logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
Build faster with M5Stack »
Build faster with M5Stack » Stick • Unit • Cardputer
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polskÄ… wersjÄ™ strony elektroda?

Nie, dziękuję Przekieruj mnie tam

BK7252 datasheet, pinout, SDKs, flash map, application schematic, flash tool for read and write

p.kaczmarek2  25 3789 Cool? (+5)
📢 Listen (AI):
Close-up of the Beken BK7252UQN68 integrated circuit mounted on a green PCB.
BK7252 is a Wi-Fi and Bluetooth Low Energy (LE) combo 32-bit chip designed for audio and video applications. It can be found in both Tuya (video doorbell) and non-Tuya (A9 spy camera) products. It supports up to 6 channels of PWM, and handles audio with a 2-channel DAC and 1-channel ADC. It also supports camera input via an 8-bit DVP interface and can compress video with a built-in JPEG engine. The integrated QSPI interface supports both Flash and RAM extension at the same time.
Excerpt from BK7252 datasheet showing chip features and QFN68 pinout diagram.
BK7252 comes in two packages - QFN68 and QFN48 (BK7252UQN48, 12 pins on side, 6x6mm).
QFN68 8x8 pinout:
Pinout diagram of BK7252 chip in QFN68 8x8 mm package with labeled pin numbers and functions.
I haven't managed to find reference to the BK7252UQN48 pinout yet. If anyone knows of it, please post.

BK7252 comparison with similar chips from Beken family:
Comparison table of XW-Chip Technology Wi-Fi/BLE chips: BL2028N, BK7231U, BK7252, BK7256.
BK7252 features more RAM and Flash than BL2028 (BK7231N?), it also has audio/video processing features.

BK7252 datasheet
English BK7252 datasheet - see also attachments for PDF version.
Cover page of the BK7252 data sheet showing product name and Beken Corporation contact details. Table of contents page from the BK7252 Wi-Fi Audio/Video SoC documentation (v1.0), by Beken Corporation. Table of contents from the BK7252 datasheet showing sections on device characteristics, package, and order information. Revision history table for Wi-Fi Audio/Video SoC documentation.
BK7252 datasheet page with introduction and main technical features of the chip. A documentation page for Beken BK7252 SoC showing key Wi-Fi Audio/Video features and a functional block diagram. Pinout diagram of the BK7252 QFN68 package, showing all pin names and numbers. Partial table describing BK7252 68-pin Wi-Fi Audio/Video SoC pinout with functions and pin types.
A table segment listing BK7252 microcontroller pin numbers 26–40 with their signal names and functions. A table excerpt from the BK7252 datasheet showing pin functions and descriptions for pins 41–62. Section of the BK7252 datasheet showing a pinout table and descriptions of Wi-Fi/Bluetooth and system clocks. Table summarizing clock sources and peripherals for the BK7252 Wi-Fi Audio/Video SoC by Beken.
Excerpt from the BK7252 Data Sheet showing power and reset modes of the chip. Documentation page describing UART, SPI, and SDIO peripherals for the BK7252 chip. A page from the BK7252 datasheet describing I2C, USB, ADC, PWM, and timer peripherals. Table of BK7252 GPIO functions with peripheral and analog mode descriptions.
Pin mapping and peripheral function table for the BK7252 chip from the Beken datasheet. Table of pins and signals of Wi-Fi Audio/Video SoC by Beken. BK7252 data sheet page with a table of pin functions and a section on FLASH download procedure. Technical documentation page describing audio/video SoC Wi-Fi interfaces, including CMOS, IrDA, I2S, and audio peripherals.
A page from the BK7252 chip datasheet, showing details on sampling, equalizer, QSPI interface, and security functions. A technical documentation page for a Wi-Fi Audio/Video SoC with parameter tables and temperature sensor information. Excerpt from BK7252 datasheet showing current consumption and WLAN receiver/transmitter characteristics tables. Table with audio parameters of the Beken Wi-Fi Audio/Video SoC, including transmitter power, DAC output amplitude, and SNR.
Technical drawings of a QFN68 IC package with dimension table and ordering information.


BK7252 development board and application schematic
This is a schematic of Wi-Fi and Bluetooth Low Energy Combo Core Board by Tuya, showing the sample BK7252 application:
Block diagram with microcontroller and several peripheral modules, labeled with section names.
Source: https://developer.tuya.com/en/docs/iot/combo-core-board-bk7252?id=Kbpymhrki9qhe

BK7252 known devices
BK7252 was so far found by us in two devices, one is branded by Tuya (and device has Tuya keys encryption), and second runs unecrypted binary (YsxLite app?). See following topics:
- Tuya Doorbell Camera (English, Polish)
- A9 mini spy camera (without teardown topic currently, but mentioned here, known PCB versions: A9_B / V1.3_220516, JC_V9_V3B / 20230809DF, BMY_A9_V3A / 20230627DF).
2BD5K-A9 ...photos.pdf (1.09 MB)You must be logged in to download this attachment.
Boot log of A9 camera:
Code: text Expand Select all Copy to clipboard


 \ | /
- RT -     Thread Operating System
 / | \     3.1.0 build May 14 2022
 2006 - 2018 Copyright by rt-thread team

OSK Rev: R-3.0.22
SDK Rev: 3.0.33

[FUNC]rwnxl_init

IP Rev: W4-3.0.33-P0

[bk]tx_txdesc_flush

[FUNC]calibration_main



rfcali_mode:0



tssi:b-125, g-115

xtal_cali:25

[FUNC]ps_init

[FUNC]func_init_extended OVER!!!



start_type:0

lwIP-2.0.2 initialized!
igmp_mac_filter add 224.0.0.1 01:00:5E:00:00:01
igmp_mac_filter add 224.0.0.1 01:00:5E:00:00:01
beken wlan hw init

drv_pm_init
[I/FAL] RT-Thread Flash Abstraction Layer (V0.4.0) initialize success.
msh />cmd 1:3 

cmd 1:3 

cmd 1:3 

SD File System initialzation failed!
[I/FAL] The FAL MTD NOR device (filesystem) created successfully
LFS Filesystem initialized! filesystem ==> /flash0
bk_misc_check_start_type=0,gDcOrBattery=1
cVersion=1_1_2_36
cVersion=1_1_2_36
00000000: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000010: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000020: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000030: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000040: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000050: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000060: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000070: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000000: 7B 22 4D 41 43 5F 41 44 44 52 22 3A 22 63 30 30  {"MAC_ADDR":"c00
00000010: 31 30 32 30 30 30 30 31 31 22 2C 22 50 52 4F 44  102000011","PROD
00000020: 55 43 54 5F 4B 45 59 22 3A 22 42 41 54 31 38 30  UCT_KEY":"BAT180
00000030: 38 32 33 49 4F 5A 52 43 22 2C 22 50 52 4F 44 55  823IOZRC","PRODU
00000040: 43 54 5F 53 45 43 52 45 54 22 3A 22 38 39 79 65  CT_SECRET":"89ye
00000050: 79 69 75 72 79 69 65 75 72 79 75 65 69 75 72 22  yiuryieuryueiur"
00000060: 2C 22 44 45 56 49 43 45 5F 4E 41 4D 45 22 3A 22  ,"DEVICE_NAME":"
00000070: 4E 55 47 5A 4C 41 22 2C 22 44 45 56 49 43 45 5F  NUGZLA","DEVICE_
sysmode=0,t=998
sending broadcast_deauth failed vif_entry == NULL

