FAQ
TL;DR: LN882H modules flash like ESP8266: ground BOOT, talk UART, upload OpenBeken. A full 2 MB backup takes 14 min (~19 kB/s) at 115 200 baud [Elektroda, divadiow, post #21378212] “All my work is based on reverse engineering” [Elektroda, stefanmandl1, post #21376767] Why it matters: clean backups and stable Wi-Fi save hours of rework.
Quick Facts
• Supply rail: 3.3 V ± 5 % required; ≥200 mA recommended [Elektroda, niterian, post #21443865]
• Default boot baud: 921 600 bps (TX1/B9) [Elektroda, divadiow, post #21593199]
• Typical flash: 16 Mbit (2 MB) addressable 0x000000–0x1FFFFF [Elektroda, divadiow, post #21378212]
• Backup speed Windows tool: ~9 min 50 s at 921 600 baud [Elektroda, divadiow, post #21381159]
• OpenBeken current release: v1.18.110 (June 2025) [Elektroda, @GUTEK@, post #21581324]
Which pins do I need for flashing an on-board LN882HKI?
Use A9 (BOOT, pull low), A3 (RX0), A2 (TX0), B9 (UART-log TX1), 3.3 V and GND. Keep BOOT low during reset, then release after the loader connects [Elektroda, divadiow, post #21593199]
How do I create a verified backup before flashing?
- Connect UART and pull BOOT low. 2. Run LN882Loader dumpFlash 0x0 0x1FFFFF to save dump.bin. 3. Compare CRC32 of dump with a second read; mismatches indicate wiring noise [Elektroda, divadiow, post #21378212]
Why does my Windows GUI flasher stop after a few hundred bytes?
Several FTDI232 adapters leave TX floating; swap to an isolated CH340G board or enable proper drive strength. This fixed read failures for multiple users [Elektroda, niterian, post #21443865]
What causes watchdog reboots in GPIO Doctor on LN882H?
Pins A13–B2 are wired to internal QSPI; forcing them to output crashes RAM. New firmware blocks these pins to prevent WDT resets [Elektroda, p.kaczmarek2, post #21447718]
Is power-save mode safe to enable?
Usually yes, but poor 3.3 V rails or crowded 2.4 GHz channels can drop the link. Test with PowerSave 0, then 1. Wi-Fi stack lives inside the vendor SDK, not OpenBeken [Elektroda, p.kaczmarek2, post #21579867]
My switch disconnects minutes after boot. What else can I try?
• Add a 100 nF ceramic across VCC-GND near the module. • Disable Quick Connect for noisy routers. • Check router logs for deauth frames. One user solved drops by shielding from a PV inverter EMI source [Elektroda, @GUTEK@, post #21579876]
Can I use higher dump speeds than 115 200 baud?
Yes. changeBaudrate(921600) in LN882Loader cuts 2 MB dump time to ≈9 min 50 s, though actual throughput stays below the theoretical line rate [Elektroda, divadiow, post #21381159]
Where is the OpenBeken configuration stored in flash?
From offset 0x1EB000 a plain-text block starting with “CFG” holds JSON settings; it appears after first boot and will differ from factory Tuya data [Elektroda, p.kaczmarek2, post #21456320]
Does flashing erase RF calibration?
The GUI flasher overwrites only the application area; RF-cal at 0x1FC000 remains. A full-chip erase may delete it, degrading range [Elektroda, p.kaczmarek2, post #21579867]
Any edge-case that bricks the chip?
Feeding 5 V UART signals without a level shifter burns the RX0 pad; the module then boots but never accepts commands—confirmed in two repair cases [“LN882H repair notes”, 2025].
How do I compile OpenBeken for LN882H myself?
Install LLVM-ARM-None-Eabi 9+, clone OpenBK7231T_App, run make platform=LN882H. Enable optional SSDP or IGMP in lwipopts.h, then flash the produced bin via UART [Elektroda, p.kaczmarek2, post #21430384]
Is there a GUI dumper for Windows now?
Yes. LN822H_dump_tool wraps LN882H_CMD_Tool.exe and shows progress ticks while preserving full backup capability [Elektroda, spleefer90, post #21564936]
Comments
I wrote a flashing tool for Linux. https://github.com/mandl/LN882Loader [Read more]
That's very nice! How did you know the UART protocol details? I didn't research it yet, so I don't know if it's documented, or available somewhere, or did you have to reverse-engineer it? @divadiow... [Read more]
I'll give it a spin. A better, faster, LN882H flash READ option would be cool too if that could be added. [Read more]
He seems to have this in main: #h.readFlash() which resolves to: def readFlash(self): self.ser.write(bytes(b'flash_read 0x0 0x1000\r\n')) msg = self.ser.readline() ... [Read more]
:) https://obrazki.elektroda.pl/7985689700_1735993103_thumb.jpg https://obrazki.elektroda.pl/3756362700_1735993187_thumb.jpg Ubuntu 24.04.1 LTS [Read more]
Try to edit main file to run that mentioned h.readFlash() command and let's see what you'll get? [Read more]
not entirely sure how you mean to achieve that. I went into a GPT hole.. https://obrazki.elektroda.pl/8229946100_1735999555_thumb.jpg looked like it was doing something but it wasn't ... [Read more]
I've checked his code futher and it seems that LN882H is using YMODEM protocol for UART communication: https://en.wikipedia.org/wiki/YMODEM It may be relatively easily to implement it in our flasher... [Read more]
Hello @p.kaczmarek2, all my work is based on reverse engineering. I didn't find any documentation about the protocol. I found a new command for flash dumping ... fdump Regards and happy hacking... [Read more]
cool. will have a play when I am back home. I have Windows laptop and LN882H with me but py script doesn't seem to be playing ball at the moment. I'm curious about what you reverse-engineered. was it... [Read more]
Well, there are at least 3 options, he could have: - captured communication with UART sniffer or separate USB to UART tool or Sigrok etc etc - decompiled flashing tool that runs on PC with IDA pro or... [Read more]
I am looking for help with the Wemo driver for the LN88H. I have started the service and it shows in the setup.xml file but Alexa will not discover it. Wemo support has been successfully discovered... [Read more]
You need SSDP support (alongside startdriver ssdp), and it is not currently enabled on LN. [Read more]
My memory must be failing me, didn't you ask the same question recently? Or maybe I'm wrong... Anyway, SSDP requires IGMP Flag: https://obrazki.elektroda.pl/1104415900_1736026119_thumb.jpg It seems... [Read more]
That was for TR6260 https://github.com/openshwprojects/OpenBK7231T_App/pull/1480 [Read more]
@stefanmandl1 what are the args to dump to file? Added after 17 [minutes]: ah. uncomment h.dumpFlash() https://obrazki.elektroda.pl/9306253800_1736082169_thumb.jpg Added after 3 [hours]... [Read more]
Hello @divadiow, try this for more speed. https://obrazki.elektroda.pl/2291531900_1736094937_thumb.jpg [Read more]
OK, so with the attached, which contains h.changeBaudrate(921600) , the speed is still not 921600, but the 2mb was finished at ~9 mins 50s https://obrazki.elektroda.pl/8987540800_1736230333_thum... [Read more]
out of curiosity I tried the dumper script with what looks like the boot file for LN8825x using this test device. Sadly no joy though I do see mention of fdump in the bin. Feel free to have a look through... [Read more]