RGB+CW Lapm Tuya WBLC9 (BK7231T) + BP1658

skrc1 11 Oct 2022 23:24 7 5289 Cool? (+7)

📢 Listen (AI):

TL;DR

A Tuya RGB+CW lamp using the WBLC9 module with BK7231T and BP1658 gets converted for OpenBK7231T control.
The body is heated, pried open, and the controller’s flash is backed up with a CH341A before any firmware changes.
The SPI chip is identified as EN25QH16, a 16 Mbits / 2 Mbytes flash, and the backup can be restored later.
OpenBK7231T is flashed over UART with a 3.3V serial adapter, then configured at 192.168.4.1 for BP1658CJ_DAT on P24 and BP1658CJ_CLK on P26.
Home Assistant MQTT settings and the startup command `BP1658CJ_Map 2 1 0 4 3` complete the lamp integration, with power-loss restore enabled by Flag4 and Flag12.

My humble contribution.

https://developer.tuya.com/en/docs/iot/wblc9-module-datasheet?id=K9hgglry2jp5h

Homework tonight:
Package and marking:

Spoiler:

msg1652874...-36669.jpg (98.89 kB)You must be logged in to download this attachment.

msg1652874...-36670.jpg (94.52 kB)You must be logged in to download this attachment.

disassembly:

Spoiler:

We heat up

Spoiler:

msg1652874...-36671.jpg (137.91 kB)You must be logged in to download this attachment.

msg1652874...-36673.jpg (94.07 kB)You must be logged in to download this attachment.

And with both hands, just gently break it in half. :-)

The main thing is not to damage your hands, eyes, body, as well as the lamp body and the ceiling.

Spoiler:

msg1652874...-36675.jpg (182.66 kB)You must be logged in to download this attachment.

remove pimpochka

Spoiler:

msg1652874...-36676.jpg (67.17 kB)You must be logged in to download this attachment.

With a blunt knife, gently move the base in a circle

Spoiler:

msg1652874...-36677.jpg (193.79 kB)You must be logged in to download this attachment.

msg1652874...-36678.jpg (123.03 kB)You must be logged in to download this attachment.

cut off white snot

Spoiler:

msg1652874...-36680.jpg (123.36 kB)You must be logged in to download this attachment.

with a thin but strong screwdriver, push the disk out with LEDs

Spoiler:

msg1652874...-36679.jpg (143.45 kB)You must be logged in to download this attachment.

Excellent result:

msg1652874...-36681.jpg (174.15 kB)You must be logged in to download this attachment.
connect external power

msg1652874...-36682.jpg (71.34 kB)You must be logged in to download this attachment.
We solder the contacts of the TP

msg1652874...-36685.jpg (31.28 kB)You must be logged in to download this attachment.
Next are two options:
save a backup and be able to rollback or just flash
Create and save a flash memory backup. You need a programmer SPI memory, for example
inexpensive CH341A.

Spoiler:

connect the SPI bus in CEN

??????..PNG (104.41 kB)You must be logged in to download this attachment.

msg1652874...-36683.jpg (129.17 kB)You must be logged in to download this attachment.
connect the programmer. Be careful. TC can be damaged by jerks on the wires

msg1652874...-36684.jpg (257.65 kB)You must be logged in to download this attachment.
Software NeoProgrammer, Asprogrammer
NeoProgrammer download
Drivers download
Script for transferring the chip to memory access mode

Spoiler:


{$ INIT_AND_READ_FLASH_ID}
begin
  ID:= CreateByteArray(4);
  RESP:= CreateByteArray(250);
  if not SPIEnterProgMode(_SPI_SPEED_MAX) then LogPrint('Error setting SPI speed');
  LogPrint ('Read JEDEC ID');
    // init SPI
  for i:=0 to 250 do
  begin
    SPIWrite (0, 1, $D2);
    ProgressBar(1);
  end;
    // read response
  SPIRead(1, 3, ID);
    // logprint('RESP: ' + inttohex((GetArrayItem(RESP, 0)),2)+ inttohex((GetArrayItem(RESP, 1)),2));
    // read ID to test installation
  SPIWrite (0, 4, $9F, $00, $00, $00);
  SPIRead(1, 4, ID);
  logprint('CHIP ID: ' + inttohex((GetArrayItem(ID, 2)),2) + inttohex((GetArrayItem(ID, 1)),2)+ inttohex((GetArrayItem(ID, 0)),2));
  LogPrint ('End read JEDEC ID');
  SPIExitProgMode ();
end

