Task, despite being a normal function from the C point of view, has no right to return via return from a function. If it is not needed, it should be removed using the appropriate function. The system will release its context etc. Such a function is vTaskDelete. Of course you have to set INCLUDE_vTaskDelete to 1 in the configuration file.

In addition, if you delete a task, you must remember that the idle task gets the CPU time, because the deletion takes place right there.

Additionally, the task itself cannot return via return.

If you want a task to execute only once and then delete itself


static void my_task(void *Par)
{
ESP_LOGI(TAG, "b=%d", length);
length++;
vTaskDelete(NULL);
while(1) vTaskDelay(1);
} .

Of course there are many other ways than while(1) vTaskDelay(1); I deliberately don't write about them at the moment because they either require a longer explanation or the right configuration

maybe this relates? https://www.elektroda.com/rtvforum/topic4086343.html

I see @xj2 has made some recent developments too https://github.com/openshwprojects/OpenBK7231T_App/pull/1516

Recently it seems there has been a lot of cheap earwax remover otoscope devices popping up on amazon/aliexpress/tiktok shop similar to this:


When powered on, the button will start flashing slowly, as well as the light for the camera will turn on. After a few seconds it will start its wifi network usually with an ssid like "Soulear-ae45b" where it seems to be very generically "Company-uniq" as another device seems to show up as "Suear-4670". My device was broadcasting under the MAC of "88:17:89:0d:0e:b0" and had dhcp assigning IPs starting at 192.168.1.10 with itself at 192.168.1.1.

Once connected on a phone, its app which seems to vary based on the device you pick up, but all of which are essentially identical, allows you to take video, pictures, switch ears from left/right, enable/disable the led, as well as switch between either wide/focused lenses or switch between "horizontal" and "mirror(?)". Some also seem to have a lock icon which I'm not sure what does.


They're very difficult to get into, and from what I can tell can't be gotten into without breaking the plastic in some way. If you're opting to take it apart and keep it looking nice, I think my approach would be cutting the seam or maybe heat or something to remove the glue holding it in. Once in, you're greeted by a 21(?) pin connector for the leds + camera, 2.7V 170mAh battery, and the main pcb. PCB has a few pads exposed, of which I may have torn off CE and CLK 😬:
- 3.3V + GND (from mcu)
- 5V + GND (from usb, although GND is shared)
- CE (CHIP_EN)
- DP (PC6, This is UART TX, RX is not exposed)
- CLK (PA10, TCLK)
- TMS (PA9)
- PA8 (USB_DET?)

These (mine at least) seem to be using the Taixen TXW816-810 which has been seen similarly with the https://www.elektroda.com/rtvforum/topic4033757.html#20946310.

UART Logs
startup:
14:06:55.069 -> [0]40 00 97 00 a8 43 12 a0
14:06:55.069 -> [0]28 e0 00 00 00 00 00 00
14:06:55.070 -> [0]00 00 00 00 00 00 00 00
14:06:55.070 -> [0]88 17 89 0d 0e 2c 76 35
14:06:55.071 -> [0]86 65 89 67 9f 57 00 00
14:06:55.071 -> [0]80 00 bb 02 a0 f7 00 00
14:06:55.071 -> [0]00 15 00 00 08 14 00 00
14:06:55.072 -> [0]00 00 00 00 00 00 0c 00
14:06:55.072 -> [0]00 00 00 40 08 84 40 08
14:06:55.072 -> [0]8c c0 08 8c c0 08 94 00
14:06:55.073 -> [0]06 4b 3f fd 92 ff 04 4e
14:06:55.073 -> [0]f0 00 4f 00 de 01 02 02
14:06:55.073 -> [0]00 ff ff ff 0f b4 04 04
14:06:55.074 -> [0]02 04 04 06 06 1f 00 17
14:06:55.074 -> [0]00 02 3e 00 00 00 00 08
14:06:55.075 -> [0]00 00 00 00 00 30 12 00
14:06:55.075 -> [0]3c 3c 0f
14:06:55.075 -> [0]validity: 1579f00d

14:06:55.076 -> ** hgSDK-v2.5.0.7-25841, app-0, build time:Dec 5 2024 12:06:20 **
14:06:55.077 -> ** libcore v2.5.0.7-26821, build time:Dec 21 2023 11:25:54
14:06:55.077 -> ** libnetutils v2.5.0.7-26821, build time:Dec 21 2023 11:26:09
14:06:55.078 -> ** libcommon v2.5.0.7-26821, build time:Dec 21 2023 11:25:58
14:06:55.078 -> ** libosal v2.5.0.7-26821, build time:Dec 21 2023 11:25:53
14:06:55.079 -> ** libatcmd v2.5.0.7-25927, build time:Nov 6 2023 16:23:19
14:06:55.080 -> ** liblmac v2.5.0.7-26821, build time:Dec 21 2023 11:26:25
14:06:55.081 -> ** libwifi v2.5.0.7-26821, build time:Dec 21 2023 11:26:38
14:06:55.081 -> ------------------------------------------------------------------
14:06:55.082 -> [0] ------- system restart fault -----------
14:06:55.082 -> [0] ---------------------------------------
14:06:55.084 -> [1]freemem:160720
14:06:55.084 -> [1]custom_mem_init:2000c740
14:06:55.084 -> [1]custom mem sram:61440
14:06:55.085 -> [2]skbpool init, total:49396 (0x20037f0c~0x20044000), max per:80%
14:06:55.086 -> [4]syscfg_read OK!
14:06:55.088 -> [4]old cfg_ver:259
14:06:55.192 -> ---xrh_io_init---

14:06:55.251 -> [154]------pwr_det_keep.........1
14:06:55.286 -> [204]------pwr_det_keep.........2
14:06:55.288 -> [205]lmac rx info size:36
14:06:55.288 -> [205]GAP0 : 20033b0c
14:06:55.288 -> [206]GAP1 : 20037f04
14:06:55.288 -> [206]lmac rx buff:20033b14, size:17392, hw rx buff size:11256, ampdu:7, max subfrm:3
14:06:55.290 -> [207]lmac priv: 2001bec4
14:06:55.290 -> [207]lmac tx : 2001c278
14:06:55.290 -> [208]lmac rx : 2001d444
14:06:55.290 -> [208]lmac ble rx: 00000000
14:06:55.291 -> [209]pack:8, bios_id:2
14:06:55.291 -> [209]use AMPM DPD!
14:06:55.291 -> [209]verf:0x5, ibpt:0x3, ibct:0x6, iref:0x6
14:06:55.292 -> [210]verfvco_trim:0x8, verfcp_trim:0x5, verfdiv_trim:0x5
14:06:55.292 -> [211]verfdsm_trim:0x4, verfvcc25_trim:0x1
14:06:55.293 -> [211]da cap:5, da gain:1
14:06:55.317 -> [214]txdcoc from:1, i:8, q:20
14:06:55.317 -> [214]tx imb from:1, pm:192, gm:0
14:06:55.318 -> [215]rx dcoc from:1
14:06:55.318 -> [216]g:0, ana:2112, i:11, q:3
14:06:55.318 -> [216]g:1, ana:2112, i:19, q:5
14:06:55.318 -> [216]g:2, ana:2112, i:18, q:4
14:06:55.318 -> [217]g:3, ana:2240, i:15, q:7
14:06:55.318 -> [217]g:4, ana:2240, i:14, q:7
14:06:55.318 -> [218]g:5, ana:2240, i:15, q:6
14:06:55.318 -> [218]g:6, ana:2240, i:15, q:7
14:06:55.318 -> [218]g:7, ana:2368, i:0, q:6
14:06:55.318 -> [219]rx imb from:1
14:06:55.318 -> [219]g:0, 8120, 4063
14:06:55.318 -> [220]g:1, 8120, 4064
14:06:55.318 -> [220]g:2, 8118, 4064
14:06:55.318 -> [220]g:3, 8120, 4062
14:06:55.318 -> [221]g:4, 8120, 4061
14:06:55.318 -> [221]g:5, 8122, 4061
14:06:55.318 -> [221]g:6, 8122, 4061
14:06:55.318 -> [221]g:7, 8116, 4062
14:06:55.318 -> [222]time offset:0, 23
14:06:55.318 -> [222]lmac test: 2001dbec
14:06:55.318 -> [223]lmac_bgn_lo_freq_set: 2432
14:06:55.318 -> [224]set rts_threshold =2304
14:06:55.318 -> [225]lmac set mac0 addr:88:17:89:0d:0e:b0
14:06:55.318 -> [225]*** open ADC success!

14:06:55.318 -> [226]*** add success: ADC channel cnt = 1, name:257

14:06:55.318 -> [227]*** add success: ADC channel cnt = 2, name:258

14:06:55.318 -> [227]*** add success: ADC channel cnt = 3, name:262

14:06:55.318 -> [228]*** delete success: ADC channel cnt = 2

14:06:55.318 -> [231]*** add success: ADC channel cnt = 3, name:1

14:06:55.366 -> [282]ad_pwr:2910 383
14:06:55.416 -> [332]ad_pwr:2853 376
14:06:55.465 -> [382]ad_pwr:2909 383
14:06:55.515 -> [432]ad_pwr:2991 394
14:06:55.564 -> [482]ad_pwr:2914 384
14:06:55.564 -> [482]poweron_ad_pwr:2915
14:06:55.615 -> [532]ad_pwr:2895 381
14:06:55.665 -> [582]ad_pwr:2906 383
14:06:55.716 -> [632]ad_pwr:2826 372
14:06:55.765 -> [682]ad_pwr:2939 387
14:06:55.814 -> [732]ad_pwr:2795 368
14:06:55.814 -> [732]poweron_ad_pwr:2872
14:06:55.865 -> [782]ad_pwr:2908 383
14:06:55.915 -> [832]ad_pwr:2930 386
14:06:55.966 -> [882]ad_pwr:2910 383
14:06:56.016 -> [932]ad_pwr:2859 376
14:06:56.066 -> [982]ad_pwr:2935 386
14:06:56.115 -> [1032]ad_pwr:2899 382
14:06:56.166 -> [1082]ad_pwr:2987 393
14:06:56.215 -> [1132]ad_pwr:2890 381
14:06:56.265 -> [1182]ad_pwr:3051 402
14:06:56.329 -> [1232]ad_pwr:2929 386
14:06:56.366 -> [1282]ad_pwr:2908 383
14:06:56.414 -> [1332]ad_pwr:2929 386
14:06:56.414 -> [1332]lmac_bgn_lo_freq_set: 2412
14:06:56.416 -> [1334]lmac_bgn_lo_freq_set: 2412
14:06:56.428 -> [1335]set rts_threshold =1600
14:06:56.428 -> [1336]set ac= 0 aifs= 2 cw_min= 15 cwmax= 1023 txop= 79
14:06:56.428 -> [1337]set ac= 1 aifs= 6 cw_min= 15 cwmax= 1023 txop= 79
14:06:56.428 -> [1337]set ac= 2 aifs= 1 cw_min= 7 cwmax= 15 txop= 128
14:06:56.428 -> [1338]set ac= 3 aifs= 1 cw_min= 3 cwmax= 7 txop= 65
14:06:56.428 -> [1339]set ac= 0 aifs= 2 cw_min= 15 cwmax= 1023 txop= 79
14:06:56.428 -> [1339]set ac= 1 aifs= 6 cw_min= 15 cwmax= 1023 txop= 79
14:06:56.428 -> [1340]set ac= 2 aifs= 1 cw_min= 7 cwmax= 15 txop= 128
14:06:56.428 -> [1341]set ac= 3 aifs= 1 cw_min= 3 cwmax= 7 txop= 65
14:06:56.428 -> [1342]lmac_bgn_lo_freq_set: 2432
14:06:56.428 -> [1343]inteface1: start scanning ...
14:06:56.428 -> [1344]vif1 state WPA_DISCONNECTED -> WPA_SCANNING
14:06:56.428 -> [1345]lmac dbg!!!mac addr err:00:00:00:00:00:00
14:06:56.428 -> [1346]Func:lmac_bgn_tx_check Line:746 LR=0x18027198
14:06:56.528 -> [1445]lmac dbg!!!mac addr err:00:00:00:00:00:00
14:06:56.528 -> [1445]Func:lmac_bgn_tx_check Line:746 LR=0x18027198
14:06:56.638 -> [1545]lmac dbg!!!mac addr err:00:00:00:00:00:00
14:06:56.638 -> [1545]Func:lmac_bgn_tx_check Line:746 LR=0x18027198
14:06:56.728 -> [1645]lmac dbg!!!mac addr err:00:00:00:00:00:00
14:06:56.728 -> [1645]Func:lmac_bgn_tx_check Line:746 LR=0x18027198
14:06:56.828 -> [1745]lmac dbg!!!mac addr err:00:00:00:00:00:00
14:06:56.828 -> [1745]Func:lmac_bgn_tx_check Line:746 LR=0x18027198
14:06:56.927 -> [1845]lmac dbg!!!mac addr err:00:00:00:00:00:00
14:06:56.927 -> [1845]Func:lmac_bgn_tx_check Line:746 LR=0x18027198
14:06:57.028 -> [1945]lmac dbg!!!mac addr err:00:00:00:00:00:00
14:06:57.028 -> [1945]Func:lmac_bgn_tx_check Line:746 LR=0x18027198
14:06:57.128 -> [2045]lmac dbg!!!mac addr err:00:00:00:00:00:00
14:06:57.128 -> [2045]Func:lmac_bgn_tx_check Line:746 LR=0x18027198
14:06:57.228 -> [2145]lmac dbg!!!mac addr err:00:00:00:00:00:00
14:06:57.228 -> [2145]Func:lmac_bgn_tx_check Line:746 LR=0x18027198
14:06:57.327 -> [2245]lmac dbg!!!mac addr err:00:00:00:00:00:00
14:06:57.327 -> [2245]Func:lmac_bgn_tx_check Line:746 LR=0x18027198
14:06:57.427 -> [2345]lmac_bgn_lo_freq_set: 2432
14:06:57.429 -> [2346]lmac_bgn_lo_freq_set: 2412
14:06:57.430 -> [2348]inteface1: scan done!
14:06:57.457 -> [2356][0]===>REDACTED (network name)
14:06:57.457 -> [2356][1]===>REDACTED (network name)
14:06:57.457 -> [2356][2]===>REDACTED (network name)
14:06:57.457 -> [2356][3]===>]......"'O.Y.v*6.x}].,h...6BOa...0..T8.......V"....Z.....N..WI..*.ks..y....RrV.1LtT....m.d.r..H.48.6..Hp.......-z..G$..i....s...j......n..E.B6......^..Gv....C..h|.#\#.../lK.LJ$~*....../.S..
.4.YK........`.....W:>..^..w....[.
14:06:57.457 -> [2359][4]===>.....V"....Z.....N..WI..*.ks..y....RrV.1LtT....m.d.r..H.48.6..Hp.......-z..G$..i....s...j......n..E.B6......^..Gv....C..h|.#\#.../lK.LJ$~*....../.S...4.YK........`.....W:>..^..w....[...U(..
E.>Rd.C-!...V..`k;g..f.~NS_i|...
14:06:57.457 -> [2362][5]===>LtT....m.d.r..H.48.6..Hp.......-z..G$..i....s...j......n..E.B6......^..Gv....C..h|.#\#.../lK.LJ$~*....../.S...4.YK........`.....W:>..^..w....[...U(..E.>Rd.C-!...V..`k;g..f.~NS_i|......^D...
.^y....j
14:06:57.457 -> u!"...

14:06:57.457 -> [2365][6]===>i....s...j......n..E.B6......^..Gv....C..h|.#\#.../lK.LJ$~*....../.S...4.YK........`.....W:>..^..w....[...U(..E.>Rd.C-!...V..`k;g..f.~NS_i|......^D....^y....j
14:06:57.457 -> u!"...

14:06:57.457 -> [2367][7]===>.h|.#\#.../lK.LJ$~*....../.S...4.YK........`.....W:>..^..w....[...U(..E.>Rd.C-!...V..`k;g..f.~NS_i|......^D....^y....j
14:06:57.457 -> u!"...

14:06:57.457 -> [2369][8]===>.......`.....W:>..^..w....[...U(..E.>Rd.C-!...V..`k;g..f.~NS_i|......^D....^y....j
14:06:57.457 -> u!"...

14:06:57.457 -> [2370][9]===>C-!...V..`k;g..f.~NS_i|......^D....^y....j
14:06:57.457 -> u!"...

14:06:57.457 -> [2371][10]===>...j
14:06:57.457 -> u!"...

