Sol-Ark response to reports of Deye inverters shutting down

[MarVerde]

Good day everyone, my name is Simon McLean and I work as VP of Marketing at Sol-Ark. I have the following response to the reports which came up over the week-end.

Sol-Ark has learned of the situation caused by the unauthorized sales of Deye-branded inverters within Puerto Rico and the USA. Though Sol-Ark has no control over Deye’s actions, we recognize that the messaging conveyed through the Deye-branded inverter’s screen suggests Sol-Ark can provide warranty or service for these cases, which we cannot. Though we are not responsible for Deye-branded inverters or any inverters that are not branded and sold by Sol-Ark or through an authorized Sol-Ark distributor or reseller, Sol-Ark has determined to offer a possible solution to those consumer households that have purchased Deye-branded inverters.

Sol-Ark’s mission, as a veteran-owned company created 12 years ago, is to enable the most reliable, innovative, and affordable energy storage solutions to power families and businesses. Because of this mission and the direct effect that Deye’s actions may have on individual families, for the period from November 15, 2024 through December 31, 2024, Sol-Ark will permit each consumer household that has installed a Deye-branded inverter and has had that inverter’s functions disabled by Deye, to purchase a new Sol-Ark inverter of equivalent performance at a substantially discounted price. If you purchase a Sol-Ark inverter under this limited program, Sol-Ark will pay to have the Sol-Ark unit shipped to your address in Puerto Rico. Sol-Ark will not make this offer available to any person after December 31, 2024. The offer is limited to consumer households and is not being made available to commercial entities or for installation at commercial facilities (only residential locations). Sol-Ark will not be responsible, and will not pay, for any costs related to installation of the Sol-Ark inverter, removal of any Deye inverter or for any damage that may have been caused by the Deye inverter or Deye’s actions.

To take advantage of this offer, the homeowner should take a photo of the serial number and model number of their Deye inverter and then contact Adriana Navarro of Sol-Ark at +1 (214) 919-1632 to initiate the process during normal business hours between 8 AM and 5 PM Eastern Standard Time Monday through Friday. Sol-Ark will retain the full right and discretion to make final determinations regarding the availability of this program and the terms under which it operates.

Only lies, they have shutdown my Inverter in Costa Rica too, and Deye tells my supplier it was SolArk and the Deye support tells me the same have all the emails, you and Deye want to sell more and destroy the Inverter from the people, but we have the choice too” NO MORE INVERTER FROM DEYE OR SOLARK” both are LIERS

 

[MarVerde]

Only lies, they have shutdown my Inverter in Costa Rica too, and Deye tells my supplier it was SolArk and the Deye support tells me the same have all the emails, you and Deye want to sell more and destroy the Inverter from the people, but we have the choice too” NO MORE INVERTER FROM DEYE OR SOLARK” both are LIERS

For poeple who think I have bought the inverter because it was cheaper in china, no I have bought the EU version with the intention to use 380V/400V

 

[Danke]

Only lies, they have shutdown my Inverter in Costa Rica too, and Deye tells my supplier it was SolArk and the Deye support tells me the same have all the emails, you and Deye want to sell more and destroy the Inverter from the people, but we have the choice too” NO MORE INVERTER FROM DEYE OR SOLARK” both are LIERS

Can you take screenshots of the emails and post them?

 

[gmbeihl]

I hope if someone gives up on one of the bricked deyes they would let me have it. That way I can try to make a firmware patch that would :

a: fix the bricking for people.

b: remove all control over it by deye and any other online source.

Since this would be a patch there is nothing anyone can do about it since it would be patching the existing firmware image and would not be providing a firmware in itself.

Firmware might be digitally signed so you better reverse the entire boot path...

 

[MarVerde]

Can you take screenshots of the emails and post them?

You the Deye tells it is SolArk and SolArk is telling us its Deye and I have bought it from Deye. Why I should ask SolArk for support? Booth are onl LIERS

 

[SparkyJJO]

The plot thickens.

 

[CaliSunHarvester]

You the Deye tells it is SolArk and SolArk is telling us its Deye and I have bought it from Deye. Why I should ask SolArk for support? Booth are onl LIERS

Ahh.. ein Landsmann in Costa Rica.

And the SolArc guy said all they can do is sell you a new one. This shows that SolArc is a bad actor.

 

[Quattrohead]

The plot thickens.

Not really, I think the layers of onion are being peeled back.

 

[ksmithaz1]

I hope if someone gives up on one of the bricked deyes they would let me have it. That way I can try to make a firmware patch that would :

a: fix the bricking for people.

b: remove all control over it by deye and any other online source.

Since this would be a patch there is nothing anyone can do about it since it would be patching the existing firmware image and would not be providing a firmware in itself.

