Locked CN X4 Pro (stock V7.4.4): 10013 caused by W32Time on UDP 123; full OTA installs fail at 100%, Escape Hatch works

[djw42]

Device / setup

• Xteink X4 Pro, USB-locked, AliExpress (China region), stock V7.4.4
• device_type ESP32S3_X4_TL_SSD1677, ota_type=0
• Xteink OTA Unlocker for Windows, unlocker-helper v0.2.38, Windows 11
• Result: CrossPoint 1.6.0 now running, via Escape Hatch. Details below in case they help others.

---

Problem 1: os error 10013 right after DNS server bound

Same symptom as crosspoint-reader#3383: hotspot starts, DNS binds on 192.168.137.1:10053, then the install fails with 10013 before the device is involved. No further log lines, even with RUST_LOG=...=debug.

Cause: the Windows Time service (W32Time) was holding UDP 0.0.0.0:123, which blocks the helper's SNTP responder.

• Stopping/disabling ICS (SharedAccess) and hns did not help. Mobile Hotspot restarts ICS anyway.
• This fixed it immediately:

Stop-Service W32Time -Force
sc.exe config W32Time start= disabled

Afterwards: sc.exe config W32Time start= demand

Suggestion: check that UDP 123 is free before starting (or log the NTP bind and its error), and mention W32Time in the Windows troubleshooting.

---

Problem 2: full firmware installs over OTA fail at 100% on V7.4.4

With 10013 fixed, the CrossPoint 1.6.0rc X4 Pro install got much further:

• Device requested check-update on api-prod.xteink.cn with ota_type=0
• Unlocker served the encrypted_v1 manifest; device downloaded the full .xota (5,341,242 bytes, xota stream complete)
• Device then showed "Update failed. Check network or try again later." and stayed on stock. No further requests after the download. Identical on a retry.

What I checked offline (decrypting with the key/layout from xota.rs):

• The Unlocker's .xota decrypts correctly with the channel-0 key; metadata (V8.2.0 / ESP32S3_X4_TL / SSD1677, flags 00 00) is well formed
• Decrypted image sha256 matches plain_sha256; ESP image checksum and appended SHA-256 are valid; chip ESP32-S3; secure_version 0
• The genuine Xteink V7.5.10 package decrypts with the same key; its image is xteink_app / 7.5.10, secure_version 0. The CrossPoint image identifies as arduino-lib-builder / 8cabf2c.

However, the official Xteink V7.5.10 update also failed the same way on this device (reached 100%, then the same generic error). So on this unit the failure doesn't look specific to the Unlocker's packaging or the app identity. V7.4.4's updater appears unable to complete full-size updates at all. (Xteink's 7.5.10 changelog lists "fixed occasional OTA failures".)

---

What worked

1. Unlocker → X4 Pro → Firmware screen → Save for SD on CrossPoint 1.6.0rc X4 Pro → copied to SD root as update.bin
2. "Is your OTA update failing to complete?" → Flash Escape Hatch firmware → device check-update → Escape Hatch installed and booted
3. In Escape Hatch, selected update.bin → flashed → CrossPoint 1.6.0 boots

Suggestion: for X4 Pro, when a full install fails after the download completes, point users to Escape Hatch more prominently (for example, in the failure screen). It is the path that worked here after hours of other attempts.

Happy to provide logs or test builds.