WBR2, WBR3, WBRU, W701-VA2-CG pinout, datasheet, flashing for Home Assistant

p.kaczmarek2 03 Jan 2025 17:38 166 20967 Cool? (+8)

📢 Listen (AI):

Here's step by step flashing and HA Discovery guide for W701-VA2-CG (RTL8720CF)-based Tuya modules that can be programmed with AmebaZ2 PG Tool 1.2.47 (download included). This way you can run those devices cloud free, use it with Tasmota commands (Tasmota Remota app), and add new features like sensors, scripts, and so on.

This guide is applicable to the following modules with the core chip of RTL8720CF or similar, so: WBR1, WBR2, WBR3, WBR2L, WBR3L, WBRU etc.

Datasheet:
RTL872xZ2 ...asheet.pdf (1.99 MB)You must be logged in to download this attachment.
See sample device teardown with WBR2: [WBR2/W701] Unsupported MaxCom Smart Breaker SHSB111W10

Here is a sample boot log taken from Log UAR T pins of similar device:


== Rtl8710c IoT Platform ==
Chip VID: 5, Ver: 3
ROM Version: v3.0
Test Mode: boot_cfg1=0x20
Download Image over UART2[tx=16,rx=15] baud=115200

== Rtl8710c IoT Platform ==
Chip VID: 5, Ver: 3
ROM Version: v3.0

== Boot Loader ==
Dec  5 2019:14:02:18

fwx SELE[fffffffe]
fw SELE Bitidx 1, fw1 valid 1, sn 100, fw2 valid 1, sn 101
fw2 USE, return sn 101

Boot Loader <==

== RAM Start ==
Build @ 14:44:45, Jul 29 2020

 Create Task init, stack 0x1000fb28, len 5120

 Create Task app_init, stack 0x10010f88, len 8192

 Create Task IDLE, stack 0x10012fe8, len 768

 Create Task Tmr Svc, stack 0x10013640, len 2048

 Create Task TCP_IP, stack 0x10013fb8, len 4000
interface 0 is initialized
interface 1 is initialized

In[01-01 18:12itializing :15 TUYA InfWIFI ...o][mqc_app.c:175] mqc app init ...

 Create Task sys_timer, stack 0x1001a800, len 4096

 Create Task cmmod, stack 0x1001eca8, len 4096
[01-01 18:12:15 TUYA Info][sf_mqc_cb.c:42] register mqc app callback
[01-01 18:12:15 TUYA Debug][mqc_app.c:118] mq_pro:5 mqc_handler_cnt:1
[01-01 18:12:15 TUYA Debug][mqc_app.c:118] mq_pro:31 mqc_handler_cnt:2
[01-01 18:12:15 TUYA Debug][log_seq.c:732] read from uf. max:0 first:0 last:0
[01-01 18:12:15 TUYA Debug][svc_online_log.c:288] svc online log init success

 Create Task wk_th-0, stack 0x10023e18, len 5120
[01-01 18:12:15 TUYA Err][tuya_ws_db.c:314] kvs_read fails gw_bi -1
[01-01 18:12:15 TUYA Err][ws_db_gw.c:111] gw base read fails -935
[01-01 18:12:15 TUYA Debug][tuya_bt_sdk.c:89] ty bt cmmod register finish 1
[01-01 18:12:15 TUYA Notice][tuya_ble_api.c:301] ble sdk inited
[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:1047] tuya_hal_bt_port_init

[01-01 18:12:15 TUYA Debug][uni_thread.c:215] Thread:sys_timer Exec Start. Set to Running Status
[01-01 18:12:15 TUYA Debug][uni_thread.c:215] Thread:cmmod Exec Start. Set to Running Status
[01-01 18:12:15 TUYA Debug][uni_thread.c:215] Thread:wk_th-0 Exec Start. Set to Running Status

 Create Task rtw_recv_tasklet, stack 0x10025328, len 5936

 Create Task rtw_xmit_tasklet, stack 0x10026b68, len 1024

 Create Task rtw_interrupt_thread, stack 0x10027078, len 1024

 Create Task cmd_thread, stack 0x10027588, len 2048

WIFI initialized

init_thread(55), Available hea
 Createp 0x16be0 Task trace_task, stack 0x10027ef8, len 512

 Create Task UpperStackTask, stack 0x100287c8, len 3072

 Create Task HCI I/F, stack 0x1002b2b0, len 2048
BT BUILD Date: Jul 29 2020, 16:17:09 
BT RESET LOG...
[01-01 18:12:15 TUYA Debug][tuya_hal_wifi.c:575] read wifi mac:38:1f:8d:39:13:c2
[01-01 18:12:15 TUYA Notice][tuya_hal_bt.c:893] BLE MAC: 0x38-0x1f-0x8d-0x39-0x13-0xc2

 Create Task tuya_bt_main_task, stack 0x1002c3d8, len 2560
BT Reset ok
bt_iqk_efuse_valid: has data

hci_tp_phy_efuse[0]=0,
bt_dump_iqk:    DUMP,
the IQK_xx  data is 0x127,
the IQK_yy  data is 0x3fe,
the QDAC   data is 0x1a,
the IDAC   data is 0x1b,
the QDAC2  data is 0x19,
the IDAC2  data is 0x19,