14:06:57.457 -> [2371][11]===>..PktK.:....^0%;u....}...[G. ..{?.j.^..^......cn.p..=..j..f.y3`_.u.;
14:06:57.457 -> [2372][12]===>......cn.p..=..j..f.y3`_.u.;
14:06:57.457 -> [2373][13]===>(.......B5..0JAZq.-.f.'g..;.kl....a.j.._\.[s.!..X.oi. .t..\....g.....$..lGDY,...V.?..|A.-I.W 9...U.R./.C.@>.M......x...*.G.3......Y......lgo....x.sF.k....PZteSo.....o....%3.-&.....l...!..3

14:06:57.458 -> .jm.i.v."t~....Z
14:06:57.458 -> [2376][14]===>.._\.[s.!..X.oi. .t..\....g.....$..lGDY,...V.?..|A.-I.W 9...U.R./.C.@>.M......x...*.G.3......Y......lgo....x.sF.k....PZteSo.....o....%3.-&.....l...!..3
14:06:57.460 -> .jm.i.v."t~....ZY1^.x..0Z.4.{......._F.g|.Th
14:06:57.461 -> [2379][15]===>DY,...V.?..|A.-I.W 9...U.R./.C.@>.M......x...*.G.3......Y......lgo....x.sF.k....PZteSo.....o....%3.-&.....l...!..3
14:06:57.463 -> .jm.i.v."t~....ZY1^.x..0Z.4.{......._F.g|.Th
14:06:57.463 -> [2381][16]===>......x...*.G.3......Y......lgo....x.sF.k....PZteSo.....o....%3.-&.....l...!..3
14:06:57.465 -> .jm.i.v."t~....ZY1^.x..0Z.4.{......._F.g|.Th
14:06:57.465 -> [2383][17]===>.k....PZteSo.....o....%3.-&.....l...!..3
14:06:57.466 -> .jm.i.v."t~....ZY1^.x..0Z.4.{......._F.g|.Th
14:06:57.467 -> [2384][18]===>.!..3
14:06:57.467 -> .jm.i.v."t~....ZY1^.x..0Z.4.{......._F.g|.Th
14:06:57.468 -> [2385][19]===>......._F.g|.Th
14:06:57.468 -> [2386][20]===>..$.g...L.....m6.x..f.Y{.".v.3.3....P....'eAJI.*.>...X..$.,....K.F7].u.z.
14:06:57.469 -> [2387][21]===>P....'eAJI.*.>...X..$.,....K.F7].u.z.
14:06:57.470 -> [2387][22]===>W..X|.....|a.~.:.1..0.t .:>[..)#N..U...?......L.P......]+*....n8.0....Kd?p.Zr.....F..V.v}jc..S'.=.Uxl]...F/..
14:06:57.471 -> [2389][23]===>.?......L.P......]+*....n8.0....Kd?p.Zr.....F..V.v}jc..S'.=.Uxl]...F/..
14:06:57.472 -> [2390][24]===>d?p.Zr.....F..V.v}jc..S'.=.Uxl]...F/..
14:06:57.473 -> [2391][25]===>...+}.|..M.ec...W&.c.`......R[@.
14:06:57.473 -> 5b..Z...9+..."b..X.j..N,...K.<r.
14:06:57.474 -> [2392][26]===>...9+..."b..X.j..N,...K.<r.
14:06:57.474 -> [2393][27]===> ......yd.m$.....d.mY..G.
14:06:57.475 -> i.O..q.@...7.....x....G.7.e~......sJ".pT.v
14:06:57.475 -> [2394][28]===>.....x....G.7.e~......sJ".pT.v
14:06:57.476 -> [2394][29]===>.^,...%.}.o.....@!W0H7.........V....Q#.lkP......to..c>.....c>_#\Oo
14:06:57.478 -> p...j.7.'LYc.C.:;3. d.....G..Dl.@.E..`
14:06:57.478 -> [2396][30]===>Q#.lkP......to..c>.....c>_#\Oo
14:06:57.479 -> p...j.7.'LYc.C.:;3. d.....G..Dl.@.E..`
14:06:57.479 -> [2397][31]===>.7.'LYc.C.:;3. d.....G..Dl.@.E..`
14:06:57.480 -> [2397]lmac set mac0 addr:88:17:89:0d:0e:b0
14:06:57.480 -> acs...
14:06:57.480 -> freq bgrssi ap rx_sync rx_err txcnt txtime => noise factor
14:06:57.636 -> 2412 -93 0 0 10 39 152588 3912
14:06:57.790 -> 2417 -93 0 0 4 36 149884 4163
14:06:57.943 -> 2422 -92 4 5 4 35 150675 4305
14:06:58.098 -> 2427 -94 3 3 3 36 151989 4221
14:06:58.253 -> 2432 -92 2 2 5 35 152793 4365
14:06:58.407 -> 2437 -92 4 4 6 36 150138 4170
14:06:58.560 -> 2442 -92 3 7 9 34 150918 4438
14:06:58.727 -> 2447 -93 5 9 15 36 163305 4536
14:06:58.881 -> 2452 -92 2 3 8 36 151823 4217
14:06:59.035 -> 2457 -93 0 0 14 37 150555 4069
14:06:59.055 -> acs result: freq=2412, nf=3912
14:06:59.055 -> acs done
14:06:59.055 -> [3954]lmac set mac0 addr:88:17:89:0d:0e:b0
14:06:59.055 -> [3955]lmac_bgn_lo_freq_set: 2412
14:06:59.055 -> [40;31m[3957]ieee80211_ap_ioctl:164::set channel 1
14:06:59.055 -> [0m[3957]set ac= 0 aifs= 1 cw_min= 1 cwmax= 3 txop= 0
14:06:59.055 -> [3958]set ac= 1 aifs= 1 cw_min= 1 cwmax= 3 txop= 0
14:06:59.055 -> [3959]set ac= 2 aifs= 1 cw_min= 1 cwmax= 3 txop= 0
14:06:59.055 -> [3959]set ac= 3 aifs= 1 cw_min= 1 cwmax= 3 txop= 0
14:06:59.055 -> [3961]vif2 state WPA_DISCONNECTED -> WPA_COMPLETED
14:06:59.055 -> [3962]add w0 interface!
14:06:59.055 -> JPG start
14:06:59.055 -> [3963]csi_test start,iic init
14:06:59.055 -> [3964]iic init finish,sensor reset & set sensor clk into 6M
14:06:59.055 -> hgdvp_set_baudrate:clock:480000000
14:06:59.055 -> [3968]set sensor finish ,Auto Check sensor id
14:06:59.055 -> [3968]devSensorInitTable = 1804d148 1804d8a8
14:06:59.055 -> [3969]HI708 page0
14:06:59.055 -> [3970]SID: ff, 96, 60, 61,4
14:06:59.055 -> [3970]devSensorInitTable = 1804d348 1804d8a8
14:06:59.055 -> [3971]SID: ff, 63, 86, 87,1
14:06:59.055 -> [3972]devSensorInitTable = 1804d528 1804d8a8
14:06:59.055 -> [3973]SID: ff, de, 66, 67,1
14:06:59.056 -> [3973]devSensorInitTable = 1804b1e8 1804d8a8
14:06:59.056 -> [3974]SID: ff, 9b, 42, 43,0
14:06:59.057 -> [3974]devSensorInitTable = 1804b448 1804d8a8
14:06:59.057 -> [3975]SID: ff, a0, 42, 43,0
14:06:59.058 -> [3976]devSensorInitTable = 1804c088 1804d8a8
14:06:59.059 -> [3977]SID: ff, bb, 66, 67,f0
14:06:59.059 -> [3977]devSensorInitTable = 1804c608 1804d8a8
14:06:59.060 -> [3978]SID: ff, 10, 42, 43,f1
14:06:59.060 -> [3978]devSensorInitTable = 1804b7c8 1804d8a8
14:06:59.062 -> [3979]SID: ff, 9d, 42, 43,f0
14:06:59.062 -> [3980]devSensorInitTable = 1804c308 1804d8a8
14:06:59.063 -> result = 0
14:06:59.063 -> [3981]preset table num:2
14:06:59.064 -> [3981]SID: ff, c0, 62, 63,0
14:06:59.064 -> [3982]devSensorInitTable = 1804af28 1804d8a8
14:06:59.065 -> [3983]SID: 20, 3a, dc, dd,fc
14:06:59.066 -> [3983]devSensorInitTable = 1804ad68 1804d8a8
14:06:59.067 -> [3984]SID: a6, 3, dc, dd,fd
14:06:59.067 -> [3984]devSensorInitTable = 1804cfa8 1804d8a8
14:06:59.068 -> [3985]SID: a6, a6, dc, dd,fd
14:06:59.068 -> [3986]id =a6 num:11 sensor_id = 20a6
14:06:59.069 -> [3986]Auto Check sensor id finish
14:06:59.069 -> [3987]mclk:24000000MHz
14:06:59.069 -> hgdvp_set_baudrate:clock:480000000
14:06:59.070 -> [3987]init:1804cda0 u8Addrbytnum:1,u8Databytnum:1
14:06:59.072 -> [3988]SENSER....init
14:06:59.123 -> [4040]init table num:396
14:06:59.123 -> [4040]SENSR ident ok:480*480
14:06:59.123 -> [4040]csi init start --
14:06:59.123 -> [4041]csi set size ====>480*480
14:06:59.124 -> [4041]csi dvp_size_set
14:06:59.124 -> [4042]csi IRQ init
14:06:59.124 -> [4042]dvpirq_register:1 180177b0 180177b0
14:06:59.125 -> [4042]dvpirq_register:0 1801779c 1801779c
14:06:59.125 -> [4043]vppirq_register:0 18017504 18017504
14:06:59.126 -> [4043]vppirq_register:1 18017948 18017948
14:06:59.126 -> [4044]vppirq_register:2 18017500 18017500
14:06:59.127 -> [4044]vppirq_register:3 1801776c 1801776c
14:06:59.128 -> [4045]vppirq_register:4 18017780 18017780
14:06:59.128 -> [4046]vppirq_register:5 180174f0 180174f0
14:06:59.128 -> [4046]vppirq_register:6 180174e0 180174e0
14:06:59.129 -> [4047]vppirq_register:7 180174d0 180174d0
14:06:59.130 -> [4047]csi IRQ init finish,start get data
14:06:59.131 -> eloop_init:287::start
14:06:59.131 -> user_eloop_run:309::run
14:06:59.134 -> [4051]dns sock :2
14:06:59.134 -> [test] init tcp server: port: 5007
14:06:59.134 -> ---tcp srvsock = 3---
14:06:59.135 -> [4052]ota num:0version:25841
14:06:59.135 -> [4053]OEM AP Default!
14:06:59.136 -> [4053]OEM NET Default!
14:06:59.136 -> [4053]OEM Firmware Default!
14:06:59.136 -> [4054]Camera TX Lib:Dec 1 2023 17:57:29
14:06:59.137 -> [4054]DVP No need Bank Size
14:06:59.137 -> [4055]client multi init
14:06:59.137 -> [4055]csock:4
14:06:59.139 -> [4055]psock:5
14:06:59.139 -> [4056]protoCtx OK!
14:06:59.139 -> [4056]eventCtx OK!
14:06:59.139 -> [4057]videoCtx OK!
14:06:59.139 -> [4057]i4 OK
14:06:59.140 -> g_sensor_init start,iic init:200014bc
14:06:59.140 -> init g_sensor,check id
14:06:59.140 -> addr:1 1 30 32
14:06:59.141 -> SID: ff, 11, 30, 32,f
14:06:59.141 -> addr:1 1 30 32
14:06:59.141 -> SID: ff, 11, 30, 32,f
14:06:59.142 -> addr:1 1 4e 50
14:06:59.142 -> SID: 13, 13, 4e, 50,1
14:06:59.142 -> id =13 num:2
14:06:59.143 -> [4060]*** ADC module info: ADC channel repeat!!!

14:06:59.145 -> [4062]notify local[0/0]!
14:06:59.145 -> [4062]----WIFI_RUN_STATUS111----1
14:06:59.158 -> init table num:20
14:06:59.158 -> [4075][SYS]Capacity GSENSOR
14:06:59.158 -> [4075][SYS]Capacity:0x2
14:06:59.158 -> [4076][SYS]Capacity:0x3
14:06:59.159 -> version_str = HKV41 5
14:06:59.159 -> ----version_str = HKV41B 32
14:06:59.159 -> product_str = BK7231U-XRH-FBPRO
14:06:59.159 -> [4077][TX]Set Vendor: YPC
14:06:59.160 -> [4077][TX]Set Product: BK7231U-XRH-FBPRO
14:06:59.161 -> [4078][TX]Set Version: HKV41B
14:06:59.161 -> [4078]no this event(20005)...
14:06:59.161 -> [4079]scan down.......
14:06:59.289 -> [4206]inteface2 find new bss: b8:f8:53:5c:53:bb-Fios-CGrF5
14:06:59.644 -> [4561]0min:2906 65535 100 100 383
14:07:00.147 -> [5064]notify local[0/0]!
14:07:00.160 -> [5078]custom mem sram:61440
14:07:00.160 -> [5078]freemem:43736
14:07:00.315 -> --------------------
14:07:00.315 -> local:88:17:89:0d:0e:b0
14:07:00.315 -> bios:2, pack:8
14:07:00.315 -> pwr idx: 1
14:07:00.315 -> chip-temperature: 34
14:07:00.315 -> freq:2412, bg_rssi:-87
14:07:00.316 -> cca: -70, -60, -62
14:07:00.316 -> tx: txq:0, ps:0, tx_stat_q:0,
14:07:00.317 -> tx dma:381, total tx:381, retry:0, tx lost:0, tx err:0
14:07:00.318 -> rx: frms:82, data:0
throughput: tx: 14.40 Kbps, rx: 0 bps
14:07:00.318 -> max gain:7
14:07:00.318 -> --------------------
14:07:01.150 -> [6067]notify local[0/0]!
14:07:01.160 -> [6078]custom mem sram:61440
14:07:01.160 -> [6078]freemem:43736
14:07:02.151 -> [7067]notify local[0/0]!
14:07:02.159 -> [7078]custom mem sram:61440
14:07:02.159 -> [7078]freemem:43832
14:07:03.150 -> [8067]notify local[0/0]!
14:07:03.161 -> [8078]custom mem sram:61440
14:07:03.161 -> [8078]freemem:44024
14:07:04.150 -> [9067]notify local[0/0]!
14:07:04.172 -> [9078]custom mem sram:61440
14:07:04.172 -> [9078]freemem:44024
14:07:05.155 -> [10067]notify local[0/0]!
14:07:05.160 -> [10078]ip:101a8c0 freemem:44024
14:07:05.161 -> [10078]custom mem sram:61440
14:07:05.163 -> [10078]freemem:44024
14:07:05.315 -> --------------------
14:07:05.315 -> local:88:17:89:0d:0e:b0
14:07:05.315 -> bios:2, pack:8
14:07:05.315 -> pwr idx: 1
14:07:05.315 -> chip-temperature: 38
14:07:05.315 -> freq:2412, bg_rssi:-88
14:07:05.315 -> cca: -70, -60, -62
14:07:05.315 -> tx: txq:0, ps:0, tx_stat_q:0,
14:07:05.316 -> tx dma:0, total tx:0, retry:0, tx lost:0, tx err:0
14:07:05.317 -> rx: frms:42, data:0
14:07:05.317 -> throughput: tx: 0 bps, rx: 0 bps
max gain:7
14:07:05.317 -> --------------------
14:07:06.151 -> [11067]notify local[0/0]!
14:07:06.161 -> [11079]custom mem sram:61440
14:07:06.161 -> [11079]freemem:44024
14:07:07.150 -> [12067]notify local[0/0]!
14:07:07.162 -> [12079]custom mem sram:61440
14:07:07.162 -> [12079]freemem:44024
14:07:08.150 -> [13067]notify local[0/0]!
14:07:08.162 -> [13079]custom mem sram:61440
14:07:08.162 -> [13079]freemem:44024
14:07:09.150 -> [14067]notify local[0/0]!
14:07:09.162 -> [14079]custom mem sram:61440
14:07:09.162 -> [14079]freemem:44024
14:07:10.150 -> [15067]notify local[0/0]!
14:07:10.162 -> [15079]custom mem sram:61440
14:07:10.162 -> [15079]freemem:44024
14:07:10.315 -> --------------------
14:07:10.315 -> local:88:17:89:0d:0e:b0
14:07:10.315 -> bios:2, pack:8
14:07:10.315 -> pwr idx: 1
14:07:10.315 -> chip-temperature: 40
14:07:10.315 -> freq:2412, bg_rssi:-88
14:07:10.315 -> cca: -70, -60, -62
14:07:10.315 -> tx: txq:0, ps:0, tx_stat_q:0,
14:07:10.316 -> tx dma:0, total tx:0, retry:0, tx lost:0, tx err:0
14:07:10.317 -> rx: frms:42, data:0
14:07:10.317 -> throughput: tx: 0 bps, rx: 0 bps
max gain:7
14:07:10.317 -> --------------------
14:07:11.150 -> [16067]notify local[0/0]!
14:07:11.162 -> [16079]ip:101a8c0 freemem:44024
14:07:11.162 -> [16079]custom mem sram:61440
14:07:11.164 -> [16079]freemem:44024
14:07:12.152 -> [17068]notify local[0/0]!
14:07:12.162 -> [17080]custom mem sram:61440
14:07:12.162 -> [17080]freemem:44024
14:07:12.663 -> [17577]inteface2 find new bss: 78:67:0e:32:a0:08-Verizon_4Z9PNJ
14:07:13.153 -> [18069]notify local[0/0]!
14:07:13.162 -> [18080]custom mem sram:61440
14:07:13.162 -> [18080]freemem:43928
Pressing button alone while powered off:
14:06:00.437 -> [0]40 00 97 00 a8 43 12 a0
14:06:00.437 -> [0]28 e0 00 00 00 00 00 00
14:06:00.438 -> [0]00 00 00 00 00 00 00 00
14:06:00.438 -> [0]88 17 89 0d 0e 2c 76 35
14:06:00.439 -> [0]86 65 89 67 9f 57 00 00
14:06:00.439 -> [0]80 00 bb 02 a0 f7 00 00
14:06:00.439 -> [0]00 15 00 00 08 14 00 00
14:06:00.440 -> [0]00 00 00 00 00 00 0c 00
14:06:00.440 -> [0]00 00 00 40 08 84 40 08
14:06:00.440 -> [0]8c c0 08 8c c0 08 94 00
14:06:00.441 -> [0]06 4b 3f fd 92 ff 04 4e
14:06:00.441 -> [0]f0 00 4f 00 de 01 02 02
14:06:00.442 -> [0]00 ff ff ff 0f b4 04 04
14:06:00.442 -> [0]02 04 04 06 06 1f 00 17
14:06:00.442 -> [0]00 02 3e 00 00 00 00 08
14:06:00.443 -> [0]00 00 00 00 00 30 12 00
14:06:00.443 -> [0]3c 3c 0f
14:06:00.443 -> [0]validity: 1579f00d