sysmode=1,t=1001
cmd 1:3 

cmd 1:3 

cmd 1:3 

SD Card initialzation failed!-->ret=-1:0
video_transfer_main entry

video transfer send type:3, open type:1

2----open I2C2

chNmb=8,sensor=0,gUsedCam=abc09

camera_intfer_init=0:abc09,a5a50003-a5a50005

cmd 1:3 

cmd 1:3 

read frame time out

cmd 1:3 

SD Card initialzation failed!-->ret=-1:0
Soft_AP_start

[saap]MM_RESET_REQ

[bk]tx_txdesc_flush

[saap]ME_CONFIG_REQ

[saap]ME_CHAN_CONFIG_REQ

[saap]MM_START_REQ

[csa]csa_in_progress[0:0]-clear

mm_add_if_req_handler:0

hapd_intf_add_vif,type:3, s:0, id:0

apm start with vif:0

------beacon_int_set:100 TU

set_active param 0
[msg]APM_STOP_CFM
update_ongoing_1_bcn_update

vif_idx:0, ch_idx:0, bcmc_idx:2

mm_set_vif_state_req_handler

update_ongoing_1_bcn_update

uap_ip_start



configuring interface uap (with Static IP)
using static ip...
please use rtthread dncp start server
[DHCP] dhcpd_start: ap

[DHCP] ip_start: [192.168.1.100]

[DHCP] ip_end: [192.168.1.254]

[DHCP] dhcp_server_start(): starting new DHCP server
[DHCP] dhcp_server_start(): starting DHCP server
def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed

start watch dog
rt_hw_wdg_start time=10000 threshold=500
closesocket: invalid s=0
closesocket: invalid s=0
[E/NTP]: ERROR no such host
cur_time is 0.
gParam.bFlagServerHello==0
read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

Boot log of doorbell:
Code: text Expand Select all Copy to clipboard

BK7251_1.0.1_f
REG:cpsr        spsr        r13         r14
SVC:0x000000D3              0xAC608462  0x53906404
IRQ:0x000000D2  0x00000010  0x63791D40  0x0D8DA088  
FIR:0x000000D1  0x00000010  0x44BBDADF  0xEC79B028  
SYS:0x000000DF              0xFEBFFFFF  0x2B08CCB0  
ST:0x8EB59285
J 0x10100
   j
[MEM DBG] heap init-------size:127816 addr:0x420cb8---------
[MEM DBG] heap init-------size:229376 addr:0x908000---------
[1970-1-1 18:13:20.536  user_flash.c user_flash_yield_cfg_read(331) Error]  [1970-1-1 18:13:20.536  tuya_ipc_dp_handler.c IPC_APP_get_yield_test_mode(1115) Debug]  [Flash]id:0xb4016
[Flash]init over
QSPi_init
QSPi_init1
sctrl_sta_ps_init
SDK Rev: 3.0.29
[STL]0 - 0
[RST]0 ~ 0
OSK Rev: F-3.0.20
cset:0 0 0 0
goto user main!!!!!!!!!!!!!!!!!!!!
hal_aes_init done
[01-01 18:12:15 TUYA I][mqc_app.c:350] mqc app init ...
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:300 cnt:1
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:302 cnt:2
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:304 cnt:3
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:307 cnt:4
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:308 cnt:5
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:312 cnt:6
[01-01 18:12:15 TUYA D][tuya_ipc_mqtt_subscribe.c:294] iot_register_extra_mqt_cb done
[01-01 18:12:15 TUYA I][uni_thread.c:220] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:5
[01-01 18:12:15 TUYA I][uni_thread.c:220] thread_create name:cmmod,stackDepth:4096,totalstackDepth:8192,priority:4
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:5 cnt:7
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:31 cnt:8
[01-01 18:12:15 TUYA D][uni_thread.c:247] Thread:sys_timer Exec Start. Set to Running Stat
[01-01 18:12:15 TUYA D][svc_online_log.c:295] svc online log init success
[01-01 18:12:15 TUYA D][log_seq.c:892] read m:0 f:0 l:0
[01-01 18:12:15 TUYA I][uni_thread.c:220] thread_create name:wk_th-0,stackDepth:5120,totalstackDepth:13312,priority:3
[01-01 18:12:15 TUYA E][tuya_ws_db.c:326] kvs_read fails gw_bi -23
[01-01 18:12:15 TUYA D][ws_db_gw.c:159] gw base read finish:-18
[01-01 18:12:15 TUYA D][tuya_bt_sdk.c:92] ty bt cmmod regist ok:1
[01-01 18:12:15 TUYA D][tuya_ble_api.c:315] upd adv para, send conn_req beacon.
dev id key: 16
d4 1d 8c d9 8f 00 b2 04 e9 80 09 98 ec f8 42 7e 
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_port_init
ble start no ble name
[01-01 18:12:15 TUYA N][tuya_ble_api.c:650] ble sdk re_inited
[01-01 18:12:15 TUYA D][tuya_ble_active.c:520] bt active init
[01-01 18:12:15 TUYA N][tuya_bt_sdk.c:141] ty bt sdk init success finish
[1970-1-1 18:12:15.154  tuya_device.c pre_device_init(159) Debug] < TUYA IOT SDK V:0.0.1 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.4_CD:1.0.0 >
< BUILD AT:2023_02_14_15_15_07 BY ci_manage FOR ty_...
[1970-1-1 18:12:15.172  tuya_device.c pre_device_init(160) Debug] SC028_WB30_ALK:2.2.4
[1970-1-1 18:12:15.180  tuya_device.c pre_device_init(161) Notice] firmware compiled at [Jul 20 2023 14:41:22]
[PLATFORM DEBUG]bk_rst:0 tuya_rst:0
[1970-1-1 18:12:15.194  tuya_device.c pre_device_init(162) Notice] system reset reason:[0]
[FUNC]rwnxl_init
[01-01 18:12:15 TUYA D]IP Rev: W4-3.0.29-P0
[uni_thread.c:247] Thread[bk]tx_txdesc_flush
:cmmod Exec Start. Set totx_txdesc_init: i=0, j= Running Stat
0, ct=1
tx_txdesc_init: i=1, j=0, ct=1
tx_txdesc_init: i=2, j=0, ct=64
tx_txdesc_init: i=3, j=0, ct=4
tx_txdesc_init: i=4, j=0, ct=1
[FUNC]intc_init
[FUNC]calibration_main
user define rfcali mode:1 

rfcali_mode:1, 0
flash txpwr table:0x0
txpwr tabe in flash is unused
Load default txpwr for b:0x10e32f
Load default txpwr for g:0x10e33d
fit n20 table with dist:2
Load default txpwr for n40:0x10d1ee
Load default txpwr for ble:0x10e34b
lpf_i & q in flash is:128, 128
found flash XTAL:16
xtal in flash is:16
xtal_cali:16
rwnx_tpc_pa_map_init
[FUNC]sdio_intf_init
[FUNC]ps_init
[FUNC]func_init_extended OVER!!!