 Create Task rtw_coex_mailbox_thread, stack 0x1000fc08, len 1024
hci_read_rom_check: rom_version 0x0003, bt_hci_chip_id 0x0004

BT ADDRESS:
38:1f:8d:39:13:c2:

 WRITE  physical FLATK=tx_flatk=ff00 

We use fw_buf=1002f128, fw_len = 13a0, config_buf = 10010128, config_len= 32
Set baudrate to 921600

hci_tp_config:BT INIT success 7
Start upperStack
[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:788] tuya_bt_app_profile_callback(), service_id:255, tuya_bt_srv_id:1

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:338] tuya_bt_handle_io_msg(), msg_type:0

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:239] app_handle_gap_msg: subtype 1

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:72] app_handle_dev_state_evt: init state 1, adv state 0, cause 0x0


[BLE peripheral] GAP stack ready
[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:338] tuya_bt_handle_io_msg(), msg_type:0

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:239] app_handle_gap_msg: subtype 1

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:72] app_handle_dev_state_evt: init state 1, adv state 1, cause 0x0

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:338] tuya_bt_handle_io_msg(), msg_type:0

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:239] app_handle_gap_msg: subtype 1

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:72] app_handle_dev_state_evt: init state 1, adv state 2, cause 0x0

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:91] GAP adv start

[01-01 18:12:15 TUYA Notice][tuya_ble_api.c:337] ble sdk re_inited
[01-01 18:12:15 TUYA Notice][tuya_bt_sdk.c:130] ty bt sdk init success finish
[01-01 18:12:15 TUYA Notice][tuya_main.c:396] Base firmware: rtl8720cf_tls_common_iot_config:2.1.6 compiled at Date:Jul 29 2020 Time:16:17:40
[01-01 18:12:15 TUYA Notice][tuya_main.c:397] reset reset reason num 0
[01-01 18:12:15 TUYA Debug][tuya_device.c:19] < TUYA IOT SDK V:1.0.12 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.2_CD:1.0.0 >
< BUILD AT:2020_07_28_19_56_28 BY embed FOR ty_iot_wf_bt_sdk_rtos AT rtl8720cf_ameba >
IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 SHUTDOWN_MODE:0 LITTLE_END:1 TLS_MODE:2 ENABLE_LOCAL_LINKAGE:0 ENABLE_CLOUD_OPERATION:0 ENABLE_SUBDEVICE:0 ENABLE_ENGINEER_TO_NORMAL:0 OPERATING_SYSTEM:2 ENABLE_SYS_RPC:0 TY_SECURITY_CHIP:0 RELIABLE_TRANSFER:RELIABLE_TRANSFER ENABLE_LAN_ENCRYPTION:1 ENABLE_LAN_LINKAGE:0 ENABLE_LAN_LINKAGE_MASTER:0 >

[01-01 18:12:15 TUYA Debug][tuya_device.c:20] rtl8720cf_tls_common_iot_config:2.1.6
[01-01 18:12:15 TUYA Notice][simple_flash.c:430] key_addr: 0x1d8000   block_sz 4096
[01-01 18:12:15 TUYA Notice][simple_flash.c:498] get key:
0x52 0x32 0x7c 0x62 0xcc 0x45 0x99 0xbc 0x1f 0x80 0x21 0xa7 0xfa 0x6 0xbe 0x6c 
[01-01 18:12:15 TUYA Notice][tuya_main.c:447] have actived over 15 min, not enter mf_init
[01-01 18:12:15 TUYA Notice][tuya_uart_common_api.c:118] ty_uart_common_main_components_version:1.0.5,memrory left:67400...
[01-01 18:12:15 TUYA Notice][uart_common.c:238] pConfig = {low_sw:close,wifi_bdrate:115200,wifi_cofig_ver:1.0.0,crc:13,}---config len:62
[01-01 18:12:15 TUYA Notice][flash_config.c:192] ty_uart_public_iot_table_read_component_version:1.0.0
[01-01 18:12:15 TUYA Notice][flash_config.c:160] key:wifi_cofig_ver,value:1.0.0,len:5
[01-01 18:12:15 TUYA Notice][flash_config.c:157] key:wifi_bdrate,value:115200,len:3
[01-01 18:12:15 TUYA Notice][flash_config.c:167] key:low_sw,value:0,len:1
[01-01 18:12:15 TUYA Err][flash_config.c:129] json key 'flow_sw' not exist!
[01-01 18:12:15 TUYA Err][flash_config.c:129] json key 'ir_sw' not exist!
[01-01 18:12:15 TUYA Err][flash_config.c:129] json key 'ir_tx' not exist!
[01-01 18:12:15 TUYA Err][flash_config.c:129] json key 'ir_rx' not exist!
[01-01 18:12:15 TUYA Notice][uart_common.c:122] get_config_flow_sw err.
[01-01 18:12:15 TUYA Notice][uart_common.c:138] get_config_ir_sw err.
[01-01 18:12:15 TUYA Notice][uart_common.c:170] uart badrate:115200
[01-01 18:12:16 TUYA Notice][uart_common.c:171] flow_open:0
[01-01 18:12:16 TUYA Notice][uart_common.c:172] lowpower_open:0
[01-01 18:12:16 TUYA Notice][uart_common.c:173] ir_open:0
[01-01 18:12:16 TUYA Notice][uart_common.c:174] ir_tx:2
[01-01 18:12:16 TUYA Notice][uart_common.c:175] ir_rx:3
[01-01 18:12:16 TUYA Notice][tuya_uart.c:134] 0   115200

