Elektroda.com
Elektroda.com
X

Search our partners

Find the latest content on electronic components. Datasheets.com
Elektroda.com

[BK7231T] My HTTP server, configurator, MQTT support from Home Assistant

p.kaczmarek2 32088 705
This content has been translated flag-pl » flag-en View the original version here.
  • sharathbk1912
    Level 6  
    Added after 1 [hours] 8 [minutes]:

    Ya that may confuse users. BL09XX would be good enough since i doubt anyone will use both together .

    For the project , i think it would be useful to add
    1. Home assistant auto discovery mqtt
    2. Hue EMulation -> would allow users to control locally through alexa for those not using home assistant -> since we have many devices supported now
    3. IR send / receive -> since we have RGB wifi controller supported and also fan modules which come with IR receiver too.

    Thanks and Regards
    Sharath b K
  • p.kaczmarek2
    Level 26  
    sharathbk1912 wrote:

    2. Hue EMulation -> would allow users to control locally through alexa for those not using home assistant -> since we have many devices supported now

    https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/cmnds/cmd_newLEDDriver.c
    There is already hue command, if that's what you mean:
    Code:

        CMD_RegisterCommand("led_saturation", "", setSaturation, "set qqqq", NULL);
        CMD_RegisterCommand("led_hue", "", setHue, "set qqqq", NULL);
  • TommyNZ
    Level 2  
    This is the board that is in the Hidin MFA03 single pole light switch. I will have to try find a magnifying glass to read the text on the chip...

    [BK7231T] My HTTP server, configurator, MQTT support from Home Assistant

    This is another image they sent me when we started talking about schematics...

    [BK7231T] My HTTP server, configurator, MQTT support from Home Assistant

    It doesn't mean very much to me though...
  • p.kaczmarek2
    Level 26  
    TuyaMCU guide released in English!
    https://www.elektroda.com/rtvforum/topic3898502.html

    @tommynz your photo has a very bad quality, I am having slight problems with tracking the traces, but take a look:
    [BK7231T] My HTTP server, configurator, MQTT support from Home Assistant
    I aligned both images for you. You can see which traces go to oscillator (XI and X0) and then you can see where RX1 and TX1 traces goes. You need them to flash the firmware with bkWriter 1.60

    Can you go on from here? If not, please provide at least a bit better photo so I can track the traces....
    Maytbe it's like this, but please double check:
    [BK7231T] My HTTP server, configurator, MQTT support from Home Assistant

    Did you read my flashing guides here in Teardowns section?
  • sharathbk1912
    Level 6  
    Why is the tracing required ? from the schematic we can see that J2 has the programming pins. VCC and GND measurement can help with orientation.
  • p.kaczmarek2
    Level 26  
    @sharathbk1912 oh well you are 100% correct, I just glanced at schematic, saw it cropped and assumed that the J2 was not there because I tought that otherwise the user wouldn't ask for help.

    Then it should be very easy, follow this guide: https://www.elektroda.com/rtvforum/topic3875654.html
  • mascencerro
    Level 2  
    I'd like to tag along with this work if you all don't mind.

    I'm just getting my feet wet in my first time working with IoT device firmware and chose some Merkury smart bulbs and plugs purchased from Wal-Mart for my test subjects. I've only been working on this project for about 3 weeks, but in that time while finding information about the chipset (turned out to be the BK7231T) I found the threads for this project and it has been extremely helpful. I can try to post pictures and as much info about my setup if it would be of interest and helpful.

    What I am working on:
    Using a RPi to compile, flash, read firmware from the BK7231T

    What I have so far working:
    - I have a pi 3b+ with arm64 Raspbian and two FT232RL that I use to communicate via the two UART connections on the BK7231T similar to the original thread. I soldered connection to CEN with a lead so I can just reset by touching it to the GND for reset.
    - I can read the firmware from the device using @btsimonh uartprogram.
    - I have been able to cross-compile the ARM32 firmware (with obk_hello_world as my test) on the ARM64 install of Raspbian using arm-none-eabi-gcc (system installed, not copy bundled in the platform/tools).
    - package firmware (ota, encrypt, beken_packager) on x86 system
    - flash firmware using uartprogram from pi
    - boot functioning device (obk_hello_world)

    I can compile apps other than obk_hello_world on the x86 system, modify, compile, flash, etc just fine. What I would like to do would be to do the encrypt/packaging process on the RPi instead of switching to an x86 system for that part of the build script.
    Has anyone made a toolset to replace the Beken packaging tools (platforms/bk7231t/bk7231t_os/tools/generate/package_tool), or am I missing the post somewhere? All I've been able to find digging around are the precompiled windows/x86-64 executables.

