This page documents the ongoing reverse engineering efforts for the Shrooly device, including hardware discoveries, unresolved mysteries, and technical findings.

Hardware Overview

The Shrooly device is built around an ESP32-S3 microcontroller with various peripherals and sensors. Through teardown and analysis, we’ve identified many components, though several mysteries remain.

Confirmed Components

Main Processor

  • ESP32-S3-DevKit-C: Dual-core Xtensa LX7 processor
  • Wi-Fi and Bluetooth capabilities
  • Multiple GPIO pins for peripheral control
  • Native USB support

Sensors

  • Temperature/Humidity Sensor: Environmental monitoring
  • CAP1206 Touch Controller: Capacitive touch interface
  • Water Level Sensing: Via I2C co-processor

Actuators

  • Air Exchange Fan: PWM-controlled bottom fan
  • Humidifier: Ultrasonic atomizer with separate fan
  • LED System: White and RGB LEDs for growth lighting

Unresolved Mysteries

Despite significant progress, several technical aspects remain unclear:

1. Screen Interface

What we know:

  • The display uses SPI communication
  • It’s likely a small OLED or LCD panel

What we don’t know:

  • Exact GPIO pins used for SPI interface
  • Display controller model
  • Resolution and color depth
  • Initialization sequence

Research needed:

  • Logic analyzer capture of SPI communication
  • GPIO pin tracing
  • Display controller identification

2. Audio and Button Interface

Potential configurations:

  • Beeper/buzzer on GPIO1 or GPIO2
  • Physical buttons on GPIO9-GPIO12
  • CAP1206 handles touch input

Unknown aspects:

  • Exact pin assignments
  • Button debouncing method
  • Audio signal generation
  • Touch sensor configuration

3. Power Monitoring

Observations:

  • Device can detect 12V supply status
  • Low voltage detection capability
  • Possible current monitoring

Questions:

  • ADC channel used for voltage monitoring
  • Threshold values for warnings
  • Power management implementation

Intentionally Unexplored Areas

Some features have been deliberately left uninvestigated:

Bluetooth Functionality

  • Not required for basic operation
  • Adds complexity without clear benefit
  • Original app dependency concerns

Water Level Sensor Details

  • Suspected I2C communication with Raspberry Pi daughterboard
  • Basic operation understood
  • Deep technical details not critical

GPIO Pin Mapping (Partial)

Based on reverse engineering efforts:

GPIO Function Confirmed Notes
GPIO1 Beeper? No Possible audio output
GPIO2 Beeper? No Alternative audio pin
GPIO9-12 Buttons? No Physical button inputs
GPIO? SPI CLK No Display clock
GPIO? SPI MOSI No Display data
GPIO? SPI CS No Display chip select
GPIO? Fan PWM Partial Air exchange fan
GPIO? LED PWM Partial Light control

Teardown Process

The detailed teardown revealed:

  1. Modular Design: Separate boards for different functions
  2. Co-processor System: Secondary processor for specialized tasks
  3. Safety Features: Multiple fail-safes and monitoring systems
  4. Upgrade Potential: Accessible programming interface

Reverse Engineering Methodology

Tools Used

  • Multimeter for continuity testing
  • Logic analyzer for protocol analysis
  • Oscilloscope for signal analysis
  • Hot air station for component inspection

Techniques Applied

  1. Visual Inspection: PCB trace following
  2. Firmware Analysis: Dumped and examined original firmware
  3. Protocol Sniffing: I2C, SPI, and UART monitoring
  4. Component Identification: Datasheet correlation

Current Challenges

Humidifier Fan Issue

The humidifier fan control remains problematic:

  • Initialization sequence not fully understood
  • Co-processor communication critical
  • Requires specific boot sequence

Display Integration

Without display support:

  • No visual feedback on device
  • Web interface compensates
  • Future development priority

Community Contributions

Several community members have contributed findings:

  • I2C packet captures
  • GPIO discoveries
  • Protocol analysis
  • Hardware modifications

Safety Considerations

When reverse engineering:

⚠️ Warning: Modifying hardware voids warranty and may damage the device.

  1. Always work with device unplugged
  2. Be careful with voltage measurements
  3. Document everything before modification
  4. Have backup firmware ready
  5. Use appropriate ESD protection

Future Research Directions

Priority areas for continued investigation:

  1. Complete GPIO Mapping: Identify all pin functions
  2. Display Support: Enable screen functionality
  3. Co-processor Protocol: Full communication decode
  4. Audio Features: Enable sound feedback
  5. Advanced Sensors: Explore unused capabilities

Resources and References

Documentation

Tools and Software

How to Contribute

If you’re interested in contributing to the reverse engineering effort:

  1. Document Findings: Share any discoveries, no matter how small
  2. Provide Captures: Logic analyzer or oscilloscope traces
  3. Test Theories: Verify hypotheses about functionality
  4. Share Code: Contribute test code or tools
  5. Ask Questions: Engage with the community

Visit the GitHub repository to share your findings or ask questions.

Disclaimer

This reverse engineering is for educational and interoperability purposes. Always respect intellectual property rights and use this information responsibly. The project aims to provide open-source alternatives and extend device functionality, not to infringe on proprietary systems.