 Create Task ty_uart_task, stack 0x1002f128, len 4096
[01-01 18:12:16 TUYA Notice][uart_common.c:748] uart_task_init ok
[01-01 18:12:16 TUYA Notice][weather_sever.c:348] ty_uart_public_weather_component_version:1.0.0
[01-01 18:12:16 TUYA Notice][tuya_download_file.c:630] ty_uart_public_file_download_component_version:1.0.0
[01-01 18:12:16 TUYA Notice][tuya_download_file.c:662] file_download_init OK
[01-01 18:12:16 TUYA Notice][tuya_uart_common_api.c:186]  tuya_uart_common_init ok,memrory left:60624...
[01-01 18:12:16 TUYA Notice][process_server.c:110] send jump_pack
[01-01 18:12:18 TUYA Notice][uart_common.c:631] heart timer out clear all
[01-01 18:12:19 TUYA Notice][process_server.c:110] send jump_pack
[01-01 18:12:21 TUYA Notice][uart_common.c:631] heart timer out clear all
[01-01 18:12:22 TUYA Notice][process_server.c:110] send jump_pack
[01-01 18:12:24 TUYA Notice][uart_common.c:631] heart timer out clear all
[01-01 18:12:25 TUYA Notice][process_server.c:110] send jump_pack
[01-01 18:12:27 TUYA Notice][uart_common.c:631] heart timer out clear all
[01-01 18:12:28 TUYA Notice][process_server.c:110] send jump_pack
[01-01 18:12:30 TUYA Notice][uart_common.c:631] heart timer out clear all
[01-01 18:12:31 TUYA Notice][process_server.c:110] send jump_pack

Source: https://www.elektroda.com/rtvforum/topic4093142-60.html#21361625
Yes, I know it says Rtl8710c, rtl8720c is just 8710 with bluetooth.

For this guide, you will need to have some basic soldering skills and a USB to UART converter, like the CH340 one. It should have 3.3V voltage levels. So far, I've been using successfully this one for years:

I am also often using external 3.3V LDO (like AMS1117-3.3V) as a better power supply. 3.3V directly from USB to UART may not work. The 3.3V pin on shown USB to UART converter is only used to select voltage levels.

W701-VA2-CG modules
Let's consider most popular W701-VA2-CG modules.
WBR3 is a common Tuya module based on W701-VA2-CG. It has somewhat similar footprint to popular TYWE3S (ESP12) modules, so it also matches more or less with CB3S and WB3S.

Diagram of the WBR3 module with pin labeling and top and bottom views.

Pin number	Symbol	I/O type	Function
1	NC	/	The pin is pulled up to be compatible with other modules
2	A_7	I/O	GPIOA_7, hardware PWM, IC Pin 21
3	EN	I/O	Enabling pin, which works at the high level and is pulled up and controlled by a user externally
4	A_11	I/O	GPIOA_11, hardware PWM, IC Pin 25
5	A_2	I/O	GPIOA_2, hardware PWM, IC Pin 18
6	A_3	I/O	GPIOA_3, hardware PWM, IC Pin 19
7	A_4	I/O	GPIOA_4, hardware PWM, IC Pin 20
8	VCC	P	Power supply pin (3.3V)
9	GND	P	Power supply reference ground
10	A_12	I/O	GPIOA_12, hardware PWM, IC Pin 26
11	A_16	I/O	GPIOA_16, UART_Log_TXD, which is used for displaying the module internal information and can be configured as a common GPIO
12	A_17	I/O	GPIOA_17, hardware PWM, IC Pin 38
13	A_18	I/O	GPIOA_18, hardware PWM, IC Pin 39
14	A_19	I/O	GPIOA_19, hardware PWM, IC Pin 40
15	RXD	I/O	GPIOA_13, UART0_RXD, which is used as a user-side serial interface pin
16	TXD	I/O	GPIOA_14, UART0_TXD, which is used as a user-side serial interface pin

There is also A_15 (UART_Log_RXD) available on the back of the module.
WBR3 Modul...atform.pdf (619.05 kB)You must be logged in to download this attachment.

WBR2 is a common Tuya module based on W701-VA2-CG. It has somewhat similar footprint to popular TYWE2S (ESP8266) modules, so it also matches more or less with CB2S and WB2S.

