Eswin ECR6600 flashing guide, datasheet, pinout, 100% local setup, Home Assistant

This topic covers detailed information about ECR6600 WiFi modules, datasheets, pinout, and firmware backup via UART and write procedure required to run ESWIN chips locally. Thanks to this, it's possible to pair ECR6600 devices with Home Assistant and use them free from the cloud. We'll use our Tasmota/esphome-like firmware port, as seen here.

What is ECR6600?
ECR6600 is an SoC WiFi+BT combo chip found in some IoT, featuring:
- WiFi connectivity, 2.4G, 802.11b/g/n/ax, 1T1R, DCM, HE20, MCS7, TX=+17dBm, Soft AP/Station/Direct mode
- Bluetooth connectivity, BLE 5.0, AFH, TX=+10dBm
- RF, Built-in PA, LNA, Switch, and Balun
- processor, Andes D10 @160MHz (up to 240MHz), FPU
- memory, 512KB SRAM, 48KB ROM, 32KB Cache, 2MB/4MB Flash, XIP
- peripherals, GPIOs, HS-UART, QSPI, PWM, I2C, I2S, SDIO, ADC(1MSPS), IR
- security, TRNG, Secure Boot, AES256, HASH, WPA/WPA2/WPA3, WPS, WEP
- operating temperature, -40~+105℃
ECR6600 can be found in two surface-mount packages, ECR6600-40D (5x5 QFN40), and ECR6600-TSxD/L (4x4 QFN32):

See the table for the full list of variants:

Variant	Packaging
ECR6600-40D	QFN40 5x5
ECR6600-TS2D	QFN32 4x4
ECR6600-TS2L	QFN32 4x4
ECR6600-TS4D	QFN32 4x4
ECR6600-TS4L	QFN32 4x4

ECR6600 modules
ECR6600 can be found in a form of some Tuya modules, for example, AXY2S, which is similar to Beken-based CB2S, WB2S or ESP8266-based TYWE2S.


Pinout:

Pin number	Symbol	Type	Function
1	VBAT	P	Power supply pin (3.3V)
2	P25	I/O	GPIO_25, hardware PWM, correspond to Pin 7 of the IC
3	GND	P	Power supply reference ground
4	P24	I/O	GPIO_24, hardware PWM, correspond to Pin 8 of the IC
5	RX	I/O	GPIO_5, UART0_RXD (user serial interface)
6	P22	I/O	GPIO_22, hardware PWM, Pin 4 of the IC
7	TX	I/O	GPIO_6, UART0_TXD (user serial interface)
8	ADC	AI	GPIO_20, common GPIO, which can be used as ADC. The range of input voltage is 0 to 3.3V. Correspond to Pin 27 of the IC.
9	P15	I/O	GPIO_15, hardware PWM, Pin 28 of the IC
10	RST	I/O	Reset pin, reset at a low level. The module has been pulled to a high level and the user can control the pin externally.
11	P14	I/O	GPIO_14, hardware PWM, correspond to Pin 29 of the IC

Another similar module is AXYU, which is in form of a well-known CBU.

Pinout:

Pin number	Symbol	Type	Function
1	P00	I/O	GPIO_00, common GPIO, which can be reused as SPI_SCK and corresponds to Pin 25 of the IC
2	P02	I/O	GPIO_02, common GPIO, which can be reused as SPI_MOSI and corresponds to Pin 23 of the IC
3	P21	I/O	GPIO_21, common GPIO, correspond to Pin 6 of the IC
4	P16	I/O	GPIO_16, common GPIO, correspond to Pin 10 of the IC
5	ADC	I/O	GPIO_20, common GPIO, which can be used as ADC. The range of input voltage is 0 to 3.3V. Correspond to Pin 27 of the IC.
6	L_RX	I/O	GPIO_17, UART_Log_RXD (used to receive information about the external logs of the module), which can be configured as a common GPIO
7	L_TX	I/O	GPIO_13, UART_Log_TXD (used to send information about the internal logs of the module), which can be configured as a common GPIO
8	P24	I/O	GPIO_24, hardware PWM, correspond to Pin 8 of the IC
9	P25	I/O	GPIO_25, hardware PWM, correspond to Pin 7 of the IC
10	P22	I/O	GPIO_22, hardware PWM, correspond to Pin 4 of the IC
11	P23	I/O	GPIO_23, hardware PWM, correspond to Pin 3 of the IC
12	P04	I/O	GPIO_04, hardware PWM, correspond to Pin 21 of the IC
13	GND	P	Power supply reference ground
14	VCC	P	Power supply pin (3.3V)
15	TXD	I/O	GPIO_6, UART0_TXD (user serial interface)
16	RXD	I/O	GPIO_5, UART0_RXD (user serial interface)
17	P15	I/O	GPIO_15, common GPIO, correspond to Pin 28 of the IC
18	RST	I/O	Reset pin, reset at low level. The module has been pulled to a high level and the user can control the pin externally.
19	P14	I/O	GPIO_14, common GPIO, correspond to Pin 29 of the IC
20	P03	I/O	GPIO_03, common GPIO, which can be reused as SPI_MISO and corresponds to Pin 22 of the IC
21	P01	I/O	GPIO_01, common GPIO, which can be reused as SPI_CS and corresponds to Pin 24 of the IC