14:06:00.449 -> ** hgSDK-v2.5.0.7-25841, app-0, build time:Dec 5 2024 12:06:20 **
14:06:00.449 -> ** libcore v2.5.0.7-26821, build time:Dec 21 2023 11:25:54
14:06:00.449 -> ** libnetutils v2.5.0.7-26821, build time:Dec 21 2023 11:26:09
14:06:00.449 -> ** libcommon v2.5.0.7-26821, build time:Dec 21 2023 11:25:58
14:06:00.449 -> ** libosal v2.5.0.7-26821, build time:Dec 21 2023 11:25:53
14:06:00.449 -> ** libatcmd v2.5.0.7-25927, build time:Nov 6 2023 16:23:19
14:06:00.449 -> ** liblmac v2.5.0.7-26821, build time:Dec 21 2023 11:26:25
14:06:00.449 -> ** libwifi v2.5.0.7-26821, build time:Dec 21 2023 11:26:38
14:06:00.449 -> ------------------------------------------------------------------
14:06:00.450 -> [0] ------- system restart fault -----------
14:06:00.450 -> [0] ---------------------------------------
14:06:00.452 -> [1]freemem:160720
14:06:00.452 -> [1]custom_mem_init:2000c740
14:06:00.452 -> [1]custom mem sram:61440
14:06:00.452 -> [2]skbpool init, total:49396 (0x20037f0c~0x20044000), max per:80%
14:06:00.454 -> [4]syscfg_read OK!
14:06:00.455 -> [4]old cfg_ver:259
Doing random things in the app:
14:08:18.401 -> [83308]Charge Status:0
14:08:51.852 -> LED:1 Control:1 1 100
14:08:51.852 -> Set LED:1 ON
14:08:51.852 -> [116763]Charge Status:0
14:08:51.886 -> LED:1 Control:1 1 100
14:08:51.886 -> Set LED:1 ON
14:08:51.886 -> [116790]Charge Status:0
14:09:00.151 -> LED:1 Control:0 0 0
14:09:00.151 -> LED:1 ON:1
14:09:00.179 -> LED:1 Control:1 0 0
14:09:00.179 -> Set LED:1 OFF
14:09:00.179 -> [125084]Charge Status:0
14:09:01.368 -> LED:1 Control:0 0 0
14:09:01.368 -> LED:1 ON:0
14:09:01.395 -> LED:1 Control:1 1 100
14:09:01.395 -> Set LED:1 ON
14:09:01.395 -> [126300]Charge Status:0
Connecting to WiFi (I believe the app may have been open in the background):
14:08:14.173 -> [79090]custom mem sram:61440
14:08:14.173 -> [79090]freemem:44024
14:08:14.192 -> [79108]notify local[0/0]!
14:08:14.608 -> [79524]lmac_bgn_add_sta: if:1, aid1, addr:6a:88:53:52:cf:f7
14:08:14.608 -> [79525]rc_init: type= 1 mcs_mask= 0x3cc
14:08:14.609 -> [79525]inteface2: sta 6a:88:53:52:cf:f7 connected
14:08:14.609 -> [79526]user_sta_add:6a 88 53 52 cf f7
14:08:14.739 -> [79655]send DHCP_OFFER ...
14:08:14.739 -> [79657]Next IP: 192.168.1.11
14:08:14.740 -> [79657]Assign IP 192.168.1.10 for 6a:88:53:52:cf:f7, flags=0 (next:192.168.1.11)
14:08:15.173 -> [80090]custom mem sram:61440
14:08:15.173 -> [80090]freemem:43488
14:08:15.196 -> [80112]notify local[1/0]!
14:08:15.319 -> --------------------
14:08:15.319 -> local:88:17:89:0d:0e:b0
14:08:15.319 -> bios:2, pack:8
14:08:15.319 -> pwr idx: 1
14:08:15.319 -> chip-temperature: 48
14:08:15.319 -> freq:2412, bg_rssi:-87
14:08:15.319 -> cca: -59, -49, -51
14:08:15.319 -> tx: txq:0, ps:0, tx_stat_q:0,
14:08:15.319 -> tx dma:12, total tx:12, retry:0, tx lost:0, tx err:0
14:08:15.319 -> rx: frms:107, data:96
14:08:15.319 -> throughput: tx: 2.95 Kbps, rx: 5.23 Kbps
14:08:15.319 -> max gain:7
14:08:15.319 -> sta:6a:88:53:52:cf:f7, aid:1, rssi:-34, evm:-25, tx frm type:*0, tx mcs:*2, freq offset:20864
14:08:15.320 -> ifidx:1, MAC:88:17:89:0d:0e:b0

14:08:15.322 -> --------------------
14:08:15.825 -> [80741]send DHCP_ACK ...
14:08:15.825 -> [80742]Assign IP 192.168.1.10 for 6a:88:53:52:cf:f7, flags=0 (next:192.168.1.11)
14:08:15.828 -> [40;32m[80744]EVENT 10007 IGNORED
14:08:15.828 -> [0m[80745]IP Pool:
14:08:15.829 -> [80746] ip:192.168.1.10 - 6a:88:53:52:cf:f7
14:08:16.173 -> [81090]custom mem sram:61440
14:08:16.173 -> [81090]freemem:43488
14:08:16.212 -> [81128]notify local[1/0]!
14:08:17.173 -> [82090]ip:101a8c0 freemem:43488
14:08:17.174 -> [82090]custom mem sram:61440
14:08:17.174 -> [82091]freemem:43488
14:08:17.212 -> [82128]notify local[1/0]!
14:08:18.174 -> [83091]custom mem sram:61440
14:08:18.174 -> [83091]freemem:43488
14:08:18.234 -> [83145]notify local[1/0]!
14:08:18.330 -> [83220]Recv SEQ:221 CMD->ID:1 AckNeed:1 reFlag:0 CMDLEN:0 RECVLEN:12
14:08:18.330 -> [83222]IP add:a01a8c0
14:08:18.330 -> [83222]*******************************************
14:08:18.330 -> [83223]mac:88:17:89:0d:0e:b0
14:08:18.330 -> [83223]->a01a8c0 fist connect
14:08:18.330 -> [83224ip:a01a8c0 0
14:08:18.330 -> [83227]Recv SEQ:221 CMD->ID:1 AckNeed:1 reFlag:0 CMDLEN:0 RECVLEN:12
14:08:18.330 -> [83228]*******************************************
14:08:18.330 -> [83229]mac:88:17:89:0d:0e:b0
14:08:18.330 -> [83229]->a01a8c0 first connect
14:08:18.330 -> [83230]ip:a01a8c0 0
14:08:18.330 -> [83233]Recv SEQ:222 CMD->ID:2 AckNeed:1 reFlag:0 CMDLEN:0 RECVLEN:12
14:08:18.330 -> read license =
14:08:18.330 -> 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x
00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

14:08:18.334 -> [83250]OK=>SN:!
14:08:18.346 -> [83263]New client active:0 0
14:08:18.346 -> hgdvp_close...............................................................
14:08:18.378 -> [83294]pic port:54589
14:08:18.401 -> [83306]Recv SEQ:224 CMD->ID:10 AckNeed:1 reFlag:0 CMDLEN:3 RECVLEN:15
14:08:18.401 -> [83307]Led control:1-1-1-100
14:08:18.401 -> LED:1 Control:1 1 100
14:08:18.401 -> Set LED:1 ON
14:08:18.401 -> [83308]Charge Status:0

Firmware Extraction
To extract the firmware (and I do apologize, I'm doing recalling this from memory so it may not be perfect) I went ahead and used an STM32 blue pill board and followed https://www.elektroda.com/rtvforum/topic4120455.html to get the flash programmer set up.
Once your stm32 is flashed, connect A1 to PA10 (labeled CLK), A5 to PA9 (labeled TMS), and G to GND. Additionally, if you want to read UART output from the device, connect your UART reader to GND and DP (This is the mcu's TX pin, connect to your RX pin).
Then, follow the instructions https://www.elektroda.com/rtvforum/topic4123724.html regarding how to generally dump or flash the firmware (although I have not attempted anything besides reading).

Whenever you interface with the chip, you need to hold the button on the board, then hit read (or otherwise connect the cklink to the target). You may need to do this quickly after hitting the button and it may be somewhat finicky, I would recommend just trying out and seeing what works.

Note: When I attempted to read the flash, I was never able to in one full go and instead had to do 0x0-0x50000 then 0x10000 increments up to 0x100000 which is the size of the mcu (1 MB), I then merged these files back together into one. I'm unsure why but I assume it's to do with the STM32 being used as the CKLink, I may recommend using an official or clone devices. Thank you divadiow for letting me know that this was due to me reading at too fast of an ICE clock speed, I believe I had been dumping it at 12000KHz, lowering this down to 1200KHz as mentioned in the article solves this for me.

It also appears there's some type of licensing? I'm not sure what exactly it is but I've seen it while reversing the mobile app as well.

I've gotten this far btu I'm not really sure where to go from here, I would like to be able to disassemble the firmware in something like Ghidra or IDA but as the https://occ-oss-prod.oss-cn-hangzhou.aliyuncs.com/cop-image-prod/resource/420257228264570880/1577083169449/C-SKY+ABIV2+Standards+Manual.pdf is not implemented in just about anything I'd have to implement it myself which I don't really want to do... I've attached the csky-elfabiv2-tools-x86_64-minilibc-20210423 but I'm not sure it's actually the right one for this chip, as well as the objdump output from running it on the full firmware file

I'll mention that as you might be able to tell this is my first post so I if you have any tips for better posting please let me know! 😄
AI: Could you clarify what your main goal is with the firmware analysis—are you looking to unlock features, patch the firmware, do security research, or just understand how the device works?
The mobile interface seems to have an upload firmware option for ota updates. Ideally, we'd be able to leverage that to put a custom firmware on it. I'm also interested in analyzing the firmware to find any possible vulnerabilities or issues with it. That being said, I also just like opening things and looking at them.
AI: Are you open to using alternative tools besides Ghidra or IDA for C-Sky V2 disassembly, like radare2, Binary Ninja, or any C-Sky-specific toolchains, or are you set on using Ghidra/IDA only?
Ghidra and IDA would be my ideals, but if I could get anything to properly get an analysis of it that's actually aware of where things are (ex. memory locations like strings) I could work with that.

I think LN pr can be merged.
IR recv works fine.
IR send seems to work fine (esphome IR receives what i sent), but i doubt that anyone would be using it.

There's also LN882H SDK update (the only important thing is wifi lib, 1.5.0->1.6.0).
Plus i added sockets count and idle hook.
https://github.com/openshwprojects/OpenLN882H/pull/22
Shall i merge it into LN8825 pr, or do it in separate one?
I tested it, and nothing is broken.

p.kaczmarek2 wrote:

The issue with devices not booting is known, but we don't have final solution yet. Of course, restoring flash backup should work. Otherwise we might need to try to reproduce it ourselves, maybe with variable power supply and investigate which part of flash breaks, exactly. Do you have variable power supply, @divadiow ?

1.18.171
OK trying. CB3S module only.

-cuts out at 2.0-2.05v down from 3.3v
-will initialise wifi at 2.05v but lower = freeze at:

Info:MAIN:Time 5, idle 188179/s, free 79320, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Registered for wifi changes
Info:MAIN:Connecting to SSID [test]
wpa_supplicant_scan
wpa_drv_scan
wpa_send_scan_req
ht in scan
scan_start_req_handler

-at 1.8v it'll boot to his point

Info:MAIN:###### safe mode activated - boot failures 5
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 2 changes count.
Info:MAIN:Main_Init_Before_Delay done
Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Main_Init_Delay
bandgap_calm_in_efuse=0x67
[load]bandgap_calm=0x67->0x27,vddig=4->5
[FUNC]rwnxl_init
tx_txdesc_flush
[FUNC]intc_init
[FUNC

or

Main_Init_Delay
bandgap_calm_in_efuse=0x67
[load]bandgap_calm=0x67->0x27,vddig=4->5
[FUNC]rwnxl_init
tx_txdesc_flush
[FUNC]intc_init
[FUNC]calibration_main
gpio_level=1,txpwr_state=15
user define rfcali mode:1
get rfcali_mode:1

-it'll still POST to a point at 1.75v
-no POST at 1.7v

not managed to kill it yet though. ~30 reboots. not all at lowest voltage. apply enough voltage and I can still join safe mode AP

More specifically, IO0 must be connected to ground during boot. If you turn on the ESP and it's already walking, then bridging IO0 to ground won't do anything. I usually:
- I either bridge IO0 to ground before connecting it to the power supply
- or I bridge IO0 to GND and then perform a reset by short-circuiting RESET to GND for a while

Added after 41 :

By the way, here's the footage:
https://www.elektroda.pl/rtvforum/topic4095025.html .

Hello.
Here I will present a quick test and teardown of the Tuya TH06 LCD clock/thermometer/hygrometer powered by USB. I will briefly explain how to pair with the phone, show the functionality of the mobile application, and then I will proceed to tear down part, and last, but not least, I will describe the reverse engineering process of its UART communication protocol. The UART protocol turns out to be not human-readable because it's binary, but I will explain how to handle that and extract information about the date and time.

Purchase of a TH06 calendar / thermometer / hygrometer
This product is available in many stores, including on Alie ~, but I bought it myself on a slightly different website for about 20$ - PLN 80:

Offer name (use this to search for this product):
Tuya WIFI Temperature Humidity Smart Sensor Clock Digital Display Remote Control Thermometer Support Alexa Google Assistant - Type A
It can also be easily found under the entry "TH06":

Parameters according to the seller:

Quote:

ABS material
Power Supply
DC 5V / 1A
Wi-Fi Support
2.4G IEEE 802.11 b / g / n
Temperature Measure Range
0 ? -60 ?
Temperature Accuracy
? 1 Humidity
Measure Range
0% RH ~ 99% RH
Humidity Accuracy
? 1% RH
Weight 45.8g
Size 65 * 65 * 17mm / 2.5 * 2.5 * 0.6in

Promotional graphics illustrate its operation (and information that it provides in the phone application):




Sellers emphasize that the product is available in two versions. The second, black version, additionally supports IR control and is called S09:



Related Topics
I have already written a few topics about WiFi products based on ESP (or similar systems). I mainly do teardowns there.
I also describe the process of programming such a switch and using it with the manufacturer's application (Blitzwolf, SmartLife, Tuya, eWeLink) or Tasmota.
I recommend that you familiarize yourself with these topics, I will not repeat all the information several times and as a rule, they apply to all products of this type.
(Warning: not all of those topics are translated to English right now but I am working on it)
List below:
- https://www.elektroda.pl/rtvforum/viewtopic.php?t=3736876&highlight=
- https://www.elektroda.pl/rtvforum/topic3687040.html#18652154
- https://www.elektroda.pl/rtvforum/topic3729892.html
- https://www.elektroda.pl/rtvforum/topic3728094.html
- https://www.elektroda.pl/rtvforum/viewtopic.php?t=3749207&highlight= (similar switch, but without RF and description of programming it in Arduino via cables)
- https://www.elektroda.pl/rtvforum/viewtopic.php?t=3769864&highlight= (this time programming via WiFi, no need to open the housing, no soldering of cables)
- https://www.elektroda.pl/rtvforum/viewtopic.php?t=3793509&highlight= (an interesting switch, which is implemented on the thyristor, not on the relay, but also has ESP8285 inside)
- https://www.elektroda.pl/rtvforum/topic3798114.html (interesting LED strip driver on MOSFET and WB3S transistor)
- https://www.elektroda.pl/rtvforum/viewtopic.php?t=3804553&highlight=
- https://www.elektroda.pl/rtvforum/topic3771510.html (sensor based on the XR809 / XR2 module)
- https://www.elektroda.pl/rtvforum/viewtopic.php?t=3806769&highlight= (a detailed description of how to create your own batch for the door sensor on the XR809)
Additionally, the topic about Tasmota and the DIY version of the WiFi relay:
- https://www.elektroda.pl/rtvforum/viewtopic.php?t=3760371&highlight=
Additionally, I recommend my topic about Home Assistant (which can control a collection of such devices):
https://www.elektroda.pl/rtvforum/viewtopic.php?t=3777098

Kit contents, first impression
The set came in a flat box:

Product code: SKUH77374
The product model (TH06) is also printed on the packaging.
Contents (USB cable is included, but it's a power-only cord, without Data lines):

There is a micro USB connector on the back, device has no batteries, it must be constantly connected to USB 5V in order to work. This flap is just a leg:

There is also a RESET button:

The product does not remember the date / time after it is turned off. The current time is taken by the WiFi network from Web. It needs to be paired beforehand, so you need to use your phone and the SmartLife application.

Pairing is very simple, I have already covered it many times in this series. According to the instructions, we press RESET longer, we provide information about our WiFi in the app ...:

Added (the temperature shows high, because I heated it with a lamp to check the reaction time - it is quite fast):


Android application and its possibilities
I have already described it several times, so here I just emphasize that the application offers a really wide range of possibilities for creating automation and work scenarios. We can trigger events with temperature, humidity, and even (I don't know why) by changing the format of the displayed temperature (F or C). We can condition events with the current time of the day, with the states of other devices, etc.
We have AND and OR logical operations available, we have delays.
Below is a collection of application screenshots:




Also, of course, there is history and charts:



Power consumption from USB
The display current consumption is not high. USB Doctor was unable to record it at all:

For this reason, I measured it with a multimeter. During operation (after downloading the date from the Internet) it fluctuates between 20mA and 30mA:

The average output is 0.15W (+ power supply losses).

Similar product but battery powered
It is worth noting that if we do not want to display the current date, we have many different options to choose from, they can be easily found under the entry "tuya lcd thermometer" and the like:

This round one, TS0201 RSH-Z-Bee-HS01, is on the Zigbee, I've already described it:
https://www.elektroda.pl/rtvforum/topic3806108.html

Interior of the TH06
The housing is latched. It must be undermined:

There is quite a lot of electronics inside:

The heart of the device is the Tuya WB3S WiFi module:

Unfortunately, it is not based on ESP. We will not be able to upload Tasmota (although you can convert it to ESP12F, desolder and solder ESP ...)
The WB3S is based on the 32-bit BK7231T. WB3S offers 1T1R WLAN module, 256-KB SRAM, 2MB flash memory and rich peripherals.

However, the WB3S itself does not support this device. Next to it is a chip in SOIC that looks like a microcontroller, but unfortunately is not signed.

In addition, we have the LCD driver, TM1621B:

The production system of Titan Micro Electronics. It is powered with the voltage of 2.4-5.2V. Here in the SSOP48 housing. Supports a display up to 32 by 4 segments.
Internal diagram:

Pin Roles:

Of course, there is also a temperature / humidity sensor on the board. This is a very popular AHT10:

Communication with AHT10 takes place via I2C:

AHT pins:

The AHT10 can also be purchased as a separate module. It can be easily used, for example, with Arduino.

Next to AHT10 you can see a transistor signed A19T.
Maybe it's AO3401? I can see it is very popular:


This transistor is probably some part of the AHT10 circuit, I see a similar element on the modules with it.
There is of course also the power section. The characteristic large element marked 4R7 is a choke (not a resistor), it proves that there is a step down converter that converts 5V to 3.3V for the WB3S. There is also no LDO regulator in the vicinity, which also confirms the presence of a step down converter. The step down converter is more efficient than the regulator.

The step down controller is signed A121.
It's probably SY8008A / SY8008B / SY8008C. I can see that someone from the Radiokot forum was already looking for it.
It is a highly efficient, synchronous step down converter:

Pinout top view:

Sample application and charts showing efficiency:

It is also worth noting that the manufacturer has placed a large low ESR electrolytic capacitor.
Only the button remains (I do not know what these unpopulated place under Q2, Q3 are for):

Now a glance from the front.
This protruding part of the WB3S module is not a coincidence. This is where the antenna is on the board. It shouldn't be covered:

Tuya strongly recommends not to cover the antenna with a PCB. This would reduce the range / quality of the WiFi signal:

There is also a place for a mysterious element with three pin, which in my opinion would undoubtedly be an IR receiver:

So probably the second version of this product with IR uses the same board, but has an additional receiver soldered here.