start_type:0
Initializing TCP/IP stack
tcp_port:57202
bk_wlan_app_init finished
rf_thread_init ok
[01-01 18:12:15 TUYA D][tuya_ws_db.c:450] init fs. Path: null 
[01-01 18:12:15 TUYA D][kv_storge.c:46] *****************kvs_init. 
[01-01 18:12:15 TUYA N][simple_flash.c:407] key_addr: 0x397000   block_sz 4096
[01-01 18:12:15 TUYA N][simple_flash.c:496] get key:
0x89 0x33 0xfa 0xd1 0x58 0xfb 0x7f 0x3b 0xe7 0x24 0x97 0xd2 0x15 0xb2 0x6f 0xbd 
[01-01 18:12:16 TUYA D][mf_core.c:38] mf_core_init success
[01-01 18:12:16 TUYA I][uni_thread.c:220] thread_create name:mf_test,stackDepth:5120,totalstackDepth:18432,priority:4
[01-01 18:12:16 TUYA D][uni_thread.c:243] enter Thread:mf_test func call
[01-01 18:12:16 TUYA D][tuya_uart.c:53] buffer size 4160
[01-01 18:12:16 TUYA D][uni_thread.c:247] Thread:mf_test Exec Start. Set to Running Stat
[01-01 18ble name:BK7231BT-01, 4:12:16 TUYA D][uni_thred:a9:19:e2:9d:b2
EM_BLad.c:247] Thread:wk_th-E_END:0xef6
-----rw_mai0 Exec Start. Set to Run task init----
nning Stat
BLE Rev: B4-3.0.29-P0
-----rw_main  start----
gapm_cmp_evt_handler operation = 0x1, status = 0x0 
gapm_cmp_evt_handler operation = 0x3, status = 0x0 
[PLATFORM NOTICE]STACK INIT OK
ble create new db
ble_env->start_hdl = 0xa
prf_task_id:120, state:1
[PLATFORM NOTICE]CREATE DB SUCCESS
[01-01 18:12:16 TUYA D][tuya_ble_api.c:543] rev ble event 3
[PLATFORM NOTICE]!!!!!!!!!!tuya_before_netcfg_cb
appm start advertising
gapm_cmp_evt_handler operation = 0x1b, status = 0x0 
[01-01 18:12:16 TUYA D][mf_test.c:355] mf thread delete
[01-01 18:12:16 TUYA D][uni_thread.c:307] Del Thrd:mf_test
[01-01 18:12:16 TUYA N][tuya_main.c:301] mf_init succ
[01-01 18:12:16 TUYA D][tuya_uart.c:53] buffer size 8
[1970-1-1 18:12:16.610  tuya_device.c app_init(197) Debug] app_init

[01-01 18:12:16 TUYA D][tuya_main.c:307] gwcm_mode 0
[01-01 18:12:16 TUYA D][tuya_main.c:323] device_init in
[1970-1-1 18:12:16.628  user_flash.c user_flash_yield_cfg_read(335) Debug] uf open OK
[1970-1-1 18:12:16.634  user_flash.c user_flash_yield_cfg_read(337) Debug] uf file yield_param read data 4!
[1970-1-1 18:12:16.646  tuya_ipc_dp_handler.c IPC_APP_get_yield_test_mode(1115) Debug] get ***** yield_test_mode:1 

[1970-1-1 18:12:16.658  user_flash.c user_flash_yield_cfg_read(335) Debug] uf open OK
[1970-1-1 18:12:16.666  user_flash.c user_flash_yield_cfg_read(337) Debug] uf file yield_param read data 4!
[1970-1-1 18:12:16.676  tuya_ipc_dp_handler.c IPC_APP_get_yield_test_mode(1115) Debug] get ***** yield_test_mode:1 

[1970-1-1 18:12:16.686  tuya_device.c device_init(578) Debug] < TUYA IOT SDK V:0.0.1 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.4_CD:1.0.0 >
< BUILD AT:2023_02_14_15_15_07 BY ci_manage FOR ty_...
[1970-1-1 18:12:16.704  tuya_device.c device_init(579) Debug] SC028_WB30_ALK:2.2.4
[1970-1-1 18:12:16.712  tuya_device.c device_init(580) Notice] firmware compiled at [Jul 20 2023 14:41:22]
[PLATFORM DEBUG]bk_rst:0 tuya_rst:0
[1970-1-1 18:12:16.726  tuya_device.c device_init(581) Notice] system reset reason:[0]
[1970-1-1 18:12:16.734  tuya_device.c device_init(582) Notice] 
  
   
 ***********device_init*******1****

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [6] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [4] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [3] init success

[01-01 18:12:16 TUYA N][tuya_drv_adc.c:536] adc init =0x9008cc,0x900800,0x900828. chn=4,5

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [13] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [5] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [25] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [28] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [7] init success

[01-01 18:12:16 TUYA N][machine.c:198] ns4150 driver_register success

[01-01 18:12:16 TUYA N][machine.c:129] ns4150 device_register success

[01-01 18:12:16 TUYA N][machine.c:79] match ns4150 success 

[01-01 18:12:16 TUYA N][snd_chip.c:48] snd chip register:ns4150 

[01-01 18:12:16 TUYA N][machine.c:50] snd_dev new name:ty_snd 

[01-01 18:12:16 TUYA N][machine.c:345] snd_dev_register 

[01-01 18:12:16 TUYA N][tuya_audio_api.c:60] tuya_audio_system_default_init success :ty_snd 

bk_dac_init[PLATFORM NOTICE]bk7252 audio adc init
[01-01 18:12:16 TUYA N][tuya_drv_adc.c:536] adc init =0x9008ac,0x900800,0x900828. chn=2,0

[01-01 18:12:16 TUYA N][tuya_audio_api.c:242] snd dev open

[01-01 18:12:16 TUYA N][tuya_audio_api.c:181] tuya_audio_format set 16 1 8000

[01-01 18:12:16 TUYA I][uni_thread.c:220] thread_create name:ty_ao,stackDepth:2048,totalstackDepth:20480,priority:1
[1970-1-1 18:12:16.886  tuya_audio.c ty_audio_play_beep(517) Debug] 
--$1---- ty_audio_play_beep D 

