Backup and Restore of Factory Firmware on Bouffalo Lab BL602/LF686 IoT Smart Devices
Born of some initially unsuccessful fiddling in this post where I was trying to flash a BL602 device factory firmware dump to an Ai-Thinker dev board, it seems the Single Download Option in Bouffalo Lab Dev Cube (BLDC) might well be the way to restore a full flash dump to any BL602.
I'll begin by demonstrating the process to dump/backup the firmware. This will be useful for restoring in the event of some catastrophic incident where the bootloader may get corrupted or you need to revert to test something using factory firmware/app. It's also good to post these backups on any posts for analysis or others to flash for testing or restoration.
Bear in mind the dump may contain SSID and wifi password if the device is not reset before backup.
This guide assumes you've already connected your device to a USB-TTL adaptor and you've pulled the BOOT pin high with a 10k resistor to get it into download mode. Guides to get this point:
https://www.elektroda.com/rtvforum/topic3889041.html
On the Ai-WB2-32S-Kit dev board this is simply a case of holding down the BOOT button while pushing the RST button. The buttons can be released after.
Backup
Download BouffaloLabDevCube-vxxxx.zip from https://dev.bouffalolab.com/download. Unzip and run BLDevCube.exe.
Choose BL602/604 chip
In the View menu choose Show Advanced Page to reveal all tabs.
On the Flash tab ensure the correct COM (Port/SN) is selected and the uart rate is 2000000. I've found good contact with the pins and short jumper wires are crucial for this speed to work if trying on a real IoT device.
You can use the Read ID button to test communication first if needed.
This step will also show you the size of the flash. Most devices I see on the forums appear to be 2mb. The WB2 board is 4mb. You'll need to know the size shortly.
The flash size can also be determined by the silkscreen print on the IC. The key is
eg:
LF/BL602C10 = 1 megabyte / 8 megabit
LF/BL602C20 = 2 megabyte / 16 megabit
LF/BL602C40 = 4 megabyte / 32 megabit
I've only seen LF602C20 in the wild so 1mb and 4mb are just assumptions following the naming convention.
To begin dump enter start and end addresses according to chip size. Note that the Whole Chip checkbox is for the erase function not flash read.
After clicking read flash and a successful handshake it should dump a flash.bin file to same location as the BLDevCube.exe. The total bytes should match above.
You've successfully backed-up the device's firmware.
Restore
To restore a firmware, switch to the IOT tab and check Enable under Single Download Options. Keep the start address 0x0 and browse to the bin dump you want to flash.
Put device into download mode again with BOOT pin method then click Create & Download. It should begin flashing. It'll erase the flash before it writes.
After success you can click Open Uart to watch your firmware boot!
I have successfully flashed quite a few BL602 dumps onto the dev board and all have booted and were pairable using Cozylife/Tuya/Magic Home apps, depending on what device they came from. They'll detect as a bulb/relay/whatever. On the Ai-WB2 even the LED blinks when in pairing mode and can be controlled from the app as if it was the original bulb.
If your backup doesn't boot or you found a backup online and are unsure if it'll work, a little indicator the file is OK is that the starting bytes appear to always be this when viewed in HxD
I have only tested backup/restore on the dev board to date, so please experiment at your own risk and give some feedback in this thread.
I'll begin by demonstrating the process to dump/backup the firmware. This will be useful for restoring in the event of some catastrophic incident where the bootloader may get corrupted or you need to revert to test something using factory firmware/app. It's also good to post these backups on any posts for analysis or others to flash for testing or restoration.
Bear in mind the dump may contain SSID and wifi password if the device is not reset before backup.
This guide assumes you've already connected your device to a USB-TTL adaptor and you've pulled the BOOT pin high with a 10k resistor to get it into download mode. Guides to get this point:
https://www.elektroda.com/rtvforum/topic3889041.html
On the Ai-WB2-32S-Kit dev board this is simply a case of holding down the BOOT button while pushing the RST button. The buttons can be released after.
Backup
Download BouffaloLabDevCube-vxxxx.zip from https://dev.bouffalolab.com/download. Unzip and run BLDevCube.exe.
Choose BL602/604 chip
In the View menu choose Show Advanced Page to reveal all tabs.
On the Flash tab ensure the correct COM (Port/SN) is selected and the uart rate is 2000000. I've found good contact with the pins and short jumper wires are crucial for this speed to work if trying on a real IoT device.
