Backup and Restore of Factory Firmware on Bouffalo Lab BL602/LF686 IoT Smart Devices

divadiow 30 Apr 2024 09:16 20 6531 Cool? (+4)

📢 Listen (AI):

TL;DR

Shows how to back up and restore factory firmware on Bouffalo Lab BL602/LF686 IoT smart devices using Bouffalo Lab Dev Cube.
Uses BLDevCube’s Flash tab to read a full flash dump, then the IOT tab’s Single Download Options to write it back from 0x0.
Sets UART to 2000000, checks flash size, and notes common sizes like 2mb boards and LF/BL602C20 = 2 megabyte / 16 megabit.
The restore method booted successfully on several BL602 dumps and made devices pairable with Cozylife, Tuya, and Magic Home apps.
Dumps may contain SSID and Wi‑Fi passwords, and the backup/restore process was tested only on the dev board.

Generated by the language model.

Born of some initially unsuccessful fiddling in this post where I was trying to flash a BL602 device factory firmware dump to an Ai-Thinker dev board, it seems the Single Download Option in Bouffalo Lab Dev Cube (BLDC) might well be the way to restore a full flash dump to any BL602.

I'll begin by demonstrating the process to dump/backup the firmware. This will be useful for restoring in the event of some catastrophic incident where the bootloader may get corrupted or you need to revert to test something using factory firmware/app. It's also good to post these backups on any posts for analysis or others to flash for testing or restoration.

Bear in mind the dump may contain SSID and wifi password if the device is not reset before backup.

This guide assumes you've already connected your device to a USB-TTL adaptor and you've pulled the BOOT pin high with a 10k resistor to get it into download mode. Guides to get this point:

https://www.elektroda.com/rtvforum/topic3889041.html

On the Ai-WB2-32S-Kit dev board this is simply a case of holding down the BOOT button while pushing the RST button. The buttons can be released after.

Backup

Download BouffaloLabDevCube-vxxxx.zip from https://dev.bouffalolab.com/download. Unzip and run BLDevCube.exe.

Choose BL602/604 chip

In the View menu choose Show Advanced Page to reveal all tabs.

On the Flash tab ensure the correct COM (Port/SN) is selected and the uart rate is 2000000. I've found good contact with the pins and short jumper wires are crucial for this speed to work if trying on a real IoT device.

You can use the Read ID button to test communication first if needed.

This step will also show you the size of the flash. Most devices I see on the forums appear to be 2mb. The WB2 board is 4mb. You'll need to know the size shortly.

The flash size can also be determined by the silkscreen print on the IC. The key is

eg:

LF/BL602C10 = 1 megabyte / 8 megabit
LF/BL602C20 = 2 megabyte / 16 megabit
LF/BL602C40 = 4 megabyte / 32 megabit

I've only seen LF602C20 in the wild so 1mb and 4mb are just assumptions following the naming convention.

To begin dump enter start and end addresses according to chip size. Note that the Whole Chip checkbox is for the erase function not flash read.

After clicking read flash and a successful handshake it should dump a flash.bin file to same location as the BLDevCube.exe. The total bytes should match above.

You've successfully backed-up the device's firmware.

Restore

To restore a firmware, switch to the IOT tab and check Enable under Single Download Options. Keep the start address 0x0 and browse to the bin dump you want to flash.

Put device into download mode again with BOOT pin method then click Create & Download. It should begin flashing. It'll erase the flash before it writes.

After success you can click Open Uart to watch your firmware boot!

I have successfully flashed quite a few BL602 dumps onto the dev board and all have booted and were pairable using Cozylife/Tuya/Magic Home apps, depending on what device they came from. They'll detect as a bulb/relay/whatever. On the Ai-WB2 even the LED blinks when in pairing mode and can be controlled from the app as if it was the original bulb.

If your backup doesn't boot or you found a backup online and are unsure if it'll work, a little indicator the file is OK is that the starting bytes appear to always be this when viewed in HxD

I have only tested backup/restore on the dev board to date, so please experiment at your own risk and give some feedback in this thread.

Update 2026
As of 2026, this platform read/write is also supported by our flash tool:
https://github.com/openshwprojects/BK7231GUIFlashTool
The connection (soldering, wires), is the same, but you can use our tool instead of the legacy one.
Please check it out and use it instead of legacy tools, let us know how it works for you!

About Author

divadiow wrote 5039 posts with rating 891 , helped 438 times. Live in city Bristol. Been with us since 2023 year.

