BK7252 datasheet, pinout, SDKs, flash map, application schematic, flash tool for read and write
BK7252 is a Wi-Fi and Bluetooth Low Energy (LE) combo 32-bit chip designed for audio and video applications. It can be found in both Tuya (video doorbell) and non-Tuya (A9 spy camera) products. It supports up to 6 channels of PWM, and handles audio with a 2-channel DAC and 1-channel ADC. It also supports camera input via an 8-bit DVP interface and can compress video with a built-in JPEG engine. The integrated QSPI interface supports both Flash and RAM extension at the same time.
BK7252 comes in two packages - QFN68 and QFN48 (BK7252UQN48, 12 pins on side, 6x6mm).
QFN68 8x8 pinout:
I haven't managed to find reference to the BK7252UQN48 pinout yet. If anyone knows of it, please post.
BK7252 comparison with similar chips from Beken family:
BK7252 features more RAM and Flash than BL2028 (BK7231N?), it also has audio/video processing features.
BK7252 datasheet
English BK7252 datasheet - see also attachments for PDF version.
BK7252 development board and application schematic
This is a schematic of Wi-Fi and Bluetooth Low Energy Combo Core Board by Tuya, showing the sample BK7252 application:
Source: https://developer.tuya.com/en/docs/iot/combo-core-board-bk7252?id=Kbpymhrki9qhe
BK7252 known devices
BK7252 was so far found by us in two devices, one is branded by Tuya (and device has Tuya keys encryption), and second runs unecrypted binary (YsxLite app?). See following topics:
- Tuya Doorbell Camera (English, Polish)
- A9 mini spy camera (without teardown topic currently, but mentioned here, known PCB versions: A9_B / V1.3_220516, JC_V9_V3B / 20230809DF, BMY_A9_V3A / 20230627DF).
Boot log of A9 camera:
\ | /
- RT - Thread Operating System
/ | \ 3.1.0 build May 14 2022
2006 - 2018 Copyright by rt-thread team
OSK Rev: R-3.0.22
SDK Rev: 3.0.33
[FUNC]rwnxl_init
IP Rev: W4-3.0.33-P0
[bk]tx_txdesc_flush
[FUNC]calibration_main
rfcali_mode:0
tssi:b-125, g-115
xtal_cali:25
[FUNC]ps_init
[FUNC]func_init_extended OVER!!!
start_type:0
lwIP-2.0.2 initialized!
igmp_mac_filter add 224.0.0.1 01:00:5E:00:00:01
igmp_mac_filter add 224.0.0.1 01:00:5E:00:00:01
beken wlan hw init
drv_pm_init
[32;22m[I/FAL] RT-Thread Flash Abstraction Layer (V0.4.0) initialize success.[0m
msh />cmd 1:3
cmd 1:3
cmd 1:3
SD File System initialzation failed!
[32;22m[I/FAL] The FAL MTD NOR device (filesystem) created successfully[0m
LFS Filesystem initialized! filesystem ==> /flash0
bk_misc_check_start_type=0,gDcOrBattery=1
cVersion=1_1_2_36
cVersion=1_1_2_36
00000000: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000010: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000020: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000030: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000040: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000050: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000060: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000070: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000000: 7B 22 4D 41 43 5F 41 44 44 52 22 3A 22 63 30 30 {"MAC_ADDR":"c00
00000010: 31 30 32 30 30 30 30 31 31 22 2C 22 50 52 4F 44 102000011","PROD
00000020: 55 43 54 5F 4B 45 59 22 3A 22 42 41 54 31 38 30 UCT_KEY":"BAT180
00000030: 38 32 33 49 4F 5A 52 43 22 2C 22 50 52 4F 44 55 823IOZRC","PRODU
00000040: 43 54 5F 53 45 43 52 45 54 22 3A 22 38 39 79 65 CT_SECRET":"89ye
00000050: 79 69 75 72 79 69 65 75 72 79 75 65 69 75 72 22 yiuryieuryueiur"
00000060: 2C 22 44 45 56 49 43 45 5F 4E 41 4D 45 22 3A 22 ,"DEVICE_NAME":"
00000070: 4E 55 47 5A 4C 41 22 2C 22 44 45 56 49 43 45 5F NUGZLA","DEVICE_
sysmode=0,t=998
sending broadcast_deauth failed vif_entry == NULL
sysmode=1,t=1001
cmd 1:3
cmd 1:3
cmd 1:3
SD Card initialzation failed!-->ret=-1:0
video_transfer_main entry
video transfer send type:3, open type:1
2----open I2C2
chNmb=8,sensor=0,gUsedCam=abc09
camera_intfer_init=0:abc09,a5a50003-a5a50005
cmd 1:3
cmd 1:3
read frame time out
cmd 1:3
SD Card initialzation failed!-->ret=-1:0
Soft_AP_start
[saap]MM_RESET_REQ
[bk]tx_txdesc_flush
[saap]ME_CONFIG_REQ
[saap]ME_CHAN_CONFIG_REQ
[saap]MM_START_REQ
[csa]csa_in_progress[0:0]-clear
mm_add_if_req_handler:0
hapd_intf_add_vif,type:3, s:0, id:0
apm start with vif:0
------beacon_int_set:100 TU
set_active param 0
[msg]APM_STOP_CFM
update_ongoing_1_bcn_update
vif_idx:0, ch_idx:0, bcmc_idx:2
mm_set_vif_state_req_handler
update_ongoing_1_bcn_update
uap_ip_start
configuring interface uap (with Static IP)
using static ip...