You can use the Read ID button to test communication first if needed.
This step will also show you the size of the flash. Most devices I see on the forums appear to be 2mb. The WB2 board is 4mb. You'll need to know the size shortly.
The flash size can also be determined by the silkscreen print on the IC. The key is
eg:
LF/BL602C10 = 1 megabyte / 8 megabit
LF/BL602C20 = 2 megabyte / 16 megabit
LF/BL602C40 = 4 megabyte / 32 megabit
I've only seen LF602C20 in the wild so 1mb and 4mb are just assumptions following the naming convention.
To begin dump enter start and end addresses according to chip size. Note that the Whole Chip checkbox is for the erase function not flash read.
Code: Text
After clicking read flash and a successful handshake it should dump a flash.bin file to same location as the BLDevCube.exe. The total bytes should match above.
You've successfully backed-up the device's firmware.
Restore
To restore a firmware, switch to the IOT tab and check Enable under Single Download Options. Keep the start address 0x0 and browse to the bin dump you want to flash.
Put device into download mode again with BOOT pin method then click Create & Download. It should begin flashing. It'll erase the flash before it writes.
After success you can click Open Uart to watch your firmware boot!
I have successfully flashed quite a few BL602 dumps onto the dev board and all have booted and were pairable using Cozylife/Tuya/Magic Home apps, depending on what device they came from. They'll detect as a bulb/relay/whatever. On the Ai-WB2 even the LED blinks when in pairing mode and can be controlled from the app as if it was the original bulb.
If your backup doesn't boot or you found a backup online and are unsure if it'll work, a little indicator the file is OK is that the starting bytes appear to always be this when viewed in HxD
Code: Text
I have only tested backup/restore on the dev board to date, so please experiment at your own risk and give some feedback in this thread.
divadiow wrote 2752 posts with
rating 472 , helped 246 times.
Live in city Bristol.
Been with us since 2023 year.
Comments
I didn't know there were any Leapfive LF686 modules out there. This is new (and the B36 W800) - to me anyway. The Hi-Link HLK-B35: https://obrazki.elektroda.pl/9777023200_1714719612_thumb.jpg... [Read more]
Ali item of course I've had to order both for my collection [Read more]
for anyone looking to use an ESP universal downloader type adaptor with the HLK-B35 - BL602/LF686 module https://obrazki.elektroda.pl/4730536600_1718912792_thumb.jpg eg https://obrazki.elektroda.pl/4366816100_1718913283_thumb.jpg... [Read more]
and a mapping for the ESP8266 to HLK-B36 (W800-B400) https://obrazki.elektroda.pl/4026552800_1718919386_thumb.jpg [Read more]
Hello! I have a 4ch switch running the original software controlled via the ewelink app. I tried backing up the FW at that corner but it showed an error reading data. but getting the ID information is... [Read more]
does it make any progress reading data or does it fail before it starts? [Read more]
this is the error: [17:31:33.898] - Save as flash.bin [17:31:33.899] - Version: bflb_eflash_loader_v2.0.0 [17:31:33.899] - Program Start [17:31:33.899] - ========= eflash loader cmd arguments ========= chipname... [Read more]
have you tried reducing the baud rate to 1500000 or 1000000? how long are your RX/TX cables? soldered or pogo? [Read more]
My cable is 10cm long. soldered directly on the module. let me try 1500000 and 1000000 Added after 2 [minutes]: wow! it was successful. Thank you very much [Read more]
oh cool. no probs. what speed worked in the end? [Read more]
1500000 sir :D Added after 7 [hours] 30 [minutes]: sir! I have an ai-wb2-12f module, as far as I know, inside it is also a BL602 chip, so I tried to flash the OpenBL602_1.17.649.bin file but... [Read more]
Yes, the AI-WB2-12F is a 4mb BL602. The OpenBeken BL602 file OpenBL602_1.17.649.bin is for flashing using the standard method, not the single download option - https://www.elektroda.com/rtvforum/topic3889041.html... [Read more]
sorry sir! Now I have free time! When I bought it I didn't know if it had a bootloader or not, I tried it and there wasn't any output when booting. I have researched this module, as you said it has 4M... [Read more]
yes. this shows the detected flash size. I think I've seen that before when trying to flash a factory backup to my Ai-WB2-32S-Kit. I think I would suggest trying other BL602 factory fw backup... [Read more]