    Again, first go-round here with this stuff, but I'll be glad to provide any info/photos/whatever I can to help the project grow. My personal project doesn't involve the home connect stuff much though and I have no experience that, but I am very interested in the firmware side of it all. I was able to backup the original 'virgin' firmware from the plug and one bulb over UART if those would be of interest and usable for anyone.

    I'm sure I'm doing some things that would make the more seasoned vets shake their head, but I'm learning. Just lemme know where I can help and what I can do.
  • p.kaczmarek2
    Level 26  
    Wow, it seems you have a very nice setup!
    You're welcome to describe it here:
    https://www.elektroda.com/rtvforum/forum41.html
    post it as separate article, as we are trying to make a big smart devices knowledge base here on Elektroda, just to help the community.

    I don't know about packaging tool, as it was never my goal to run it outside x86. Still, I think you can take a look here (but it seems you already did):
    https://github.com/OpenBekenIOT/hid_download_py
    and here:
    https://github.com/khalednassar/bk7231tools
    [BK7231T] My HTTP server, configurator, MQTT support from Home Assistant
    and maybe here:
    https://github.com/tuya-cloudcutter/tuya-cloudcutter

    I am not sure but it seems that bk7231tools depackaging stuff might be your best shot.
    https://github.com/khalednassar/bk7231tools/blob/main/bk7231tools/crypto/code.py


    mascencerro wrote:
    I was able to backup the original 'virgin' firmware from the plug and one bulb over UART if those would be of interest and usable for anyone.

    Please submit it here so we can create an OTA hack to program those devices without opening the case and soldering:
    https://github.com/tuya-cloudcutter/tuya-cloudcutter/issues
    you can also put device photos/module information etc in our Teardowns section of Elektroda
  • RainyShadow
    Level 2  
    Hello.
    I have this drone which seems to be using BK7231U for WiFi controls and camera.
    I bought it second-hand, i could not find any branding or model markings on it.
    It appears to be a clone of Eachine E58 Pro, but with fake FHD resolution.
    You can see the insides here: imgur.com/a/GtyHgX7
    This page has links for the controlling app: qr02.cn/FrW2Ym

    Do you think it would be easy to make a backup of the firmware and modify it somehow?
    I don't want to risk bricking it. but i would like to try make it use the original camera resolution instead of the fake 1920x1080.
    I tried to modify the android app, but no success so far. I believe the SSID is somehow related. My drone creates an AP named WIFI_4K__8EEFDC
  • p.kaczmarek2
    Level 26  
    There are SDKs for U version:
    https://github.com/search?q=bk7231u
    Connecting the UART programmer and doing the flash read will not break the chip, but you'd have to solder the RX and TX to correct traces on the board.
    I can't see any programmer pads on the board, tough.
    Still, are you willing to try? do a bkWriter firmware dump?

    I could also buy such a drone myself and dissect it piece by piece, but I'd need more information where to get a Beken one, and you're saying there are no markings whatsoever.... so maybe try searching by app or by photo?

    How much such a drone costs?

    I haven't looked into drones yet, but you definetly got me interested.

    Eachine E58 Pro on aliexpress seems to be for about 200 zł, so 50$ or so, I could buy one.

    Of course 'hacking' the drone would be a separate project from OpenBK for IoT devices, but still, i would like to try.
  • mascencerro
    Level 2  
    p.kaczmarek2 wrote:
    Wow, it seems you have a very nice setup!
    You're welcome to describe it here:
    https://www.elektroda.com/rtvforum/forum41.html
    post it as separate article, as we are trying to make a big smart devices knowledge base here on Elektroda, just to help the community.


