Shows how to flash WBR2 and WBR3 modules built around the RTL8720CF/W701-VA2-CG chip.
Uses a step-by-step soldering guide with a few extra wires, similar to flashing ESP modules.
Covers WBR1, WBR2, WBR3, WBR2L, WBR3L, and WBRU modules, with English and Polish text guides.
Lets you replace firmware, free devices from the cloud, and pair them with Home Assistant.
A 2026 update says BK7231GUIFlashTool now supports the read/write process, while the wiring stays the same.
Generated by the language model.
RTL8720CF/W701-VA2-CG can be easily flashed just like ESP modules - you just need to connect few more wires. Here's a step by step video showing firmware change process for WBR3 and WBR2 modules, which are using mentioned Realtek chip. This way you can free your devices from the cloud and pair them with Home Assistant.
This guide is applicable to the following modules with the core chip of RTL8720CF or similar, so: WBR1, WBR2, WBR3, WBR2L, WBR3L, WBRU etc.
Thank you for watching! Let us know how the flashing process went. You can also visit our teardowns list here: https://openbekeniot.github.io/webapp/devicesList.html , if you have a device that's not listed yet, please consider submitting it. See you!
Update 2026 As of 2026, this platform read/write is also supported by our flash tool:
https://github.com/openshwprojects/BK7231GUIFlashTool The connection (soldering, wires), is the same, but you can use our tool instead of the legacy one.
Please check it out and use it instead of legacy tools, let us know how it works for you!
About Author
p.kaczmarek2 wrote 14400 posts with
rating 12330 , helped 650 times.
Been with us since 2014 year.
a user on this forum kindly sent me some WBR3 modules for testing. The location of those pads on the rear is a pain, as already stated.
I think I will turn the CR3L Bluetooth Gateway chassis into a... [Read more]
p.kaczmarek2
06 Feb 2025 12:37
Will you route out the pad on the module back? I did it, just to be on the safe side - it may be needed if I brick the OTA.
https://obrazki.elektroda.pl/6443591600_1738841842_thumb.jpg
https://obrazki.elektroda.pl/4473560000_1738841840_thumb.jpg... [Read more]
divadiow
06 Feb 2025 12:40
yes. initial idea is that all should be routed to the outside case for every eventuality [Read more]
p.kaczmarek2
06 Feb 2025 12:47
So you have two options:
1. do just like me, route out a wire
2. is this just a twosided board and copper ground pour is on both sides onder WBR3 place? If so, maybe you could... well, carefully cut... [Read more]
divadiow
06 Feb 2025 12:53
likely this, but maybe with thin enamelled wire
hadn't thought of this, but it looks like most of both sides are covered by a ground plane so that would need careful avoidance/isolation from the... [Read more]
p.kaczmarek2
06 Feb 2025 13:45
The PCB edges would be needed to be sanded with sand paper.
Btw, I still have those 3 from the reader:
https://obrazki.elektroda.pl/6737341400_1738845723_thumb.jpg
I will probably swap them... [Read more]
divadiow
07 Feb 2025 07:58
some progress
https://obrazki.elektroda.pl/8656125300_1738880047_thumb.jpg https://obrazki.elektroda.pl/9652426300_1738880070_thumb.jpg https://obrazki.elektroda.pl/6103917500_1738880138_thumb.jpg... [Read more]
Very nice idea. Remember to add more grounds and VDD pins in advance.
Also, we really need to check if it 's possible to print pin names on paper, it would help a lot if we could label this connec... [Read more]
divadiow
08 Feb 2025 17:22
oh. I thought 3 GND and 2 3V3 would do for now. Plenty of space if more needed though
Added after 45 :
which connector? [Read more]
p.kaczmarek2
08 Feb 2025 17:24
This one obviously:
https://obrazki.elektroda.pl/2609557500_1739031818_thumb.jpg
I need to do the same for my dev board: https://www.elektroda.com/rtvforum/topic4062695.html [Read more]
divadiow
08 Feb 2025 17:27
I have labelled it!
https://obrazki.elektroda.pl/9486103600_1739032163_thumb.jpg
https://obrazki.elektroda.pl/8153794200_1739032190_thumb.jpg [Read more]
p.kaczmarek2
08 Feb 2025 17:39
Ah right, sorry, I didn't see. It seems that we need to use "big thumb" image option more often. [Read more]
p.kaczmarek2
17 Jan 2026 11:35
Update 2026
As of 2026, this platform read/write is also supported by our flash tool:
https://github.com/openshwprojects/BK7231GUIFlashTool
The connection (soldering, wires), is the same, but you... [Read more]
tomik67
17 Jan 2026 23:08
Today I flashed four pieces of MTG276-WF-RL presence sensors with the WBR3 modules mentioned in this thread...:
Link
It was possible to read the modules, it only worked at a speed of 1500000,... [Read more]
divadiow
16 Mar 2026 13:02
I didn't notice this post from back in January. Here's the boot log from your firmware dump.