Comments

Add a comment

divadiow 03 May 2024 09:05

I didn't know there were any Leapfive LF686 modules out there. This is new (and the B36 W800) - to me anyway. The Hi-Link HLK-B35: https://obrazki.elektroda.pl/9777023200_1714719612_thumb.jpg... [Read more]

divadiow 03 May 2024 09:53

Ali item of course I've had to order both for my collection [Read more]

divadiow 20 Jun 2024 22:45

for anyone looking to use an ESP universal downloader type adaptor with the HLK-B35 - BL602 module https://obrazki.elektroda.pl/4730536600_1718912792_thumb.jpg eg https://obrazki.elektroda.pl/4366816100_1718913283_thumb.jpg... [Read more]

divadiow 20 Jun 2024 23:32

and a mapping for the ESP8266 to HLK-B36 (W800-B400) https://obrazki.elektroda.pl/4026552800_1718919386_thumb.jpg [Read more]

daoviethung1992 24 Jul 2024 11:37

Hello! I have a 4ch switch running the original software controlled via the ewelink app. I tried backing up the FW at that corner but it showed an error reading data. but getting the ID information is... [Read more]

divadiow 24 Jul 2024 12:15

does it make any progress reading data or does it fail before it starts? [Read more]

daoviethung1992 24 Jul 2024 12:32

this is the error: [17:31:33.898] - Save as flash.bin [17:31:33.899] - Version: bflb_eflash_loader_v2.0.0 [17:31:33.899] - Program Start [17:31:33.899] - ========= eflash loader cmd arguments ========= chipname... [Read more]

divadiow 24 Jul 2024 12:35

have you tried reducing the baud rate to 1500000 or 1000000? how long are your RX/TX cables? soldered or pogo? [Read more]

daoviethung1992 24 Jul 2024 12:47

My cable is 10cm long. soldered directly on the module. let me try 1500000 and 1000000 Added after 2 [minutes]: wow! it was successful. Thank you very much [Read more]

divadiow 24 Jul 2024 12:48

oh cool. no probs. what speed worked in the end? [Read more]

daoviethung1992 24 Jul 2024 20:20

1500000 sir :D Added after 7 [hours] 30 [minutes]: sir! I have an ai-wb2-12f module, as far as I know, inside it is also a BL602 chip, so I tried to flash the OpenBL602_1.17.649.bin file but... [Read more]

divadiow 24 Jul 2024 20:48

Yes, the AI-WB2-12F is a 4mb BL602. The OpenBeken BL602 file OpenBL602_1.17.649.bin is for flashing using the standard method, not the single download option - https://www.elektroda.com/rtvforum/topic3889041.html... [Read more]

daoviethung1992 26 Jul 2024 20:48

sorry sir! Now I have free time! When I bought it I didn't know if it had a bootloader or not, I tried it and there wasn't any output when booting. I have researched this module, as you said it has 4M... [Read more]

divadiow 26 Jul 2024 22:36

yes. this shows the detected flash size. I think I've seen that before when trying to flash a factory backup to my Ai-WB2-32S-Kit. I think I would suggest trying other BL602 factory fw backup... [Read more]

jansn 14 Sep 2025 23:24

How would I go about backing up just the app portion of the factory firmware from a RGBW controller (AK001-ZJ2147) that I want to flash to a RGB controller (AK001-ZJ2148), as a full flash would overwrite... [Read more]

divadiow 15 Sep 2025 08:32

I'd start with 2 full backups, splice things around in HxD in a new file, then flash the Frankenstein full flash back to 0x0. [Read more]

jansn 15 Sep 2025 17:06

but how do I know at what addresses to do the splicing? [Read more]

insmod 15 Sep 2025 17:10

This is BL602, not BK7231. Don't worry about rf/mac, since they're in efuse and not in flash. [Read more]

jansn 15 Sep 2025 17:38

oh sweet then, will try then full backup and full flash when i get time [Read more]

FAQ

TL;DR: For BL602 and LF686 tinkerers, full backup usually means reading 2 MB from 0x00000000 to 0x001FFFFF, then restoring it with Single Download at 0x0. One practical warning: "the dump may contain SSID and wifi password" unless you reset first. This FAQ shows the exact addresses, modes, and failure fixes. [#21065272]

Why it matters: A correct full dump lets you recover a bricked BL602 device, test factory firmware safely, and move known-good images between compatible boards.