offset:3576832,this:3576832,read_len:320,remain_len:15972offset:3577152,this:3577152,read_len:320,remain_len:15652offset:3577472,this:3577472,read_len:320,remain_len:15332offset:3577792,this:3577792,read_len:320,remain_len:15012offset:3578112,this:3578112,read_len:320,remain_len:14692offset:3578432,this:3578432,read_len:320,remain_len:14372offset:3578752,this:3578752,read_len:320,remain_len:14052offset:3579072,this:3579072,read_len:320,remain_len:13732[01-01 18:12:16 TUYA D][uni_thread.c:125] del list not empty...deleting
[01-01 18:12:16 TUYA D][uni_thread.c:128] Thread:mf_test is still running..
[01-01 18:12:16 TUYA D][uni_thread.c:247] Thread:ty_ao Exec Start. Set to Running Stat
offset:3579392,this:3579392,read_len:320,remain_len:13412offset:3579712,this:3579712,read_len:320,remain_len:13092offset:3580032,this:3580032,read_len:320,remain_len:12772offset:3580352,this:3580352,read_len:320,remain_len:12452offset:3580672,this:3580672,read_len:320,remain_len:12132[01-01 18:12:17 TUYA D][uni_thread.c:265] Thread:mf_test Exec Finish. Set to Del Stat
[01-01 18:12:17 TUYA D][uni_thread.c:125] del list not empty...deleting
[01-01 18:12:17 TUYA D][uni_thread.c:132] Final Free Thread:mf_test, is_self:1
[01-01 18:12:17 TUYA D][uni_thread.c:138] delay to delete thread self
[01-01 18:12:17 TUYA D][uni_thread.c:149] finally delete thread self
offset:3580992,this:3580992,read_len:320,remain_len:11812offset:3581312,this:3581312,read_len:320,remain_len:11492offset:3581632,this:3581632,read_len:320,remain_len:11172offset:3581952,this:3581952,read_len:320,remain_len:10852offset:3582272,this:3582272,read_len:320,remain_len:10532offset:3582592,this:3582592,read_len:320,remain_len:10212offset:3582912,this:3582912,read_len:320,remain_len:9892offset:3583232,this:3583232,read_len:320,remain_len:9572offset:3583552,this:3583552,read_len:320,remain_len:9252offset:3583872,this:3583872,read_len:320,remain_len:8932offset:3584192,this:3584192,read_len:320,remain_len:8612offset:3584512,this:3584512,read_len:320,remain_len:8292offset:3584832,this:3584832,read_len:320,remain_len:7972offset:3585152,this:3585152,read_len:320,remain_len:7652offset:3585472,this:3585472,read_len:320,remain_len:7332offset:3585792,this:3585792,read_len:320,remain_len:7012offset:3586112,this:3586112,read_len:320,remain_len:6692offset:3586432,this:3586432,read_len:320,remain_len:6372offset:3586752,this:3586752,read_len:320,remain_len:6052offset:3587072,this:3587072,read_len:320,remain_len:5732offset:3587392,this:3587392,read_len:320,remain_len:5412offset:3587712,this:3587712,read_len:320,remain_len:5092offset:3588032,this:3588032,read_len:320,remain_len:4772offset:3588352,this:3588352,read_len:320,remain_len:4452offset:3588672,this:3588672,read_len:320,remain_len:4132offset:3588992,this:3588992,read_len:320,remain_len:3812offset:3589312,this:3589312,read_len:320,remain_len:3492offset:3589632,this:3589632,read_len:320,remain_len:3172offset:3589952,this:3589952,read_len:320,remain_len:2852offset:3590272,this:3590272,read_len:320,remain_len:2532offset:3590592,this:3590592,read_len:320,remain_len:2212offset:3590912,this:3590912,read_len:320,remain_len:1892offset:3591232,this:3591232,read_len:320,remain_len:1572offset:3591552,this:3591552,read_len:320,remain_len:1252offset:3591872,this:3591872,read_len:320,remain_len:932offset:3592192,this:3592192,read_len:320,remain_len:612offset:3592512,this:3592512,read_len:292,remain_len:292fatfs: disk_initialize vol 0
===sd card open:0===
Not 4 line mode. skip config SD_D2(P18)
cmd 1:3 
sdcard cmd 8 timeout,cmdresp_int_reg:0x84
cmd8 noresp, voltage mismatch or Ver1.X SD or not SD
sdcard cmd 37 timeout,cmdresp_int_reg:0x84
send cmd55 err:3
send cmd55&cmd41 err, quite loop
Not 4 line mode. skip config SD_D2(P18)
cmd 1:3 
sdcard cmd 8 timeout,cmdresp_int_reg:0x84
cmd8 noresp, voltage mismatch or Ver1.X SD or not SD
sdcard cmd 37 timeout,cmdresp_int_reg:0x84
send cmd55 err:3
send cmd55&cmd41 err, quite loop
Not 4 line mode. skip config SD_D2(P18)
cmd 1:3 
sdcard cmd 8 timeout,cmdresp_int_reg:0x84
cmd8 noresp, voltage mismatch or Ver1.X SD or not SD
sdcard cmd 37 timeout,cmdresp_int_reg:0x84
send cmd55 err:3
send cmd55&cmd41 err, quite loop
sdcard_open err
[1970-1-1 18:12:19.492  tuya_sdcard.c sd_mount(108) Error] -----mount fatfs fail-----

[1970-1-1 18:12:19.498  bk_sd_fac.c bk_sd_fac_connect(112) Debug] no sdcard

[1970-1-1 18:12:19.506  bk_sd_fac.c bk_sd_fac_init(734) Debug] bk_sd_fac_connect fail , bk sd fac out -1

[1970-1-1 18:12:19.516  tuya_power.c tuya_power_init(265) Debug] tuya_power_init
[01-01 18:12:19 TUYA N][tuya_peripheral.c:223] ty_gpio pin [2] init success

[01-01 18:12:19 TUYA N][tuya_drv_adc.c:536] adc init =0x9008bc,0x900800,0x900828. chn=3,4

[1970-1-1 18:12:19.540  tuya_power_save.c ty_power_save_init(139) Debug] set deepsleep timer timeout 185!
[01-01 18:12:19 TUYA I][uni_thread.c:220] thread_create name:ty_ps,stackDepth:2560,totalstackDepth:23040,priority:4
[1970-1-1 18:12:19.560  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x8] success

[1970-1-1 18:12:19.568  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x600] success

[1970-1-1 18:12:19.578  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x80] success

[1970-1-1 18:12:19.588  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x2] success

[1970-1-1 18:12:19.596  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x600] success

[1970-1-1 18:12:19.606  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0xc3600] success

[1970-1-1 18:12:19.614  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x2c800] success

[1970-1-1 18:12:19.624  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x10000] success

[01-01 18:12:19 TUYA I][uni_thread.c:220] thread_create name:wk_th-0,stackDepth:1536,totalstackDepth:24576,priority:4
[1970-1-1 18:12:19.644  tuya_lite_doorbell.c ty_user_doorbell_task_proc_start(358) Debug] __begin

[01-01 18:12:19 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[1970-1-1 18:12:19.660  user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default!
[1970-1-1 18:12:19.672  tuya_led_ctrl.c led_light_mode_set(214) Info] change led status => [8]

[01-01 18:12:19 TUYA I][uni_thread.c:220] thread_create name:blue_led_light_ctrl,stackDepth:1024,totalstackDepth:25600,priority:1
[01-01 18:12:19 TUYA D][ipc_key.c:116] min_timer_period :10
[01-01 18:12:19 TUYA D][ipc_key.c:116] min_timer_period :10
[01-01 18:12:19 TUYA D][key_proc.c:62]  key_proc_init done !!!