Of course, there are also non-Tuya ECR6600 modules, for example, WG236, which is in form similar to ESP12 or CB3S/WB3S/TYWE3S:




ECR6600 devices
ECR6600 has been observed in few devices so far:
- [ECR6600][BL0937] Tuya Wifi Smart Plug With Energy Measurement
- [AXY2S] [ECR6600] Teardown LSC Connect Smart Wall Dimmer (3207304)
Please let us know if you've managed to get IoT device with ECR6600!


Important pins
For the flashing, there are just few important pins:
- IO6/TX0 - programming port
- IO5/RX0 - programming port
- IO13/TX2 - boot log output - 115200 baud - use it to check if firmware boots correctly
You may also need RST and obviously power pins (GND and 3.3V).

Connection requirements
ECR6600 connection for flashing is very similar to Beken - there is no GPIO0 like on ESP, you just need to reset when prompted.
This procedure was tested with a WG236 module using an ESP adapter, but it should work with any ECR chip.

So, solder to GND, VCC and TX0 (GPIO6) and RX0 (GPIO5) according to however real device allows this if possible. Also preferably RST pin, so you can do reboot.

Backup old firmware
Firmware backup is always recommended; furthermore, you can always submit a flash dump to our repository to help us:
https://github.com/openshwprojects/FlashDumps
So, to backup the firmware - start by running the ESWIN RDTool.exe program after downloading and unzipping ESWIN_ECR6600_RDTool_v1.0.21.zip from https://github.com/openshwprojects/FlashTools/tree/main/TransaSemi-ESWIN

When loaded double-click the develop tool plugin.

Select the single file tab and choose the file ECR6600F_stub_V1.3.1.bin from the unzipped files in the open dialog box after clicking select stub.
Ensure the startup address is 0x10000 and select the correct COM port

At the moment you hit start, reset (ground CEN/RST) or power-on 3.3V to the device. The window of opportunity is very small so timing is crucial.

Switch to the flash tab, choose port again and enter start address of 0 and read length of 0x400000 or 0x200000, depending on your chip flash size (4MB or 2MB). If not sure, first try 0x400000, then, in case of "FLASH is not enough!" error, fall back to 0x200000. Select save path and give your backup an informative name eg; Tuya_LSPA9_Backup_ECR6600.bin. Click start next to save path to begin device flash backup to file.

Once backup is done, please consider sharing it with us, but be aware - it will contain your SSID and other data after pairing, so better backup firmware before connecting device to the cloud.

Flashing new firmware - OpenECR6600
Run RDTool as above, go to the develop tool plugin but navigate to all-in-one on the download tab. Download the latest OpenECR600 UART flash binary from the release page https://github.com/openshwprojects/OpenBK7231T_App/releases/
Choose the downloaded file after selecting all-in-one file path. Click start and perform CEN/RST or power-on quickly, just like with the backup.
Flashing OBK does not require the same stub step that backup requires.

Reboot by doing power off and power on cycle. The device WiFi access point should appear, just like with Tasmota, connect to it and visit configuration page to proceed. Everything as usual.


At the time of writing (March 2025), our firmware release for this platform is a WIP testing version, so there still may be imperfections, but we'll try to increase the stability soon...


Attachments
ECR6600 datasheet:


ECR6600 pins functions (pinmux) table:


RDToolV1.0.19.rar for flashing:


RD Tool User Guide_v2.0 guide pdf:


Hardware Reference Design User guide:


CDI-WX56600A-00 module documentation:


ECR6600 product brief:


ECR6600_T_EVK_V2 development board schematic:


SkyLab WG236 V1.04 datasheet_SL-22020220 (chinese):


SDK OTA doc (chinese):


Summary
This is how you can backup and flash ESR6600, this way you can also run it free from the cloud. That's how much we've found out so far, special thanks for @insmod for porting and @divadiow for research and testing. If you're reading it, and have device with ECR chip or similar, let us know! We can help you with flashing and getting your device to run 100% local.
PS: Don't forget related links:
- YT guides: https://www.youtube.com/@elektrodacom
- devices list: https://openbekeniot.github.io/webapp/devicesList.html
- project repository: https://github.com/openshwprojects/OpenBK7231T_App