    Ok, I will see if I can find some time soon to make some write-ups.

    p.kaczmarek2 wrote:

    I don't know about packaging tool, as it was never my goal to run it outside x86. Still, I think you can take a look here (but it seems you already did):
    https://github.com/OpenBekenIOT/hid_download_py
    and here:
    https://github.com/khalednassar/bk7231tools
    [BK7231T] My HTTP server, configurator, MQTT support from Home Assistant
    and maybe here:
    https://github.com/tuya-cloudcutter/tuya-cloudcutter

    I am not sure but it seems that bk7231tools depackaging stuff might be your best shot.
    https://github.com/khalednassar/bk7231tools/blob/main/bk7231tools/crypto/code.py


    Actually these two repos provided some sources I was needing:
    ghsecuritylab/tysdk_for_bk7231t
    tiancj/rtt_ota_tools

    p.kaczmarek2 wrote:

    mascencerro wrote:
    I was able to backup the original 'virgin' firmware from the plug and one bulb over UART if those would be of interest and usable for anyone.

    Please submit it here so we can create an OTA hack to program those devices without opening the case and soldering:
    https://github.com/tuya-cloudcutter/tuya-cloudcutter/issues
    you can also put device photos/module information etc in our Teardowns section of Elektroda


    Done. Just made an issue for each including link to device as well as zip with firmware and boot log.
    Here is the link to the github repo I made containing what firmware dumps I have collected so far.
  • RainyShadow
    Level 2  
    p.kaczmarek2 wrote:
    Connecting the UART programmer and doing the flash read will not break the chip, but you'd have to solder the RX and TX to correct traces on the board.
    I can't see any programmer pads on the board, tough.
    Still, are you willing to try? do a bkWriter firmware dump?

    Thanks, i will try it when i have some time to disassemble the thing and hook up everything.
    Those pictures were taken when i was cleaning the drone after it being lost for about a month, collecting mud and rain in some bushes. Luckily a neighbour found it and called me :) I didn't think of shooting the other side of the board, because it didn't have any parts there.
    I have a few USB-TTL adapters here (PL2303, CP2102, a CH341A programmer), but none of them seem to have a 3.3V jumper for the data lines. The CH341A has some setting jumper, but it's marked in chinese, so not sure.
    I also have a cheap level shifter made from what looks like 4 transistors. Maybe i will use that just in case.

    p.kaczmarek2 wrote:
    I could also buy such a drone myself and dissect it piece by piece, but I'd need more information where to get a Beken one, and you're saying there are no markings whatsoever.... so maybe try searching by app or by photo?

    How much such a drone costs?

    I haven't looked into drones yet, but you definetly got me interested.

    Eachine E58 Pro on aliexpress seems to be for about 200 zł, so 50$ or so, I could buy one.


    Don't rush to buy anything blindly, please! Unless you have money to waste, lol.
    As i said, mine doesn't have any branding. Nothing on the drone itself, neither on the remote, or in the included leaflets.
    I just added a few more images to the album so you can see for yourself.
    I got it for cheap (20 bulgarian leva = about 11 USD) from a coworker, who had it gifted to him recently and wanted to sell it anyways. He said the previous owner had it for maybe a year, so this model (whichever it is) must be at least two years old.
    The original price must have been much higher.

    I only found out about the Eachine models by visually searching for a replacement battery. The plain E58 is supposed to have a microSD card slot, while the E58 Pro don't have one. Mine don't have a slot too. Also, the E58 remote has a sliding power switch, and the E58 Pro has a push-button.
    And the official Eachine android app doesn't work here.

    Another possibility is DroneX Pro.
    I found a few other similar models, but can't remember them now.

    There are also different shapes for the blue LED light on the top of the drone.

    Looking at the WiFi_CAM app in jadx-gui, i found these:
    Code:
        public static final String WIFI_PREFIX = "HD-720P-|HD-FPV-|HD720-|FHD-";
    