please use rtthread dncp start server
[DHCP] dhcpd_start: ap
[DHCP] ip_start: [192.168.1.100]
[DHCP] ip_end: [192.168.1.254]
[DHCP] dhcp_server_start(): starting new DHCP server
[DHCP] dhcp_server_start(): starting DHCP server
def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed
start watch dog
rt_hw_wdg_start time=10000 threshold=500
closesocket: invalid s=0
closesocket: invalid s=0
[31;22m[E/NTP]: ERROR no such host[0m
cur_time is 0.
gParam.bFlagServerHello==0
read frame time out
read frame time out
read frame time out
read frame time out
read frame time out
read frame time out
read frame time out
read frame time out
read frame time out
read frame time out
read frame time out
read frame time out
read frame time out
read frame time out
Boot log of doorbell:
BK7251_1.0.1_f
REG:cpsr spsr r13 r14
SVC:0x000000D3 0xAC608462 0x53906404
IRQ:0x000000D2 0x00000010 0x63791D40 0x0D8DA088
FIR:0x000000D1 0x00000010 0x44BBDADF 0xEC79B028
SYS:0x000000DF 0xFEBFFFFF 0x2B08CCB0
ST:0x8EB59285
J 0x10100
j
[MEM DBG] heap init-------size:127816 addr:0x420cb8---------
[MEM DBG] heap init-------size:229376 addr:0x908000---------
[1970-1-1 18:13:20.536 user_flash.c user_flash_yield_cfg_read(331) Error] [1970-1-1 18:13:20.536 tuya_ipc_dp_handler.c IPC_APP_get_yield_test_mode(1115) Debug] [Flash]id:0xb4016
[Flash]init over
QSPi_init
QSPi_init1
sctrl_sta_ps_init
SDK Rev: 3.0.29
[STL]0 - 0
[RST]0 ~ 0
OSK Rev: F-3.0.20
cset:0 0 0 0
goto user main!!!!!!!!!!!!!!!!!!!!
hal_aes_init done
[01-01 18:12:15 TUYA I][mqc_app.c:350] mqc app init ...
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:300 cnt:1
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:302 cnt:2
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:304 cnt:3
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:307 cnt:4
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:308 cnt:5
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:312 cnt:6
[01-01 18:12:15 TUYA D][tuya_ipc_mqtt_subscribe.c:294] iot_register_extra_mqt_cb done
[01-01 18:12:15 TUYA I][uni_thread.c:220] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:5
[01-01 18:12:15 TUYA I][uni_thread.c:220] thread_create name:cmmod,stackDepth:4096,totalstackDepth:8192,priority:4
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:5 cnt:7
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:31 cnt:8
[01-01 18:12:15 TUYA D][uni_thread.c:247] Thread:sys_timer Exec Start. Set to Running Stat
[01-01 18:12:15 TUYA D][svc_online_log.c:295] svc online log init success
[01-01 18:12:15 TUYA D][log_seq.c:892] read m:0 f:0 l:0
[01-01 18:12:15 TUYA I][uni_thread.c:220] thread_create name:wk_th-0,stackDepth:5120,totalstackDepth:13312,priority:3
[01-01 18:12:15 TUYA E][tuya_ws_db.c:326] kvs_read fails gw_bi -23
[01-01 18:12:15 TUYA D][ws_db_gw.c:159] gw base read finish:-18
[01-01 18:12:15 TUYA D][tuya_bt_sdk.c:92] ty bt cmmod regist ok:1
[01-01 18:12:15 TUYA D][tuya_ble_api.c:315] upd adv para, send conn_req beacon.
dev id key: 16
d4 1d 8c d9 8f 00 b2 04 e9 80 09 98 ec f8 42 7e
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_port_init
ble start no ble name
[01-01 18:12:15 TUYA N][tuya_ble_api.c:650] ble sdk re_inited
[01-01 18:12:15 TUYA D][tuya_ble_active.c:520] bt active init
[01-01 18:12:15 TUYA N][tuya_bt_sdk.c:141] ty bt sdk init success finish
[1970-1-1 18:12:15.154 tuya_device.c pre_device_init(159) Debug] < TUYA IOT SDK V:0.0.1 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.4_CD:1.0.0 >
< BUILD AT:2023_02_14_15_15_07 BY ci_manage FOR ty_...