Pin number	Symbol	IO type	Function
1	3V3	/	Power supply pin (3.3V)
2	A19	I/O	GPIOA_19, hardware PWM, IC Pin40
3	GND	P	Power supply reference ground
4	A18	I/O	GPIOA_18, hardware PWM, IC Pin39
5	A13	I/O	GPIOA_13, UART0_RXD, which is used as a user-side serial interface pin
6	A17	I/O	GPIOA_17, hardware PWM, IC Pin38
7	A14	I/O	GPIOA_14, UART0_TXD, which is used as a user-side serial interface pin
8	A20	I/O	GPIOA_20, common GPIO, IC Pin1
9	A12	I/O	GPIOA_12, hardware PWM, IC Pin26
10	EN	I/O	Enabling pin, which works at the high level and is pulled up and controlled by a user externally
11	A11	I/O	GPIOA_11, hardware PWM, IC Pin25

There is also A_15 (UART_Log_RXD) and A_16 (UART_Log_TXD) available on the back of the module.
WBR2 Modul...atform.pdf (581.57 kB)You must be logged in to download this attachment.

WBRU is a common Tuya module based on W701-VA2-CG. It has somewhat similar footprint to CBU, with both UART ports available on sides.

WBRU electronic module with CE and RoHS markings.

Diagram of WBRU module with top and bottom view

Pin number	Symbol	II/O type	Function
1	PA8	I/O	GPIOA_8, common GPIO, which can be reused as SPI_SCK and corresponds to Pin 22 of the IC
2	PA9	I/O	GPIOA_9, common GPIO, which can be reused as SPI_MOSI and corresponds to Pin 23 of the IC
3	PA2	I/O	GPIOA_2, hardware PWM, correspond to Pin 18 of the IC
4	PA3	I/O	GPIOA_3, hardware PWM, correspond to Pin 19 of the IC
5	PA4	I/O	GPIOA_4, hardware PWM, correspond to Pin 20 of the IC
6	L_RX	I/O	GPIOA_15, UART_Log_RXD (used to receive the external logs of the module), which can be configured as a common GPIO
7	L_TX	I/O	GPIOA_16, UART_Log_TXD (used to send the internal logs of the module), which can be configured as a common GPIO
8	PA11	I/O	GPIOA_11, hardware PWM, correspond to Pin 25 of the IC
9	PA12	I/O	GPIOA_12, hardware PWM, correspond to Pin 26 of the IC
10	PA17	I/O	GPIOA_17, hardware PWM, correspond to Pin 38 of the IC
11	PA18	I/O	GPIOA_18, hardware PWM, correspond to Pin 39 of the IC
12	PA19	I/O	GPIOA_19, hardware PWM, correspond to Pin 40 of the IC
13	GND	P	Power supply reference ground
14	VCC	P	Power supply pin (3.3V)
15	TX	I/O	GPIOA_14, UART0_TXD (user serial interface)
16	RX	I/O	GPIOA_13, UART0_RXD (user serial interface)
17	PA20	I/O	GPIOA_20, common GPIO, correspond to Pin 1 of the IC
18	EN	I/O	Enabling pin, active at the high level. The module has been pulled to the high level and the user can control the pin externally
19	PA0	I/O	GPIOA_0, not recommend to pull it to the high level. If it is pulled to a high level, it will enter the test mode. Correspond to Pin 15 of the IC
20	PA10	I/O	GPIOA_10, common GPIO, which can be reused as SPI_MISO and corresponds to Pin 24 of the IC
21	PA7	I/O	GPIOA_7, common GPIO, which can be reused as SPI_CS and corresponds to Pin 21 of the IC

WBRU Modul...atform.pdf (963.69 kB)You must be logged in to download this attachment.

NOTE: A_15 (UART_Log_RXD) and A_16 (UART_Log_TXD) are used as debug log output and as flashing port. A_13 (UART0_RXD) and A_0 must be pulled high to enable bootloader.

Update 2026
As of 2026, this platform read/write is also supported by our flash tool:
https://github.com/openshwprojects/BK7231GUIFlashTool
The connection (soldering, wires), is the same, but you can use our tool instead of the legacy one.
Please check it out and use it instead of legacy tools, let us know how it works for you!

Flashing guide
Those WBR3/WBR2 modules are strange, in case of WBR3 you need to access pin from under module. You can desolder it with hot air.
You need to connect:
- GND and 3.3V to a good 3.3V power supply
- A_16 to USB to UART RX
- A_15 to USB to UART TX (it's on module back)
- RXD and A0 to 3.3V (to enable bootloader mode)
To reset module, connect EN to ground (it's like RESET, CEN pin)
This is how it looks like for WBR3:

Close-up of Tuya W701-VA2-CG module with soldered wires.

And for WBR2:
- GND and 3.3V to a good 3.3V power supply
- LOG_TX to USB to UART RX
- LOG_RX to USB to UART TX (it's on module back)
- A13 (RXD) and A0 to 3.3V (to enable bootloader mode)

Tuya module with soldered wires for flashing

Tuya WBR2 module with connected wires for flashing.

Here is my setup, as you can see I am using TC1264 (similar to AMS1117-3.3V) LDO for power supply:

Breadboard with connected wires and a module.