Reverse engineering of the UART protocol with TH06
Inside we probably have a microcontroller that communicates with WB3S via UART. This is a fairly common solution in this type of product.
Let's try to get to know their communication protocol.
I started by locating the UART pins. That's not a problem, we have the WB3S documentation:

The picture with the leads is a view from the bottom, so looking from above we have to mirror it in our mind.
I also tracked the pins on the board:

Both RX and TX go to unknown microcontroller circuits, which is all as expected.
I soldered the cable to the TX to see what the WB3S was sending. If we wanted to replace WB3S with another module, e.g. ESP12F, we would also have to send it:

On the other hand, I led the signal to the RX of the UART adapter.
Of course, there must also be a common ground, so I also connected GND from the UART adapter.
On the computer I used RealTerm and checked roughly the more popular baud rates, hoping that the communication protocol is text.
Unfortunately, no success.

Communication appears to be binary. Although I was still considering that it is a text, but it has been scrambled with, for example, XOR before sending.
In order to finally check what the baud is, I used an oscilloscope. All you need is a single trigger and the trigger set appropriately for the oscilloscope to catch the beginning of the signal and we get:

One bit is 104us ... that's enough information for us. We can calculate baud now.
(by the way, this Rigol has the possibility to unlock the RS232 debug mode in a certain versions, but I have not tested it yet, but it should be able to automatically read the byte values from UART signal)
Baud is the number of bits per second.
1s / 104us = approximately 9600 baud.
We can also prepare a look up table beforehand to make time conversion to baud easier:
Time Baud 833us 1200 416us 2400 208us 4800 104us 9600 69us 14400 52us 19200 34us 28800 26us 38400 17us 57600 8us 115200
The results here are a bit rounded, if you get 108us it doesn't mean you have to count exactly and expect 9615 baud.
Equipped with the information that the baud is really 9600, I checked the communication again, this time saving the received data to a file:

In Realterm, you can save captured data to a file via the Capture tab.
I opened the file with my favorite hex editor, xvi32, which is available for free:

XVI32 has a convenient 'data inspector' that allows you to view the data value interpreted as word, dword or float.
You can see a repeating pattern in the data. Could it be packages?

The packages, however, are of different lengths. In order to facilitate further analysis, I wrote a C program to read in the data and verify whether there is a pattern repeating there.
I started by loading the file:

#include
typedef unsigned char byte;
#include

int main() {
FILE *f = fopen("C:/capturebin.txt","rb");
fseek(f,0,SEEK_END);
int len = ftell(f);
byte *d = (byte*)malloc(len+1);
fseek(f,0,SEEK_SET);
fread(d,len,1,f);
d[len] = 0;

fclose(f);

return 0;
}

Then I made a loop iterating through it byte by byte and detecting the section header:


for(int p = 0; p < len; ){
byte *at = d + p;
if(at[0] == 'U' && at[1] == 170) {
printf("Section at %i\n",p);


} else {
p++;
}


}

Then I added skipping section data. As it turned out, after the section header (two bytes, U and the value 170) there are another two bytes which probably indicate the type of section. Depending on the type of section, different data is included in the package.


for(int p = 0; p < len; ){
byte *at = d + p;
if(at[0] == 'U' && at[1] == 170) {
printf("Section at %i\n",p);
short type = *((short*)(at+2));
if(type == 0){
p += 7;
} else if(type == 9216) {
p += 8;
} else if(type == 7168) {
p += 15;
} else if(type == 11008) {
p += 8;
}
else
{
p++;
}
} else {
printf("Unknown section at %i of %i\n",p,len);
p++;
}
}

The above code correctly goes through the entire file (except for one glitch a bit further in its content, but probably because of moving the cables from the UART).
I then decided to write particular package data to separate files in some easy-to-understand form. Each package from a new line.



#include
typedef unsigned char byte;
#include

void dbgprntf(FILE *f, int p, byte *d, int s) {
for(int j = 0; j < s; j++){
fprintf(f,"0x%02x(%i) ",d[p+j],(int)d[p+j]);
}
fprintf(f,"\n\r");
}
int main() {
FILE *f = fopen("C:/capturebin.txt","rb");
fseek(f,0,SEEK_END);
int len = ftell(f);
byte *d = (byte*)malloc(len+1);
fseek(f,0,SEEK_SET);
fread(d,len,1,f);
d[len] = 0;
FILE *f0 = fopen("D:/res1.txt","w");
FILE *f1 = fopen("D:/res2.txt","w");
FILE *f2 = fopen("D:/res3.txt","w");
for(int p = 0; p < len; ){
byte *at = d + p;
if(at[0] == 'U' && at[1] == 170) {
printf("Section at %i\n",p);
short type = *((short*)(at+2));
if(type == 0){
p += 7;
} else if(type == 9216) {
dbgprntf(f0,p,d,8);
p += 8;
} else if(type == 7168) {
dbgprntf(f1,p,d,15);
p += 15;
} else if(type == 11008) {
dbgprntf(f2,p,d,8);
p += 8;
}
else
{
p++;
}
} else {
printf("Unknown section at %i of %i\n",p,len);
p++;
}


}
fclose(f);
fclose(f0);
fclose(f1);
fclose(f2);
return 0;
}

Below is the result from the .txt file, with my comment (column names):

It is very clear which byte is responsible for what. Information about the current year, month, day and time data are sent as separate bytes. The tenth hour is binary 10 (not '1' '0' in ASCII, only 0x0A byte). The other values are similar.
Those repeating 0x01 may be an AM tag.
One of the values here is probably also the pairing indicator and WiFi signal strength indicator.
And the day of the week.
I don't know what the last changing value is, maybe it's some checksum, CRC to validate the packet?
The basis of the protocol is already known. I have not checked the communication the other way around, but it can be done in the same way. If the need arises, I will take care of it, and for now I will stop at this stage. You have the entire methodology of getting to know the protocol.
And of course I know that you could look at XVI32 right away and not play with C processing, but it was so convenient for me and it allowed me to explore the whole thing much easier.

WB3S programming
It is worth mentioning that the process of compiling the SDK for WB3S has already been briefly described by me in the topic about XR809:
https://www.elektroda.pl/rtvforum/topic3806769.html
so it is probably possible to make your own firmware version for it, but more on that later.

Summary
Unfortunately, there are no big revelations here. The current date along with the temperature and humidity on TH06 looks quite aesthetic, but the product also has a lot of disadvantages:
- the product requires a USB power supply (and it is often sold on the same website / offer as products very similar to it, but battery powered)
- the product does not remember the date after losing power (so if there is no electricity in the house and there is no internet, the date will not appear on it)
- the product cannot be changed to a 24h system (but the seller warns against it)
- the product is based on WB3S, there is no ESP inside, so we will not upload our own firmware
As for the pluses, I can praise the product for using a step down converter instead of LDO, always a bit more efficient. And at least the seller gave the USB cable in the set.
I am enclosing catalog notes for the elements inside and related materials, including its manual in PDF format and the UART packages I have collected (but be warned that there is some glitch at the end of the file).
Do you use this type of smart products, and if so, what specific model and in what environment? Zigbee, WiFi, Home Assistant or the manufacturer's application?

boot log from dump w/TuyaMCU emulation using product key 1bnccnulaqx6xerl from dump

V:BK7231N_1.0.1
REG:cpsr spsr r13 r14
SVC:000000D3 00401C1C 000033AC
IRQ:000000d2 00000010 00401e0c ffd5eab6
FIR:000000d1 00000010 00401ffc f7616ff3
SYS:000000df 0040192c 00000158
ST:00000000
J 0x10000
bk_misc_init_start_type 0 0
prvHeapInit-start addr:0x4112b8, size:126280
[Flash]id:0xeb6015
[01-01 18:12:15 TUYA I][lr:0xacdc1] mqc app init ...
[01-01 18:12:15 TUYA I][lr:0xb809b] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:5
[01-01 18:12:15 TUYA D][lr:0xb7f33] Thread:sys_timer Exec Start. Set to Running Stat
[01-01 18:12:15 TUYA I][lr:0xb809b] thread_create name:cmmod,stackDepth:5120,totalstackDepth:9216,priority:4
[01-01 18:12:15 TUYA D][lr:0xaccdb] mq_pro:5 cnt:1
[01-01 18:12:15 TUYA D][lr:0xaccdb] mq_pro:31 cnt:2
[01-01 18:12:15 TUYA D][lr:0xd7197] svc online log init success
[01-01 18:12:15 TUYA D][lr:0xd2935] read m:0 f:0 l:0
[01-01 18:12:15 TUYA I][lr:0xb809b] thread_create name:wk_th-0,stackDepth:5120,totalstackDepth:14336,priority:3
[01-01 18:12:15 TUYA E][lr:0xbc305] wd_protected_read fails gw_bi -23
[01-01 18:12:15 TUYA D][lr:0xbc577] gw base read finish:-23
[01-01 18:12:15 TUYA D][lr:0xd4d1b] ty bt cmmod regist ok:1
dev id key: 16
d4 1d 8c d9 8f 00 b2 04 e9 80 09 98 ec f8 42 7e
adv_data 12
02 01 06 03 02 01 a2 04 16 01 a2 00
rsp_data 30
03 09 54 59 19 ff d0 07 81 03 00 00 0c 00 5f 9f 6e 03 22 00 95 d8 0a f2 87 2e da ac 83 7e
[PLATFORM DEBUG]bt_port_init
[01-01 18:12:15 Tble mac:fc-3c-d7-67-f8-UYA N][lr:0xa8cd1] ble 53
!!!!!!init_type=0
sdk re_inited
[01-01 1 [lr:0xd5t_cmd]
!!!!!!init_type=1
llm_init:312
7c5] [gapm_cmp_evt_handler] bt active init
[01-01 conidx:0,operation:0x1,18:12:15 TUYA N][lr:0xdstatus:0x0
cmd->addr.a4e09] ty bt sdk init sucddr[5] :0
!!!!!!init_tcess finish
[01-01 18:ype=2
[gapm_cmp_evt_ha12:15 TUYA D][lr:0x6140ndler] conidx:0,operatib] < TUYA IOT SDK V:2.3on:0x3,status:0x0
gapm.3 BS:40.00_PT:2.2_LAN:_cmp_evt:GAPM_SET_DEV_CO3.4_CAD:1.0.5_CD:1.0.0 NFIG
gapm_cmp_evt:wait>
< BUILD AT:2023_11_0 GAPM_GEN_RAND_NB
7_14_04_04 BY ci_manage FOR[gapm_cmp_evt_handler] ty_iot_sdk AT bk7231n conidx:0,operation:0x1a,>
IOT DEFS < WIFI_GW:1status:0x0
gapm_cmp_ev DEBUG:1 KV_FILE:0 SHUTt:GAPM_GEN_RAND_NB
[gaDOWN_MODE:0 LITTLE_END:pm_cmp_evt_handler] con1 TLS_MODE:2 ENABLE_CLOidx:0,operation:0x1a,stUD_OPERATION:0 OPERATINGatus:0x0
gapm_cmp_evt:_SYSTEM:2 ENABLE_SYS_RPGAPM_GEN_RAND_NB
[gapmC:0 RELIABLE_TRANSFER:0_cmp_evt_handler] conid ENABLE_LAN_ENCRYPTION:x:0,operation:0x28,stat1 ENABLE_LAN_LINKAGE:0 us:0x0
gapm_cmp_evt:BLEENABLE_LAN_DEV:0 >

_STACK_OK
[PLATFORM NOT[01-01 18:12:15 TUYA D]ICE]STACK INIT OK
ble [lr:0x61415] bk7231n_cocreate new db
ble_env-mmon_user_config_ty:2.1>start_hdl = 0x10
[PLA.17
[01-01 18:12:15 TUYTFORM NOTICE]CREATE DB A N][lr:0xa5155] SetLogOK
ManageAttr 2
adv_state:1
[gapm_cmp_evt_handler] conidx:0,operation:0x1b,status:0x0
adv_actv_idx:0,tx_pwr:0
[PLATFORM DEBUG]UNKNOW EVENT:17
[gapm_cmp_evt_handler] conidx:0,operation:0xa0,status:0x0
[appm_adv_fsm_next] cur adv_state:1
adv_state:2
set data
end adv_state:2
[PLATFORM DEBUG]UNKNOW EVENT:16
[gapm_cmp_evt_handler] conidx:current kv info, addr: 0cnt: 13, is valid: 0
1ed000, cnt: 13, is val[appm_adv_fsm_next] curid: 0
mirror kv info, f000, cnt: 13, is valiaddr: 1cf000, cnt: 13, d: 0
adv_state:3
end is valid: 0
adv_state:3
[PLATFORM DEBUG]UNKNOW EVENT:16
[gapm_cmp_evt_handler] conidx:0,operation:0xaa,status:0x0
[appm_adv_fsm_next] cur adv_state:3
adv_state:6
dvertising]
end adv_st[lr:0xd7c63] init proteate:6
[PLATFORM DEBUG]Ucted data length 460 wrNKNOW EVENT:16
_cnt 13
[gapm_cmp_evt_handler[01-01 18:12:15 TU] conYA N][lr:0xd098b] key_aidx:0,operation:0xa4,stddr: 0x1ee000 block_satus:0x0
[appm_adv_fsmz 4096
_next] cur adv_state:6
adv_state:7
end adv_state:7
[PLATFORM DEBUG]UNKNOW EVENT:16
[01-01 18:12:15 TUYA N][lr:0xd0a5b] get kvs:
0xdb 0xe5 0xf5 0xde 0x2a 0x14 0x41 0x6a 0xbe 0x3e 0xfa 0x8d 0xb6 0x43 0xbe 0xf8
[load]bandgap_calm=0x3e->0x1e,vddig=4->5
IP Rev: ebc6695
tx_txdesc_flush
[FUNC]intc_init
[FUNC]calibration_main
gpio_level=1,txpwr_state=15
get rfcali_mode:1
calibration_main over
temp in flash is:330
xtal in flash is:67
[FUNC]func_init_extended OVER
Version:
tcp_port:62642
app_init finished
[01-01 18:12:16 TUYA N][lr:0x60ef1] mf_init succ
[01-01 18:12:16 TUYA N][lr:0x5caab] file_download_init OK
[01-01 18:12:16 TUYA N][lr:0x59067] recv jump_pack ok.
[01-01 18:12:16 TUYA N][lr:0x58f05] get_dev_info ok memrory left:60512
[01-01 18:12:16 TUYA N][lr:0x57183] attr_cnt:0
[01-01 18:12:16 TUYA N][lr:0x571bf] VER:1.0.0,mcu tp :9
[01-01 18:12:16 TUYA N][lr:0x57209] cfg_mode:0.first_mode:3.firmware_key:key83r5jq9qqeaxt.product_key:1bnccnulaqx6xerl

[PLATFORM NOTICE]bk_rst:0 tuya_rst:0
[01-01 18:12:16 TUYA N][lr:0xbb7e3] Last reset reason: 0
[01-01 18:12:16 TUYA N][lr:0xbb8bf] serial_no:fc3cd767f852
rw_ieee80211_set_country code:
code: CN
channel: 1 - 13
mode: MANUAL
bk_wlan cca closed
[01-01 18:12:16 TUYA N][lr:0xbb8fd] gw_cntl.gw_wsm.stat:1
[01-01 18:12:16 TUYA N][lr:0xc02a5] gw_cntl->gw_wsm.nc_tp:2
[01-01 18:12:16 TUYA N][lr:0xc02ad] gw_cntl->gw_wsm.md:0
[01-01 18:12:16 TUYA N][lr:0xbba55] gw_cntl.gw_if.abi:0 input:0
[01-01 18:12:16 TUYA N][lr:0xbba63] gw_cntl.gw_if.product_key:1bnccnulaqx6xerl, input:1bnccnulaqx6xerl
[01-01 18:12:16 TUYA N][lr:0xbba6d] gw_cntl.gw_if.tp:9, input:9
[01-01 18:12:16 TUYA N][lr:0xbba7d] gw_cntl.gw_if.firmware_key:key83r5jq9qqeaxt, input:key83r5jq9qqeaxt
[01-01 18:12:16 TUYA N][lr:0xd4ecb] ty bt upd product:1bnccnulaqx6xerl 0
[PLATFORM DEBUG]ssid:SmartLife-F852 key: channel: 6
MM_RESET_REQ
tx_txdesc_flush
ME_CONFIG_REQ
ME_CHAN_CONFIG_REQ
MM_START_REQ
[csa]csa_in_progress[0:0]-clear
hapd_intf_add_vif,type:3, s:0, id:0
apm start with vif:0
me_set_ps_disable:842 0 0 1 0 0
[01-01 18:12:16 TUYA E------beacon_int_set:100 TU
set_active param 0
[msg]APM_STOP_CFM
update_ongoing_1_bcn_update
vif_idx:0, ch_idx:0, bcmc_idx:1
update_ongoing_1_bcn_update
enter low level!
mac fc:3c:d7:67:f8:53
leave low level!
net_wlan_add_netif done!, vif_idx:0
uap_ip_start

configuring uap(with IP)def netif is sta
][lr:0x61279] data is invalid :2 ,0
[01-01 18:12:16 TUYA N][lr:0xa8bef] update bound stat:0
dev id key: 16
05 9d 39 b6 1e 33 13 80 33 f9 b7 87 e2 d8 81 60
adv_data 28
02 01 06 03 02 01 a2 14 16 01 a2 00 31 62 6e 63 63 6e 75 6c 61 71 78 36 78 65 72 6c
rsp_data 30
03 09 54 59 19 ff d0 07 01 03 00 00 0c 00 93 95 b5 5e 0a 6c 78 a9 77 4c 7b 21 83 ab 41 4d
[PLATFORM DEBUG]bt rst adv
adv_state:12
[gapm_cmp_evt_handler] conidx:0,operation:0xa9,status:0x0
[appm_adv_fsm_next] cur adv_state:c
adv_state:13
end adv_state:d
[PLATFORM DEBUG]UNKNOW EVENT:19
[PLATFORM DEBUG]UNKNOW EVENT:16
[gapm_cmp_evt_handler] conidx:0,operation:0xaa,status:0x0
[appm_adv_fsm_next] cur adv_state:d
adv_state:7
end adv_state:7
[PLATFORM DEBUG]UNKNOW EVENT:20
[PLATFORM DEBUG]UNKNOW EVENT:16
[01-01 18:12:16 TUYA N][lr:0xa89e1] ble adv && resp changed
temperature_type=2
temp_code:19 - adc_code:343 - adc_trend:[13]:330->[12]:340
[01-01 18:12:17 TUYA N][lr:0x578d5] wifi status is :2
[01-01 18:12:19 TUYA N][lr:0x565f1] send heat beat ,get heap size 46688
[01-01 18:12:19 TUYA N][lr:0x59067] recv jump_pack ok.
[01-01 18:12:34 TUYA N][lr:0x565f1] send heat beat ,get heap size 46688
[01-01 18:12:34 TUYA N][lr:0x59067] recv jump_pack ok.