[1970-1-1 18:12:15.172 tuya_device.c pre_device_init(160) Debug] SC028_WB30_ALK:2.2.4
[1970-1-1 18:12:15.180 tuya_device.c pre_device_init(161) Notice] firmware compiled at [Jul 20 2023 14:41:22]
[PLATFORM DEBUG]bk_rst:0 tuya_rst:0
[1970-1-1 18:12:15.194 tuya_device.c pre_device_init(162) Notice] system reset reason:[0]
[FUNC]rwnxl_init
[01-01 18:12:15 TUYA D]IP Rev: W4-3.0.29-P0
[uni_thread.c:247] Thread[bk]tx_txdesc_flush
:cmmod Exec Start. Set totx_txdesc_init: i=0, j= Running Stat
0, ct=1
tx_txdesc_init: i=1, j=0, ct=1
tx_txdesc_init: i=2, j=0, ct=64
tx_txdesc_init: i=3, j=0, ct=4
tx_txdesc_init: i=4, j=0, ct=1
[FUNC]intc_init
[FUNC]calibration_main
user define rfcali mode:1
rfcali_mode:1, 0
flash txpwr table:0x0
txpwr tabe in flash is unused
Load default txpwr for b:0x10e32f
Load default txpwr for g:0x10e33d
fit n20 table with dist:2
Load default txpwr for n40:0x10d1ee
Load default txpwr for ble:0x10e34b
lpf_i & q in flash is:128, 128
found flash XTAL:16
xtal in flash is:16
xtal_cali:16
rwnx_tpc_pa_map_init
[FUNC]sdio_intf_init
[FUNC]ps_init
[FUNC]func_init_extended OVER!!!
start_type:0
Initializing TCP/IP stack
tcp_port:57202
bk_wlan_app_init finished
rf_thread_init ok
[01-01 18:12:15 TUYA D][tuya_ws_db.c:450] init fs. Path: null
[01-01 18:12:15 TUYA D][kv_storge.c:46] *****************kvs_init.
[01-01 18:12:15 TUYA N][simple_flash.c:407] key_addr: 0x397000 block_sz 4096
[01-01 18:12:15 TUYA N][simple_flash.c:496] get key:
0x89 0x33 0xfa 0xd1 0x58 0xfb 0x7f 0x3b 0xe7 0x24 0x97 0xd2 0x15 0xb2 0x6f 0xbd
[01-01 18:12:16 TUYA D][mf_core.c:38] mf_core_init success
[01-01 18:12:16 TUYA I][uni_thread.c:220] thread_create name:mf_test,stackDepth:5120,totalstackDepth:18432,priority:4
[01-01 18:12:16 TUYA D][uni_thread.c:243] enter Thread:mf_test func call
[01-01 18:12:16 TUYA D][tuya_uart.c:53] buffer size 4160
[01-01 18:12:16 TUYA D][uni_thread.c:247] Thread:mf_test Exec Start. Set to Running Stat
[01-01 18ble name:BK7231BT-01, 4:12:16 TUYA D][uni_thred:a9:19:e2:9d:b2
EM_BLad.c:247] Thread:wk_th-E_END:0xef6
-----rw_mai0 Exec Start. Set to Run task init----
nning Stat
BLE Rev: B4-3.0.29-P0
-----rw_main start----
gapm_cmp_evt_handler operation = 0x1, status = 0x0
gapm_cmp_evt_handler operation = 0x3, status = 0x0
[PLATFORM NOTICE]STACK INIT OK
ble create new db
ble_env->start_hdl = 0xa
prf_task_id:120, state:1
[PLATFORM NOTICE]CREATE DB SUCCESS
[01-01 18:12:16 TUYA D][tuya_ble_api.c:543] rev ble event 3
[PLATFORM NOTICE]!!!!!!!!!!tuya_before_netcfg_cb
appm start advertising
gapm_cmp_evt_handler operation = 0x1b, status = 0x0
[01-01 18:12:16 TUYA D][mf_test.c:355] mf thread delete
[01-01 18:12:16 TUYA D][uni_thread.c:307] Del Thrd:mf_test
[01-01 18:12:16 TUYA N][tuya_main.c:301] mf_init succ
[01-01 18:12:16 TUYA D][tuya_uart.c:53] buffer size 8
[1970-1-1 18:12:16.610 tuya_device.c app_init(197) Debug] app_init
[01-01 18:12:16 TUYA D][tuya_main.c:307] gwcm_mode 0
[01-01 18:12:16 TUYA D][tuya_main.c:323] device_init in
[1970-1-1 18:12:16.628 user_flash.c user_flash_yield_cfg_read(335) Debug] uf open OK
[1970-1-1 18:12:16.634 user_flash.c user_flash_yield_cfg_read(337) Debug] uf file yield_param read data 4!
[1970-1-1 18:12:16.646 tuya_ipc_dp_handler.c IPC_APP_get_yield_test_mode(1115) Debug] get ***** yield_test_mode:1
[1970-1-1 18:12:16.658 user_flash.c user_flash_yield_cfg_read(335) Debug] uf open OK
[1970-1-1 18:12:16.666 user_flash.c user_flash_yield_cfg_read(337) Debug] uf file yield_param read data 4!
[1970-1-1 18:12:16.676 tuya_ipc_dp_handler.c IPC_APP_get_yield_test_mode(1115) Debug] get ***** yield_test_mode:1
[1970-1-1 18:12:16.686 tuya_device.c device_init(578) Debug] < TUYA IOT SDK V:0.0.1 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.4_CD:1.0.0 >
< BUILD AT:2023_02_14_15_15_07 BY ci_manage FOR ty_...