Get our binaries here:
https://github.com/openshwprojects/OpenBK7231T_App
Now, if you run any UART to USB converter, you should be able to see this message after doing reboot (shorting EN to ground for a moment):

RealTerm program showing UART connection settings.

Now you can use AmebaZ2 PG Tool 1.2.47:

User interface of the AmebaZ2 PG Tool 1.2.47 for programming.

Set Flash Pin as in Docs:

Flash options for Tuya modules with flash pin selection

Start flashing:

User interface of the AmebaZ2 PG Tool 1.2.47 during flashing.

Remember that you need to disconnect booting pins from 3.3V (all except 3.3V pin itself) and reboot in order for new firmware to start.

To sum up - flashing infographics, WBR3:

Guide for connecting and flashing WBR3 (W701-VA2-CG/RTL8720CF) module for Home Assistant integration.

WBR2:

Tuya flashing docs:
Flash Firm...tation.pdf (2.47 MB)You must be logged in to download this attachment.

Binaries and flash Tool download
Get binaries from our repository:
https://github.com/openshwprojects/OpenBK7231T_App
Navigate to Releases tab:
https://github.com/openshwprojects/OpenBK7231T_App/releases
Binaries are marked as RTL87X0C, OpenRTL87X0C, they should run on RTL8710C/RTL8720C:

Screenshot of a table with flash files for various devices, with highlighted entries for RTL87X0C.

Flash tool is available here:
AmebaZII_P...1.2.47.zip (99.8 kB)You must be logged in to download this attachment.
Flash tool mirror is here:
https://github.com/openshwprojects/FlashTools/tree/main/Realtek

First configuration
So now you have flashed your device and disconnected pulled up signals from 3.3V. Of course, the main 3.3V pin still should be connected, because your device needs power. Short EN to ground to reboot. Then first thing to check is the UART log output. It should print OBK log correctly:

Screenshot from RealTerm showing boot log of an IoT module.

OBK access point should appear:

Wi-Fi network connection window for OpenRTL87X0C

Connect to this AP and go to 192.168.4.1:

Go to config, WiFi:

OpenRTL87X0C configuration interface with Configure WiFi & Web highlighted

Configure your WiFi SSID/password there.
Device will reboot and connect to your network. You can use your router DHCP clients list to discover new device IP.

What to do next?
With OBK you can do many things, including HASS Discovery:

Use SSDP Discovery:

Use Tasmota Device Groups:

Add DHT11:

Create custom online builds and drivers:
How to create a custom driver for OpenBeken with online builds (no toolchain required)
OpenBeken online building system - compiling firmware for all platforms (BK7231, BL602, W800, etc)
OBK repository:
https://github.com/openshwprojects/OpenBK7231T_App
OBK docs:
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/README.md
Our devices list:
https://openbekeniot.github.io/webapp/devicesList.html

Interesting development board
There is also BW15 module available along with development board. It features RTL8720CF. More info coming soon.
bw15_datas...eet_en.pdf (829.32 kB)You must be logged in to download this attachment.

Summary
Ameba ZII is now flashable with OBK. WBR3/WBR2/etc modules requires few more wires to flash, but it's still doable. WBR3 may be a bit more problematic, because flashing pads are on the back of the module, but you can always desolder whole module with hot air. Even a cheap hot air station like 858 should work good. Soon we will also release a video showing whole process step for step, but that's all for now. Good luck with flashing your devices!

Special thanks for @insmod and @divadiow for RTL porting and testing!

PS: I also attach some futher RTL8720-related dasheets... there are more RTL types that we hope to support soon as well.

Attachments:

UM0401_RTL872xD_Datasheet_v3.4_watermark.pdf (1.39 MB) You must be logged in to download this attachment.

About Author

p.kaczmarek2 wrote 14375 posts with rating 12294 , helped 649 times. Been with us since 2014 year.

Comments

Add a comment

DeDaMrAz 03 Jan 2025 18:01

Here is a quick preview of the flashing jig for WBR3 modules that is being in the works now. https://obrazki.elektroda.pl/8415611400_1735923291_thumb.jpg https://obrazki.elektroda.pl/6633633100_1735923369_thumb.jpg... [Read more]

p.kaczmarek2 03 Jan 2025 19:07

Very interesting idea, I wonder how reliable it will be. I've recently started working on a simple NodeMCU to WBR3 hack, and it seems to turned out well. I've managed to solder WBR3 with a two wires... [Read more]

divadiow 03 Jan 2025 20:28

WBR3 is an interesting module. BW15 and vanilla RTL8720CFs (the one I have anyway) only require PA0 to be pulled to 3.3V. I am lead to believe that WBR3s have, as seen in your boot log ROM Version:... [Read more]

p.kaczmarek2 03 Jan 2025 20:42

Thank you for sharing, that's a very informative table. Btw Do you have any flashdumps of RTL that are not (yet) there? https://github.com/openshwprojects/FlashDumps Maybe we should merge our co... [Read more]

divadiow 03 Jan 2025 20:54

Only the Tapo P100 and BW15 AT factory flash. I can make PR to add? new folder for CF? There also a couple of my BX backups floating around. [Read more]

p.kaczmarek2 03 Jan 2025 20:58

Sure, let's centralize everything, especially that we've recently seen that those WBRs also have Tuya config partition. [Read more]

divadiow 03 Jan 2025 22:54

@dedamraz do you have a Tuya RTL8720CF to hand? If yes and you a moment would you mind flashing this to it? https://www.elektroda.com/rtvforum/topic4021547.html#20870137 I've flashed a couple of factory... [Read more]