dpIDs/schema
{
"result": {
"model": {
"modelId": "efcm68",
"services": [
{
"actions": [],
"code": "",
"description": "",
"events": [],
"name": "默认服务 (Default service)",
"properties": [
{
"abilityId": 1,
"accessMode": "rw",
"code": "switch_1",
"description": "",
"extensions": {
"iconName": "icon-dp_power2",
"attribute": "165"
},
"name": "开关 (Switch)",
"typeSpec": {
"type": "bool"
}
},
{
"abilityId": 102,
"accessMode": "ro",
"code": "mechanic_lock",
"description": "",
"name": "机械挂锁 (Mechanical lock)",
"typeSpec": {
"type": "bool"
}
},
{
"abilityId": 103,
"accessMode": "rw",
"code": "remote_lock",
"description": "",
"name": "远程锁定 (Remote lock)",
"typeSpec": {
"type": "bool"
}
},
{
"abilityId": 104,
"accessMode": "ro",
"code": "local_lock",
"description": "",
"name": "手动模式 (Manual mode)",
"typeSpec": {
"type": "bool"
}
}
]
}
]
}
},
"success": true,
"t": 1765436383603,
"tid": "f891b84dd65e11f0bfd7de116888fc39"
}


{
"result": {
"active_time": 1765436273,
"bind_space_id": "263966187",
"category": "dlq",
"create_time": 1765436273,
"custom_name": "",
"icon": "smart/icon/ay1572417367195I1zWH/2f80ffcc43e339f3f80706741d7e40e8.jpg",
"id": "bf65a4b4940cc1c0947gm5",
"ip": "90.241.68.226",
"is_online": true,
"lat": "0",
"local_key": "v@E*1{{]ZAj+kGmm",
"lon": "0",
"model": "",
"name": "R3_WIFI3",
"product_id": "1bnccnulaqx6xerl",
"product_name": "R3_WIFI3",
"sub": false,
"time_zone": "+00:00",
"update_time": 1765436277,
"uuid": "8e633d4cafcec9db"
},
"success": true,
"t": 1765436521805,
"tid": "4b07efb2d65f11f0bfd7de116888fc39"
}

rogeros wrote:

HAL_UART_Receive_IT(&huart2, &Received, 1);

Should the HAL_UART_Receive_IT function be sure to pass the pointer address to the UART_HandleTypeDef structure?

I wonder if we could create our own small "TuyaMCU simulator" that would run inside a C++ class that could be used for two purposes, first, for self-testing OBK in simulator (without any hardware), and then, for testing physical WiFi module with simulated MCU.

New device flashed (BK7231N)
Theres no module, they develop the pcb with the BK7231N, its hard to find the pinout, but i found it.
Novadigital 1 way smart switch
attached the original fw

CONNECT ALL UART
3.3, GND, TX , RX
short cut fast CEN to GND

PINOUT
P6 = CEN
P5 = RX
P4 = TX
P1 = GND
C8 = 3.3

photos




--------------
JSON
--------------
{
"rl1_lv":"1",
"on_off_cnt":"10",
"onoff_rst_m":"1",
"onoff_clear_t":"10",
"rand_dpid":"42",
"net_trig":"2",
"onoff_n":"3",
"netled1_lv":"0",
"jv":"100",
"onoff_rst_type":"2",
"total_bt_pin":"8",
"nety_led":"2",
"total_stat":"0",
"reset_t":"5",
"netled1_pin":"6",
"remote_add_dp":"49",
"remote_list_dp":"50",
"net_type":"0",
"inch_dp":"44",
"rf_width":"359",
"module":"CBU",
"ch_cddpid1":"9",
"remote_io":"23",
"onoff1":"14",
"clean_t":"5",
"init_conf":"38",
"zero_select":"0",
"onoff_type":"0",
"series_ctrl":"0",
"total_bt_lv":"0",
"cyc_dpid":"43",
"remote_select":"1",
"ch_num":"1",
"rl1_pin":"15",
"netn_led":"2",
"ch_dpid1":"1",
"crc":"10"
}



--------------
TEXT
--------------


Device configuration, as extracted from Tuya:
- Pair/Toggle All Button on P8
- WiFi LED on P6
- RF Remote on P23
- TglChannelToggle (channel 1) on P14
- Relay (channel 1) on P15
Device seems to be using CBU module, which is using BK7231N.
And the Tuya section starts, as usual, at 2023424

Go to safe mode (quick reset 5 times) and disable powersave

.
.

I found a schematic of the BP2958X, it appears that it communicates over PWM with the CBU.

BP2958X circuit description:

1. brand name
Jingfeng Mingyuan

2 Circuit description
The BP2958D/BP2958F is a precision LED driver with constant current in a step-down configuration. It supports both PWM input dimming and full analogue dimming control mode, making it ideal for smart LED lighting applications, free of strobe effect and noise.

The BP2958X series provides excellent dimming linearity and high output current stability. It can be used in non-isolated step-down LED power supplies with a wide input voltage range (85-265 V AC). The BP2958X chip integrates a high-voltage start-up circuit and a 500 V power transistor, so no additional VCC capacitor or auxiliary windings are required. The minimal number of peripheral components enables very good current stabilisation performance, while reducing the cost and size of the overall system.

Inside the BP2958X chip is a high-precision current sampling circuit, which guarantees accurate maintenance of constant output current for the LEDs and excellent supply voltage stabilisation. In addition, the chip is equipped with a number of protection features, including broken circuit (open LED) protection, LED short circuit and thermal regulation. The BP2958X comes in a DIP7 housing.

3 Features

Supports analogue dimming from 1-100%
Full analogue dimming without strobe effect
No need for a start-up resistor and VCC capacitor
Integrated 500 V power transistor (lamp)
Accuracy of LED output current: ±5%
Open-circuit protection (LED)
LED short-circuit protection
Thermal regulation
DIP7 housing

4 Applications

LED ceiling light
LED bulb lighting
Other types of LED lighting

U1 circuit is BP2525

that's a TuyaMCU device so you'll not be setting assignments in the config page but rather running the TuyaMCU driver and setting up dpIDs relevant to your device

Guides and examples:

TuyaMCU flashing, setup and configuration guide - configure dpIDs for Home Assistant
https://www.elektroda.com/rtvforum/topic4038151.html

TuyaMCU protocol - communication between the microcontroller and the WiFi module
https://www.elektroda.com/rtvforum/topic3880546.html

OpenBeken and TuyaMCU dimmer - configuration guide/tutorial
https://www.elektroda.com/rtvforum/topic3898502.html

Extracting DpIDs for TUYA MCU devices
https://www.elektroda.com/rtvforum/topic4021129.html

How to get dpID list of types and values for flashed TuyaMCU devices with OpenBeken
https://www.elektroda.com/rtvforum/topic4049908.html

How to make TuyaMCU device send more data points? Why are dpIDs not sent? Processing by the Wi-Fi...
https://www.elektroda.com/rtvforum/topic4089722.html

Scripting the behaviour of TuyaMCU relay OpenBeken - custom buttons, timers, events, countdown
https://www.elektroda.com/rtvforum/topic4009196.html

Post your factory firmware backup, if you took one and it was taken before/if paired with Tuya app, and we can extract the dpID info too.

hmm. this feels familiar but I can't find the post. It *may* have been change Btn_Tgl for TglChanOnTgl. I can't think of the reasoning for why though

Added after 1 [minutes]:

incorrect. found post. it was the other way round

https://www.elektroda.com/rtvforum/topic4124971.html#21570110

TglChanOnTgl will change on each state change, so it won't work good for touch button. It will toggle first when you begin to touch, and then it will toggle when you lift finger. It's 100% normal. Do not use TglChanOnTgl for touch buttons. It's for old-style bistable switches where they have two states.

I see this is a related topic:
https://www.elektroda.pl/rtvforum/topic4089386.html .
I will answer the title question here, but as for the device itself, it is better to write already in the thread which is https://www.elektroda.pl/rtvforum/topic4089386.html .

Samezrp1 wrote:

I use CH341 for UART tapping, when disconnected it forces the device to go into gas detection alarm and after a while puts the device into off line mode, you can't see it in the app. Probably something wrong with the load on the UART pins.

.
I have not encountered such a problem. Unless there is very complex data there, e.g. in RAW mode, you can also retrieve the dpID from the Tuya API: https://www.elektroda.pl/rtvforum/topic4021129.html .
You can try for principle with this converter what I recommend, possibly also describe how you connect it?

A side thing to check, by the way, is whether this is a normal TuyaMCU device or battery-powered , i.e. is the MCU able to switch off power to the Wi-Fi module and only switch it on to report data to the cloud? Is 3.3V still on the VDD of the Wi-Fi module? Is the Wi-Fi module's VDD connected to the power supply via the MOSFET that the MCU controls?

Samezrp1 wrote:

Can you suggest what programmers you are using to wire up the UART?.

.
I use the ones shown on YT, such as:

.



CH340 with jumper to select voltage level.

Samezrp1 wrote:

.
Do I understand correctly that the TuyaMCUAnalyzer uses two, independent programmers and you can't listen to Tx and Rx independently on one?

.
Generally yes, but if, for example, you know you want to listen to what the app is sending to the MCU when you set the relay state to ON, for example, then just listen to the Wi-Fi TX to MCU RX line.
Similarly, if you want to see how the thermostat reports its temperature, then just listen to the MCU TX -> Wi-Fi RX.
You don't necessarily have to have two pieces at once.
And if you want to do a "whole capture" (not just one operation) then just do separately on the RX and then on the TX, the TuyaMCU is documented on the web, if necessary you can analyse it later so you know what's going on....

I do have changed some things.
Decoded window now as list.
Windows do have a movable splitter
Handling on decoding messages.
Anti flickering
Date filter added.
Layout & font changed.

backup and flash is possible with Easy Flasher in BK7238 mode https://github.com/openshwprojects/BK7231GUIFlashTool

The iRobot Roomba range of hoovers has a well-documented Roomba Open Interface allowing remote control of the hoover. I will present here the details of this interface and demonstrate an example made by us of integrating the device with an external WiFi module, also allowing connection to the Home Assistant. In the way shown here, you can add wireless connectivity to models that do not normally have it.

This modification will also give the possibility of, for example, automatic commands to the hoover at a given time, etc.

This topic was based on the Roomba 780 model, but the solution was also tested on the 500 and 600 series. It is worth mentioning here that not every Roomba model has WiFi from the factory, so it might make sense to play with it...

Source of the table: https://en.wikipedia.org/wiki/Roomba


I made the modification with a colleague from the forum - @DeDaMrAz

The adventure begins, of course, with reading the documentation. Everything is available on the web, which makes the project shown here ideal fun for beginners. No need to play around with reverse engineering, yes https://www.elektroda.pl/rtvforum/topic4035491.html itself https://www.elektroda.pl/rtvforum/topic3991620.html sometimes https://www.elektroda.pl/rtvforum/topic4039890.html .
We start by reading the introduction:

Then we learn the technical details.
So let's consider the connector offered to us by the hoover:

We have here primarily a power supply and a UART serial port. This can be used, but the devil is in the details. The power supply here is far from the 3.3V required by our WiFi module. It would be tempting to put an LDO regulator here, for example an AMS1117-3.3V, but the WiFi module can draw quite a lot of current (even more than 100mA) and the regulator, even allowing for a high input voltage, could heat up. It would be better to proceed more efficiently - find some kind of step-down converter. The choice on the web is wide.
With the UART itself, there is a similar problem - if our WiFi module only supports 3.3V levels and not 5V, you will need to add a logic level converter. But again, this is no problem, there are ready-made modules for everything. Schematic:

(Small note - we connect RX to TX and TX to RX, send to receive and receive to send, unless someone has already swapped the labels in place before....)
Practice:
In the photo above is a CB2S module with BK7231N as we have such in abundance. We run https://github.com/openshwprojects/OpenBK7231T_App on it to be able to encode the UART without programming and compiling the batch.
The specific model of inverters and converters doesn't matter, we used an ADUM1201, which also isolates, but this is not needed here.
Here's a photo from testing, still without CB2S, but with our BK7231 development board (https://www.elektroda.com/rtvforum/topic3973321.html ):

For control, we also have several modes available, including a full mode, "Full Mode". It gives full control of the hoover, but I'll focus on that elsewhere...

Now let's look at the more software side. We have the hardware ready to go. The UART here also has fairly standard settings, baud 115200, parity and stop bits as in most applications I encounter...


You still need to know what to send, and it's surprisingly simple:

Yes, there are not even headers here, no packet lengths, no checksums.... we just send individual bytes. There's not much to discuss here.
It's certainly easy to do this on many platforms, but we chose https://github.com/openshwprojects/OpenBK7231T_App . We already have OTAs, scripts, HA integrations ready there. We have written a simple script to create buttons on the HTTP panel to which we have plugged the upload. We have example scripts in this style on one of our documentation pages, more precisely on https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/autoexecExamples.md .
Into the script we have moved the basic commands responsible for control and operation of the hoover.

startDriver httpButtons

setButtonLabel 0 "ENABLE CONTROL"
setButtonColor 0 ORANGE
setButtonEnabled 0 1
setButtonCommand 0 "uartSendHex 8083"

setButtonLabel 1 "DISABLE CONTROL"
setButtonColor 1 ORANGE
setButtonEnabled 1 1
setButtonCommand 1 "uartSendHex ad"

setButtonLabel 2 "START/STOP"
setButtonEnabled 2 1
setButtonCommand 2 "uartSendHex 87"

setButtonLabel 3 "SPOT"
setButtonEnabled 3 1
setButtonCommand 3 "uartSendHex 86"

setButtonLabel 4 "MAX CLEAN"
setButtonEnabled 4 1
setButtonCommand 4 "uartSendHex 88"

setButtonLabel 5 "SEEK DOCK"
setButtonEnabled 5 1
setButtonCommand 5 "uartSendHex 8f"

setButtonLabel 6 "RESET"
setButtonColor 6 RED
setButtonEnabled 6 1
setButtonCommand 6 "uartSendHex 07"

setButtonLabel 7 "POWER"
setButtonColor 7 RED
setButtonEnabled 7 1
setButtonCommand 7 "uartSendHex 85"

The script creates the following web panel:


Of course the panel is accessible without any problem from a web browser.
It's time to fire up our hoover and see if it still works:

This is the final presentation:

Everything works satisfactorily. That's it for now, but that was just the first part of the topic. In the second I will try to expand on the topic. Among other things, we are planning to:
- parse the log from the device (baud 115200), here is an example fragment:

charger-wakeup
slept for 1 minutes 29 seconds

2011-02-18-1446-L
r3_orion/branches/release-1.0:609 CLEAN

bootloader id: 4716 4A56 B82B FFFF
assembly: 3.8
revision: 1
flash version: 10
flash info crc passed: 1

start-charge: 2011-02-18-1446-L
do-charging-checking-fets @ minutes 7
bat: min 7 sec 32 mV 16059 mA -8 tenths-deg-C 551 mAH 2696 state 1
Charging FET test passed.
do-charging-wait-initial @ minutes 7
bat: min 7 sec 33 mV 16059 mA -16 tenths-deg-C 482 mAH 2696 state 2
bat: min 7 sec 34 mV 16059 mA -8 tenths-deg-C 457 mAH 2696 state 2
bat: min 7 sec 35 mV 16059 mA -8 tenths-deg-C 448 mAH 2696 state 2
bat: min 7 sec 36 mV 16059 mA -8 tenths-deg-C 445 mAH 2696 state 2
bat: min 7 sec 37 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 38 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 39 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 40 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 41 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 42 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 43 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 44 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 45 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 46 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 47 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 48 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 49 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 50 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 51 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 52 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 53 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 54 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2
bat: min 7 sec 55 mV 16059 mA -8 tenths-deg-C 443 mAH 2696 state 2

- improve the current web panel (e.g. change button colours according to device status?)
- add integration with Home Assistant:

Of course I probably also don't need to mention that such a control can also be realised without problems on the ESP, in combination with OTA it can also be a nice toy. We simply used what we have at hand. Now the hoover works from the HA, although it will definitely be useful to get the aforementioned battery parameter reading. All in good time.
Has anyone also tried converting hoovers like this?
PS: Still for the inquisitive - a photo of the hoover without the housing:

You can well see here the mentioned connector we use.