[1970-1-1 18:12:16.704 tuya_device.c device_init(579) Debug] SC028_WB30_ALK:2.2.4
[1970-1-1 18:12:16.712 tuya_device.c device_init(580) Notice] firmware compiled at [Jul 20 2023 14:41:22]
[PLATFORM DEBUG]bk_rst:0 tuya_rst:0
[1970-1-1 18:12:16.726 tuya_device.c device_init(581) Notice] system reset reason:[0]
[1970-1-1 18:12:16.734 tuya_device.c device_init(582) Notice]
***********device_init*******1****
[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [6] init success
[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [4] init success
[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [3] init success
[01-01 18:12:16 TUYA N][tuya_drv_adc.c:536] adc init =0x9008cc,0x900800,0x900828. chn=4,5
[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [13] init success
[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [5] init success
[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [25] init success
[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [28] init success
[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [7] init success
[01-01 18:12:16 TUYA N][machine.c:198] ns4150 driver_register success
[01-01 18:12:16 TUYA N][machine.c:129] ns4150 device_register success
[01-01 18:12:16 TUYA N][machine.c:79] match ns4150 success
[01-01 18:12:16 TUYA N][snd_chip.c:48] snd chip register:ns4150
[01-01 18:12:16 TUYA N][machine.c:50] snd_dev new name:ty_snd
[01-01 18:12:16 TUYA N][machine.c:345] snd_dev_register
[01-01 18:12:16 TUYA N][tuya_audio_api.c:60] tuya_audio_system_default_init success :ty_snd
bk_dac_init[PLATFORM NOTICE]bk7252 audio adc init
[01-01 18:12:16 TUYA N][tuya_drv_adc.c:536] adc init =0x9008ac,0x900800,0x900828. chn=2,0
[01-01 18:12:16 TUYA N][tuya_audio_api.c:242] snd dev open
[01-01 18:12:16 TUYA N][tuya_audio_api.c:181] tuya_audio_format set 16 1 8000
[01-01 18:12:16 TUYA I][uni_thread.c:220] thread_create name:ty_ao,stackDepth:2048,totalstackDepth:20480,priority:1
[1970-1-1 18:12:16.886 tuya_audio.c ty_audio_play_beep(517) Debug]
--$1---- ty_audio_play_beep D
offset:3576832,this:3576832,read_len:320,remain_len:15972offset:3577152,this:3577152,read_len:320,remain_len:15652offset:3577472,this:3577472,read_len:320,remain_len:15332offset:3577792,this:3577792,read_len:320,remain_len:15012offset:3578112,this:3578112,read_len:320,remain_len:14692offset:3578432,this:3578432,read_len:320,remain_len:14372offset:3578752,this:3578752,read_len:320,remain_len:14052offset:3579072,this:3579072,read_len:320,remain_len:13732[01-01 18:12:16 TUYA D][uni_thread.c:125] del list not empty...deleting
[01-01 18:12:16 TUYA D][uni_thread.c:128] Thread:mf_test is still running..
[01-01 18:12:16 TUYA D][uni_thread.c:247] Thread:ty_ao Exec Start. Set to Running Stat
offset:3579392,this:3579392,read_len:320,remain_len:13412offset:3579712,this:3579712,read_len:320,remain_len:13092offset:3580032,this:3580032,read_len:320,remain_len:12772offset:3580352,this:3580352,read_len:320,remain_len:12452offset:3580672,this:3580672,read_len:320,remain_len:12132[01-01 18:12:17 TUYA D][uni_thread.c:265] Thread:mf_test Exec Finish. Set to Del Stat
[01-01 18:12:17 TUYA D][uni_thread.c:125] del list not empty...deleting
[01-01 18:12:17 TUYA D][uni_thread.c:132] Final Free Thread:mf_test, is_self:1
[01-01 18:12:17 TUYA D][uni_thread.c:138] delay to delete thread self
[01-01 18:12:17 TUYA D][uni_thread.c:149] finally delete thread self
offset:3580992,this:3580992,read_len:320,remain_len:11812offset:3581312,this:3581312,read_len:320,remain_len:11492offset:3581632,this:3581632,read_len:320,remain_len:11172offset:3581952,this:3581952,read_len:320,remain_len:10852offset:3582272,this:3582272,read_len:320,remain_len:10532offset:3582592,this:3582592,read_len:320,remain_len:10212offset:3582912,this:3582912,read_len:320,remain_len:9892offset:3583232,this:3583232,read_len:320,remain_len:9572offset:3583552,this:3583552,read_len:320,remain_len:9252offset:3583872,this:3583872,read_len:320,remain_len:8932offset:3584192,this:3584192,read_len:320,remain_len:8612offset:3584512,this:3584512,read_len:320,remain_len:8292offset:3584832,this:3584832,read_len:320,remain_len:7972offset:3585152,this:3585152,read_len:320,remain_len:7652offset:3585472,this:3585472,read_len:320,remain_len:7332offset:3585792,this:3585792,read_len:320,remain_len:7012offset:3586112,this:3586112,read_len:320,remain_len:6692offset:3586432,this:3586432,read_len:320,remain_len:6372offset:3586752,this:3586752,read_len:320,remain_len:6052offset:3587072,this:3587072,read_len:320,remain_len:5732offset:3587392,this:3587392,read