[W302] Set with RGB LED strip, WiFi controller, remote control and LXU405 power supply

p.kaczmarek2 14 Feb 2024 19:26 3 2778 Cool? (+3)

📢 Listen (AI):

TL;DR

The teardown covers an RGB LED strip kit with a W302 WiFi controller, remote control, and JKY0918-1201500E 12V power supply.
The controller uses a 12V-to-3.3V step-down on 8HMP, three 340S transistors, a microphone, and a W302 chip with SPI flash.
A 2 MB dump in NeoProgrammer identified the memory as ZB25VQ16, 16 Mbits, and the binary contains Tuya references plus RTL8711B SDK fragments.
The JKY02-18W-X02 power supply has a reasonably decent input/output filter, but no fuse or NTC was found at the input.
At PLN 125, the kit looks fine for app-based use, but firmware modification is still unclear and only UART probing is planned.

Generated by the language model.

Today I am presenting a full set with an RGB LED strip, a controller based on the W302 WiFi microcontroller, a 12V JKY0918-1201500E power supply and a remote control. In this topic I will show both the inside of the controller (I will also download its input from the memory chip via SPI) and the power supply.

Purchase of the LXU405 kit
The set was purchased from a Polish distributor for PLN 125:

This is quite a high price, but the set includes a power supply and a strap, not only the controller and remote control:

Instruction:

I`m skipping tests with the application, it has been discussed many times.

LXU405 interior
As usual, on the hooks:

Only inside there is a small surprise waiting for us. It is neither ESP8266 nor BK7231:

Inside you can see a step down converter converting 12V into 3.3V based on 8HMP, three 340S transistors (one per color), a microphone and the most interesting - the W302 chip with SPI memory, where the program probably resides. Could it be some Chinese ESP clone again?
Bottom - maybe programming pads? I also see room for AMS1117-3.3V:

I don`t know yet how to change the input of this system, so maybe I`ll start by copying the memory...

Memory ripping
For this purpose I use a programmer based on CH341, although regarding it I recommend reading on the Internet about converting its power supply to 3.3V. Anyway, I desoldered the memory and soldered it to the socket. I have a brace, but I don`t trust it, it`s not always possible to read the memory in the system.

Operation performed:

On the computer side, I use NeoProgrammer 2.2.0.10, the program immediately recognized the chip as ZB25VQ16, 16 Mbits, type SPI_NOR:

There was a tutorial about it on the English-language Elektroda channel:

In the 2MB batch I downloaded, I see mentions of Tuya:

Fragments from the batch prove that the RTL8711B SDK was used:

It is possible that W302 is some variation or version of this Realtek.
Additionally, you can read about W302 on the Tuya website:
https://developer.tuya.com/en/docs/iot/tyauxj-module-datasheet?id=K9kj97si9y5an

Quote:

The Wi-Fi Module consists of a highly integrated wireless radio chip W302 1119VP1 and some extra flash that has been programmed with Wi-Fi network protocol and plenty of software examples. TYAUX_J includes ARM CM4F, WLAN MAC, 1T1R WLAN, maximum frequency reaches 125MHz, 256K SRAM, 2M byte flash, and various peripheral resources.

Unfortunately, I don`t see any more specifics there.

The inside of the power supply
It would be a shame not to take this opportunity and check how low quality the power supply we received:

If we question it, we can immediately see the "ingenious" connection of the plug to the board:

PCB, designation: JKY02-18W-X02:

Let`s take out the PCB:

Do I see correctly? Is there a fuse or even an NTC at the input that limits the starting current? Or even a simple filter with a choke and two capacitors... for China, it`s quite rich, but there is only an empty space after the varistor.

Both capacitors - CX and CY - are also available.
Output filtering is also nice:

This power supply is not that bad, I have seen products of much lower quality.

Summary
If we want to buy this strap to use the manufacturer`s application, I have no major complaints, it`s worse if we want to change the firmware. At the moment I don`t see such an option. I haven`t seen the W302 system before and this RTL is new to me. I will only try to connect from UART to this controller. Anyway, a copy of the original post is here:
https://github.com/openshwprojects/FlashDumps/commit/d5c4823b9ce9b0f5db35cf2bb4e507e6a015648e
Recently I managed to "free the system from the cloud". LN882H , so maybe it will work here soon too? We`ll see, for now I need to find the SDK... I will update the topic if necessary.

About Author

p.kaczmarek2 wrote 14612 posts with rating 12629 , helped 655 times. Been with us since 2014 year.