Method / Tool	Best use	Start address	Notes
BLDevCube Flash read	Full backup	`0x00000000`	Read full flash range for 1 MB, 2 MB, or 4 MB devices
BLDevCube Single Download	Restore full dump	`0x00000000`	Writes a complete image, including bootloader
BLDevCube standard flash	Flash OpenBL602 app image	`0x00010000`	Leaves existing bootloader intact
BK7231GUIFlashTool	Newer read/write option	Same wiring	Added as supported option in 2026

Key insight: On BL602, a full backup flashed at 0x0 is not the same as an app image flashed at 0x10000. Most restore failures in the thread came from using the right file with the wrong flashing mode. [#21166602]

Quick Facts

BLDevCube backup uses UART 2000000 baud by default, but one failed read on a 4-channel eWeLink switch succeeded after dropping to 1500000 baud; the test wiring used 10 cm soldered leads. [#21166040]
The thread maps full-flash dump ranges as: 1 MB 0x00000000-0x000FFFFF, 2 MB 0x00000000-0x001FFFFF, and 4 MB 0x00000000-0x003FFFFF. [#21065272]
The BL602 download-mode wiring guidance includes pulling the BOOT pin high with a 10 kΩ resistor on a USB-TTL setup, or using BOOT + RST buttons on the Ai-WB2-32S-Kit. [#21065272]
The thread states that many forum devices use 2 MB flash, while the Ai-WB2-32S-Kit uses 4 MB; sample part markings mentioned are LF/BL602C10, C20, and C40. [#21065272]
In 2026, the thread added BK7231GUIFlashTool as a supported BL602/LF686 read-write tool, with the same soldering and wire connection method as the older workflow. [#21811290]

How do I back up the full factory firmware from a Bouffalo Lab BL602 device with BouffaloLab Dev Cube?

Use BLDevCube to read the entire flash, not just the app area. 1. Open BLDevCube, choose BL602/604, and enable Show Advanced Page. 2. On the Flash tab, select the correct COM port, set UART to 2000000 baud, and enter the full-chip start and end addresses for your flash size. 3. Click Read Flash; after a successful handshake, BLDevCube saves flash.bin beside BLDevCube.exe. Reset the device before backup if you do not want stored Wi‑Fi credentials in the dump. [#21065272]

What is the Single Download Option in BLDevCube, and when should it be used to restore a BL602 flash dump?

Single Download is the BLDevCube restore mode for a complete flash image. Use it when your .bin contains the whole dump, including the bootloader, and flash it from 0x0 on the IOT tab with Enable checked under Single Download Options. Do not use this mode for app-only images like OpenBL602 builds. The thread reports it erased flash first, then restored working factory dumps that booted and paired in apps such as Cozylife, Tuya, and Magic Home. [#21065272]

Which start and end addresses should I use to dump 1 MB, 2 MB, or 4 MB flash on BL602 or LF686 devices?

Use full-range addresses that match the flash size. For 1 MB, read 0x00000000 to 0x000FFFFF. For 2 MB, read 0x00000000 to 0x001FFFFF. For 4 MB, read 0x00000000 to 0x003FFFFF. The thread also says the output byte counts should match 1,048,576, 2,097,152, and 4,194,304 bytes respectively. These are the ranges for a full backup, not just the application partition. [#21065272]

Why does BL602 firmware backup fail with "BFLB FLASH READ FAIL" even though Read ID works, and how can baud rate affect it?

The failure can happen when communication is stable enough to read JEDEC ID but not stable enough for sustained flash reads. In the thread, Read ID succeeded, then the read operation failed with BFLB FLASH READ FAIL until the user lowered UART speed. Short wiring and good contact also mattered; the guide explicitly says short jumper wires are crucial at 2000000 baud. If ID works but reads fail, reduce baud first before changing power hardware. [#21166016]

What UART speed worked for successful BL602 backup when 2000000 baud caused read errors on a 4-channel eWeLink switch?

1500000 baud worked. The user first failed at 2000000 baud, then reported success after trying lower rates suggested in the thread. The same discussion notes the cable length was about 10 cm and soldered directly to the module. That makes 1500000 baud the confirmed working fallback for that 4-channel eWeLink backup case. [#21166040]

How should I flash OpenBL602_1.17.649.bin onto an AI-WB2-12F, and why is that different from restoring a full backup at 0x0?

Flash OpenBL602_1.17.649.bin with the standard BLDevCube method at 0x10000, not with Single Download at 0x0. The thread says that image is an app-style OpenBeken build, so BLDevCube should leave the existing bootloader intact on the AI-WB2-12F, which is described there as a 4 MB BL602 module. Restoring a full backup at 0x0 is different because that image includes bootloader data and replaces the entire flash layout. [#21166602]

What does the error "BFLB FLASH CFG NOT FIT WITH BOOTHEADER" mean when flashing a BL602 or AI-WB2 module?