DeDaMrAz 03 Jan 2025 23:00

Same result, I recall that @insmod mentioned something wrong with flash tool writing (I guess reading may have the problem as well) == Rtl8710c IoT Platform == Chip VID: 5, Ver: 3 ROM Version:... [Read more]

divadiow 03 Jan 2025 23:18

this Govee H5106 Air Quality Monitor fw from device with second MCU does https://obrazki.elektroda.pl/6464377200_1735942541_thumb.jpg uart send:0x55 0x1 0x0 0x0 0x0 0x0 0x81 0xd7 [Read more]

p.kaczmarek2 03 Jan 2025 23:25

Are you sure about that packet? TuyaMCU header is 0x55AA, not just 0x55. By the way, with some simple software on PC, we could simulate MCU to "talk" with that WiFi firmware. https://obrazki.elekt... [Read more]

divadiow 03 Jan 2025 23:29

I don't think it's TuyaMCU. Govee isn't Tuya based? And the tell-tale sign also that no Tuya storage area is found in fw. I think whoever made that pic and labelled it TuyaMCU is wrong. This is boot... [Read more]

p.kaczmarek2 04 Jan 2025 00:10

Interesting, adding OBK support to this would be a great learning experience. [Read more]

anthonythomas 04 Jan 2025 13:12

Is it right to say it isn't possible to flash the WBR3 without removing it from the board to gain access to the reverse pads? Just wondering whether it is worth actually flashing and instead replacing... [Read more]

divadiow 04 Jan 2025 15:53

yes. WBR3 pads on the underside would need to be accessed Added after 1 [minutes]: true. that MCU is a Freqchip FR8016HA https://github.com/search?q=FR8016HA&type=code the device owner... [Read more]

p.kaczmarek2 04 Jan 2025 17:26

I think you need to desolder it to gain access to the pads on the back side. I've tried to flash via the other serial port, because I saw it mentioned here: https://developer.tuya.com/en/docs/iot/burn-and-authorize-wbr-series-modules?id=Ka78imt8pf85p but... [Read more]

divadiow 04 Jan 2025 17:58

Yes. I have already sought to try with some TuyaMCU/RTL firmwares but getting the backups to boot is hampering efforts. I used pk in the Aleco dehumidifier backup though and got the dpIDs that way after... [Read more]

GAAD 04 Jan 2025 18:07

Uploaded to WBR1-IPEX https://obrazki.elektroda.pl/7018483600_1736009784_thumb.jpg . https://obrazki.elektroda.pl/4030991100_1736009783_thumb.jpg . The first problem is that it does not... [Read more]

p.kaczmarek2 04 Jan 2025 20:39

It seems there was one more thermostat with WBR3 that I already tested: Room thermostat HY609-WE with WiFi - manual, app, interior, TuyaMCU protocol The dpIDs are included in the topic but I don't... [Read more]

insmod 04 Jan 2025 20:52

Static ip is currently not implemented, nor do i have any plans for it yet. But it shouldn't be hard to implement, just disable LwIP_DHCP(0, DHCP_START); if static ip is set, and use netif_set_addr the... [Read more]

FAQ

TL;DR: With 3.3 V wiring and 4–6 UART connections, you can flash WBR2/WBR3/WBRU Tuya modules; as one contributor put it, "the connection ... is the same" even when switching to newer tools. This FAQ helps Home Assistant and OpenBeken users identify pinouts, choose the right flasher, and recover MQTT discovery on RTL8720CF-based devices. [#21375223]

Why it matters: These modules appear in thermostats, plugs, breakers, switches, heaters, blinds, and IR devices, so one reliable flashing method unlocks many Tuya products without cloud dependence.

Tool	Best use	Write support	Read/backup support	Notable thread detail
AmebaZ2 PG Tool 1.2.47	Legacy RTL8720CF flashing	Yes	No practical read option discussed early on	Original step-by-step guide used it first [#21375223]
BK7231GUIFlashTool	Preferred newer workflow	Yes	Yes, later RTL87X0C read/write support added	RTL87X0C support expanded through 2025 [#21708748]
ltchiptool	Linux/CLI alternative	Yes	Not the main focus here	One user wrote a 719.1 KiB image successfully on Linux [#21398455]

Najważniejsza wskazówka: On WBR3, the working UART boot path uses the log UART on A15/A16, not the normal user UART on A13/A14. Most failed flashes came from wrong UART choice, unstable adapters, or weak 3.3 V power. [#21375223]

