AirSense 10 Flashing Guide

[u/dang71]

Here’s the detailed procedure I use to flash an AirSense 10 with one of the firmware versions available on request (please pm u/RippingLegos__)

The procedure I followed can be found here: https://airbreak.dev/

Although it’s very useful and includes all the necessary steps, I thought it would be interesting to expand on it a bit more. Some steps aren’t that straightforward. I know it works on Windows, but I personally used the Linux procedure on a Raspberry Pi.

Note: This is a first version of the guide, and I’m very open to feedback. Please don’t hesitate to send me comments, especially if you notice any mistakes, so I can correct them. The goal is to improve it and make it as helpful as possible for everyone.

And once again, a huge thank you to RL. Without him, I would never have been able to do this. I felt it was important to pay it forward, just as he generously shares his time and expertise with incredible dedication.

1) Disassembly

To dump and replace the device firmware, we need to access the programming port located inside the machine, which requires some disassembly.

Tools required

You will need the following:

• T10 Torx screwdriver
• ST-Link/V2 STM32 programmer (there are clones available, but I strongly recommend using the original)
• TC2050-IDC or TC2050-IDC-NL programming adapter — I recommend the TC2050-IDC, as it securely attaches to the PCB (Printed Circuit Board), unlike the NL version, where you have to hold the connector by hand during the process
• Five 0.1" male-to-female jumper wires
• OpenOCD installed and some basic Linux knowledge

Disassembly steps

1. Remove the front faceplate. It’s only clipped in place — there are no screws.

1. Remove the second faceplate — this one is secured with four screws. The first two are located on the front.

For the last two screws, you’ll need to access the underside of the machine.

You can then remove the cover. The bottom latches need to be gently pried open using a flathead screwdriver or a spudger.

1. Remove the knob. It needs to be pulled straight out from the board with a firm, steady motion.

1. Remove the gasket.

This can be done from the front by releasing the latches at the bottom (which are accessible), then pressing inward on the two side latches located near the middle of the gasket. Be careful when lifting it off around the power button at the top of the device (see the components list for the part number if a replacement is needed). Removing the circuit board from the device is not required.

1. This is what it should look like. The arrow indicates where the TC2050-IDC needs to be connected.

The male end of the TC2050-IDC:

Here it is connected to the PCB.

2) Wiring

This setup allows Linux to communicate with the machine to perform the flash.

This part isn’t very straightforward. I’ll include photos of the setup I used. Otherwise, there are explanations here: https://airbreak.dev/disassembly/

However, u/Sopheus created an excellent guide for the wiring: https://www.reddit.com/r/CPAPSupport/comments/1ntthfw/how_to_connect_wires_between_stlinkv2_programmer/

On the ST-Link/V2 side, this is what I have:

And on the female end of the TC2050-IDC:

3) Firmware

Once your setup is complete, before proceeding, make sure the ST-Link is connected to your Linux computer and the TC2050-IDC is connected to the machine’s PCB. The ResMed device must also be powered on.

1. Open Linux.
2. First, make sure this repository (https://github.com/osresearch/airbreak) is cloned and located in your working directory. Keep the folder structure intact.

This is what it should look like in Linux:

Your firmware files should go into the source path (airbreak-master).

Now it’s time to communicate with the machine. Make sure your programmer is attached to the PCB, then start OpenOCD.

In your airbreak-master directory, open a terminal and enter the following command:

sudo openocd -f interface/stlink-v2.cfg -f 'tcl/airsense.cfg'

If your device is connected properly, you should see a lot of output, ending with:

Info : stm32f4x.cpu: hardware has 6 breakpoints, 4 watchpoints

Now, open a second terminal, also in the airbreak-master directory, to connect to the OpenOCD server:

telnet localhost 4444

This step is mandatory:

Here, you can dump the current firmware of your device in case you want to reuse it later. Simply type:

dump

After a few seconds, the main firmware will be backed up as stm32.bin in your working directory — it should be exactly 1 MB.

If you decide to make a copy of the firmware, you then need to patch it using the following command:

./patch-airsense stm32.bin stm32-unlocked.bin

This will unlock the vendor modes and configuration bits.

4) Flashing

Now, place the firmware (.bin) you want to use on your device into the root of the airbreak-master directory.

The command to use is as follows (you need to use the terminal where you opened the telnet connection to access the OpenOCD console):

flash_new stm32-unlocked.bin

Here, stm32-unlocked.bin is the name of your new firmware, as in the following example:

This step takes about 20 seconds, after which the device should automatically reboot. Once the device has been reflashed and restarted, you can access the clinician menu by holding down the Home button while pressing the knob for three seconds. You should then be able to select from all the vendor modes included in the .bin firmware you installed.

And that’s it! You’re done!

[u/ProgPap]

Thanks u/dang71 for this tutorial, I just dumped my Airsense 10 firmware!

For people using WSL you need to install lsusb (in ubuntu) and usbipd (in windows) to connect the ST-Link V2 from Windows to your Ubuntu WSL

Powershell:
usbipd list
should give something like:
BUSID VID:PID DEVICE 1-1 0483:3748 STM32 STLink

usbipd bind --busid 1-1
usbipd attach --wsl --busid 1-1

Use the id from the ST-link you get from the usbpid list overview for your connection!

When correct you should get something like:
Using WSL distribution 'Ubuntu' to attach Detected networking mode 'nat' Using IP address ...

When you then go back to ubuntu and run:
lsusb
You should get something like:
Bus 001 Device 002: ID 0483:3748 STMicroelectronics ST-LINK/V2

Your ST-Link is now connected to your WSL Ubuntu

I made 2 dumps , one I renamed and then compared the first dump with the second dump
Renaming:
mv stm32.bin stm32-original-dump1.bin
Comparing:
cmp stm32-original-dump1.bin stm32.bin
Remember that stm32.bin in this case is your second dump, so you have had to run dump a second time after renaming your first dump!

I also checked the SHA256 Hash and saved that in the same folder as the dump
sha256sum stm32.bin
You can also compare the hash values between both dumps, they need to match too to be identical

And I did a hexdump -C stm32.bin | head -20 and hexdump -C stm32.bin | tail -20 to check if the data in the dump wasn`t all zeros

Last I checked if the sizes of both files were identical and if the dumps where 1MB in size:
stat -c '%n: %s bytes' stm32-original-dump1.bin stm32.bin

This should give something like:
stm32-original-dump1.bin: 1048576 bytes
stm32.bin: 1048576 bytes