        public static final String WIFI_PREFIX_1080 = "FHD-";
        public static final String WIFI_PREFIX_720 = "HD720-";
        public static final String WIFI_PREFIX_720P = "HD-720P-";
        public static final String WIFI_PREFIX_CO = "CORBY-CX012-";
        public static final String WIFI_PREFIX_CT = "CT-";
        public static final String WIFI_PREFIX_CT1080 = "CT1080-";
        public static final String WIFI_PREFIX_CT4K = "CT4K-";
        public static final String WIFI_PREFIX_CT720 = "CT720-";
        public static final String WIFI_PREFIX_CT720P = "CT720P-";
        public static final String WIFI_PREFIX_CTWIFI = "CTWIFI-";
        public static final String WIFI_PREFIX_DU = "Du-";
        public static final String WIFI_PREFIX_DU4K = "Du-HD4K-";
        public static final String WIFI_PREFIX_DU720 = "Du-HD720-";
        public static final String WIFI_PREFIX_DUAL = "Dual_";
        public static final String WIFI_PREFIX_DUAL1080 = "Dual_1080-";
        public static final String WIFI_PREFIX_DUAL4K = "Dual_4K-";
        public static final String WIFI_PREFIX_DUAL720 = "Dual_720-";
        public static final String WIFI_PREFIX_DUAL720P = "Dual_720P-";
        public static final String WIFI_PREFIX_DUALHD = "Dual_HD-";
        public static final String WIFI_PREFIX_Du1080 = "Du-HD1080-";
        public static final String WIFI_PREFIX_FHD = "wifi_camera_";
        public static final String WIFI_PREFIX_FPV = "HDFPV-";
        public static final String WIFI_PREFIX_FPV1080 = "FPV-1080-";
        public static final String WIFI_PREFIX_FPV4K = "FPV-4K-";
        public static final String WIFI_PREFIX_FPV720 = "FPV-720-";
        public static final String WIFI_PREFIX_FPV720P = "FPV-720P-";
        public static final String WIFI_PREFIX_FPVHD = "FPVHD-";
        public static final String WIFI_PREFIX_FPVVGA = "FPV-";
        public static final String WIFI_PREFIX_HD = "HD-";
        public static final String WIFI_PREFIX_HD1080 = "HD1080-";
        public static final String WIFI_PREFIX_HD4K = "HD4K-";
        public static final String WIFI_PREFIX_HD720 = "HD720P-";
        public static final String WIFI_PREFIX_HDFPV_1080 = "HDFPV-1080-";
        public static final String WIFI_PREFIX_HDS = "HDS-";
        public static final String WIFI_PREFIX_HDWIFI = "HDWIFI-";
        public static final String WIFI_PREFIX_HD_720 = "HD-720-";
        public static final String WIFI_PREFIX_HJH = "HJH_FPV-";
        public static final String WIFI_PREFIX_HJH4K = "HJH_4K-";
        public static final String WIFI_PREFIX_HJHUFO = "HJH_UFO-";
        public static final String WIFI_PREFIX_KY = "KY-";
        public static final String WIFI_PREFIX_KY1080 = "KY1080-";
        public static final String WIFI_PREFIX_KY4K = "KY4K-";
        public static final String WIFI_PREFIX_KY720 = "KY720-";
        public static final String WIFI_PREFIX_KY720P = "KY720P-";
        public static final String WIFI_PREFIX_KYFPV = "KYFPV-";
        public static final String WIFI_PREFIX_KYS = "KYS-";
        public static final String WIFI_PREFIX_KYUFO = "KYUFO-";
        public static final String WIFI_PREFIX_KYWIFI = "KYWIFI-";
        public static final String WIFI_PREFIX_NO_GESTURE = "HD|SMAO";
        public static final String WIFI_PREFIX_OLD_HD = "HD";
        public static final String WIFI_PREFIX_SMAOS = "SMAO-S-720P-";
        public static final String WIFI_PREFIX_SMAOS4K = "SMAO-S-4K-";
        public static final String WIFI_PREFIX_UFO = "HDUFO-";
        public static final String WIFI_PREFIX_VGA = "HD-FPV-";

    I could not find my prefix "WIFI_4K_" anywhere, yet the app works.

    I also searched for some online database of cheap toy drones with part lists, firmwares, etc., but couldn't find anything alike.
    Everyone is mostly focused on STM32 based flight controllers and DIY kits.
  • echojjj
    Level 7  
    @rainyshadow

    p.kaczmarek2 wrote:
    Of course 'hacking' the drone would be a separate project from OpenBK for IoT devices, but still, i would like to try.


    Hi there, just been following along the progress of OpenBK.... It doesn't really have to be a separate project. What about voice with Alexa controlling the drone! I'm kidding.
    This would be worse than "Alexa turn on the kitchen light."

    EDIT gave it some more thought
    "Alexa, tell drone to follow my 6-year-old riding his bicycle on the street"
    "Alexa, tell drone to record my neighbor's dog barking non-stop" (Do drones record audio???)

    I'm liking the idea of a drone being part of the IoT
  • RainyShadow
    Level 2  
    @echojjj
    Since these cheap drones are pretty dumb, it would be more like "Alexa, take the controls and follow my 6-year-old with the drone".
    Some models record audio, mine doesn't have a microphone though. I should check if there are pads broken out for one to connect...