I am attaching the mentioned documentation, all the details of the protocol are described there.

insmod wrote:

don't you already have this device?

negative. only the above sensor

Added after 2 [hours] 42 [minutes]:

cool





uart sniff attached is what the W800 dump is sending from PB6



Tuya firmware doesn't seem to want to talk to I don't think. Connected to PB6/PB16 and OUT is to PB24

[01-01 18:12:15 TUYA Info][mqc_app.c:337] mqc app init ...
[01-01 18:12:15 TUYA Info] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:5
[01-01 18:12:15 TUYA Info] thread_create name:cmmod,stackDepth:4096,totalstackDepth:8192,priority:4
[01-01 18:12:15 TUYA Debug][mqc_app.c:148] mq_pro:5 cnt:1
[01-01 18:12:15 TUYA Debug][mqc_app.c:148] mq_pro:31 cnt:2
[01-01 18:12:15 TUYA Debug][log_seq.c:872] read from uf. max:0 first:0 last:0
[01-01 18:12:15 TUYA Debug] svc online log init success
[01-01 18:12:15 TUYA Info] thread_create name:wk_th-0,stackDepth:5120,totalstackDepth:13312,priority:3
[01-01 18:12:15 TUYA Err][tuya_ws_db.c:324] kvs_read fails gw_bi -1
[01-01 18:12:15 TUYA Debug][ws_db_gw.c:141] gw base read finish:-18
[01-01 18:12:15 TUYA Debug][tuya_bt_sdk.c:84] ty bt cmmod register finish 1
[01-01 18:12:15 TUYA Notice][tuya_ble_api.c:345] ble sdk inited
[01-01 18:12:15 TUYA Notice][tuya_os_adapt_bt.c:219] tuya_hal_bt_port_init

BT mac:286dcdd19db8
port inited
[01-01 18:12:15 TUYA Notice][tuya_ble_api.c:381] ble sdk re_inited
[01-01 18:12:15 TUYA Notice][tuya_bt_sdk.c:125] ty bt sdk init success finish

< TUYA IOT SDK V:2.3.0 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.3_CD:1.0.0 >
< BUILD AT:2021_07_28_00_28_32 BY maht FOR ty_iot_wf_bt_sdk_rtos AT w800 >
IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 SHUTDOWN_MODE:0 LITTLE_END:1 TLS_MODE:2 ENABLE_LOCAL_LINKAGE:0 ENABLE_CLOUD_OPERATION:0 ENABLE_SUBDEVICE:0 ENABLE_ENGINEER_TO_NORMAL:0 OPERATING_SYSTEM:2 ENABLE_SYS_RPC:0 TY_SECURITY_CHIP:0 RELIABLE_TRANSFER:RELIABLE_TRANSFER ENABLE_LAN_ENCRYPTION:1 ENABLE_LAN_LINKAGE:1 ENABLE_LAN_LINKAGE_MASTER:0 ENABLE_LAN_DEV:1 ENABLE_LAN_DEV_MASTER:0 >

[FW]: w800_light_5_rgbcw_v2 | [HW]: TW03_V2.0 | : V0.0.1 (Jun 16 2023 18:58:43) | [PID]: 4ops1avp7zdwhyqu
[01-01 18:12:15 TUYA Notice][tuya_device.c:807] free_mem_size:77824
[01-01 18:12:15 TUYA Debug][tuya_device.c:810] DEBUG MODE
[01-01 18:12:15 TUYA Err][tuya_device.c:2996] get_reset_cnt: [{"fsw_cnt_key":0}]
========>tls_uart_port_init uart1:0
HR_CLK_RST_STA:0x00000000
=======>state_led_output:n7,c0,p0
=======>state_gpio_output: blink n7,c7,p0
=======>state_led_output:n9,c7,p0
APP: TLS_BLE_GAP_EVT_ADAPTER_ON
Starting advertwait ack err
wait ack err
wait ack err
ising
i2c data received PART_ID= 53
i2c data received MANUFAC_ID= ff
wait ack err
GAP procedure initiated: advertise; disc_mode=2 adv_channel_map=0 own_addr_type=0 adv_filter_policy=0 await ack err
wait ack err
wait ack err
dv_itvli2c data received PART_ID= 53
i2c data received MANUFAC_ID= ff
wait ack err
_min=120 adv_itvl_max=120
APP: TLS_BLE_GAP_EVT_ADV_STARTED
wait ack err
wait ack err
wait ack err
i2c data received PART_ID= 53
i2c data received MANUFAC_ID= ff
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
pir_io val=1wait ack err
wait ack err
wait ack err

wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
ld2410_in_io val=0
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
===>HLK Ver:0.0.1
=======>tls WiFi MAC=28:6D:CD:CE:90:78
=======>tls BLE MAC=28:6D:CD:D1:9D:B8
[01-01 18:12:15 TUYA Err][tuya_main.c:221] auth_key Complete !

[01-01 18:12:15 TUYA Err][tuya_device.c:1121] tuya_iot_wf_soc_dev_init :4ops1avp7zdwhyqu,0.0.1
[01-01 18:12:15 TUYA Err][tuya_device.c:2996] get_reset_cnt: [{"fsw_cnt_key":1}]
===>uart_monitor loop start
user_app_handle_task start.
uart send 14
uart rev 0
fast station connect v2:1020
uart send 14
uart rev 0
uart send 14
uart rev 0
uart send 14
NETIF_WIFI_JOIN_SUCCESS
NETIF_IP_NET_UP
[1192]set static done.
uart rev 0
uart send 14
uart rev 0
uart send 30
uart rev 0
[01-01 00:00:01 TUYA Err][mqtt_client.c:1468] ret:1.
uart send 30
uart rev 0
[01-01 00:00:01 TUYA Err][mqtt_client.c:1468] ret:1.
uart send 30
uart rev 0
uart send 30
uart rev 0
wait ack err
wait ack err
wait ack err
i2c data received PART_ID= 53
i2c data received MANUFAC_ID= ff
wait ack err
wait ack err
wait ack err
wait ack err
i2c data received PART_ID= 53
i2c data received MANUFAC_ID= ff
wait ack err
wait ack err
wait ack err
wait ack err
i2c data received PART_ID= 53
i2c data received MANUFAC_ID= ff
wait uart send 30
uart rev 0
ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack ewifi_stat:7,1839
=======>state_led_output:n11,c7,p9
rr
wait ack err
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
=======>auto redo 11
uart send 30
uart rev 0
wait ack err
wait ack err
wait ack err
i2c data received PART_ID= 53
i2c data received MANUFAC_ID= ff
wait ack err
wait ack err
wait ack err
wait ack err
i2c data received PART_ID= 53
i2c data received MANUFAC_ID= ff
wait ack err
wait ack err
wait ack err
wait ack err
i2c data received PART_ID= 53
i2c data received MANUFAC_ID= ff
wait uart send 30
uart rev 0
ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ackuart send 30
uart rev 0
err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
uart send 30
uart rev 0
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
uart send 30
uart rev 0
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
uart send 30
uart rev 0
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
wait ack err
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
Stop advertising
GAP procedure initiated: stop advertising
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
[01-01 00:00:05 TUYA Err] uf_open netcfg_log err 8
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30
uart rev 0
uart send 30

Maybe I should just get the same device

very nice



I did notice this on TX1 on a constant roll

uart rx fifo full
cbuart rx fifo full
suart rx fifo full
uart rx fifo full
]4uart rx fifo full
,uart rx fifo full
uart rx fifo full
15uart rx fifo full
uart rx fifo full
uart rx fifo full
uart rx fifo full
freuart rx fifo full
uart rx fifo full
9euart rx fifo full
uart rx fifo full
b8uart rx fifo full
uart rx fifo full
uart rx fifo full
uart rx fifo full


Added after 5 [minutes]:

2nd sensor


Added after 11 [hours] 38 [minutes]:

XH-WB3S datasheet

Hello, can you be a bit more specific? What does not work? Does it connect to your WiFi when powered from mains?

Are you able to check for the 3.3V presence while it's being powered from mains? Just be sure that you can do that in a safe manner. Mains voltage is deadly dangerous.

Was it working with mains before firmware change?

Maybe, both RTL8711AM and B are in a good enough state.
But, i will still complain about OTA on B.
I got 4 days uptime on a B+bl0937 plug.

Almost all of the modules on screenshot are unsupported.
WBR1D/RTL8720DF is AmebaD.
XR3 - is XR809 module, therefore supported.
RTL8710ECF is AmebaLite, have yet to see it in any device.
I don't know what is inside BW20, datasheet only mentions a RTL8711 without family name. AmebaD+?
BT3L is TLSR8250F512ET32, so either bluetooth or zigbee.

Added after 2 [hours] 59 [minutes]:

Managed to create a uart->tcp bridge driver.
Looks like it works.
ExtraDebug:DRV:5 bytes TCP RX->UART TX: 1AC038BC7E
Info:MAIN:Time 11, idle 0/s, free 112496, MQTT 0(0), bWifi 1, secondsWithNoPing -1, socks 4/21
ExtraDebug:DRV:7 bytes UART RX->TCP TX: 1AC1020B0A527E
Info:MQTT:mqtt_host empty, not starting mqtt
Info:MAIN:Time 12, idle 0/s, free 92144, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 6/21
Info:MAIN:Time 13, idle 0/s, free 101232, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 4/21
ExtraDebug:DRV:8 bytes TCP RX->UART TX: 004221A850ED2C7E
ExtraDebug:DRV:11 bytes UART RX->TCP TX: 0142A1A8582805C1AE247E
ExtraDebug:DRV:4 bytes TCP RX->UART TX: 8160597E
ExtraDebug:DRV:11 bytes TCP RX->UART TX: 7D314321A9542A1989FB7E
ExtraDebug:DRV:13 bytes UART RX->TCP TX: 1243A1A9542A19B049E7E2DC7E
ExtraDebug:DRV:4 bytes TCP RX->UART TX: 82503A7E
ExtraDebug:DRV:12 bytes TCP RX->UART TX: 224021A9072A2DE8595E057E
ExtraDebug:DRV:10 bytes UART RX->TCP TX: 2340A1A9072A159AB77E
ExtraDebug:DRV:4 bytes TCP RX->UART TX: 83401B7E
ExtraDebug:DRV:12 bytes TCP RX->UART TX: 334121A9072A0CB05997EB7E
ExtraDebug:DRV:10 bytes UART RX->TCP TX: 3441A1A9072A15F1287E
ExtraDebug:DRV:4 bytes TCP RX->UART TX: 8430FC7E
ExtraDebug:DRV:12 bytes TCP RX->UART TX: 444621A9072A08805993D67E
ExtraDebug:DRV:10 bytes UART RX->TCP TX: 4546A1A9072A1505697E
Info:MAIN:Time 14, idle 0/s, free 105784, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 4/21
ExtraDebug:DRV:4 bytes TCP RX->UART TX: 8520DD7E
ExtraDebug:DRV:12 bytes TCP RX->UART TX: 554721A9072A37B05980D97E
ExtraDebug:DRV:10 bytes UART RX->TCP TX: 5647A1A9072A15AF307E
ExtraDebug:DRV:4 bytes TCP RX->UART TX: 8610BE7E
This is on WRG1 module (RTL8711AM) wired to EFR32MG21 Zigbee coordinator ZB-GW04 (via rx/tx pins) and connected via zigbee2mqtt.

Added after 8 [hours] 15 [minutes]:

On RTL8710A static ip is wrongly parsed on save
IP=192.168.1.176 (c0 00 00 00)

Mask=255.255.255.0 (ff 00 00 00)

DNS=192.168.1.1 (c0 00 00 00)

GW=192.168.1.1 (c0 00 00 00)

Here's something I've needed for a long time - a dual USB to UART converter, i.e. one USB connector and two serial ports on the output, and this together with the DTR/RTS flow control signals brought out, which can be used, for example, to reset and control the bootloader mode of external devices. The whole thing can be bought for about a dozen zloty, the price depends on the quantity imported and the online shop chosen.

Like the well-known CH340, this chip gives us a choice between 3.3 V and 5 V logic levels. Also in an analogous way, it has one rather serious shortcoming, namely that it cannot provide a sufficiently large current from its 3.3 V pins for many applications, so if we want to run some Wi-Fi modules with it such as the ESP8266, ESP32 or there BK7231, we need to arm ourselves with an external chip with a 3.3 V LDO, such as the AMS1117-3.3 for example.
The CH342 itself is available in tiny housings such as QFN24 (CH342F) and ESSOP-10 (CH342K). The CH342 requires minimal external components to operate.


The main motivation and 'battle test' for this module was to use it to work with https://www.elektroda.com/rtvforum/topic3951016.html , as this chip has two UART ports that are both actively used during firmware development - one is used to display the device activity log and the other for programming. Here are the pictures from colleague @DeDaMrAz :

Unfortunately, however, it was not possible to make the absolute minimum connection, as the Beken would not start without an external 3.3 V supply:


Looks like we're in for an additional 3.3 V LDO hand-soldering to the underside of the board shown. How about finding a module with CH342 and AMS1117-3.3? That would be the best option.
In any case, the UART works fine - the computer immediately sees the COM ports, here for example COM4 and COM7 and we can operate them via Realterm:


In summary , I liked the CH342-based USB-2TTL module very much. Its only downside is the lack of a good LDO on board, which complicates things in some tasks and, for example, makes it difficult to connect the whole thing to a programmable Wi-Fi module. On the other hand, I consider the presence of DTR and RTS lines to be a plus - many cheaper adapters lack this.
Finally, it is worth mentioning that the module is equipped with a modern USB C-type connector, so there is no problem with the orientation of the plug.
Have you used the CH342? What applications do you see for this chip?

https://www.aliexpress.us/item/32568045880987...US%213489641176%21&curPageLogUid=fc42pj50kRIv

Got these in today and found out they have the C2BS chips. First time messing with openbeken, have to say it was pretty simple.

With these, after taking it apart and clamping on the mini alligator clips, I was able to flash with ease. Once you open BK7231 Easy UART Flasher, select the N chip. I left the default flash file it loads when you start the program, wanted to make sure OTA update worked after.
When it says Getting bus... (now, please do reboot by CEN or by power off/on) all I did was hold both power buttons (black buttons) at the same time for close to 10 seconds. The flash program detected it and flashed away.

Below is the extracted data

Device configuration, as extracted from Tuya:
- Button (channel 1) on P24
- WiFi LED on P23
- Relay (channel 2) on P7
- Button (channel 2) on P26
- Relay (channel 1) on P6
Device seems to be using CB2S module, which is using BK7231N.
And the Tuya section starts, as usual, at 2023424

and json data
{
"rl1_lv":"1",
"bt_type":"0",
"bt1_pin":"24",
"net_trig":"4",
"jv":"1.0.3",
"netled1_lv":"1",
"netled_reuse":"0",
"ffc_select":"0",
"nety_led":"0",
"total_stat":"2",
"over_cur":"20000",
"rl_type":"0",
"bt1_lv":"0",
"reset_t":"5",
"netled1_pin":"23",
"chip_type":"3",
"rl2_lv":"1",
"lose_vol":"40",
"over_vol":"240",
"module":"CB2S",
"ch_cddpid1":"9",
"rl2_pin":"7",
"bt2_pin":"26",
"ch_cddpid2":"10",
"ch_num":"2",
"ele_fun_en":"1",
"bt2_lv":"0",
"rl1_pin":"6",
"netn_led":"0",
"vol_def":"1",
"ch_dpid1":"1",
"ch_dpid2":"2",
"crc":"8",
"Bgw_di0)Btls_ca_cntbv":"40.00",
"pv":"2.2",
"lpv":"3.3",
"pk":"keyjup78v54myhan",
"firmk":"keyjup78v54myhan",
"cadv":"0",
"cdv":"1.0.0",
"dev_swv":"1.1.8",
"s_id":"null",
"dtp":"0",
"sync":"0",
"attr_num":"0",
"mst_tp_0":"0",
"mst_ver_0":"null",
"mst_tp_1":"0",
"mst_ver_1":"null",
"mst_tp_2":"0",
"mst_ver_2":"null",
"mst_tp_3":"0",
"mst_ver_3":"null "
}

After rebooting the device, I was able to access the UI page and configure MQTT, showed up quickly in HA. This device does have 2 LEDs for each switch and also has energy monitoring when I had it added in smart life.

I have found no devices like it to apply a configuration profile and I am unsure how to set all that up. Would it be possible to get help from the community to get this configured correctly?

Much appreciated!!!!

check my schematic, what worked very good
https://i.imgur.co m/999GUqv.png

Added after 19 [minutes]:

esphome: name: lscrgbcct friendly_name: LscRGBCCT
bk72xx: board: generic-bk7231n-qfn32-tuyathis is my header

esphome:
name: lscrgbcct
friendly_name: LscRGBCCT

bk72xx:
board: generic-bk7231n-qfn32-tuya
wrote:



and this code; https://devices.esphome.io/devices/LSC-Light-White-and-Color-Ambiance-2578539
cos there is a bp5758d leddriver inside

Oh see, even better solution I thought this write() only ingests byte by by byte, hence the idea of an extra loop etc.

Please write what you are using to communicate with the ESP8266. As I understand it, in the first case it is a PC (terminal) and in the second case some external microprocessor (Raspberry or what ?). In both cases the communication is via RS232 with the ESP8266 module.Is that so?

My guess is that you want to download the predicted weather data via the wether underground service provider API.

Go here https://github.com/squix78/esp8266-weather-station. There you have everything, including the source code.

The query to the server should look like this:

client.print(String("GET ") + url + " HTTP/1.1" + "Host: api.wunderground.com" + "Connection: close");

and as far as I can see you have constructed it correctly, but I don't know if the PSTR function works correctly in this case. It is possible that you have to mark the special characters (\n) somehow.
To check this, just enter the address (not as a variable to convert to string) and see if it works.

Hello
Sometimes a man needs some unusual generator or quartz. You have to wait 2 days or 2 months for an order, and I am too stingy to buy a proprietary generator, so what? You have to do something yourself.
For a long time I had an idea ... Something small, I set the frequencies and I forget.
So I present the generator module project based on the Si5351A chip and the HK32F030MJ4M6 microcontroller.
The generator has 3 outputs with a frequency range of 4kHz ... 112.5MHz and is configurable via the UART interface and the settings are stored in the built-in EEPROM in HK32F030MJ4M6.
Own Soft, written in C.
Power supply 3.3V.



Menu:

'F1', 'F2', 'F3' - frequency configuration
'c' - calibration
'w' - save settings
Baudrate: 115200

Diagram:

When using the newer version HK32F030MJ4M6, the SDA / SCL pins must be switched.
As there was little space on the board, I used a pull-up built into the microcontroller for the SDA ("kids, don't do it at home" :D ).
SCL is push / pull controlled.