This would be an interesting exercise. I'm still confused a bit... It sounds like a bunch of fake sol-ark products hit the market, that were then shut down by some means. I doubt there is much in the way of keys protecting the firmware on these things. Is there a standard ASIC inside these things that control the various functions? Do you have the needed expertise? Is there a JTAG port or something for IFL?

 

[cs1234]

This would be an interesting exercise. I'm still confused a bit... It sounds like a bunch of fake sol-ark products hit the market, that were then shut down by some means.

No, they are "legitimate" Deye units being bricked because of marketing arrangements with distributors in certain regions. You have some reading to catch up on.

Thread 'CHINA kills all non Sol-Ark branded DEYE unit in the USA this morning.'

Nov 15, 2024

Ethics-wise you are literally shutting down equipment homeowners paid for and depend on to fit some twisted business strategy.
literally seeing dozens of people call me all morning, and I never even sold Deye

EDIT 11/19/24
After this issue has turned out to be a strategy to disable and "brick" inverters that were not the listed USA partner brand (and hilariously bricked some USA branded units by accident showing their total control over all their hardware) EG4 and Luxpowertek released a joint statement signed by both company owners re-affirming the absolute rights of the end users...

• James Showalter
• Replies: 2,653
• Forum: Cybersecurity

• 
• 
• 

 

[Solar Guppy]

I doubt there is much in the way of keys protecting the firmware on these things. Is there a standard ASIC inside these things that control the various functions?

Highly unlikely, Hybrid's use DSP processors and these have built-in protections including from Jtag, OTP memory typically where the code that unpacks the encrypted binary firmware is decoded then written to internal DSP's flash which is protected. It's and end to end process, the days of hacking like from the movie War Games is mostly a Hollywood thing.

 

[ksmithaz1]

Highly unlikely, Hybrid's use DSP processors and these have built-in protections including from Jtag, OTP memory typically where the code that unpacks the encrypted binary firmware is decoded then written to internal DSP's flash which is protected. It's and end to end process, the days of hacking like from the movie War Games is mostly a Hollywood thing.

"War Games" was done with a modem connecting to some insecure site in a nuclear silo and typing some commands on a cli. Totally bogus but silly fun. Booting up an SOC from a JTAG port is a totallly different thing. A "DSP" or Digital Signal Processor is a different animal. I would not expect a pure-play DSP not designed to do much but a lot of A/D. My expectation would be a custom SOC with a bunch of A/D inputs and outputs similar to (say) an RPI. The average phone has an SOC/jtag and usually there is some way (Short a jumper or trace) for force it to boot/load from the JTAG. There are one-shot type devices, a U2F key comes to mind, that are OTP'd but generally I would think something like this would not have that level of physical security.

 

[740GLE]

No, they are "legitimate" Deye units being bricked because of marketing arrangements with distributors in certain regions. You have some reading to catch up on.

Thread 'CHINA kills all non Sol-Ark branded DEYE unit in the USA this morning.'

Nov 15, 2024

Ethics-wise you are literally shutting down equipment homeowners paid for and depend on to fit some twisted business strategy.
literally seeing dozens of people call me all morning, and I never even sold Deye

EDIT 11/19/24
After this issue has turned out to be a strategy to disable and "brick" inverters that were not the listed USA partner brand (and hilariously bricked some USA branded units by accident showing their total control over all their hardware) EG4 and Luxpowertek released a joint statement signed by both company owners re-affirming the absolute rights of the end users...

• James Showalter
• Replies: 2,653
• Forum: Cybersecurity

• 
• 
• 

With the guy having a EU spec unit bricked in Costa Rica, (as well as the Panama bricked unit) you now have to factor in gross incompetence on Deyes implementation of the alleged solarks orders.

They meant to only impact units in SolArks territory, yet impacted legit sales.

They used a hatchet when needed to use a scalpel.

 

[Solar Guppy]

I would not expect a pure-play DSP not designed to do much but a lot of A/D. My expectation would be a custom SOC with a bunch of A/D inputs and outputs similar to (say) an RPI.

From a Youtube Video of a teardown of a Deye Hybrid, they use the TI TMS320F2802 DSP for the inverter / power section and an arm processor for the HMI.

This TI TMS320 processor family was released in 2004 time frame and it was used in Xantrex Schneider XW series in charge controllers and inverters, I know its also used in Solis inverters. I doubt there a hybrid one without, nothing else matches the price / performance.

 

[Browse]

It would be great if someone reverse engineered the bricked Deye models to overcome the firmware restrictions and prevented them from ever being messed with by the manufacturer again.

 

[ULR]

From a Youtube Video of a teardown of a Deye Hybrid, they use the TI TMS320F2802 DSP for the inverter / power section and an arm processor for the HMI.