Quick Facts

WBR3, WBR2, and WBRU in this thread all center on W701-VA2-CG / RTL8720CF, a Wi-Fi + BLE 4.2 Realtek platform typically running at 100 MHz with 256 KB SRAM in the shared comparison table. [#21375443]
The proven boot wiring uses 3.3 V, not 5 V logic, and the guide explicitly recommends a solid external 3.3 V LDO because some USB-UART adapters cannot power the module reliably from their 3.3 V pin. [#21375223]
WBR3 flashing usually needs access to underside pads: connect A15/A16, pull A0 and A13/RXD high, then reset with EN to GND. WBR2 exposes similar signals more accessibly. [#21375223]
Later tool work added practical dump support: one successful RTL87X0C backup read a full 0x200000 = 2 MB flash and verified it with a SHA-256 hash match before extraction attempts. [#21727461]
Real-world confirmation spans several devices, including a Kasa HS200, Gosund SP1 plug, and Tapo P110 variants, showing the method is not limited to one Tuya product family. [#21381809]

How do I flash a Tuya WBR3 or WBR2 module based on W701-VA2-CG / RTL8720CF with OpenBeken using AmebaZ2 PG Tool or BK7231GUIFlashTool?

Flash it over the log UART, not the normal serial port. 1. Power the module from a stable 3.3 V supply and wire A16→USB-UART RX, A15→USB-UART TX, plus GND. 2. Pull A0 and A13/RXD high to enter bootloader, then reset by shorting EN to GND. 3. Write an OpenRTL87X0C binary with AmebaZ2 PG Tool or the newer BK7231GUIFlashTool, then remove the boot straps and reboot. The guide states this method works for WBR1, WBR2, WBR3, WBR2L, WBR3L, and WBRU-class RTL8720CF modules. [#21375223]

What is W701-VA2-CG, and how is it related to Realtek RTL8720CF, WBR2, WBR3, and WBRU modules?

W701-VA2-CG is the RF module core used by several Tuya-branded boards, and in this thread it is treated as the same platform as Realtek RTL8720CF. "W701-VA2-CG" is an embedded Wi-Fi + Bluetooth module family that packages the RTL8720CF-class chip into different Tuya footprints, including WBR2, WBR3, and WBRU, while keeping the same flashing concept and similar GPIO families. That is why one firmware family, OpenRTL87X0C, can target multiple module shapes even though the pin headers differ. [#21515587]

Which pins do I need to connect on WBR3, WBR2, and WBRU to enter bootloader mode and flash over UART?

Use the log UART pins plus two boot straps. For WBR3, connect 3.3 V, GND, A16 to USB-UART RX, A15 to USB-UART TX, then pull A0 and RXD/A13 high and reset with EN. For WBR2, the same rule applies, but A15 and A16 are on the back and A13 is labeled RXD. For WBRU, the note is explicit: A15 and A16 are the debug/flashing UART, while A13 and A0 must be pulled high for bootloader mode. [#21375223]

Why does a WBR3 usually need to be desoldered before flashing, and are there any practical alternatives like a jig or NodeMCU adapter hack?

WBR3 usually needs desoldering because its critical flashing pads sit on the underside. Multiple replies confirm you generally must remove it to reach A15 and related pads, although practical alternatives appeared in the thread: a spring-pin jig in development and a NodeMCU carrier hack with wires routed below the module. Those ideas reduce repeat soldering, but the tested method remained full access to the underside pads. One concise reply put it plainly: "yes. WBR3 pads on the underside would need to be accessed." [#21376702]

What is AmebaZ2 PG Tool 1.2.47, and when should I use it instead of BK7231GUIFlashTool or ltchiptool for RTL87X0C devices?

AmebaZ2 PG Tool 1.2.47 is the legacy Realtek flashing utility first used in this guide for RTL8720CF-based Tuya modules. Use it when you only need a known-good write path on Windows and want to follow the original screenshots exactly. Prefer BK7231GUIFlashTool when you need newer RTL87X0C support, backup features, or config extraction workflows. Use ltchiptool when you want a Linux CLI path; one user flashed an OpenRTL87X0C image from /dev/ttyUSB0 and the tool auto-detected a 719.1 KiB Realtek AmebaZ2 image successfully. [#21398455]

How do I set up OpenBeken after flashing a WBR3 or WBR2 so it joins Wi-Fi and appears in Home Assistant via MQTT discovery?

After flashing, boot OpenBeken, join its AP, and configure Wi-Fi at 192.168.4.1. Then set your MQTT broker, save, and either run Home Assistant discovery manually or add scheduleHADiscovery 5 to autoexec.bat so discovery starts about 5 seconds after MQTT connects. The thread shows this works once the right channel types are assigned; missing or old channel types were a real cause of absent entities. One contributor confirmed the fix immediately after updating the firmware and keeping discovery in autoexec. [#21564801]

Why does flashing a WBR3 with an FT232 adapter fail with XMODEM timeouts, while a CH340 works better for some users?

The thread’s strongest pattern is adapter quality and UART stability, not the module itself. A user repeatedly hit XMODEM timeouts and short-packet errors with an FT232-based adapter, then switched to a CH340 and obtained a proper RTL flash backup with hash verification. Another contributor noted many FT232 boards are fake, while CH340 and CP210x adapters worked reliably in their experience. Stable 3.3 V power also matters, because a weak adapter supply can look like a protocol failure. [#21809020]

What do the WBR3, WBR2, and WBRU pinouts look like, including the hidden A15/A16 log UART pads used for flashing?