_len:320,remain_len:5412offset:3587712,this:3587712,read_len:320,remain_len:5092offset:3588032,this:3588032,read_len:320,remain_len:4772offset:3588352,this:3588352,read_len:320,remain_len:4452offset:3588672,this:3588672,read_len:320,remain_len:4132offset:3588992,this:3588992,read_len:320,remain_len:3812offset:3589312,this:3589312,read_len:320,remain_len:3492offset:3589632,this:3589632,read_len:320,remain_len:3172offset:3589952,this:3589952,read_len:320,remain_len:2852offset:3590272,this:3590272,read_len:320,remain_len:2532offset:3590592,this:3590592,read_len:320,remain_len:2212offset:3590912,this:3590912,read_len:320,remain_len:1892offset:3591232,this:3591232,read_len:320,remain_len:1572offset:3591552,this:3591552,read_len:320,remain_len:1252offset:3591872,this:3591872,read_len:320,remain_len:932offset:3592192,this:3592192,read_len:320,remain_len:612offset:3592512,this:3592512,read_len:292,remain_len:292fatfs: disk_initialize vol 0
===sd card open:0===
Not 4 line mode. skip config SD_D2(P18)
cmd 1:3
sdcard cmd 8 timeout,cmdresp_int_reg:0x84
cmd8 noresp, voltage mismatch or Ver1.X SD or not SD
sdcard cmd 37 timeout,cmdresp_int_reg:0x84
send cmd55 err:3
send cmd55&cmd41 err, quite loop
Not 4 line mode. skip config SD_D2(P18)
cmd 1:3
sdcard cmd 8 timeout,cmdresp_int_reg:0x84
cmd8 noresp, voltage mismatch or Ver1.X SD or not SD
sdcard cmd 37 timeout,cmdresp_int_reg:0x84
send cmd55 err:3
send cmd55&cmd41 err, quite loop
Not 4 line mode. skip config SD_D2(P18)
cmd 1:3
sdcard cmd 8 timeout,cmdresp_int_reg:0x84
cmd8 noresp, voltage mismatch or Ver1.X SD or not SD
sdcard cmd 37 timeout,cmdresp_int_reg:0x84
send cmd55 err:3
send cmd55&cmd41 err, quite loop
sdcard_open err
[1970-1-1 18:12:19.492 tuya_sdcard.c sd_mount(108) Error] -----mount fatfs fail-----
[1970-1-1 18:12:19.498 bk_sd_fac.c bk_sd_fac_connect(112) Debug] no sdcard
[1970-1-1 18:12:19.506 bk_sd_fac.c bk_sd_fac_init(734) Debug] bk_sd_fac_connect fail , bk sd fac out -1
[1970-1-1 18:12:19.516 tuya_power.c tuya_power_init(265) Debug] tuya_power_init
[01-01 18:12:19 TUYA N][tuya_peripheral.c:223] ty_gpio pin [2] init success
[01-01 18:12:19 TUYA N][tuya_drv_adc.c:536] adc init =0x9008bc,0x900800,0x900828. chn=3,4
[1970-1-1 18:12:19.540 tuya_power_save.c ty_power_save_init(139) Debug] set deepsleep timer timeout 185!
[01-01 18:12:19 TUYA I][uni_thread.c:220] thread_create name:ty_ps,stackDepth:2560,totalstackDepth:23040,priority:4
[1970-1-1 18:12:19.560 ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x8] success
[1970-1-1 18:12:19.568 ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x600] success
[1970-1-1 18:12:19.578 ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x80] success
[1970-1-1 18:12:19.588 ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x2] success
[1970-1-1 18:12:19.596 ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x600] success
[1970-1-1 18:12:19.606 ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0xc3600] success
[1970-1-1 18:12:19.614 ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x2c800] success
[1970-1-1 18:12:19.624 ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x10000] success
[01-01 18:12:19 TUYA I][uni_thread.c:220] thread_create name:wk_th-0,stackDepth:1536,totalstackDepth:24576,priority:4
[1970-1-1 18:12:19.644 tuya_lite_doorbell.c ty_user_doorbell_task_proc_start(358) Debug] __begin
[01-01 18:12:19 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[1970-1-1 18:12:19.660 user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default!
[1970-1-1 18:12:19.672 tuya_led_ctrl.c led_light_mode_set(214) Info] change led status => [8]
[01-01 18:12:19 TUYA I][uni_thread.c:220] thread_create name:blue_led_light_ctrl,stackDepth:1024,totalstackDepth:25600,priority:1
[01-01 18:12:19 TUYA D][ipc_key.c:116] min_timer_period :10
[01-01 18:12:19 TUYA D][ipc_key.c:116] min_timer_period :10
[01-01 18:12:19 TUYA D][key_proc.c:62] key_proc_init done !!!
[1970-1-1 18:12:19.708 tuya_alarm.c tuya_notifify_alarm_init(303) Debug] tuya_notifify_alarm_init
[PLATFORM DEBUG]bk_rst:0 tuya_rst:0
rw_ieee80211_set_country code:
code: CN
channel: 1 - 13
mode: MANUAL
bk_wlan cca closed
[1970-1-1 18:12:19.740 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4436]
[PLATFORM DEBUG]tuya_os_adapt_watchdog_init_start
[PLATFORM DEBUG]tuya_os_adapt_watchdog_init_start OK
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[01-01 18:12:19 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[1970-1-1 18:12:19.758 user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default!