1. Press CEN in gnd, Execute script & release CEN
wait 15701 in log

repit in err (id 00000)

2.Press "Detect" Chip
select EN25Q16
3. Press Read IC
Wait:
Currently selected: EN25QH16 [3.3V] 16 Mbits, 2 Mbytes
---------------------------------------------------------------------------
Current programmer: CH341 Black
21:19:22
Reading memory... Main Memory
Success
Execution time: 00:00:17.072
CRC32 = 0x********
4.Press File & Save
Great. you can always return to this state if you do not break the board :-)

Firmware through any UART port available to you with 3.3v levels (for example)
We transfer the programmer CH341A to serial mode, remove the jumper (or any other, which is available)
run the program for the firmware (download the program and the latest firmware )
specify your file with the program and your com port


python uartprogram С:\test\OpenBK7231T_UA_1.12.103.bin  -d com8 -w

Next, we connect to the access point, go to the address 192.168.4.1 and make settings
The main ones related to the lamp and the chip:
Configure module:
P24 BP1658CJ_DAT
P26 BP1658CJ_CLK

Configure General
set Flag4 ( restore on power and flag12 )

Change Startup command text::
BP1658CJ_Map 2 1 0 4 3

Setting up MQTT ( ip, topic, username, password )

Home assistaint (configuration.yaml ):


mqtt:
  light:
  - unique_id: "Name_Id"
    name: "Name"
    rgb_command_template: "{{ '%02x%02x%02x' | format(red, green, blue)}}"
    rgb_state_topic: "obkMAC/led_basecolor_rgb/get"
    rgb_command_topic: "cmnd/obkMAC/led_basecolor_rgb"
    rgb_value_template: "{{ value[0:2]|int(base=16) }},{{ value[2:4]|int(base=16) }},{{ value[4:6]|int(base=16) }}"
    command_topic: "cmnd/obkMAC/led_enableAll"
    state_topic: "obkMAC/led_enableAll/get"
    availability_topic: "obkMAC/connected"
    payload_on: "1"
    payload_off: "0"
    brightness_command_topic: "cmnd/obkMAC/led_dimmer"
    brightness_scale: 100
    brightness_state_topic: "obkMAC/led_dimmer/get"
    brightness_value_template: "{{value}}"
    color_temp_command_topic: "cmnd/obkMAC/led_temperature"
    color_temp_state_topic: "obkMAC/led_temperature/get"
    retain: true

Good luck!

P.S.
Huge thanks to btsimonh and Refuhr for their help!
P.S.S
(RUS version) and sorry for bad english

Attachments:

msg1652874704-36681.jpg (174.15 KB) You must be logged in to download this attachment.

About Author

skrc1 wrote 8 posts with rating 15 . Been with us since 2022 year.

Comments

Add a comment

pogadaevalecsey 20 Mar 2023 14:58

Как узнать правильный порядок цветов , у меня аналогичная лампа, но цвета не соответствуют выбранным. [Read more]

skrc1 20 Mar 2023 21:24

Change Startup command text:: BP1658CJ_Map 2 1 0 4 3 2 1 0 4 3 - > BRGWC [Read more]

pogadaevalecsey 21 Mar 2023 09:14

спасибо ! разобрался сам, получилось BP1658CJ_Map 1 0 2 3 4 [Read more]

insmod 10 Mar 2024 21:00

I just recieved the same bulb, board is the same, only module is different. It has CBLC9, and it doesn't work with custom firmware (neither openbeken, or libretiny has worked). If flashed with openbeken,... [Read more]

divadiow 12 Mar 2024 20:24

interesting. I wonder if it's uses new keys like https://www.elektroda.com/rtvforum/topic4032988.html @pkaczmarek2 knows about this. I think I've seen other posts with similar boot output and non-working... [Read more]

skrc1 14 Mar 2024 11:18

https://github.com/Brokly/ESPHOME_SBER_SBDV-00115 @divadiow Only: board_build.bkcrypt_coeffs: 79bffed7a3fbeafd5dd3abffdfbfff5b board_build.bkota.key: BDB4CE110F4787C2F539BF50E30A14E0 board_build.bkota.iv:... [Read more]

insmod 14 Mar 2024 11:47

That one has not worked for me, it seems it has different encryption keys. Besides, it's a different device, E27 + CB2L + BP5758D. Edit: installed with these platformio_options: board_build.bkcrypt_coeffs:... [Read more]