[1970-1-1 18:12:19.708  tuya_alarm.c tuya_notifify_alarm_init(303) Debug] tuya_notifify_alarm_init
[PLATFORM DEBUG]bk_rst:0 tuya_rst:0
rw_ieee80211_set_country code:
code: CN
channel: 1 - 13
mode: MANUAL
bk_wlan cca closed
[1970-1-1 18:12:19.740  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4436]

[PLATFORM DEBUG]tuya_os_adapt_watchdog_init_start
[PLATFORM DEBUG]tuya_os_adapt_watchdog_init_start OK
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[01-01 18:12:19 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[1970-1-1 18:12:19.758  user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default!
[PLATFORM DEBUG]ssid:SmartLife-9DB2 key:  channnel: 6
[saap]MM_RESET_REQ
[bk]tx_txdesc_flush
tx_txdesc_init: i=0, j=0, ct=1
tx_txdesc_init: i=1, j=0, ct=1
tx_txdesc_init: i=2, j=0, ct=64
tx_txdesc_init: i=3, j=0, ct=4
tx_txdesc_init: i=4, j=0, ct=1
[saap]M[1970-1-1 18:12:19.946  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4222]

[1970-1-1 18:12:20.092  tuya_ipc_camera.c tuya_ipc_camera_init(358) Debug] video test set format
[1970-1-1 18:12:20.112  tuya_ipc_camera.c tuya_ipc_camera_init(366) Debug] video test set buff
[1970-1-1 18:12:20.116  tuya_ipc_camera.c tuya_ipc_camera_init(428) Debug] video test start stream
E_CONFIG_REQ
[saap]ME_CHAN_CONFIG_REQ
[saap]MM_START_REQ
[csa]csa_in_progress[0:0]-clear
mm_add_if_req_handler:0
hapd_intf_add_vif,type:3, s:0, id:0
apm start with vif:0
------beacon_int_set:100 TU
set_active param 0
[msg]APM_STOP_CFM
update_ongoing_1_bcn_update
mm_set_vif_state_req_handler
vif_idx:0, ch_idx:[1970-1-1 18:12:20.148  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4464]

0, bcmc_idx:2
update_ongoing_1_bcn_update
enter low level!
mac 4c:a9:19:e2:9d:b3
leave low level!
[net]addvif_idx:0
uap_ip_start

configuring interface uap (with[1970-1-1 18:12:20.172  tuya_power_save.c ty_power_save_deal_wake_soure(161) Notice] 
--#3---sctrl_get_deep_sleep_wake_soure [0], gpio [-1]
[1970-1-1 18:12:20.184  tuya_power_save.c ty_power_save_deal_wake_soure(175) Debug] get_gw_active not is ACTIVATED
[1970-1-1 18:12:20.196  tuya_device.c device_init(656) Info] 
--#1---TUYA_APP_Init_Stream_Storage

Init tuya_ipc_ss_init[01-01 18:12:20 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[1970-1-1 18:12:20.214  user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default!
[1970-1-1 18:12:20.226  tuya_ipc_dp_handler.c IPC_APP_get_sd_record_onoff(478) Debug] curr sd_record_on_off:1 

[01-01 18:12:20 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[1970-1-1 18:12:20.242  user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default!
[1970-1-1 18:12:20.254  tuya_ipc_dp_handler.c IPC_APP_get_sd_record_mode(512) Debug] curr sd_record_mode:0 

[01-01 18:12:20 TUYA E][tuya_ipc_stream_storage.c:1780] the ss mgr not inited, but msg buffered: set mode 1
[1970-1-1 18:12:20.274  tuya_device.c __wait_online(550) Notice] wait online ...
 Static IP)def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed
dev id key: 16
6d 65 25 f2 34 fb 69 34 74 0e 9e fc 3d 01 87 49 
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_reset_adv
gapm_cmp_evt_handler operation = 0x10, status = 0x0 
[1970-1-1 18:12:20.306  tuya_sdcard.c tuya_ipc_sd_status_upload(177) Debug] report sd status : [5]
[01-01 18:12:20 TUYA E][tuya_ipc_stream_storage.c:1782] storage not inited
[1970-1-1 18:12:20.348  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4353]

[1970-1-1 18:12:20.378  tuya_ld.c get_ld_stat_cb(99) Debug] LD state :[TY_LD_STATE_LIGHT]

fetch msg success. event type = [0x80]
[1970-1-1 18:12:20.378  tuya_event.c __event_night_state_callback(158) Debug] process night event 0

[1970-1-1 18:12:20.388  tuya_peripheral.c ty_peripheral_ctrl_irled(306) Debug] tuya_gpio_write success! pin=[6] val=[0], ret=[0]

[1970-1-1 18:12:20.402  tuya_peripheral.c ty_peripheral_ircut_set(531) Debug] ty_peripheral_ircut_set [TY_PERIPHERAL_SW_ON]

[1970-1-1 18:12:20.560  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4218]

[1970-1-1 18:12:20.718  tuya_stream_proc.c tuya_stream_ctrl_night(606) Debug] bai-------------------------------------------tian
[1970-1-1 18:12:20.720  tuya_stream_proc.c tuya_stream_ctrl_night(854) Debug] 0328-----baitian--------------

[1970-1-1 18:12:20.758  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4477]

[1970-1-1 18:12:20.758  tuya_device.c __wifi_status_cb(425) Info] wf_nw_status_cb,wifi_status:2
[1970-1-1 18:12:20.766  tuya_led_ctrl.c led_light_mode_set(214) Info] change led status => [9]

publish event [0x80] success
[1970-1-1 18:12:20.966  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4314]

[1970-1-1 18:12:21.178  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4387]

[1970-1-1 18:12:21.302  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:21.376  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4456]

[1970-1-1 18:12:21.588  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4278]

[1970-1-1 18:12:21.796  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4463]

[1970-1-1 18:12:22.008  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4392]

[1970-1-1 18:12:22.206  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4238]

[1970-1-1 18:12:22.322  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:22.416  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4490]

[1970-1-1 18:12:22.628  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4340]

[1970-1-1 18:12:22.628  tuya_power.c update_sys_bat(106) Debug] update_sys_bat percent: 100 percent_hold: 100 bat: 100

[1970-1-1 18:12:23.342  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:24.362  tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:25.382  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:26.402  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:26.956  tuya_audio.c __audio_output_proc(389) Debug] ao buffer empty.

[1970-1-1 18:12:27.422  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:28.442  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:29.462  tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:30.482  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:31.502  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:32.522  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:33.542  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:34.562  tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:35.582  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:36.602  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:36.956  tuya_audio.c __audio_output_proc(389) Debug] ao buffer empty.

[1970-1-1 18:12:37.622  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:38.642  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:39.662  tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:40.682  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:41.702  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:42.722  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:43.742  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:44.762  tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:45.782  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:46.394  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:46.708  tuya_soft_wdt.c tuya_soft_wdt_check(51) Info] type = [0] ts=31 pts=31, last=0

[1970-1-1 18:12:46.708  tuya_soft_wdt.c tuya_soft_wdt_check(51) Info] type = [1] ts=31 pts=31, last=0

[1970-1-1 18:12:46.716  tuya_soft_wdt.c tuya_soft_wdt_check(51) Info] type = [2] ts=31 pts=31, last=0

[1970-1-1 18:12:46.956  tuya_audio.c __audio_output_proc(389) Debug] ao buffer empty.