[PLATFORM DEBUG]ssid:SmartLife-9DB2 key: channnel: 6
[saap]MM_RESET_REQ
[bk]tx_txdesc_flush
tx_txdesc_init: i=0, j=0, ct=1
tx_txdesc_init: i=1, j=0, ct=1
tx_txdesc_init: i=2, j=0, ct=64
tx_txdesc_init: i=3, j=0, ct=4
tx_txdesc_init: i=4, j=0, ct=1
[saap]M[1970-1-1 18:12:19.946 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4222]
[1970-1-1 18:12:20.092 tuya_ipc_camera.c tuya_ipc_camera_init(358) Debug] video test set format
[1970-1-1 18:12:20.112 tuya_ipc_camera.c tuya_ipc_camera_init(366) Debug] video test set buff
[1970-1-1 18:12:20.116 tuya_ipc_camera.c tuya_ipc_camera_init(428) Debug] video test start stream
E_CONFIG_REQ
[saap]ME_CHAN_CONFIG_REQ
[saap]MM_START_REQ
[csa]csa_in_progress[0:0]-clear
mm_add_if_req_handler:0
hapd_intf_add_vif,type:3, s:0, id:0
apm start with vif:0
------beacon_int_set:100 TU
set_active param 0
[msg]APM_STOP_CFM
update_ongoing_1_bcn_update
mm_set_vif_state_req_handler
vif_idx:0, ch_idx:[1970-1-1 18:12:20.148 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4464]
0, bcmc_idx:2
update_ongoing_1_bcn_update
enter low level!
mac 4c:a9:19:e2:9d:b3
leave low level!
[net]addvif_idx:0
uap_ip_start
configuring interface uap (with[1970-1-1 18:12:20.172 tuya_power_save.c ty_power_save_deal_wake_soure(161) Notice]
--#3---sctrl_get_deep_sleep_wake_soure [0], gpio [-1]
[1970-1-1 18:12:20.184 tuya_power_save.c ty_power_save_deal_wake_soure(175) Debug] get_gw_active not is ACTIVATED
[1970-1-1 18:12:20.196 tuya_device.c device_init(656) Info]
--#1---TUYA_APP_Init_Stream_Storage
Init tuya_ipc_ss_init[01-01 18:12:20 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[1970-1-1 18:12:20.214 user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default!
[1970-1-1 18:12:20.226 tuya_ipc_dp_handler.c IPC_APP_get_sd_record_onoff(478) Debug] curr sd_record_on_off:1
[01-01 18:12:20 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[1970-1-1 18:12:20.242 user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default!
[1970-1-1 18:12:20.254 tuya_ipc_dp_handler.c IPC_APP_get_sd_record_mode(512) Debug] curr sd_record_mode:0
[01-01 18:12:20 TUYA E][tuya_ipc_stream_storage.c:1780] the ss mgr not inited, but msg buffered: set mode 1
[1970-1-1 18:12:20.274 tuya_device.c __wait_online(550) Notice] wait online ...
Static IP)def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed
dev id key: 16
6d 65 25 f2 34 fb 69 34 74 0e 9e fc 3d 01 87 49
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_reset_adv
gapm_cmp_evt_handler operation = 0x10, status = 0x0
[1970-1-1 18:12:20.306 tuya_sdcard.c tuya_ipc_sd_status_upload(177) Debug] report sd status : [5]
[01-01 18:12:20 TUYA E][tuya_ipc_stream_storage.c:1782] storage not inited
[1970-1-1 18:12:20.348 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4353]
[1970-1-1 18:12:20.378 tuya_ld.c get_ld_stat_cb(99) Debug] LD state :[TY_LD_STATE_LIGHT]
fetch msg success. event type = [0x80]
[1970-1-1 18:12:20.378 tuya_event.c __event_night_state_callback(158) Debug] process night event 0
[1970-1-1 18:12:20.388 tuya_peripheral.c ty_peripheral_ctrl_irled(306) Debug] tuya_gpio_write success! pin=[6] val=[0], ret=[0]
[1970-1-1 18:12:20.402 tuya_peripheral.c ty_peripheral_ircut_set(531) Debug] ty_peripheral_ircut_set [TY_PERIPHERAL_SW_ON]
[1970-1-1 18:12:20.560 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4218]
[1970-1-1 18:12:20.718 tuya_stream_proc.c tuya_stream_ctrl_night(606) Debug] bai-------------------------------------------tian
[1970-1-1 18:12:20.720 tuya_stream_proc.c tuya_stream_ctrl_night(854) Debug] 0328-----baitian--------------
[1970-1-1 18:12:20.758 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4477]
[1970-1-1 18:12:20.758 tuya_device.c __wifi_status_cb(425) Info] wf_nw_status_cb,wifi_status:2
[1970-1-1 18:12:20.766 tuya_led_ctrl.c led_light_mode_set(214) Info] change led status => [9]
publish event [0x80] success
[1970-1-1 18:12:20.966 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4314]
[1970-1-1 18:12:21.178 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4387]
[1970-1-1 18:12:21.302 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:21.376 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4456]
[1970-1-1 18:12:21.588 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4278]
[1970-1-1 18:12:21.796 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4463]
[1970-1-1 18:12:22.008 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4392]
[1970-1-1 18:12:22.206 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4238]
[1970-1-1 18:12:22.322 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:22.416 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4490]
[1970-1-1 18:12:22.628 tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4340]
[1970-1-1 18:12:22.628 tuya_power.c update_sys_bat(106) Debug] update_sys_bat percent: 100 percent_hold: 100 bat: 100
[1970-1-1 18:12:23.342 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:24.362 tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:25.382 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:26.402 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:26.956 tuya_audio.c __audio_output_proc(389) Debug] ao buffer empty.