Random purchase from Taobao https://kr.world.taobao.com/item/661235058111.htm via Superbuy.com



Bare PCB, no cam, no battery, no case. A9 type PCB size and layout. 18 pin camera connector as seen in other A9s. BK7252UQN68. 2 buttons, 2 LED, one single red the other two-tone blue/green

Markings: SC-10024 v1.0.0



TX1 log at 115200 baud:

BK7251_1.0.1_f
REG:cpsr spsr r13 r14
SVC:0x000000D3 0xE254CFAC 0xFFFD773E
IRQ:0x000000D2 0x00000010 0xC4D15E2C 0x72903CC6
FIR:0x000000D1 0x00000010 0x0DE58C2C 0xFE7CB47E
SYS:0x000000DF 0xD55ABCDD 0x39DFD4F3
ST:0x87390800
J 0x10100
 SHh U
 T + -+ jjjjjj Ě º 
ъ* ݂jjjjjjjjjjR ժ
 T + -+ W iWK 钒ʚ 
‚ jjjjjjjjjj e +  K ‰ jR e +k с ٕ 5R 5 + WH(  + jR ɱ} х} } 5) -  r r jR 5EŪj jR %5E  j 5
IU 2 r r jR4͕    j t ͕Ɂ

jR ښ jm ʺ j j  Ҋ Ғ r  ͕ }ͱ }݅  } ͱ } }݅ ł JJ噽u ѕ ͕с ͽ  5R  j5R ښ jm ʺ j j  Ҋ Ғ r  ͕ }ͱ }݅  } ͱ } }݅ J ɹu 9=Q х 5*  j5RB } } с 5) j  Ҋ Ҋ  U ) ō} 險 jō
J сrrrj  j  Ҋ Ҋ  U 
T E } } } Չ͍ɥ 钢 J }ɕ ѕ } Ʌ} } 5R j  Ҋ Ҋ  
E } } } Չ͍ɥ 钪 j } ɽѽ } 5Rڅ j  Ҋ Ҋ  U 
T E } } } Չ͍ɥ 钲 J } ō} }ɕ ѕ } 5) j  Ҋ Ҋ  U  ō} 銢 j } ɽ ͂  jR  j  Ҋ Ҋ  U 
E } } } Չ͍ɥ 钲 J } ō} }ɕ ѕ } 5Rڅ j  Ҋ Ҋ  U 
T + } 銢 j } ɽ隂  j  j  Ҋ Ҋ  
E } } } Չ͍ɥ 钲 J } ō} }ɕ ѕ } 5R j  Ҋ Ҋ  U 
+ } 銢 j } ɽ隂  jP  j  Ҋ Ҋ  Ue um } } } Չ͍ɥ  ʲ J } ō} }ɕ ѕ } 5R j  Ҋ Ҋ  
+ }  Ţ j } ɽ隂  jR  j  Ҋ Ҋ  U  E } } } Չ͍ɥ  ɲ J } ō} }ɕ ѕ } 5( j  Ҋ Ҋ  Ue um ō}  Ţ j } ɽ ͊  jR  j  Ҋ Ҋ  U 
T E } } } Չ͍ɥ 钺 J }ɕ ѕ } Ʌ} } " 5R j  Ҋ Ҋ  Ue %umչ }ѡɕ 钒  ɕ } ɕ ѕ }ѥ ɱ х  ѡ颂ʲb х х  ѡ颂ʲb ɥ ɥ jR  j  Ҋ Ҋ  Ue %umչ }ѡɕ  ʒ  ɕ } ɕ ѕ r  х  ѡ颂ʲb х х  ѡ Šʒb ɥ ɥ jR  j  Ҋ Ҋ  U  + } 銢 j } ɽ  jR  j  Ҋ Ҋ  U  + } 銢 j } ɽ隊 jR  j  Ҋ Ҋ  U 
T 5ٍ} }  ʪꁚٍ z с Ս 5) j  Ҋ Ҋ  Ue umչ }ѡɕ  ʢ  ɕ }ѥ Ɂᕍ х ѹ с⽁ չ х 5R j  Ҋ Ҋ  Օ
5 Ź ʒ  2 b jR  j  Ҋ Ҋ  Ue %umչ }ѡɕ  ʒ  ɕ } ɕ ѕ r 麭}ѡ b х  ѡ Պ b х х  ѡ Ś b ɥ ɥ jR  j  Ҋ Ҋ  Ue um } }  Β Z }ɕ ́: } jR  j  Ҋ Ҋ  Ue um } } ݹ 銪 :݁ ͕ 2 ͡ j jR  j  Ҋ Ҋ  U  E } }͑ ʒꁢ с ɕ с jR  j  Ҋ Ҋ  Ue um } } 隊 
ف Ʌ  }ɕŁ jR" ف 邊 j D  "   2   * ‚  *   * jR  * JU
T T)))RR HHH]]^X k} } } } 5R х с  r 5R j  Ҋ Ҋ  
ɪ E } }  ٪  ͑ ɕ} ѕ 5Rڅ j  Ҋ Ҋ  U 
T E } } ѥٕ 骒 с
ѥٕ 5R  j  Ҋ Ҋ  U ɪ E } }͑ 銢  с͑ с Ս ́ ͡5R ښ jm 庂j j  Ҋ Ҋ r  } ٥ ɕ} ٥ } ѡŚ J"U ՝u  U 
)  * )$ & )5 r E r 19 r  r r 5E r r  jR  Ŋ
R '&& L %  պ Ų * 2=I } } rrjR ښ jm ʺ j j  Ҋ Ҋ r  } ٥  ɕ} ٥ } ѡ J" ՝u j Ҋr r ڴ j5R ښ jm 庂j j  Ҋ Ҋ r  } ٥ ɕ} ٥ } ѡ Jr ѥ u 2 ɵ݅ɕ 
с = с   Қ Ғ 굴 j5* A1Q=I5 " Uu }  } jR ښ jm 亂j j  Ҋ Ҋ r  } ٥ ɕ} ٥ } ѡŢ Jr ѥ u ѕ ҕ͕с ͽ n mz j5) U9u ݹ } 5R  j  Ҋ Ҋ  U  IU  j r r j jd U }ѡɕ 钢  ɕ m u } ᑕ͍} ͡5R  ᕍ Mх ѹ } ᑕ͍} J bR b Iչ Mх 5) jRD } ᑕ͍} J bR b jRD } ᑕ͍} J bR b ٢jdD } ᑕ͍} J bR b jRD } ᑕ͍} J bR b jP e 5 ˋ } 5) U9u Ʌѥ } 5RjR$ } jR flash txpwr table:0xf
dif g and n20 ID in flash:2
dif g and n40 ID in flash:3
read txpwr tab from flash success
lpf_i & q in flash is:17, 17
xtal in flash is:16
xtal_cali:16
rwnx_tpc_pa_map_init
[FUNC]sdio_intf_init
[FUNC]ps_init
[FUNC]func_init_extended OVER!!!

start_type:0
Initializing TCP/IP stack
tcp_port:55289
bk_wlan_app_init finished
rf_thread_init ok
[01-01 18:12:15 TUYA D][tuya_ws_db.c:450] init fs. Path: null
[01-01 18:12:15 TUYA D][kv_storge.c:46] *****************kvs_init.
[01-01 18:12:15 TUYA N] key_addr: 0x397000 block_sz 4096
[01-01 18:12:15 TUYA N] get key:
0x60 0xc6 0xb3 0xb0 0x82 0x1 0xf0 0x98 0x2c 0x64 0x4 0x65 0xf1 0xb1 0x86 0x86
[01-01 18:12:15 TUYA D][mf_core.c:38] mf_core_init success
[01-01 18:12:15 TUYA I] thread_create name:mf_test,stackDepth:5120,totalstackDepth:18432,priority:4
[01-01 18:12:15 TUYA D] enter Thread:mf_test func call
[01-01 18:12:15 TUYA D][tuya_uart.c:53] buffer size 4160
[01-01 18:12:15 TUYA D] Thread:mf_test Exec Start. Set to Running Stat
[01-01 18:12:15 TUYble name:BK7231BT-01, 3A D] 9:1f:8d:a9:26:40
EM_BLThread:wk_th-0 Exec StarE_END:0xef6
-----rw_mat. Set to Running Statin task init----

BLE Rev: B4-3.0.29-P0
-----rw_main start----
gapm_cmp_evt_handler operation = 0x1, status = 0x0
gapm_cmp_evt_handler operation = 0x3, status = 0x0
[PLATFORM NOTICE]STACK INIT OK
ble create new db
ble_env->start_hdl = 0xa
prf_task_id:120, state:1
[PLATFORM NOTICE]CREATE DB SUCCESS
[01-01 18:12:15 TUYA D][tuya_ble_api.c:543] rev ble event 3
[PLATFORM NOTICE]!!!!!!!!!!tuya_before_netcfg_cb
appm start advertising
gapm_cmp_evt_handler operation = 0x1b, status = 0x0
[01-01 18:12:16 TUYA D][mf_test.c:355] mf thread delete
[01-01 18:12:16 TUYA D] Del Thrd:mf_test
[01-01 18:12:16 TUYA N][tuya_main.c:301] mf_init succ
[1970-1-1 18:12:16.254 tuya_device.c app_init(153) Debug] app_init

[01-01 18:12:16 TUYA D][tuya_main.c:307] gwcm_mode 0
[01-01 18:12:16 TUYA D][tuya_main.c:323] device_init in
[01-01 18:12:16 TUYA N][tuya_peripheral.c:199] ty_gpio pin [6] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:199] ty_gpio pin [18] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:199] ty_gpio pin [24] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:199] ty_gpio pin [26] init success

[01-01 18:12:16 TUYA N][tuya_drv_adc.c:532] adc init =0x900904,0x900818,0x900840. chn=6,7

[01-01 18:12:16 TUYA N][tuya_peripheral.c:199] ty_gpio pin [7] init success

[01-01 18:12:16 TUYA N][tuya_drv_adc.c:532] adc init =0x9008f4,0x900818,0x900840. chn=5,6

[01-01 18:12:16 TUYA N][tuya_peripheral.c:199] ty_gpio pin [6] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:199] ty_gpio pin [4] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:199] ty_gpio pin [2] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:199] ty_gpio pin [19] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:199] ty_gpio pin [7] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:199] ty_gpio pin [2] init success

[01-01 18:12:16 TUYA E] uf_open ipc_param err 8
[1970-1-1 18:12:16.370 user_flash.c user_flash_read(95) Error] uf file ipc_param can't open and read data! use default!
[1970-1-1 18:12:16.382 tuya_led_ctrl.c led_light_mode_set(213) Info] change led status => [8]

[1970-1-1 18:12:16.390 tuya_led_ctrl.c led_light_mode_set(213) Info] change led status => [0]

[01-01 18:12:16 TUYA I] thread_create name:red_led_light_ctrl,stackDepth:1024,totalstackDepth:19456,priority:1
[01-01 18:12:16 TUYA I] thread_create name:blue_led_light_ctrl,stackDepth:1024,totalstackDepth:20480,priority:1
[01-01 18:12:16 TUYA D] min_timer_period :10
[01-01 18:12:16 TUYA D] min_timer_period :10
[01-01 18:12:16 TUYA D][key_proc.c:55] key_proc_init done !!!

[01-01 18:12:16 TUYA I] thread_create name:ty_dev_stat,stackDepth:2560,totalstackDepth:23040,priority:2
[01-01 18:12:16 TUYA D][app_agent.c:413] lan disable
[01-01 18:12:16 TUYA N][tuya_iot_wifi_api.c:276] wifi soc init. pid:keyph8vwhadwsx3a firmwarekey:keyph8vwhadwsx3a ver:1.0.4
[01-01 18:12:16 TUYA D][tuya_svc_upgrade.c:789] tuya svc upgrade init success!
[PLATFORM DEBUG]bk_rst:0 tuya_rst:0
[01-01 18:12:16 TUYA N][tuya_devos_entry.c:1621] Last reset reason: 0
[01-01 18:12:16 TUYA D][ws_db_gw.c:159] gw base read finish:0
[01-01 18:12:16 TUYA D][tuya_tls.c:326] tls register constant a8925d12d72aad39 qvilcBjlyr1hCs3sVCh5PgARuK4R2Ia8 mbVQkug3z502iCDVtkNkj8XOxawMc6jYmT1hI
[01-01 18:12:16 TUYA D][tuya_tls.c:273] tls_ca_cnt:0 and parse:0
[01-01 18:12:16 TUYA N][tuya_devos_entry.c:1110] serial_no:381f8da92640
rw_ieee80211_set_country code:
code: CN
channel: 1 - 13
mode: MANUAL
bk_wlan cca closed
[01-01 18:12:16 TUYA D][ws_db_gw.c:291] gw_wsm read success
[01-01 18:12:16 TUYA N][tuya_devos_entry.c:1141] gw_cntl.gw_wsm.stat:1
[01-01 18:12:16 TUYA D][tuya_devos_netcfg.c:628] <__gw_upd_nc_type> bcustom_mode:0, old_wf_start_mode: 0
[01-01 18:12:16 TUYA N][tuya_devos_netcfg.c:1294] gw_cntl->gw_wsm.nc_tp:2
[01-01 18:12:16 TUYA N][tuya_devos_netcfg.c:1295] gw_cntl->gw_wsm.md:0
[01-01 18:12:16 TUYA D] set_dns_cache_priority:0
[01-01 18:12:16 TUYA D][ws_db_gw.c:454] gw_di read success
[01-01 18:12:16 TUYA D][tuya_devos_entry.c:764] stride from flash: 0.
[01-01 18:12:16 TUYA D][tuya_devos_entry.c:771] no actived, no upgrade:1
[01-01 18:12:16 TUYA N][tuya_devos_entry.c:1195] gw_cntl.gw_if.abi:0 input:0
[01-01 18:12:16 TUYA N][tuya_devos_entry.c:1196] gw_cntl.gw_if.product_key:keyph8vwhadwsx3a, input:keyph8vwhadwsx3a
[01-01 18:12:16 TUYA N][tuya_devos_entry.c:1197] gw_cntl.gw_if.tp:0, input:0
[01-01 18:12:16 TUYA N][tuya_devos_entry.c:1199] gw_cntl.gw_if.firmware_key:keyph8vwhadwsx3a, input:keyph8vwhadwsx3a
[01-01 18:12:16 TUYA D][ws_db_gw.c:579] gw_ai read success
[01-01 18:12:16 TUYA D] set_dns_region:0
[01-01 18:12:16 TUYA D] cache dns [http://a.tuyacn.com/d.json]<->[47.100.118.152]
[01-01 18:12:16 TUYA D] cache dns [https://a3.tuyacn.com/d.json]<->[8.153.105.238]
[01-01 18:12:16 TUYA D] cache dns [m2.tuyacn.com:1883]<->[47.103.41.29]
[01-01 18:12:16 TUYA D] cache dns [m2.tuyacn.com:8886]<->[47.103.41.29]
[01-01 18:12:16 TUYA D] cache dns <->[101.132.62.80]
[01-01 18:12:16 TUYA D][tuya_devos_entry.c:1643] enter success_proc
[01-01 18:12:16 TUYA D][tuya_devos_health.c:37] init watchdog, interval: 60
[PLATFORM DEBUG]tuya_os_adapt_watchdog_init_start
[PLATFORM DEBUG]tuya_os_adapt_watchdog_init_start OK
[01-01 18:12:16 TUYA D][tuya_devos_health.c:318] watch_dog_interval:60, monitor_detect_interval:600
[01-01 18:12:16 TUYA I] thread_create name:health_monitor,stackDepth:1536,totalstackDepth:24576,priority:5
[01-01 18:12:16 TUYA D] del list not empty...deleting
[01-01 18:12:16 TUYA D] Thread:mf_test is still running..
[01-01 18:12:16 TUYA D] Thread:health_monitor Exec Start. Set to Running Stat
[01-01 18:12:16 TUYA D][tuya_devos_health.c:30] feed watchdog
[PLATFORM DEBUG]tuya[01-01 18:12:16 TUYA D]_os_adapt_watchdog_refr[mqc_app.c:144] mq_pro:esh
11 cnt:8
[01-01 18:12:16 TUYA D][mqc_app.c:144] mq_pro:41 cnt:9
[01-01 18:12:16 TUYA D][mqc_app.c:144] mq_pro:100 cnt:10
[01-01 18:12:16 TUYA D][mqc_app.c:144] mq_pro:27 cnt:11
[01-01 18:12:16 TUYA N][tuya_bt_sdk.c:162] ty bt upd product:keyph8vwhadwsx3a 1
[01-01 18:12:16 TUYA N][tuya_ble_api.c:415] upd product_id type:1 keyph8vwhadwsx3a a8925d12d72aad39 qvilcBjlyr1hCs3sVCh5PgARuK4R2Ia8
[01-01 18:12:16 TUYA D][tuya_devos_netcfg.c:1044] nc_tp:2, md:0
[01-01 18:12:16 TUYA D][tuya_devos_netcfg.c:1244] dev_nw_cfg_active_stage:2
[01-01 18:12:16 TUYA D][tuya_iot_wifi_api.c:415] register wifi network monitor. interval:1
[01-01 18:12:16 TUYA D][netcfg_module.c:132] type:0x10002,is_set:0
[01-01 18:12:16 TUYA D][netcfg_module.c:132] type:0x10004,is_set:0
[01-01 18:12:16 TUYA D][netcfg_module.c:132] type:0x10002,is_set:1
[PLATFORM DEBUG]ssid:SmartLife-2640 key: channnel: 6
MM_RESET_REQ
tx_txdesc_flush
tx_txdesc_init: i=0, j=0, ct=1
tx_txdesc_init: i=1, j=0, ct=1
tx_txdesc_init: i=2, j=0, ct=64
tx_txdesc_init: i=3, j=0, ct=4
tx_txdesc_init: i=4, j=0, ct=1
ME_CONFIG_REQ
ME_CHAN_CONFIG_REQ
MM_START_REQ
[csa]csa_in_progress[0:0]-clear
mm_add_if_req_handler:0
hapd_intf_add_vif,type:3, s:0, id:0
apm start with vif:0
------beacon_int_set:100 TU
set_active param 0
[msg]APM_STOP_CFM
update_ongoing_1_bcn_update
mm_set_vif_state_req_handler
vif_idx:0, ch_idx:0, bcmc_idx:2
update_ongoing_1_bcn_update
enter low level!
mac 38:1f:8d:a9:26:41
leave low level!
[net]addvif_idx:0
uap_ip_start

configuring interface uap (with Static IP)def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed
[01-01 18:12:16 TUYA D][ap_netcfg.c:800] start ap success:SmartLife-2640
[01-01 18:12:16 TUYA D][netcfg_module.c:132] type:0x10002,is_set:0
[01-01 18:12:16 TUYA D][netcfg_module.c:132] type:0x10004,is_set:0
[01-01 18:12:16 TUYA D][netcfg_module.c:132] type:0x10002,is_set:0
[01-01 18:12:1  
嫋 } ձ 銚  ł bJ }͕ j  j  Ҋ Ҋ  
k } ձ 隲 r э j ձ х с j  j  Ҋ Ҋ  U 
T 嫋o ս ձ  Ͳ r э ձ х с ł jR  j  Ҋ Ҋ  Ue um } э 
 х ڪ j  j  Ҋ Ҋ  U 
T U }ѡɕ 銒 " b сr с* 幹r" ѥ 5R j  Ҋ Ҋ  U 
U }ѡɕ 銒  Eɕ j }ѕ с ́ ѥ չ jR  j  Ҋ Ҋ  
U }ѡɕ 钢  ɕ 骑 } } *ᕍ Mх ѹ 5с չ Mх 5Rڅ j  Ҋ Ҋ  U 
) U }ѡɕ 钒  ɕ } ɕ ѕ 򅵕 Ց } } ͱ х  ѡ Ϊ¢b х х  ѡ Š b ɥ ɥ jD  j  Ҋ Ҋ  Ue um э } ձ 銊  х с ‚  jR  j  Ҋ Ҋ  U 
T % } э  Ŋ с э х 5) j  Ҋ Ҋ  U ɪ E } } 颚  ѕ  չ х jR  j  Ҋ Ҋ  U 
T 嫋k ս ձ  Ŋ ꁚх с ł  jR  j  Ҋ Ҋ  Ue um } } 隊 
ف Ʌ  }ɕŁ jR" فJ 邊 j D 2 ł2 
   2ف* 
 