== Boot Loader ==
Dec 5 2019:14:02:18
fwx SELE[fffffffe]
fw SELE Bitidx 1, fw1 valid 1, sn 0, fw2... [Read more]
p.kaczmarek2
16 Mar 2026 13:38
This has macOS build but no RTL support:
https://github.com/openshwprojects/EasyGUIFlashTool
No RTL support... yet? [Read more]
tomik67
16 Mar 2026 16:12
Model MTG236-WF is the flush-mounted version and MTG276-WF-RL is the surface-mounted version, pcb slightly different but dpID the same. [Read more]
divadiow
18 Mar 2026 22:10
could give it a go I guess, unless you were thinking or doing it. or anyone else was
Added after 47 :
Almost got XR806 support in EF1 to a good point I believe [Read more]
FAQ
TL;DR: Flashing WBR2/WBR3 needs more than 4 wires, and one expert notes the rear pads are "a pain" to reach. This FAQ is for Tuya modders who want a step-by-step RTL8720CF flashing path, safer pad access, and a reusable WBR3 test jig that frees devices from the cloud and works with Home Assistant. [#21427090]
Why it matters: The thread turns a fiddly Realtek module into a repeatable flashing workflow, plus a practical dev-board approach for recovery, testing, and faster firmware experiments.
Option
Year mentioned
RTL8720CF support in thread
Best use
Legacy RTL flashing tools
2025
Yes
Original WBR2/WBR3 process
BK7231GUIFlashTool
2026
Yes
Preferred read/write tool for this platform
EasyGUIFlashTool macOS build
2026
No RTL support yet
macOS availability, but not for RTL yet
Key insight: Keep recovery access to the hard-to-reach rear pad and to A0/A13. That single design choice makes repeated flashing, full-chip erase, and post-OTA rescue much easier on WBR3 hardware.
Quick Facts
The guide explicitly covers WBR1, WBR2, WBR3, WBR2L, WBR3L, and WBRU when they use the RTL8720CF or similar core chip. [#21426314]
Reported working flash speeds were 921600 and 2000000 baud for writing, while one user could read a module only at 1500000 baud and still saw errors. [#21811926]
One reusable WBR3 adapter used 5 V USB-C, 3 GND, and 2 3V3 pins, with labeled headers and spare GPIOs for repeated test access. [#21430457]
A flashed WBR3 was mapped as PA3 = red LED, PA2 = blue LED, and PA11 = button, confirming practical GPIO identification after OpenRTL flashing. [#21430141]
How do you flash a WBR2 or WBR3 module with the RTL8720CF step by step, including which wires and pads need to be soldered?
You flash it by soldering the required wires, then following the RTL8720CF video guide and text guide for WBR2/WBR3-class modules. 1. Solder the flashing wires, including access to the hard-to-reach rear pad and the lines needed to control boot state. 2. Pull the required control pads high as shown on the custom dev board approach. 3. Run the flash tool and then continue configuration through the linked playlist for Home Assistant setup. The author states the process is similar to ESP modules, but needs a few more wires. [#21426314]
Which Tuya modules are covered by this RTL8720CF flashing guide besides WBR2 and WBR3, such as WBR1, WBR2L, WBR3L, or WBRU?
The guide also covers WBR1, WBR2L, WBR3L, and WBRU, as long as the module uses the RTL8720CF core chip or a similar Realtek chip. That scope is stated directly in the opening post, so the procedure is not limited to only WBR2 and WBR3 boards. [#21426314]
What's the best way to access the rear pads on a WBR3 module when the pad layout is hard to reach for flashing?
The most practical method is to route the rear pad to an external header using thin wire, ideally hidden inside a donor chassis or adapter. One builder called the rear pad position “a pain,” then proposed converting a CR3L case into a WBR3 dev board so all GPIOs and hard pads stay reachable from outside. [#21427090]
Why would someone route the back pad of a WBR3 module out to an external header, and how does that help if an OTA flash gets bricked?