[1970-1-1 18:12:47.414  tuya_device.c __wait_online(550) Notice] wait online ...


BK7252 flash read and write with SPI (CH341)
Just refer to Doorbell guide by @divadiow
Tuya Doorbell - English
Tuya Doorbell - Polish

BK7252 flash read and write with UART (CH340)
BK7252 flashing is very similar to BK7231T - in fact, BK7231T mode in Easy UART Flasher may work for some BK7252s. As far as I've tested, the only issue may arise with some BK7252s in BK7231 Easy UART flasher due to the "address wrap" hack used to access the bootloader:
Screenshot from Visual Studio showing C# source code, with the line addr + FLASH_SIZE; highlighted.
That's why Easy UART flasher version 19 and later has a new BK7252-specific mode.
So, get it here:
https://github.com/openshwprojects/BK7231GUIFlashTool
Just choose BK7252 mode:
Screenshot of BK7231 Easy UART Flasher software with a Reading success! message displayed.
On hardware side, it's a classic BK connection - just RX, TX, GND and power (3.3V).

If flasher can't "Get bus", do a quick power off/on cycle. You can check out our other BK7231 tutorials to see more details:
https://openbekeniot.github.io/webapp/devicesList.html
https://www.youtube.com/@elektrodacom
Alternatively, you can use old Python solution:
https://github.com/OpenBekenIOT/hid_download_py
Example backup flash to file command:
Code: text Expand Select all Copy to clipboard

python uartprogram -l 0x1FFFFF -b 115200 -r -d COM3  mybackup.bin

This will read 2MB flash, starting with default 0x11000 offset. Bootloader is not read there. It seems bootloader reading is possible only on some BK7252 - we don't know why yet.
To write:
Code: text Expand Select all Copy to clipboard

python uartprogram -b 115200 -w -d COM3 newflash.bin

Then do power off/on cycle to run new firmware.
You can also submit your BK7252 factory backup here:
https://github.com/openshwprojects/FlashDumps

UART method should not be used to change bootloader because it may be possible to brick BK7252 that way. Just like with BK7231T, the bootloader is in 0-0x11000 physical address section. In the event of Bootloader overwrite it is likely a restore using the SPI method will be required as device will not respond over UART anymore.

Bootloader is using RT-Thread. See attached documents.


BK7252 open source firmware
OpenBeken is going to support BK7252 soon, but current build is not public. Check Releases Tab periodically for updates:
LED lighting control panel on a device running OpenBK7252 system.

BK7252 Tuya SDKs (as links, files are too large to attach):
Code: text Expand Select all Copy to clipboard

https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.10.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.11.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.14.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.16.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.17.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.18.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.21.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.22.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.23.zip

They consist of gcc-arm-none-eabi-5_4-2016q3.tar.bz2 SDK, FreeRTOSv9.0.0, Beken SDK, tools:
- video_tool
- tuya_packager
- scripts
- rtt_ota
- rt_partition_tool
- memory_leak
- make
- iperf_test
- gnuwin32
- crc_binary
- beken_packager
The attached BK72XX_SDK_User_Manual-3.0.3.pdf and BEKEN_WiFi_SDK_API_Reference-3.0.27.pdf documents are also from the Tuya SDK package.

BK7252 Flash Maps
bk7252_flash_map_2MB.xlsx
Spreadsheet showing memory partitioning with highlighted rows for app and other sections.
Partition NameStart Addr (Hex)Start Addr (Dec)Physical AddrSizeSize (Hex)Start Addr (Hex)Start Addr (Dec)Logical AddrSizeSize (Hex)Remarks
bootloader0x0000KB68KB0x000KB64KB0x10000Boot + Copy. Bootloader does not use full 64KB. RF+MAC placed before.
app0x110006963268KB1224KB0x1320000x100006553664KB1152KB0x120000Main Program Area
download0x14300013230081292KB748KB0xBB000Temporary download area, can reuse. 748 / 1152 (app) = ~65%
param10x1FE00020889602040KB4KB0x1000EasyFlash
param20x1FF00020930562044KB4KB0x1000Fast Connect

🟨 Yellow rows (app) indicate discrepancy between physical and logical addresses
bk7252_flash_map_4MB.xlsx
Screenshot of an Excel sheet showing a table with memory addresses and sizes for different software partitions.
Partition NameStartAddr_Physical_HexStartAddr_Physical_DecAddrSize_KBSize_HexStartAddr_Logical_HexStartAddr_Logical_DecLogical_KBSize_KB_LogicalSize_Hex_LogicalNotes
bootloader0x0000000KB64KB0x0000000KB60KBBoot + Copy bootloader doesn't use full 64KB RF+MAC placed in front
app0x110006963268KB1768KB0x1BA0000x100006553664KB1664KB0x1A0000Main application area physical address aligned to 68KB
filesystem0x1CB00018800641836KB1156KB0x1210000x1B000017694721728KB1088KB0x110000
download0x2EC00030638082992KB1096KB0x1120001100/1664=66%
param10x3FE00041861124088KB4KBEasyFlash
param20x3FF00041902084092KB4KBEasyFlash


Related A9 camera "hack"
It may be also possible to get A9 camera video stream without firmware change - see this guide:
https://www.elektroda.com/rtvforum/topic4117962.html

Summary
This is all BK7252 information I have managed to find so far. Currently we know flashing methods (both SPI and UART) and we can compile our own firmware for it, but we're still working on OTA and video processing. Hopefully we'll be able to resolve these issues soon. Special thanks for @divadiow and @insmod for development and info.

See attachments for more information. If you have any more info, let us know.
Attachments:
  • BK7252_Micropython_Demo-removedVSCodestuff.zip (31.84 MB) You must be logged in to download this attachment.
  • BK72XX_SDK_User_Manual-3.0.3.pdf (705.04 KB) You must be logged in to download this attachment.
  • BEKEN_WiFi_SDK_API_Reference-3.0.27.pdf (4.19 MB) You must be logged in to download this attachment.
  • RT-THREAD BK7252 麻雀一号开发板使用文档_20191112.pdf (51.79 MB) You must be logged in to download this attachment.
  • RT-Thread编程指南_2018-12-12.pdf (2.59 MB) You must be logged in to download this attachment.
  • RW052_datasheet.pdf (313.64 KB) You must be logged in to download this attachment.
  • BK7252_Data_Sheet_V1.0.pdf (660.99 KB) You must be logged in to download this attachment.
About Author
p.kaczmarek2
p.kaczmarek2 wrote 14232 posts with rating 12130 , helped 647 times. Been with us since 2014 year.