[1970-1-1 18:12:27.422 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:28.442 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:29.462 tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:30.482 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:31.502 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:32.522 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:33.542 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:34.562 tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:35.582 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:36.602 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:36.956 tuya_audio.c __audio_output_proc(389) Debug] ao buffer empty.
[1970-1-1 18:12:37.622 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:38.642 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:39.662 tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:40.682 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:41.702 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:42.722 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:43.742 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:44.762 tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:45.782 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:46.394 tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:46.708 tuya_soft_wdt.c tuya_soft_wdt_check(51) Info] type = [0] ts=31 pts=31, last=0
[1970-1-1 18:12:46.708 tuya_soft_wdt.c tuya_soft_wdt_check(51) Info] type = [1] ts=31 pts=31, last=0
[1970-1-1 18:12:46.716 tuya_soft_wdt.c tuya_soft_wdt_check(51) Info] type = [2] ts=31 pts=31, last=0
[1970-1-1 18:12:46.956 tuya_audio.c __audio_output_proc(389) Debug] ao buffer empty.
[1970-1-1 18:12:47.414 tuya_device.c __wait_online(550) Notice] wait online ...
BK7252 flash read and write with SPI (CH341)
Just refer to Doorbell guide by @divadiow
Tuya Doorbell - English
Tuya Doorbell - Polish
BK7252 flash read and write with UART (CH340)
BK7252 flashing is very similar to BK7231T - in fact, BK7231T mode in Easy UART Flasher may work for some BK7252s. As far as I've tested, the only issue may arise with some BK7252s in BK7231 Easy UART flasher due to the "address wrap" hack used to access the bootloader:
That's why Easy UART flasher version 19 and later has a new BK7252-specific mode.
So, get it here:
https://github.com/openshwprojects/BK7231GUIFlashTool
Just choose BK7252 mode:
On hardware side, it's a classic BK connection - just RX, TX, GND and power (3.3V).
If flasher can't "Get bus", do a quick power off/on cycle. You can check out our other BK7231 tutorials to see more details:
https://openbekeniot.github.io/webapp/devicesList.html
https://www.youtube.com/@elektrodacom
Alternatively, you can use old Python solution:
https://github.com/OpenBekenIOT/hid_download_py
Example backup flash to file command:
python uartprogram -l 0x1FFFFF -b 115200 -r -d COM3 mybackup.bin
This will read 2MB flash, starting with default 0x11000 offset. Bootloader is not read there. It seems bootloader reading is possible only on some BK7252 - we don't know why yet.
To write:
python uartprogram -b 115200 -w -d COM3 newflash.bin
Then do power off/on cycle to run new firmware.
You can also submit your BK7252 factory backup here:
https://github.com/openshwprojects/FlashDumps
UART method should not be used to change bootloader because it may be possible to brick BK7252 that way. Just like with BK7231T, the bootloader is in 0-0x11000 physical address section. In the event of Bootloader overwrite it is likely a restore using the SPI method will be required as device will not respond over UART anymore.
Bootloader is using RT-Thread. See attached documents.
BK7252 open source firmware
OpenBeken is going to support BK7252 soon, but current build is not public. Check Releases Tab periodically for updates:
BK7252 Tuya SDKs (as links, files are too large to attach):
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.10.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.11.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.14.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.16.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.17.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.18.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.21.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.22.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.23.zip
They consist of gcc-arm-none-eabi-5_4-2016q3.tar.bz2 SDK, FreeRTOSv9.0.0, Beken SDK, tools:
- video_tool
- tuya_packager
- scripts
- rtt_ota
- rt_partition_tool
- memory_leak
- make
- iperf_test
- gnuwin32
- crc_binary
- beken_packager
The attached BK72XX_SDK_User_Manual-3.0.3.pdf and BEKEN_WiFi_SDK_API_Reference-3.0.27.pdf documents are also from the Tuya SDK package.