It means the image boot header and detected flash configuration do not match closely enough for BLDevCube to program it in that mode. In the thread, the error appeared on an AI-WB2-12F after BLDevCube detected 0x00400000 flash size and compared it with the image being flashed. A common trigger was using the wrong method, such as trying to push a non-full image through Single Download or restoring a backup that did not match the target flash configuration. [#21169262]

How can I tell whether a BL602 flash backup file is probably valid before restoring it, such as by checking for the "BFNP....FCFG" header in HxD?

A quick sanity check is to open the dump in HxD and inspect the first bytes. The thread says a good-looking BL602 backup often starts with BFNP....FCFG. That pattern does not prove the firmware will boot, but it is a practical indicator that the file is structurally plausible before you erase a target board. If the header is missing, treat the image as suspect and verify the dump size against the device flash size first. [#21065272]

What is JEDEC ID on a BL602 flash chip, and how is it used to identify flash size or compatibility?

"JEDEC ID" is a flash-memory identification code that reports the connected chip family and helps the tool detect the attached SPI flash before reading or writing it. In the thread, BLDevCube used JEDEC reads such as ef401500 and 5e401680 before backup or programming attempts. The ID helped confirm that communication with flash worked, but it did not guarantee that a later full read or image write would succeed. [#21166010]

What is eFuse on BL602, and why does it matter when cloning or restoring full firmware backups between RGB and RGBW controllers?

"eFuse" is on-chip non-volatile configuration storage that keeps hardware-bound values outside normal flash, including identifiers that survive full flash rewrites. In the thread, this mattered because a user worried that cloning a full backup between AK001-ZJ2147 and AK001-ZJ2148 would copy the wrong MAC or RF data. The reply states that on BL602, you should not worry about rf/mac, because those values are in eFuse, not in flash. [#21690829]

BLDevCube vs BK7231GUIFlashTool: which tool is better for reading and writing BL602 or LF686 firmware backups?

BK7231GUIFlashTool is the newer option in this thread, while BLDevCube is the proven legacy workflow. BLDevCube has the complete backup and Single Download procedures documented step by step, including 0x0 full restores and flash reads. In 2026, the thread added that BK7231GUIFlashTool also supports BL602/LF686 read and write with the same connection method. Choose BLDevCube for the documented path today, or BK7231GUIFlashTool if you want the newer maintained tool. [#21811290]

How do I put a BL602 device or Ai-Thinker Ai-WB2 board into download mode with the BOOT pin or BOOT/RST buttons?

Put the chip into download mode by forcing BOOT during reset. On a generic BL602 device, connect a USB-TTL adapter and pull the BOOT pin high with a 10 kΩ resistor. On the Ai-WB2-32S-Kit, hold BOOT, press RST, then release both after reset. The thread says you must do this before backup or restore operations in BLDevCube. [#21065272]

What wiring or pin mapping should I use to connect an ESP universal downloader or ESP8266 adapter to the Hi-Link HLK-B35 or HLK-B36 modules?

Use the thread’s posted adapter mappings for each module family. It includes one mapping for an ESP universal downloader to the HLK-B35 BL602 module and another for an ESP8266-to-HLK-B36 connection. The author posted both as image pin maps on 2024-06-20, specifically for people reusing ESP flashing adapters with these modules. The thread does not give a text pin list, so the safest answer is to follow those posted diagrams exactly. [#21126621]

How would I back up only the app portion of factory firmware from an AK001-ZJ2147 RGBW controller and flash it to an AK001-ZJ2148 RGB controller without overwriting the wrong areas?

The thread does not confirm a safe app-only address range for that swap. Instead, the practical recommendation was to make two full backups, edit them in HxD, and write back a combined full flash at 0x0. A later reply also says not to worry about rf/mac on BL602, because those are stored in eFuse, not flash. That means the thread favors a full-backup workflow over the proposed 0x10000-0x18FFFF app-only method. [#21690372]

How do I know which addresses to splice in HxD when combining two BL602 full backups into a Frankenstein image for flashing back to 0x0?

You do not get exact splice addresses from this thread. The guidance was to start from two full backups, compare them in HxD, and build a new combined image before flashing it back to 0x0. When the user asked how to find the splice points, the thread did not provide a partition map or byte offsets. The only firm follow-up was that rf/mac on BL602 are in eFuse, so those identifiers are not the flash regions you need to preserve manually. [#21690829]

Generated by the language model.