--- title: SwitchBot art frame follow-up: the firmware is readable description: A follow-up to a teardown of the SwitchBot AI Art Frame reveals the firmware's RBL blob is decryptable using RT-Qboot's stock AES+GZIP algorithm, not a dead... canonical: https://daily.dev/posts/switchbot-art-frame-follow-up-the-firmware-is-readable-c0zntezuf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SwitchBot art frame follow-up: the firmware is readable | daily.dev og:description: A follow-up to a teardown of the SwitchBot AI Art Frame reveals the firmware's RBL blob is decryptable using RT-Qboot's stock AES+GZIP algorithm, not a dead... og:url: https://daily.dev/posts/switchbot-art-frame-follow-up-the-firmware-is-readable-c0zntezuf og:image: https://api.daily.dev/og/posts/C0zNTezUf.png og:image:alt: SwitchBot art frame follow-up: the firmware is readable og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SwitchBot art frame follow-up: the firmware is readable **[/dev/io](https://daily.dev/sources/iodev)** · 4 min read · 0 upvotes · 0 comments ## Summary A follow-up to a teardown of the SwitchBot AI Art Frame reveals the firmware's RBL blob is decryptable using RT-Qboot's stock AES+GZIP algorithm, not a dead end as previously thought. The plaintext firmware exposes three display size implementations (7.3", 13.3", 31.5"), image handling routines using a Stucki-derived dithering algorithm, the MQTT-based picture delivery flow, OTA update paths, and certificate provisioning. Open questions remain around whether a modified, repacked firmware image would actually pass boot validation, whether secure boot is enabled, and what recovery options exist after a bad flash. Details on SwitchBot's OpenAPI uploadImage endpoint and its current limitations are also covered. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How is the SwitchBot AI Art Frame's RBL firmware image encrypted? It uses RT-Qboot's algorithm 0x0102, which combines AES encryption with GZIP compression. The stock Qboot key and IV successfully decrypt RBL packages for firmware versions V02 through V15, producing a valid GZIP stream that decompresses into plaintext firmware. This matches an earlier entropy measurement of 7.997 bits per byte, ruling out eFuse-held keys or custom compression. _Firmware reverse engineers tracking IoT device internals can find deep teardown writeups like this on daily.dev._ ### What dithering algorithm does the SwitchBot art frame app use to prepare images for e-paper displays? It uses a custom Stucki-based dithering routine called stuckiDither, applying Stucki's 12-neighbour error diffusion geometry. The diffusion weights sum to 42 but the error is divided by 64, meaning only about 65.6% of quantization error propagates forward, which behaves closer to Atkinson dithering than classic Stucki since part of the error is discarded rather than fully distributed. _Anyone comparing dithering algorithms for e-paper or low-color displays can dig into details like this on daily.dev._ ### Is it possible to boot a modified firmware image on the SwitchBot AI Art Frame? That remains unverified. A full round trip of modifying, repacking, decrypting, and decompressing an RBL image works offline, but whether a modified image passes boot validation, whether secure boot is enabled, and how to recover from a bad flash are all still unknown without direct access to the hardware. _Developers evaluating the hackability and risk of IoT hardware before flashing it can follow findings like this on daily.dev._ ## Similar posts on daily.dev - [Inside the SwitchBot AI Art Frame](https://daily.dev/posts/inside-the-switchbot-ai-art-frame-k3igwvmlz) · /dev/io · 0 upvotes · 0 comments - [Reconstructing Device Firmware From SPI Reads](https://daily.dev/posts/reconstructing-device-firmware-from-spi-reads-0xotr3rl5) · Hackaday · 0 upvotes · 0 comments - [Flipper One Documentation](https://daily.dev/posts/flipper-one-documentation-8ffwsmznr) · Hacker News · 0 upvotes · 0 comments --- Tags: [#backend](https://daily.dev/tags/backend), [#iot](https://daily.dev/tags/iot) [View this post on daily.dev](https://daily.dev/posts/switchbot-art-frame-follow-up-the-firmware-is-readable-c0zntezuf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SwitchBot art frame follow-up: the firmware is readable","url":"https://daily.dev/posts/switchbot-art-frame-follow-up-the-firmware-is-readable-c0zntezuf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/switchbot-art-frame-follow-up-the-firmware-is-readable-c0zntezuf"},"datePublished":"2026-09-29T10:46:11.186Z","dateModified":"2026-09-29T10:46:36.020Z","description":"A follow-up to a teardown of the SwitchBot AI Art Frame reveals the firmware's RBL blob is decryptable using RT-Qboot's stock AES+GZIP algorithm, not a dead...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ae0e2494a9a437117efb57228515c788?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ae0e2494a9a437117efb57228515c788?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"/dev/io","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"/dev/io","logo":"https://media.daily.dev/image/upload/s--xOsuFPZX--/f_auto,q_auto/v1777801594/logos/iodev","url":"https://daily.dev/sources/iodev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/switchbot-art-frame-follow-up-the-firmware-is-readable-c0zntezuf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"backend,iot","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"/dev/io","item":"https://daily.dev/sources/iodev"},{"@type":"ListItem","position":3,"name":"SwitchBot art frame follow-up: the firmware is readable"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/switchbot-art-frame-follow-up-the-firmware-is-readable-c0zntezuf#faq","mainEntity":[{"@type":"Question","name":"How is the SwitchBot AI Art Frame's RBL firmware image encrypted?","acceptedAnswer":{"@type":"Answer","text":"It uses RT-Qboot's algorithm 0x0102, which combines AES encryption with GZIP compression. The stock Qboot key and IV successfully decrypt RBL packages for firmware versions V02 through V15, producing a valid GZIP stream that decompresses into plaintext firmware. This matches an earlier entropy measurement of 7.997 bits per byte, ruling out eFuse-held keys or custom compression. Firmware reverse engineers tracking IoT device internals can find deep teardown writeups like this on daily.dev."}},{"@type":"Question","name":"What dithering algorithm does the SwitchBot art frame app use to prepare images for e-paper displays?","acceptedAnswer":{"@type":"Answer","text":"It uses a custom Stucki-based dithering routine called stuckiDither, applying Stucki's 12-neighbour error diffusion geometry. The diffusion weights sum to 42 but the error is divided by 64, meaning only about 65.6% of quantization error propagates forward, which behaves closer to Atkinson dithering than classic Stucki since part of the error is discarded rather than fully distributed. Anyone comparing dithering algorithms for e-paper or low-color displays can dig into details like this on daily.dev."}},{"@type":"Question","name":"Is it possible to boot a modified firmware image on the SwitchBot AI Art Frame?","acceptedAnswer":{"@type":"Answer","text":"That remains unverified. A full round trip of modifying, repacking, decrypting, and decompressing an RBL image works offline, but whether a modified image passes boot validation, whether secure boot is enabled, and how to recover from a bad flash are all still unknown without direct access to the hardware. Developers evaluating the hackability and risk of IoT hardware before flashing it can follow findings like this on daily.dev."}}]} ```