This TI TMS320 processor family was released in 2004 time frame and it was used in Xantrex Schneider XW series in charge controllers and inverters, I know its also used in Solis inverters. I doubt there a hybrid one without, nothing else matches the price / performance.

According to the manual:
(https://www.ti.com/lit/ds/symlink/t...ps%3A%2F%2Fwww.ti.com%2Fproduct%2FTMS320F2802)

9.1.10 Security

The 280x devices support high levels of security to protect the user firmware from being reverse engineered.
The security features a 128-bit password (hardcoded for 16 wait-states), which the user programs into the flash.
One code security module (CSM) is used to protect the flash/OTP and the L0/L1 SARAM blocks. The security
feature prevents unauthorized users from examining the memory contents via the JTAG port, executing code
from external memory or trying to boot-load some undesirable software that would export the secure memory
contents. To enable access to the secure blocks, the user must write the correct 128-bit KEY value, which
matches the value stored in the password locations within the Flash.

So (if they set it up properly) it won't be practical to try to read the current contents with just the device,
or overlay an existing load with a patch.

Haven' t read far enough to be sure, but I expect it to be possible to reflash it "like a virgin", erasing
whatever it currently contains without reading it.

So you'll pretty much need, not just a bricked device, but also a firmware load and the tools to install it.
Then you should be able to logic-analyze the update process to get the key, at least for the
particular version you're installing - maybe for the product line. (Unless the flashing tool
generates a per-device custom key...). After that you can try to analyze and modify the update
image (on external media) to make a patched one. Assuming it doesn't need to be signed
you'll have something that can debrick-and-replace-firmware on bricked Deyes.

If you can get hold of a firmware update image you might be able to decompile it and
figure out the unbricking code. Then if they didn't use good enough crypto you might
be able to make a debricking key generator.

Not easy. Maybe doable. Lot of work. How much/possible depends on how lazy,
rushed, or incompetent the guys who set up and who used the product's security design were.

Hope is not lost. Soft/firm-ware projects tend to skimp on security in order to avoid missing
the competitive "winddow" and thus the market opportunity. (That's why so many devices
have rotten security: Spend the time to do it right and three of your competitors who don't
do that beat you, get the whole market, and you're an also-ran and bankrupted.)

 

[On_The_Road]

Or LUXpower

The joint statement from EG4 and Luxpower inspires confidence.

Money given to solark is money given to Deye. I don't support deye's actions.

 

[Brandon.UnizSolar]

Someone know how to unlock bricks?

 

[TM48]

Hammer?

 

[cvanmeter]

I was on the fence between Solark and EG4.

I am no longer in the fence.

EG4 all the way.

I am in the same place. Started the planning to begin purchase and building system this spring. I was leaning Solark, but the Gridboss had me looking at EG4. This debacle has solidified the decision for me and plan to soon purchase from EG4. Some may disagree with me, which is fine. However, this is my hard earned money and will spend it how I choose.

 

[cs1234]

I am in the same place. Started the planning to begin purchase and building system this spring. I was leaning Solark, but the Gridboss had me looking at EG4. This debacle has solidified the decision for me and plan to soon purchase from EG4. Some may disagree with me, which is fine. However, this is my hard earned money and will spend it how I choose.

At least the OEM for EG4 has not intentionally, as of yet, to the best of my knowledge, remotely disabled their customers private property.

 

[OutlawSolar]

At least the OEM for EG4 has not intentionally, as of yet, to the best of my knowledge, remotely disabled their customers private property.

There is day and night difference between, committed murder and has a potential to commit murder.
Deye/?????, you have done it.

 

[marionw]

Many devices that permit the uploading of new firmware actually have two copies of the firmware embedded in the device. One is able to be updated and the other is a fallback oftentimes requiring using a particular power on sequence or reset. The inverters may have such a capability where a particular set of the front panel "Menu" buttons needs to be held down during the power on sequence causing the device to boot from the failsafe firmware

 

[myles]

Many devices that permit the uploading of new firmware actually have two copies of the firmware embedded in the device. One is able to be updated and the other is a fallback oftentimes requiring using a particular power on sequence or reset. The inverters may have such a capability where a particular set of the front panel "Menu" buttons needs to be held down during the power on sequence causing the device to boot from the failsafe firmware

People start trying this!

 

[cdsolar]

Note: Factory Reset may only be for settings, not firmware, but worth a try.

Someone might want to read the manual for a bricked inverter to start...

A customer with one of these inverters, not bricked, who has access to Deye or distributor support, should ask if this is possible (use embedded as opposed to updated firmware and how to do it) and once determined, post it here, and Brickees can figure out if they can do it too.

I do not have a Deye, nor make any claims about knowledge of them. If you want to try this, I can't help.