" jR  * JU
T ( T)))RR HHH]]^X k} } }ɕ͕ } 5R  j  Ҋ Ҋ  U 
ɪ E } } 麒  ف 2  5R j  Ҋ Ҋ  Օ
U }ѡɕ 钲  Cɕ j }ѕ с*ᕍ 2 ͡ с  Nх 5) j  Ҋ Ҋ  U  U }ѡɕ  Œ " сr с* rr" ѥ 5R  j  Ҋ Ҋ  U  U }ѡɕ 銚 2 2ɕ Q ɕ j }ѕ ѱJ }͕ jR  j  Ҋ Ҋ  U  U }ѡɕ  Ś " 偢 " ѕ ѡɕ 52 j  Ҋ Ҋ  Ue umչ }ѡɕ  ʢ 2 偒 ѕ ɕ ͕ 5R: } } } Ɂz Ʌѥ  b х ́  jR  j  Ҋ Ҋ  U  U }ѡɕ  ɢ  ɕ } } хс*ᕍ Jх ѹ Uс Iչ Mх 5Rڴښ jm ʺ j j  Ҋ Ҋ r  }ͽ }ݑѹ }ͽ }ݑ } JJ噽u     bb jR  j5Rڴښ jm ʺ j j  Ҋ Ҋ r  }ͽ }ݑѹ }ͽ }ݑ } JJ噽u  ꁢ  bb j  j5R ښ jm ʺ j j  Ҋ Ҋ r  }ͽ }ݑѹ }ͽ }ݑ } JJ噽u  %ꁢ  bb jD  j5R ښ jm 꺂j j  Ҋ Ҋ r  } ٥ } }ɕ } ѕ J" ՝u ͉ х ́  ՝ 5Rڴ j5) j  Ҋ Ҋ  Ue umչ }ѡɕ  ʢ  ɕ 钕 } } } *ᕍ х ѹ с Iչ Jх 5) j  Ҋ Ҋ  U  U }ѡɕ  ɢ  ɕ 钱Օ} } } *ᕍ х ѹ с Iչ Mх 5) [01-01 18:12:17 TUYA D][tuya_iot_wifi_api.c:381] wifi netstat changed to:2 -->>
[1970-1-1 18:12:17.796 tuya_device.c __wifi_status_cb(315) Info] wf_nw_status_cb,wifi_status:2
[1970-1-1 18:12:17.800 tuya_led_ctrl.c led_light_mode_set(213) Info] change led status => [2]

[01-01 18:12:17 TUYA D][tuya_iot_wifi_api.c:384] wifi netstat changed to:2 <<--
[01-01 18:12:21 TUYA D][tuya_devos_health.c:30] feed watchdog
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[01-01 18:12:26 TUYA D][tuya_devos_health.c:30] feed watchdog
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh

garbled area wasn't readable at any baud

EF custom read from 0x11000 to end of 4mb from TX2/RX2

standard BK7252 preset read stops at 2mb.

soldered up test pads and used Beken SPI Python program and CH341A demonstrated here https://www.elektroda.com/rtvforum/topic4073760.html#21512355


Pads map as:
Taobao A9 PCB Pads Tuya Doorbell Pads CH341A CE/CEN CE D2 SCK TCK SCK CSN TMS CS0 SI TDI MOSI SO TDO MISO GND GND GND

into SPI Beken SPI mode




NeoProgrammer detects flash - XTX XT25F32B [3.3V] 32 Mbits, 4 Mbytes - SPI ID: 0B4016. Dumps: https://github.com/openshwprojects/FlashDumps/pull/32/files


[line:45ee6b0706]
Pairs with Tuya app


Tuya dev info
Query Things Data Model
{
"result": {
"model": "{\"modelId\":\"000003uanz\",\"services\":[{\"actions\":[],\"code\":\"\",\"description\":\"\",\"events\":[],\"name\":\"默认服务\",\"properties\":[{\"abilityId\":101,\"accessMode\":\"rw\",\"code\":\"basic_indicator\",\"description\":\"设备设置页面-基本功能设置\\n设备指示灯是否打开，true打开，false关闭\",\"extensions\":{\"iconName\":\"icon-setting\",\"attribute\":\"1152\"},\"name\":\"状态指示灯\",\"typeSpec\":{\"type\":\"bool\"}},{\"abilityId\":105,\"accessMode\":\"rw\",\"code\":\"basic_private\",\"description\":\"\",\"extensions\":{\"iconName\":\"icon-setting\",\"attribute\":\"1152\"},\"name\":\"隐私模式\",\"typeSpec\":{\"type\":\"bool\"}},{\"abilityId\":108,\"accessMode\":\"rw\",\"code\":\"basic_nightvision\",\"description\":\"1:关\\n2:开\",\"extensions\":{\"iconName\":\"icon-setting\",\"attribute\":\"1024\"},\"name\":\"红外夜视\",\"typeSpec\":{\"type\":\"enum\",\"range\":[\"1\",\"2\"]}},{\"abilityId\":109,\"accessMode\":\"ro\",\"code\":\"sd_storge\",\"description\":\"单位改为kb\\n---\\n3503775744|778977280|2718158848\\n其中第一字符串是总容量，第二个字符串是已使用的容量，第三个是剩余容量\",\"extensions\":{\"iconName\":\"icon-setting\",\"attribute\":\"1024\"},\"name\":\"获取存储卡容量\",\"typeSpec\":{\"type\":\"string\",\"maxlen\":255}},{\"abilityId\":110,\"accessMode\":\"ro\",\"code\":\"sd_status\",\"description\":\"status：sd卡状态，1-正常，2-异常，3-空间不足，4-正在格式化，5-无SD卡；\",\"extensions\":{\"iconName\":\"icon-setting\",\"attribute\":\"1024\"},\"name\":\"存储卡状态\",\"typeSpec\":{\"type\":\"value\",\"max\":5,\"min\":1,\"scale\":0,\"step\":1}},{\"abilityId\":111,\"accessMode\":\"rw\",\"code\":\"sd_format\",\"description\":\"\",\"extensions\":{\"iconName\":\"icon-setting\",\"attribute\":\"1024\"},\"name\":\"存储卡格式化\",\"typeSpec\":{\"type\":\"bool\"}},{\"abilityId\":117,\"accessMode\":\"ro\",\"code\":\"sd_format_state\",\"description\":\"返回错误码：\\n-2000：SD卡正在格式化\\n-2001：SD卡格式化异常\\n-2002：无SD卡\\n-2003：SD卡错误\\n\\n//正数为格式化进度\",\"extensions\":{\"iconName\":\"icon-setting\",\"attribute\":\"1024\"},\"name\":\"格式化状态\",\"typeSpec\":{\"type\":\"value\",\"max\":200000,\"min\":-20000,\"scale\":0,\"step\":1}},{\"abilityId\":145,\"accessMode\":\"ro\",\"code\":\"wireless_electricity\",\"description\":\"\",\"extensions\":{\"iconName\":\"icon-setting\",\"attribute\":\"1152\"},\"name\":\"电量\",\"typeSpec\":{\"type\":\"value\",\"max\":100,\"min\":0,\"scale\":0,\"step\":1,\"unit\":\"%\"}},{\"abilityId\":146,\"accessMode\":\"ro\",\"code\":\"wireless_powermode\",\"description\":\"设备主动上报当前供电状态，供电状态发生变化时上报。0为电池供电状态，1为插电供电状态（或电池充电状态）\",\"extensions\":{\"iconName\":\"icon-setting\",\"attribute\":\"1024\"},\"name\":\"供电方式\",\"typeSpec\":{\"type\":\"enum\",\"range\":[\"0\",\"1\"]}},{\"abilityId\":147,\"accessMode\":\"rw\",\"code\":\"wireless_lowpower\",\"description\":\"若电量百分比低于该阈值，则触发报警；App端设置，设备本身无须关心该dp点。\",\"extensions\":{\"iconName\":\"icon-setting\",\"attribute\":\"1024\"},\"name\":\"低电量报警\",\"typeSpec\":{\"type\":\"value\",\"max\":50,\"min\":10,\"scale\":0,\"step\":1}},{\"abilityId\":150,\"accessMode\":\"rw\",\"code\":\"record_switch\",\"description\":\"设备设置页面-存储卡设置\\nSD卡录像开关，true为打开，false为关闭\\n功能关闭时，不录像到SD卡\",\"extensions\":{\"iconName\":\"icon-setting\",\"attribute\":\"1024\"},\"name\":\"SD卡录像开关\",\"typeSpec\":{\"type\":\"bool\"}},{\"abilityId\":162,\"accessMode\":\"rw\",\"code\":\"device_restart\",\"description\":\"无参数，页面操作为按钮类型，用户点击远程重启，直接发送ture的命令。\",\"extensions\":{\"iconName\":\"icon-setting\",\"attribute\":\"1024\"},\"name\":\"设备重启\",\"typeSpec\":{\"type\":\"bool\"}},{\"abilityId\":212,\"accessMode\":\"rw\",\"code\":\"initiative_message\",\"description\":\"\",\"extensions\":{\"attribute\":\"2048\"},\"name\":\"主动消息推送\",\"typeSpec\":{\"type\":\"raw\",\"maxlen\":128}},{\"abilityId\":231,\"accessMode\":\"rw\",\"code\":\"ipc_save_percent\",\"description\":\"\",\"name\":\"SD卡容量百分比显示开关\",\"typeSpec\":{\"type\":\"bool\"}},{\"abilityId\":235,\"accessMode\":\"rw\",\"code\":\"ipc_float_osd\",\"description\":\"\",\"name\":\"浮层osd\",\"typeSpec\":{\"type\":\"bool\"}}]}]}"
},
"success": true,
"t": 1747946181255,
"tid": "6ba25ea5374c11f0b7363af2f1e8cfff"
}
Device Details
{
"result": [
{
"active_time": 1747945436,
"bind_space_id": "238377361",
"category": "sp",
"create_time": 1747945436,
"custom_name": "",
"icon": "smart/icon/ay15232455785155wLDe/d61aa08199f5b0484c5bb81a441afe47.png",
"id": "bf2db8078f43eeb836tsa1",
"ip": "84.69.49.147",
"is_online": true,
"lat": "0",
"local_key": "Q'R-Vod2Rf)d~@ct",
"lon": "0",
"model": "",
"name": "Security Camera ",
"product_id": "u0kmecmr7j8roazz",
"product_name": "VGA卡片机",
"sub": false,
"time_zone": "+01:00",
"update_time": 1747945447,
"uuid": "a8925d12d72aad39"
}
],
"success": true,
"t": 1747946085169,
"tid": "32670474374c11f0a5b45285f2aacdc1"
}
Device Update Info
{
"result": [
{
"channel": 0,
"control_type": 0,
"current_version": "1.0.4",
"dev_type": 0,
"firmware_key": "keyph8vwhadwsx3a",
"last_upgrade_time": 0,
"timeout": 0,
"type": 0,
"type_desc": "Main Module",
"upgrade_status": 0
},
{
"channel": 9,
"control_type": 0,
"current_version": "1.0.4",
"dev_type": 0,
"firmware_key": "",
"last_upgrade_time": 0,
"timeout": 0,
"type": 9,
"type_desc": "MCU Module",
"upgrade_status": 0
}
],
"success": true,
"t": 1747946150580,
"tid": "5962db88374c11f0b50a8ad9f66a9c16"
}

[line:45ee6b0706]

From https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/14322039247

OpenBK7252_Tuya_QIO__7231u_t_c1b0ac146bf0.bin BL boots but no app

BK7251_1.0.13
REG:cpsr spsr r13 r14
SVC:0x000000D3 0x0043F7B8 0x00001CD1
IRQ:0x000000D2 0x00000010 0x0043FC10 0x00001AAC
FIR:0x000000D1 0x00000010 0x00440000 0xFE3CB47E
SYS:0x000000DF 0x0043B820 0x29DFC4F3
ST:0xBEDEAD12
Fal(V0.4.0)success
RT-Thread OTA package(V0.2.8-beken-1133282d-20220604) initialize success.


go os_addr(0x10000)..........
[ARM ANOMALY][2]

OpenBK7252_QIO__7231u_t_c1b0ac146bf0.bin boots into OBK!



[line:45ee6b0706]

Forgot to add that, like the doorbell, the OTA mechanism is like the Realteks with OTA1/OTA2 ping-pong.


ty_ipc_lite_sdk

I will present here an analysis of the interior and a short reverse engineering of the UART protocol of another Tuya dimmer, this time based on a rather unusual LMB54 (BK7231N) module and two HC32F003 microcontrollers. I will fully describe here how it can be programmed and added its OpenBeken support using the scripting language offered by these firmwares. The presented dimmer will be quite unusual, because it does not use the TuyaMCU protocol as discussed https://www.elektroda.pl/rtvforum/topic3898502.html , only from a slightly different, simpler UART communication, which in this case is unidirectional.


Purchase WXDM2
The dimmer gave me a reader (along with a set of other gadgets) to upload OpenBeken to them, as I wrote in the previous part. The purchase of the dimmer itself took place on the Polish auction site:

The dimmer cost PLN 80, which is quite a lot, but at least it supports two light bulbs and two switches.
Description from seller:

Important note - in the original firmware it dims by pressing the button, so the monostable button is preferred:

assembly diagram:

But beware, the product shipped has the N and L places swapped, you should follow the markings on its housing, they have the "last word"


Received set
This seller doesn't even provide mounting screws or tape in the kit...



WXDM2 interior, module pins and PCB analysis
Just pry the cover:

The parts of the dimmer I analyzed. Here you can see a 3.3V LDO regulator, an optocoupler, a MOSFET (7N65C), 8 S3M diodes and a PN8016 converter controller.


We look further - the WiFi module is not signed, it is not WB3S:

Let's desolder the upper PCB:

Here is the second MOSFET, 7N65C... and a large capacitor, but I haven't analyzed its role.
On the bottom of the PCB with the WiFi module, there are up to two HC32F003 microcontrollers - could it be a product from TuyaMCU? But how is it two? One per dimming channel?


Now you need to unsolder the screen from the WiFi module to see what's inside.

BK7231N! There are chances to change the firmware. But where is the RX and TX?
Let's desolder the WiFi module to check its pinout description.
Hot air is essential here.




Finally, I developed a sketch:

Explains:
- 3.3V and GND is known, power supply
- S1 and S2 are button inputs, they are connected to the WiFi module
- RX and TX from the WiFi module is led outside
- TX from WiFi module goes to both HC32F003
- R1 and R2 are dimmer outputs, each supports one HC32F003
- ZC is zero detection so that the dimmer knows when to start conducting (it is connected through a transistor, to both HC)
I also tried eavesdropping on UART communication. Only on the TX from the WiFi system something is happening.

Collected data as text:

FF 55 01 3F 59 00 00 0A
FF 55 02 3F 3F 00 00 0A
FF 55 01 59 3F 00 00 0A
FF 55 02 59 59 00 00 0A
FF 55 01 3F 59 00 00 0A
FF 55 02 3F 3F 00 00 0A
FF 55 01 59 3F 00 00 0A
FF 55 02 59 59 00 00 0A



00
FF 55 01 FF 00 05 DC 0A
0A FF 55 02 FF FF 05 DC 0A

00 FF 55 01 FF 00 05 DC 0A FF 55 02 FF FF 05 DC 0A
FF
55 01 FF 00 05 DC 0A FF 55 02 FF FF 05 DC 0A

Byte 0x55 looks like TuyaMCU protocol, but TuyaMCU is not.
0x01 and 0x02 look like identifiers which dimmer we are setting.
I decided to upload OpenBeken and check if I am able to send the UART packet controlling the dimmer myself.

Uploading the firmware and the first tests of control
However, it quickly turned out that all the fun with the soldering was unnecessary - in fact, only the WiFI module "talks" to the UART here, so it can be programmed in the system. Nothing will disturb us in the MCU. I marked the pads in the previous paragraph. Here is the connection of the programmer:

I uploaded the batch via:
https://github.com/openshwprojects/BK7231GUIFlashTool
according to the instructions on the page above.
then in OpenBeken I used the uartSendHex command to test sending various packets to the dimmers. I wanted to simulate the operation of the original firmware. This is necessary to control these dimmers.
After some testing, I've come to the conclusion that the following package works:

uartSendHex 0A FF 55 02 00 9F 00 00 0A

And 9F is the brightness level value, from 0 to 255, one byte. There is no checksum here. I don't know what the rest of the bytes are, except for 0x02 which is the ID of which of the two dimmers on board we are controlling.

Proof of concept - test script
I already have a suspicion of how it works. So I can prepare a simple OpenBeken script that changes the brightness of the lamp in a loop. Will the script work as expected?

again:
addChannel 10 1 0 255 1
delay_ms 100
uartSendHex 0A FF 55 02 00 $CH10$ 00 00 0A

goto again

The script above operates on OpenBeken channel 10. It gradually increases it, after reaching 255 it loops from 0. The value of channel 10 is used as the byte value in the sent packet.
OBK commands documentation:
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/commands.md
The script works:


The final example - the bar and mapping its changes to the UART value
OpenBeken offers the ability to set the type of channels, i.e. the way they are displayed. The Dimmer256 type is a dimmer strip with a range of 0 to 255, so it's as found here. In combination with the script below, we can get the dimmer control on the web panel:

addEventHandler OnChannelChange 0 uartSendHex 0A FF 55 02 00 $CH0$ 00 00 0A

When channel 0 is changed, a given message will be sent to the UART. This is enough to have real control over this dimmer..
Result:




Summary
It was quite an unusual product. I have not met a dimmer from Tuya before, but without TuyaMCU, using instead a simplified, "one-way" UART protocol (i.e. here only the WiFi module sends information, it does not receive anything). This "unidirectionality" is a bit justified for me, however, because there are separate MCUs inside to dim each channel. Both are connected to one TX1 line from BK7231N and they only select packets intended for them by their content (one of the bytes is 0x01 or 0x02). The dimmer is already working in OpenBeken, although it could be improved a bit and, for example, remembering the dimmer state (at the moment there is only one variable, so turning off the lamp is equivalent to setting the dimmer to 0). All this is possible to do by OBK scripts, so I consider the dimmer to be anyway supported and in the future I will give a separate topic about the already mentioned scripts.