Interesting timing, I have spent the last week with Claude reverse engineering the on-air protocol and I'm getting pretty close to building a secondary "listener" receiver that will collect measurements from my bridge + sensor pair locally.

To Flume's credit, it required me to dump the firmware from the bridge device's ESP8266 in order to extract my key. I didn't consider an approach like this article took, given I have direct access to the HW and there's no flash protection on the 8266.

[elmoret]

If you document this somewhere I'd love to read about it! I took the approach of sniffing the packets between the radio and mcu on the bridge board, got most of the way into reverse engineering that, then helped build this instead:

https://github.com/tronikos/esphome-magnetometer-water-gas-m...

But I always wanted to finish pulling flume data to home assistant, without the cloud.

[Ductapemaster]

I am planning a write up once I get it working. I'd be happy to share.

My setup is a logic analyzer tap on the SPI bus between 8266 and the RFM69 on the bridge device to log raw traffic, and my secondary RX (ESP32 + RFM69) for over-the-air traffic.

Also, I have a gas meter sensor based on your work half-built on my workbench. I plan to set that up once I finish my Flume distraction. Great work, thank you!

[elmoret]

> My setup is a logic analyzer tap on the SPI bus between 8266 and the RFM69 on the bridge device

I'd done exactly the same, though my efforts were pre-Claude. If you want my logs/data, username at gmail.

[mrloopex]

How did you get the epoxy off the ESP? I use a mill but I only have a 30% success rate.

[Ductapemaster]

No need — I simply plugged into the exposed programming header on the gateway.

The sensor has an Atmel SAMD part which I assume has the security bit set. I didn't need to dump that firmware directly as it exists within the gateway flash.

[mrloopex]

The gateway had an open debug port?!?!