Comments

chemik_16 21 Apr 2025 09:55

But to operate a camera/audio probably still a long way off ? ;) . [Read more]

p.kaczmarek2 21 Apr 2025 10:06

We haven't tried this directly yet, but there are quite a few potential examples and SDKs. One would have to see if they work with the camera module what is used on these boards. The links posted are also... [Read more]

divadiow 21 Apr 2025 12:40

I've just started taking some pics of another cam for another BK7252 adventure. BK7252NQN481 https://obrazki.elektroda.pl/8147659100_1745231751_bigthumb.jpg "bk7252n" searches specifically... [Read more]

insmod 21 Apr 2025 12:56

I just recently updated sdk to 3.0.76, which adds bk7252n support. The chip is very recent, most information i see about it was made in 2025. Will have to see if i can build for it. Camera is a very... [Read more]

p.kaczmarek2 21 Apr 2025 13:15

I still need to find my second A9 camera, which also had BK7252 but I stopped working on it in the past because I bricked the bootloader. Maybe I will be able to recover it with SPI method. @insmod... [Read more]

divadiow 21 Apr 2025 13:17

Taixin TXW817 uart boot log and some SDK bits from this post onwards https://www.elektroda.com/rtvforum/topic4033757.html#20946310 I can get latest if you need. [Read more]

satanistik 22 Apr 2025 09:07

Would it be possible to add circuit support to the OBK via SPI? I am referring to the ATM90E3 three-phase power meter. [Read more]

p.kaczmarek2 22 Apr 2025 10:03

Sure, it seems the datasheet is available, but where did you find ATM90E3 device? Or are you making a custom one? Is there a product with one of supported chips and ATM90E3 ? [Read more]

satanistik 22 Apr 2025 15:37

Well, there is no cheap power measurement device for 3-phase systems using transformers. But there is something out there for about 1kzl, the ATM90E3 is quite cheap and available. I can design the boa... [Read more]

divadiow 22 Apr 2025 21:02

with reference to the BK7252N A9 cam, SPI mode entered and dump taken with Neo. SPI entered using same method as the doorbell I made another import.xml for Neo so more of the flash IDs used in our... [Read more]

p.kaczmarek2 22 Apr 2025 21:05

Is OpenBK7238 QIO from 0x0 booting on NiceMCU? [Read more]

divadiow 23 Apr 2025 08:06

got a feeling it doesn't. can try in a while Added after 10 [hours] 55 [minutes]: QIO does actually boot and AP broadcasts. whole log out is from UART2 P0 instead of UART1 P11 [Read more]

elek2sambartle 30 Apr 2025 14:43

The BK7252 is also in the ALDI REKA, Video doorbell (742868) in the UK. (And probably other locations), it uses the Tuya app so probably similar. https://www.aldi.co.uk/product/reka-video-doorbell-000000000634500001 A... [Read more]

elek2sambartle 30 Apr 2025 14:46

The BK7252 is also in the ALDI REKA, Video doorbell (742868) in the UK. (And probably other locations), it uses the Tuya app so probably similar. https://www.aldi.co.uk/product/reka-video-doorbell-000000000634500001 A... [Read more]

divadiow 30 Apr 2025 14:58

cool. I usually keep an eye on Lidl and Aldi weekly things for smart bits but hadn't noticed this show. Would you be happy to post firmware backup and uart boot log if/when captured? Added after 4 [minutes]:... [Read more]

elek2sambartle 30 Apr 2025 15:31

Sure, here you go. [Read more]

divadiow 30 Apr 2025 20:36

cool. will have a look. You can also dump the entire flash, including bootloader, if you choose BK7231T mode - maybe - ref https://www.elektroda.com/rtvforum/viewtopic.php?p=21525243#21525243 - if not,... [Read more]

Apache02 16 May 2025 00:02

Hi. I recorded a video to demonstrate that it's possible to create an open-source firmware for these types of cameras: This processor has 2 UARTs and 2 I2C interfaces. The camera is controlled via... [Read more]

p.kaczmarek2 16 May 2025 00:56

Good job, which SDK and camera driver did you use? [Read more]

FAQ

TL;DR: BK7252 is a 32-bit Wi‑Fi + BLE camera SoC with up to 6 PWM channels, and the thread’s clearest status check is: "Camera is a very long way from working." This FAQ helps modders find the datasheet, pinout status, SDKs, flash maps, UART/SPI flashing methods, and current camera-firmware limits for doorbells and A9 mini cameras. [#21525668]

Why it matters: If you are reverse-engineering a BK7252 device, this thread compresses the practical facts that decide whether you can back up flash, recover a bricked unit, or build open firmware.

SoC Seen in thread Radio / media focus Open-firmware status in thread
BK7252 Tuya doorbell, A9 mini camera, ALDI REKA doorbell Wi‑Fi + BLE, audio, DVP camera, JPEG UART/SPI flashing works; camera support is partial
XF16 / XR872 Alternate A9 camera variant Camera board alternative Investigated in parallel, less detail shared
TXW817 Another camera SoC discussed for comparison Wi‑Fi + MJPEG, DVP, USB, SDMMC SDK bits and boot logs noted, but not the main target

Key insight: BK7252 is already practical for dumping, restoring, and testing firmware, but camera and audio support still depends on SDK examples, matching sensors, and intact bootloader or SPI access.

Quick Facts

  • BK7252 is described as a Wi‑Fi and Bluetooth LE combo 32-bit chip for audio/video products, with up to 6 PWM, 2-channel DAC, 1-channel ADC, 8-bit DVP camera input, JPEG compression, and QSPI for Flash and RAM extension. [#21525668]
  • The thread shows two package variants for BK7252: QFN68 (8Ă—8 mm) and QFN48 (6Ă—6 mm). A confirmed QFN48 marking also appears later as BK7252NQN481. [#21525668]
  • The 2 MB flash map places bootloader at 0x0–0x11000, app at physical 0x11000, and reserves 4 KB each for param1 and param2 at 0x1FE000 and 0x1FF000. [#21525668]
  • Easy UART Flasher added a dedicated BK7252 mode in version 19+ because some chips fail with the older BK7231 address-wrap bootloader hack. [#21525668]
  • A working open-camera path now exists: one repository demonstrated BK7252 camera firmware with the hi704 sensor, while other reported sensors such as gc0310 remained unsupported in the cited tests. [#21550713]

What is BK7252, and which Wi‑Fi, Bluetooth LE, audio, and camera features does it include for doorbells and mini cameras?

BK7252 is a 32-bit Wi‑Fi and Bluetooth Low Energy combo chip built for audio and video devices. The thread lists up to 6 PWM channels, a 2-channel DAC, a 1-channel ADC, an 8-bit DVP camera interface, a built-in JPEG engine, and QSPI that can extend both Flash and RAM. It has already been found in Tuya video doorbells and A9 mini cameras, so it fits battery doorbells and small IP-camera boards rather than simple relays or bulbs. [#21525668]

How do I flash a BK7252 over UART with a CH340 using Easy UART Flasher or hid_download_py without overwriting the bootloader?

Use UART only for the application area, not the bootloader region at physical 0x0–0x11000.
  1. Connect RX, TX, GND, and stable 3.3 V power, then select BK7252 mode in Easy UART Flasher v19+.
  2. Back up flash first, for example with python uartprogram -l 0x1FFFFF -b 115200 -r -d COM3 mybackup.bin.
  3. Write only the new app image, then power-cycle the board.
The thread warns that changing the bootloader over UART can brick the chip and force SPI recovery. [#21525668]

Why does Easy UART Flasher sometimes fail to "Get bus" on BK7252, and what power-cycle or mode-selection steps help?