Comments

Add a comment

artin.bruyen 16 Feb 2024 08:40

What annoys me is that there are photos on the boxes and each LED lights up in a different color. Such as those from the WS series... and it turns out that they are ordinary RGB. Clearly misleading the... [Read more]

p.kaczmarek2 16 Feb 2024 16:32

This is a common problem and I don`t like it very much either. Supposedly, the sellers explain that these colors are intended to illustrate the fact that the strip can glow in different colors, but it... [Read more]

divadiow 08 Jan 2025 21:30

additional info from firmware v1.0.6 backup flashed to RTL8710BN test module (T112_V1.1) UART boot log for paired v1.0.6 <RTL8195A>ROM:[V0.1] FLASHRATE:4 BOOT TYPE:0 XTAL:40000000 IMG1... [Read more]

FAQ

TL;DR: This FAQ helps buyers and tinkerers identify a 12 V RGB strip kit: the controller carries 2 MB SPI flash, and the crucial finding is "This is RTL8710BN," not ESP8266 or BK7231. It also explains dump, UART, OTA, and power-supply clues in one place. [#20964336]

Why it matters: It separates a standard cloud RGB strip from an addressable strip and gives a practical path toward firmware research or replacement.

Option	Seen in this LXU405 thread	Main clue from the board or dump
ESP8266	No	Author explicitly says it is not ESP8266
BK7231	No	Author explicitly says it is not BK7231
RTL8710BN / W302	Yes	Tuya module text, Realtek SDK strings, later identification

Key insight: W302 in this controller is best treated as a Tuya module built around Realtek RTL8710BN plus external SPI flash. That matters because firmware work should follow RTL8710BN tools and Tuya-specific traces, not ESP8266 or BK7231 assumptions.

Quick Facts

The full kit cost PLN 125 and included the controller, remote, strip, and a 12 V JKY0918-1201500E power supply, so the price covered more than the controller alone. [#20961723]
NeoProgrammer recognized the desoldered flash as ZB25VQ16, a 16 Mbit SPI NOR device, and the author read a 2 MB dump from it. [#20961723]
The controller board includes a 12 V to 3.3 V step-down stage marked 8HMP, three 340S transistors for RGB channels, a microphone, and a W302 module with external SPI memory. [#20961723]
The power-supply PCB is marked JKY02-18W-X02; the teardown shows a fuse, NTC, choke, CX capacitor, CY capacitor, and output filtering, but an empty position where a varistor could have been fitted. [#20961723]

1. What exactly is the W302 WiFi chip used in the LXU405 RGB LED controller, and how is it related to the RTL8710BN mentioned in Tuya documentation?

W302 in this LXU405 controller matches a Tuya Wi-Fi module built around Realtek RTL8710BN with external flash. The thread first suspected RTL8711B, then corrected that with Tuya module text stating TYAUX_J uses RTL8710BN, 256K SRAM, 2M byte flash, and a 125 MHz ARM CM4F. In practice, treat W302 as the module name and RTL8710BN as the underlying Realtek SoC used by that module. [#20964336]

2. How can I dump the SPI flash from an LXU405 RGB LED controller with a CH341 programmer and NeoProgrammer?

You can dump it by removing the flash and reading it externally at 3.3 V. 1. Desolder the SPI flash from the controller because the author did not trust in-circuit reading. 2. Place it in a CH341-based programmer socket and make sure the programmer is configured for 3.3 V. 3. Read it in NeoProgrammer 2.2.0.10, which identified the chip and produced a 2 MB backup. A common failure case is using the wrong CH341 supply voltage. [#20961723]

3. Why did NeoProgrammer identify the memory chip as ZB25VQ16 SPI_NOR, and what does SPI_NOR mean in this kind of LED controller?

NeoProgrammer identified it as ZB25VQ16 because that is the external flash fitted next to the W302 module. "SPI_NOR is a serial flash memory category that stores firmware and data, supports random reads, and is commonly used as external code storage beside Wi‑Fi microcontrollers." In this controller, the software image sat in a 16 Mbit, or 2 MB, SPI NOR chip that NeoProgrammer recognized automatically. [#20961723]

4. What evidence from the flash dump suggests that the LXU405 firmware is based on Tuya and the Realtek RTL8710BN SDK?

The dump points to both Tuya and Realtek. The author found Tuya references inside the 2 MB flash image, and separate strings showed the RTL8711B SDK at first. A later correction tied the module to RTL8710BN, and the 2025 UART boot log made that even stronger by showing Tuya IOT SDK V1.0.7 and a build target of rtl8710bn. Those two traces together make a Tuya-on-Realtek firmware base the strongest reading. [#21384029]

5. Which is more likely inside this Tuya-style RGB controller: ESP8266, BK7231, or RTL8710BN, and how do you tell them apart on the PCB?

RTL8710BN is the likely platform in this controller, not ESP8266 or BK7231. The board inspection ruled out ESP8266 and BK7231 visually, then the flash contents and Tuya module text pointed to Realtek. On this PCB, the decisive clues were the W302-marked module, the separate SPI flash chip, and later identification of the Tuya TYAUX_J module as RTL8710BN-based. The thread does not provide a universal visual checklist for every board family. [#20964336]

6. Where are the programming pads or UART pins on the LXU405 controller board, and how would you use them to investigate the firmware?