BK7252 Flash Maps
bk7252_flash_map_2MB.xlsx
| Partition Name | Start Addr (Hex) | Start Addr (Dec) | Physical Addr | Size | Size (Hex) | Start Addr (Hex) | Start Addr (Dec) | Logical Addr | Size | Size (Hex) | Remarks | bootloader | 0x0 | 0 | 0 | 0KB | 68KB | 0x0 | 0 | 0KB | 64KB | 0x10000 | Boot + Copy. Bootloader does not use full 64KB. RF+MAC placed before. | app | 0x11000 | 69632 | 68KB | 1224KB | 0x132000 | 0x10000 | 65536 | 64KB | 1152KB | 0x120000 | Main Program Area | download | 0x143000 | 1323008 | 1292KB | 748KB | 0xBB000 | Temporary download area, can reuse. 748 / 1152 (app) = ~65% | param1 | 0x1FE000 | 2088960 | 2040KB | 4KB | 0x1000 | EasyFlash | param2 | 0x1FF000 | 2093056 | 2044KB | 4KB | 0x1000 | Fast Connect |
π¨ Yellow rows (app) indicate discrepancy between physical and logical addresses
bk7252_flash_map_4MB.xlsx
| Partition Name | StartAddr_Physical_Hex | StartAddr_Physical_Dec | Addr | Size_KB | Size_Hex | StartAddr_Logical_Hex | StartAddr_Logical_Dec | Logical_KB | Size_KB_Logical | Size_Hex_Logical | Notes | bootloader | 0x00000 | 0 | 0KB | 64KB | 0x00000 | 0 | 0KB | 60KB | Boot + Copy | bootloader doesn't use full 64KB | RF+MAC placed in front | app | 0x11000 | 69632 | 68KB | 1768KB | 0x1BA000 | 0x10000 | 65536 | 64KB | 1664KB | 0x1A0000 | Main application area | physical address aligned to 68KB | filesystem | 0x1CB000 | 1880064 | 1836KB | 1156KB | 0x121000 | 0x1B0000 | 1769472 | 1728KB | 1088KB | 0x110000 | download | 0x2EC000 | 3063808 | 2992KB | 1096KB | 0x112000 | 1100/1664=66% | param1 | 0x3FE000 | 4186112 | 4088KB | 4KB | EasyFlash | param2 | 0x3FF000 | 4190208 | 4092KB | 4KB | EasyFlash |
Related A9 camera "hack"
It may be also possible to get A9 camera video stream without firmware change - see this guide:
https://www.elektroda.com/rtvforum/topic4117962.html
Summary
This is all BK7252 information I have managed to find so far. Currently we know flashing methods (both SPI and UART) and we can compile our own firmware for it, but we're still working on OTA and video processing. Hopefully we'll be able to resolve these issues soon. Special thanks for @divadiow and @insmod for development and info.
See attachments for more information. If you have any more info, let us know.
p.kaczmarek2 wrote 11780 posts with
rating 9909 , helped 563 times.
Been with us since 2014 year.
Comments
Add a commentBut to operate a camera/audio probably still a long way off ? ;) . [Read more]
We haven't tried this directly yet, but there are quite a few potential examples and SDKs. One would have to see if they work with the camera module what is used on these boards. The links posted are also... [Read more]
I've just started taking some pics of another cam for another BK7252 adventure. BK7252NQN481 https://obrazki.elektroda.pl/8147659100_1745231751_bigthumb.jpg "bk7252n" searches specifically... [Read more]
I just recently updated sdk to 3.0.76, which adds bk7252n support. The chip is very recent, most information i see about it was made in 2025. Will have to see if i can build for it. Camera is a very... [Read more]
I still need to find my second A9 camera, which also had BK7252 but I stopped working on it in the past because I bricked the bootloader. Maybe I will be able to recover it with SPI method. @insmod... [Read more]
Taixin TXW817 uart boot log and some SDK bits from this post onwards https://www.elektroda.com/rtvforum/topic4033757.html#20946310 I can get latest if you need. [Read more]
Would it be possible to add circuit support to the OBK via SPI? I am referring to the ATM90E3 three-phase power meter. [Read more]
Sure, it seems the datasheet is available, but where did you find ATM90E3 device? Or are you making a custom one? Is there a product with one of supported chips and ATM90E3 ? [Read more]
Well, there is no cheap power measurement device for 3-phase systems using transformers. But there is something out there for about 1kzl, the ATM90E3 is quite cheap and available. I can design the boa... [Read more]
with reference to the BK7252N A9 cam, SPI mode entered and dump taken with Neo. SPI entered using same method as the doorbell I made another import.xml for Neo so more of the flash IDs used in our... [Read more]
Is OpenBK7238 QIO from 0x0 booting on NiceMCU? [Read more]
got a feeling it doesn't. can try in a while Added after 10 [hours] 55 [minutes]: QIO does actually boot and AP broadcasts. whole log out is from UART2 P0 instead of UART1 P11 [Read more]
The BK7252 is also in the ALDI REKA, Video doorbell (742868) in the UK. (And probably other locations), it uses the Tuya app so probably similar. https://www.aldi.co.uk/product/reka-video-doorbell-000000000634500001 A... [Read more]
The BK7252 is also in the ALDI REKA, Video doorbell (742868) in the UK. (And probably other locations), it uses the Tuya app so probably similar. https://www.aldi.co.uk/product/reka-video-doorbell-000000000634500001 A... [Read more]
cool. I usually keep an eye on Lidl and Aldi weekly things for smart bits but hadn't noticed this show. Would you be happy to post firmware backup and uart boot log if/when captured? Added after 4 [minutes]:... [Read more]
Sure, here you go. [Read more]
cool. will have a look. You can also dump the entire flash, including bootloader, if you choose BK7231T mode - maybe - ref https://www.elektroda.com/rtvforum/viewtopic.php?p=21525243#21525243 - if not,... [Read more]
Hi. I recorded a video to demonstrate that it's possible to create an open-source firmware for these types of cameras: This processor has 2 UARTs and 2 I2C interfaces. The camera is controlled via... [Read more]
Good job, which SDK and camera driver did you use? [Read more]