It can fail because BK7252 is close to BK7231T, but some chips break with the older address-wrap bootloader access method. The practical fixes are simple: select the dedicated BK7252 mode in Easy UART Flasher v19 or newer, keep the classic 3.3 V UART wiring, and if “Get bus” fails, do a quick power off/on cycle and retry. That sequence is the thread’s explicit recovery step for bus-detection problems. [#21525668]

Where can I find the BK7252 datasheet, Tuya application schematic, and known SDK packages such as BK7252_1.1.10 through 1.1.23?

The thread’s main post is the best index. It includes an English BK7252 datasheet in screenshots and PDF attachments, a Tuya Combo Core Board application schematic, and direct SDK package names from BK7252_1.1.10 through BK7252_1.1.23. It also notes later sightings of BK7252U QFN68 datasheet v1.3 behind paywalls and an English BK7252N datasheet shared later in the discussion, but no full QFN48 pinout is confirmed there. [#21525668]

What is RT-Thread in the context of BK7252 bootloaders and SDKs, and why does it show up in the boot log?

RT-Thread appears because BK7252 boot code and firmware components in this thread use that RTOS stack. "RT-Thread" is a real-time operating system that schedules embedded tasks, provides components such as Flash Abstraction Layer and filesystems, and prints its own version banners during boot. The A9 boot log shows RT - Thread Operating System 3.1.0, FAL initialization, and LFS mount messages, which confirms the runtime is active before the camera app starts. [#21525668]

What is EasyFlash on BK7252 flash maps, and how is it different from the app, download, and param partitions?

EasyFlash is the small persistent-parameter area, not the main firmware image. "EasyFlash" is a lightweight flash-parameter storage layer that keeps small key-value data in dedicated sectors, separate from executable code and temporary OTA staging space. In the 2 MB map, param1 at 0x1FE000 is marked EasyFlash, while app holds the main program, download is the temporary download area, and param2 stores Fast Connect data. [#21525668]

BK7252 vs XF16/XR872 vs TXW817: how do these camera SoCs compare for hacking A9 mini cameras and building open firmware?

BK7252 is the most actionable target in this thread because people already dumped flash, restored boards, and booted custom code on it. XF16/XR872 appears only as an alternate A9 platform under parallel investigation. TXW817 looks richer on paper, with MJPEG, DVP, USB 2.0 HS, SDMMC, SDIO 2.0, SPI, UART, IIC, IIS, PDM, ADC, and DAC, but the thread treats it as a side path with logs and SDK fragments, not a finished open-firmware target. [#21526124]

Which BK7252 devices have been identified so far, including Tuya doorbells, A9 spy cameras, and the ALDI REKA video doorbell?

The thread identifies at least three BK7252 product families. First, a Tuya video doorbell is documented with encrypted Tuya keys. Second, several A9 mini camera PCB variants are listed, including A9_B / V1.3_220516, JC_V9_V3B / 20230809DF, and BMY_A9_V3A / 20230627DF. Third, the ALDI REKA video doorbell model 742868 in the UK was later reported as another BK7252 device, likely using the Tuya app and a GalaxyCore GC0328 camera. [#21535382]

How should I interpret the BK7252 2MB and 4MB flash maps, especially the physical-vs-logical address mismatch in the app area?

Read the map as two views of the same firmware layout: physical flash offsets versus the chip’s logical execution mapping. In the 2 MB layout, the app starts at physical 0x11000 but logical 0x10000. In the 4 MB layout, the app is 1768 KB physically yet 1664 KB logically, and the filesystem also has separate physical and logical bases. The yellow “app” rows highlight that translation layer, so you must match your tool and image format to the correct address space. [#21525668]

What does the missing BK7252UQN48 or BK7252NQN48 pinout situation mean for board reverse-engineering, and where are people finding partial datasheets?

It means reverse-engineering a QFN48 board still requires tracing pins manually, even if you already know the chip family. The thread provides a QFN68 pinout, states that BK7252UQN48 pinout had not been found, and later shows a marked BK7252NQN481 package plus references to a BK7252N datasheet in English and a BK7252U QFN68 datasheet v1.3 seen behind paywalls. So partial datasheets exist, but a complete public QFN48 pinout still remains the gap. [#21706214]

Why might a BK7252 camera fail to respond over UART or SPI flash access mode, and how can eFuse-locked flash affect recovery?

A BK7252 camera can stop responding if the bootloader is missing, the wrong interface pins are exposed, or the SPI flash is locked by eFuse. One later test report states that some boards still allow direct SPI-flash access for bootloader recovery, but at least one camera neither answered over UART nor entered SPI flash mode. That matters because eFuse-locked flash can block both the easy UART path and the low-level recovery path. [#21550476]

Which camera sensors and drivers are actually working with BK7252 right now, such as hi704, gc0310, GC0328, and unsupported txw817-based modules?

The only explicitly working BK7252 camera sensor in this thread is hi704. A linked repository branch and issue note say the sensor works there. By contrast, one developer says their BK7252 camera boards came with gc0310 and a txw817-marked unknown camera, and neither matched the SDK examples they had. GC0328 appears in the ALDI REKA doorbell discussion as a likely sensor identification, but that post does not claim a working open driver. [#21550713]

What steps are people using to recover a BK7252 after the bootloader was bricked, including SPI dump, erase, and restore with Neo or BKFIL?

They recover it through direct SPI-flash work, then restore a known-good dump.
  1. Enter SPI mode using the same method used on the documented doorbell boards.
  2. Dump flash with Neo, then erase or inspect it with BKFIL.
  3. Write back a valid UART or factory dump and verify the normal boot log returns.
One reported recovery erased the flash fully, read back all FF, then restored a UART dump and regained a normal camera boot log. [#21527527]

How far along is OpenBeken support for BK7252 camera and audio features, and what SDK examples or repos are being used to get video working?

OpenBeken support is real for booting and flashing, but camera support is still incomplete. The thread says public OpenBeken BK7252 camera builds were not yet released, while separate work showed open-camera video on BK7252 using a repository branch named working_camera and the hi704 sensor. Earlier posts also mention BK7252 camera SDK archives with CFG_USE_CAMERA_INTF, plus BK7252 SDK 3.0.76 adding BK7252N support. That means video progress exists, but it still depends on matching sensors and SDK examples. [#21526110]

How would SPI support for the ATM90E3 three-phase energy meter fit into OpenBeken, and what would a custom board need to make that practical?

It would fit as a new SPI peripheral driver, but the thread frames it as a custom-board project, not an existing BK7252 product. The discussed goal is a three-phase meter using the ATM90E3 because ready-made transformer-based units are scarce and around 1k zł, while the metering IC itself is cheap and available. To make it practical, you would need a supported OpenBeken-capable MCU, ATM90E3 wired over SPI, and a board design that exposes the needed pins and power domains cleanly. [#21527221]
%}