You route that pad out so you still have hardware recovery access if an OTA update fails. The thread explicitly says the extra back-pad wire was added “just to be on the safe side” because it may be needed after a bricked OTA, which turns a risky hidden pad into an accessible recovery point. [#21427247]
What are A0 and A13 used for during WBR3 flashing, and how do you pull them high correctly on a custom dev board?
A0 and A13 are the pads the custom WBR3 adapter exposed so they could be pulled high easily during flashing. The finished board specifically reports that “A0 and A13 can be pulled high with ease,” which means the builder designed dedicated, reachable header access instead of relying on temporary probes on tiny rear pads. [#21430141]
How can you turn a CR3L Bluetooth Gateway chassis into a WBR3 development board with USB-C power, labeled headers, and spare GPIO access?
Remove the CR3L module, fit a WBR3, and route the module pads to external jumper headers in the case. The finished build added 5 V USB-C power, labeled headers, spare GPIOs, multiple grounds, and 3V3 pins, creating a reusable flashing and testing adapter instead of a one-off wiring job. [#21430141]
Which GPIOs were identified in the thread for the flashed WBR3 module, and how were PA3, PA2, and PA11 mapped to LEDs and button functions?
The mapped GPIOs were PA3 for the red LED, PA2 for the blue LED, and PA11 for the button. Those assignments were reported immediately after the module was flashed to OpenRTL, so they serve as working pin confirmations for that specific WBR3-based dev-board build. [#21430141]
What is OpenRTL in the context of flashing Realtek RTL8720CF modules, and how does it relate to freeing Tuya devices from the cloud?
OpenRTL is firmware used on Realtek RTL8720CF-based modules after flashing, and the thread shows a WBR3 successfully flashed to it. "OpenRTL" is firmware that replaces stock Tuya software on supported Realtek modules, enabling local control, direct GPIO mapping, and cloud-independent operation. In this thread, it is presented as part of the path to free Tuya devices from the cloud and pair them with Home Assistant. [#21426314]
What does OTA mean when working with WBR3 or RTL8720CF devices, and why is it important to keep recovery access available?
OTA means over-the-air firmware updating, and it matters because a failed OTA can lock you out of normal recovery. "OTA" is a firmware update method that writes new software through the device itself, without opening hardware, but a failed image can leave recovery pads as the only practical rescue path. That is why the thread recommends routing out the hidden rear pad before final assembly. [#21427247]
BK7231GUIFlashTool vs the legacy RTL flashing tools: which one should you use for WBR2/WBR3 modules in 2026 and why?
Use BK7231GUIFlashTool in 2026 because the thread says this platform is supported there for read and write, with the same soldering and wire connections as before. The 2026 update explicitly recommends using that tool instead of legacy tools for RTL8720CF-class modules such as WBR2 and WBR3. [#21811291]
How can I run the Realtek flashing tools on macOS for WBR3 or RTL8720CF devices, and what are the current limitations?
You currently cannot rely on a macOS build for RTL8720CF flashing from this thread alone, because the cited macOS build has no RTL support yet. The thread names EasyGUIFlashTool as having a macOS build, but immediately adds the limitation: “No RTL support... yet?”, so WBR3/RTL use on macOS remains unfinished here. [#21863652]
Why might reading flash from a WBR3 module be flakier than writing, and which baud rates were reported to work more reliably?
Reading appears flakier than writing on this platform, and the thread reports concrete baud-rate differences. One user could read only at 1500000 baud, with intermittent errors, while writing worked at 921600 and 2000000 baud. A later test also says read was “oddly flakier than write,” though write and full-chip erase were still acceptable with capped baud. [#21866282]
What should you do when a WBR3 module shows repeated read errors or an OBK config write fails during flashing?
Try the newer Easy Flasher first, lower expectations for read stability, and separate firmware flashing from config extraction. A user reported repeated read errors and a failed OBK config write on an MTG276-WF-RL module, and the reply said the latest Easy Flasher should be more resilient for those failures. [#21863617]
How do MCU-based Tuya devices like the MTG276-WF-RL or MTG236-WF differ from fully Wi-Fi-controlled devices when extracting configs or making OpenBeken templates?