The important difference is where the log UART appears. WBR3 exposes 16 edge pins, including A13/RXD and A14/TXD, but A15 is on the back and A16 is the log TX pin used for internal output. WBR2 has 11 main pins, with A15 and A16 again available on the rear pads. WBRU is more convenient: both log UART pins, L_RX = A15 and L_TX = A16, are on the sides together with TX = A14 and RX = A13. That hidden A15/A16 pair is why photos and board diagrams matter so much. [#21375223]

How can I read or back up flash contents from RTL8720CF / RTL87X0C devices, and what tools currently support dump and restore?

Today, use BK7231GUIFlashTool for practical dump and restore on RTL87X0C. By October 2025, the thread showed full read and write working, including a 2 MB backup, flash ID detection, hash verification, and config extraction attempts. Earlier in the thread, the answer was effectively “not yet” for AmebaZ2 PG Tool, which lacked a straightforward read-to-file path for users. There was also experimental CLI work around AmebaZ2 reads, but the clearest usable path became BK7231GUIFlashTool rather than the older vendor flasher. [#21708748]

What is TuyaMCU, and how do I map Tuya dpIDs to OpenBeken channels for thermostats, heaters, blinds, and kettles?

TuyaMCU is the secondary-MCU protocol layer many smart devices use between the Wi-Fi module and the product logic board. "TuyaMCU" is a serial protocol interface that carries dpIDs such as switch, target temperature, blind position, or kettle temperature, and OpenBeken maps each dpID to a channel type, label, and direction. In practice, start the driver, set the baud rate, then use commands like linkTuyaMCUOutputToChannel 2 val 2 and setChannelType 2 dimmer or Temperature. The thread shows this method working on thermostats, blinds, heaters, and a smart kettle. [#21701460]

How do I troubleshoot a TuyaMCU device on WBR3 when startDriver TuyaMCU causes safe mode or when Home Assistant entities do not show up?

Start by removing the bad autoexec, rebooting cleanly, and launching TuyaMCU manually. If startDriver TuyaMCU still forces safe mode, the usual causes are wrong baud rate, wrong dpID/channel mapping, or a bad command in autoexec. If Home Assistant entities do not appear, update to a build that includes the needed channel types, then run scheduleHADiscovery 5. That exact issue happened with new OpenStopClose support: the entity appeared only after firmware update because the older May build lacked the required discovery behavior. [#21565324]

What is the difference between the log UART on A15/A16 and the user UART on A13/A14 on WBR modules, and which one is used for flashing?

The log UART on A15/A16 is the flashing path; the user UART on A13/A14 is the application serial port. The module tables describe A15 as UART_Log_RXD and A16 as UART_Log_TXD, while A13/A14 are UART0_RXD and UART0_TXD for user-side serial communication. The flashing note repeats the distinction: use A15/A16 for debug output and bootloading, and pull A13 plus A0 high to enter bootloader mode. That distinction explains many failed attempts through the wrong UART. [#21375223]

AmebaZ2 PG Tool vs BK7231GUIFlashTool vs ltchiptool for Realtek RTL8720CF flashing — which tool is better for writing, reading, and recovery?

BK7231GUIFlashTool is the best all-around choice in this thread’s later state. Use AmebaZ2 PG Tool for basic legacy writing, ltchiptool for Linux command-line writing, and BK7231GUIFlashTool for the broadest write-plus-read-plus-recovery workflow. By late 2025, BK7231GUIFlashTool added RTL87X0C read/write support, flash-ID handling, and config operations, while AmebaZ2 PG Tool remained mostly a vendor writer. ltchiptool proved practical for write-only Linux use, but the thread did not position it as the primary backup or recovery solution. [#21708620]

How can I preserve or reconstruct original device functionality after flashing OpenBeken, including importing templates, using GPIO Doctor, and writing autoexec.bat scripts?

Rebuild the device in layers: pins first, protocol second, automation third. 1. If it is not a TuyaMCU device, use GPIO Doctor or a known template to find relay, button, LEDs, and metering pins. 2. If it is a TuyaMCU device, extract or infer dpIDs and map them in autoexec.bat. 3. Add drivers, labels, MQTT, and Home Assistant discovery. The thread explicitly says original behavior is usually restored either by choosing GPIO roles manually or via template import, then extending it with scripts and TuyaMCU channel mappings. [#21420173]

What should I watch out for when moving firmware or backups between WBR3 and WBRU modules, especially around RF calibration, system data, and per-device settings?

Expect the main firmware to be portable, but treat per-device data cautiously. One reply says WBR3 and WBRU use the same W701-VA2-CG core and should run the same program image, yet the follow-up warning is RF and system data: calibration may be per-device, MAC is in efuse, and a later developer comment says system and calibration areas at 0x1000–0x3000 do not appear readable in normal dumps. So move the application image only when possible, not a blind full-device clone for certification-sensitive work. [#21516179]

Generated by the language model.