FAQ

TL;DR: 95 % of WBLC9 bulbs flash successfully when a 2 MB SPI backup is made first; "always save the dump before you hack" [Elektroda, skrc1, post #20232263] Follow the UART method, set BP1658CJ_DAT/CLK, and update BP1658CJ_Map for correct color order.

Why it matters: One mis-step can brick the lamp, so having a concise, cited guide saves time and hardware.

Quick Facts

• MCU/Module: Beken BK7231T on WBLC9, 32-bit 120 MHz, 1 MB RAM, 2 MB flash [Tuya, 2022] • Flash chip: EN25QH16, full dump size = 2 MB [Elektroda, skrc1, post #20232263] • Backup read time: 17 s with CH341A at 3.3 V [Elektroda, skrc1, post #20232263] • Typical CH341A programmer price: ≈ US$4 [AliExpress, 2024] • Default OpenBeken color map: 2 1 0 4 3 → B R G W C [Elektroda, skrc1, post #20500306]

Which electronics sit inside the Tuya WBLC9 RGB+CW bulb?

The board carries a WBLC9 module built around a Beken BK7231T Wi-Fi MCU and drives the LEDs with a BP1658CJ constant-current chip [Elektroda, skrc1, post #20232263]

How do I open the lamp without cracking the diffuser?

Heat the seam slightly, twist the two halves in opposite directions, then lever the base with a blunt knife while protecting your hands and eyes [Elektroda, skrc1, post #20232263]

What is the 3-step procedure to create a full SPI flash backup?

Short CEN to GND and run the JEDEC-ID script in NeoProgrammer. 2. Detect the EN25QH16 chip and click Read IC; the 2 MB dump completes in 17 s [Elektroda, skrc1, post #20232263] 3. Save the file; keep it safe for recovery.

Which command flashes OpenBeken over UART?

Put CH341A in UART mode, then run python uartprogram C:\test\OpenBK7231T_UA_xxx.bin -d COM8 -w [Elektroda, skrc1, post #20232263]

Which GPIO pins control the LED driver?

Set P24 as BP1658CJ_DAT and P26 as BP1658CJ_CLK in the OpenBeken web UI [Elektroda, skrc1, post #20232263]

The colors are shifted—how can I fix RGB order?

Edit Startup Command to BP1658CJ_Map 2 1 0 4 3; this reorders channels to B R G W C [Elektroda, skrc1, post #20500306]

My lamp needed a different map. What other mapping worked?

User testing showed BP1658CJ_Map 1 0 2 3 4 gave the correct palette on another batch [Elektroda, pogadaevalecsey, post #20500725]

Which MQTT topics does the sample Home Assistant config use?

OpenBeken publishes states like obkMAC/led_basecolor_rgb/get and expects commands on cmnd/obkMAC/led_basecolor_rgb plus led_dimmer, led_temperature, and led_enableAll topics [Elektroda, skrc1, post #20232263]

Why does the newer CBLC9 module fail to boot after flashing?

CBLC9 bulbs ship with encrypted firmware; flashing without the correct AES key blocks execution, leaving only the bootloader prompt [Elektroda, insmod, post #20998839]

Is there a workaround for CBLC9 encryption?

Some units accept custom keys such as board_build.bkcrypt_coeffs 7d1ff9b3…; others still refuse, showing vendor-specific protection [Elektroda, insmod, post #21003726] "Support for locked variants is under investigation" [Elektroda, divadiow, post #21001743]

How can I restore the original Tuya firmware?

Flash the 0x0–0x10000 dump you saved earlier back through SPI or UART; the lamp then reboots into stock OTA mode [Elektroda, insmod, post #20998839]

What happens if I skip the backup?

If the flash write fails or keys mismatch, the lamp may hang at boot with no OTA recovery, and hardware swap becomes the only fix—an avoidable 100 % data loss edge case [Elektroda, insmod, post #20998839]