They differ because the Wi-Fi module handles communication, while the external MCU handles device logic, so detailed Wi-Fi-side templates may not exist. The thread states there is no detailed config for MTG276-WF-RL because it is an MCU device, and it adds that MTG236-WF and MTG276-WF-RL share the same dpID despite different flush and surface-mounted hardware. [#21863783]
What labeling, ground, and 3V3 header layout works best when building a reusable WBR3 test jig or development adapter for repeated flashing?
A practical layout uses clear pin labels, multiple grounds, and at least two 3V3 pins on an external header. One finished adapter had labeled headers, 3 GND, and 2 3V3, while the follow-up advice was to add more grounds and VDD pins in advance because repeated flashing and GPIO experiments benefit from extra power and reference points. [#21430457]
Comments
a user on this forum kindly sent me some WBR3 modules for testing. The location of those pads on the rear is a pain, as already stated. I think I will turn the CR3L Bluetooth Gateway chassis into a... [Read more]
Will you route out the pad on the module back? I did it, just to be on the safe side - it may be needed if I brick the OTA. https://obrazki.elektroda.pl/6443591600_1738841842_thumb.jpg https://obrazki.elektroda.pl/4473560000_1738841840_thumb.jpg... [Read more]
yes. initial idea is that all should be routed to the outside case for every eventuality [Read more]
So you have two options: 1. do just like me, route out a wire 2. is this just a twosided board and copper ground pour is on both sides onder WBR3 place? If so, maybe you could... well, carefully cut... [Read more]
likely this, but maybe with thin enamelled wire hadn't thought of this, but it looks like most of both sides are covered by a ground plane so that would need careful avoidance/isolation from the... [Read more]
The PCB edges would be needed to be sanded with sand paper. Btw, I still have those 3 from the reader: https://obrazki.elektroda.pl/6737341400_1738845723_thumb.jpg I will probably swap them... [Read more]
some progress https://obrazki.elektroda.pl/8656125300_1738880047_thumb.jpg https://obrazki.elektroda.pl/9652426300_1738880070_thumb.jpg https://obrazki.elektroda.pl/6103917500_1738880138_thumb.jpg... [Read more]
https://obrazki.elektroda.pl/2508226500_1739015994_thumb.jpg https://obrazki.elektroda.pl/8511049900_1739016108_thumb.jpg https://obrazki.elektroda.pl/4475598600_1739016197_thumb.jpg https://obrazki.elektroda.pl/7679658500_1739016197_thumb.jpg... [Read more]
Very nice idea. Remember to add more grounds and VDD pins in advance. Also, we really need to check if it 's possible to print pin names on paper, it would help a lot if we could label this connec... [Read more]
oh. I thought 3 GND and 2 3V3 would do for now. Plenty of space if more needed though Added after 45 : which connector? [Read more]
This one obviously: https://obrazki.elektroda.pl/2609557500_1739031818_thumb.jpg I need to do the same for my dev board: https://www.elektroda.com/rtvforum/topic4062695.html [Read more]
I have labelled it! https://obrazki.elektroda.pl/9486103600_1739032163_thumb.jpg https://obrazki.elektroda.pl/8153794200_1739032190_thumb.jpg [Read more]
Ah right, sorry, I didn't see. It seems that we need to use "big thumb" image option more often. [Read more]
Update 2026 As of 2026, this platform read/write is also supported by our flash tool: https://github.com/openshwprojects/BK7231GUIFlashTool The connection (soldering, wires), is the same, but you... [Read more]
Today I flashed four pieces of MTG276-WF-RL presence sensors with the WBR3 modules mentioned in this thread...: Link It was possible to read the modules, it only worked at a speed of 1500000,... [Read more]
I didn't notice this post from back in January. Here's the boot log from your firmware dump. == Boot Loader == Dec 5 2019:14:02:18 fwx SELE[fffffffe] fw SELE Bitidx 1, fw1 valid 1, sn 0, fw2... [Read more]
This has macOS build but no RTL support: https://github.com/openshwprojects/EasyGUIFlashTool No RTL support... yet? [Read more]
Model MTG236-WF is the flush-mounted version and MTG276-WF-RL is the surface-mounted version, pcb slightly different but dpID the same. [Read more]
could give it a go I guess, unless you were thinking or doing it. or anyone else was Added after 47 : Almost got XR806 support in EF1 to a good point I believe [Read more]