The likely programming area is on the bottom side of the controller PCB. The author explicitly noted possible programming pads there and also space for an AMS1117-3.3V regulator footprint. To investigate, use a 3.3 V UART connection and watch the boot log first, because that can reveal the SoC family, firmware version, and boot flow without writing anything. The thread confirms this approach later with a captured RTL8710BN UART log. [#20961723]

7. What is OTA firmware in Tuya devices, and how does the v1.0.6 to v1.0.7 update process work for this RTL8710BN-based controller?

OTA firmware is the network-delivered upgrade image that updates the device without opening it. "OTA firmware is an over-the-air update package that replaces device code through Wi‑Fi, keeping the hardware unchanged and usually carrying only the upgrade image rather than a full flash backup." In this case, firmware v1.0.6 offered an update to v1.0.7, and the thread even lists a Tuya-hosted .bin upgrade file plus archived 1.0.6 and 1.0.7 backups for RTL8710BN. [#21384029]

8. Why do some RGB LED strip boxes show each LED in a different color even though the strip is only a standard non-addressable RGB strip?

They do it as marketing art, not as a literal operating mode. One commenter called it misleading because the box looks like a WS-type individually addressable strip, while the product is only ordinary RGB. The reply says sellers use mixed colors on packaging to show that the strip can glow in different colors, but not in several colors simultaneously. That makes the box image easy to misread at purchase time. [#20964336]

9. How does a standard analog RGB LED strip differ from WS-series addressable strips when it comes to showing multiple colors at the same time?

A standard analog RGB strip shows one chosen color across the whole strip, while WS-series strips can show different colors on different LEDs at the same time. The thread states this limit directly when explaining the misleading packaging. That is the practical buying distinction: ordinary RGB gives global color mixing, but WS-style addressable products can display multicolor patterns simultaneously on one strip. [#20964336]

10. What components are inside the LXU405 controller board besides the W302 module, such as the 8HMP step-down converter, 340S transistors, and microphone, and what do they do?

The board contains a 12 V to 3.3 V step-down converter marked 8HMP, three 340S transistors, a microphone, external SPI flash, and the W302 Wi‑Fi module. The 8HMP stage powers the logic from the 12 V supply. The three 340S devices switch the red, green, and blue channels, one per color. The microphone supports sound-reactive effects, and the SPI flash stores the firmware image read during the dump. [#20961723]

11. How good or bad is the JKY0918-1201500E / JKY02-18W-X02 power supply in terms of safety and build quality?

It looks better than many very cheap LED-strip adapters, but it is not flawless. The teardown shows input protection and filtering parts that are often missing in bargain supplies, including a fuse or NTC, a choke, CX and CY capacitors, and decent output filtering. The author’s verdict is clear: this unit is “not that bad,” and they had seen much lower-quality products. The main visible concern is the unpopulated varistor position. [#20961723]

12. Why is the empty varistor position in the LXU405 power supply worth noticing, and what role would a varistor play there?

It matters because a fitted varistor would add surge suppression at the mains input, but this board leaves that position empty. "A varistor is a surge-protection component that clamps short overvoltage spikes, sacrificing low leakage in normal operation for rapid protection during mains transients." The rest of the input stage looks relatively complete for a small supply, so the empty varistor footprint stands out as a cost-saving omission rather than a missing core function. [#20961723]

13. What do the fuse, NTC, choke, CX capacitor, and CY capacitor do in a small 12V LED strip power supply like this one?

They form the basic input protection and EMI filtering chain. The fuse protects against major faults. The NTC limits inrush current at startup. The choke with CX and CY capacitors reduces conducted noise between line, neutral, and the isolated side. In this teardown, the author was surprised to see this many parts in a low-cost supply, calling it “quite rich” by typical cheap-China standards. [#20961723]

14. What can be learned from the UART boot log of the RTL8710BN firmware backup, including the Tuya SDK version, product key, and boot process?

The UART log confirms a Realtek/Tuya stack and exposes useful firmware metadata. It shows ROM banners for RTL8195A-family code, boot from flash, OTA slot information, Wi‑Fi initialization, and Tuya application startup. It also prints firmware version 1.0.6, Tuya IOT SDK V1.0.7, build date strings from 2020, product key keymenctfd4sd3yq, and a later prompt to upgrade toward 1.0.7. That is enough to map the device family and the cloud firmware lineage. [#21384029]

15. What is the best path to replace or 'free from the cloud' the firmware on this W302 / RTL8710BN Tuya RGB controller, and which SDK or open-source tools are relevant?

The best path is to treat the controller as an RTL8710BN Tuya target and start with read-only analysis. 1. Dump and archive the original 2 MB flash first. 2. Capture UART logs from the suspected bottom pads to confirm boot behavior. 3. Work from the OpenRTL8710BN SDK source that the author linked, because they said “we will flash soon” after identifying RTL8710BN. The thread does not yet provide a finished cloud-free firmware for this exact board. [#20964336]

Generated by the language model.