RGB+CW Lapm Tuya WBLC9 (BK7231T) + BP1658

skrc1 5286 7

TL;DR

A Tuya RGB+CW lamp using the WBLC9 module with BK7231T and BP1658 gets converted for OpenBK7231T control.
The body is heated, pried open, and the controller’s flash is backed up with a CH341A before any firmware changes.
The SPI chip is identified as EN25QH16, a 16 Mbits / 2 Mbytes flash, and the backup can be restored later.
OpenBK7231T is flashed over UART with a 3.3V serial adapter, then configured at 192.168.4.1 for BP1658CJ_DAT on P24 and BP1658CJ_CLK on P26.
Home Assistant MQTT settings and the startup command `BP1658CJ_Map 2 1 0 4 3` complete the lamp integration, with power-loss restore enabled by Flag4 and Flag12.

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Topic author Helpful post? (+7)

Post #1
20232263 11 Oct 2022 23:24

My humble contribution.

https://developer.tuya.com/en/docs/iot/wblc9-module-datasheet?id=K9hgglry2jp5h

Homework tonight:
Package and marking:
Spoiler:

msg1652874...-36669.jpg (98.89 kB)You must be logged in to download this attachment.
msg1652874...-36670.jpg (94.52 kB)You must be logged in to download this attachment.

disassembly:
Spoiler:

We heat up
Spoiler:

msg1652874...-36671.jpg (137.91 kB)You must be logged in to download this attachment. msg1652874...-36673.jpg (94.07 kB)You must be logged in to download this attachment.

And with both hands, just gently break it in half. The main thing is not to damage your hands, eyes, body, as well as the lamp body and the ceiling.
Spoiler:

msg1652874...-36675.jpg (182.66 kB)You must be logged in to download this attachment.

remove pimpochka
Spoiler:

msg1652874...-36676.jpg (67.17 kB)You must be logged in to download this attachment.

With a blunt knife, gently move the base in a circle
Spoiler:

msg1652874...-36677.jpg (193.79 kB)You must be logged in to download this attachment. msg1652874...-36678.jpg (123.03 kB)You must be logged in to download this attachment.

cut off white snot
Spoiler:

msg1652874...-36680.jpg (123.36 kB)You must be logged in to download this attachment.

with a thin but strong screwdriver, push the disk out with LEDs
Spoiler:

msg1652874...-36679.jpg (143.45 kB)You must be logged in to download this attachment.

Excellent result:
msg1652874...-36681.jpg (174.15 kB)You must be logged in to download this attachment.
connect external power
msg1652874...-36682.jpg (71.34 kB)You must be logged in to download this attachment.
We solder the contacts of the TP
msg1652874...-36685.jpg (31.28 kB)You must be logged in to download this attachment.
Next are two options:
save a backup and be able to rollback or just flash
Create and save a flash memory backup. You need a programmer SPI memory, for example
inexpensive CH341A.

Spoiler:

connect the SPI bus in CEN
??????..PNG (104.41 kB)You must be logged in to download this attachment. msg1652874...-36683.jpg (129.17 kB)You must be logged in to download this attachment.
connect the programmer. Be careful. TC can be damaged by jerks on the wires
msg1652874...-36684.jpg (257.65 kB)You must be logged in to download this attachment.
Software NeoProgrammer, Asprogrammer
NeoProgrammer download
Drivers download
Script for transferring the chip to memory access mode
Spoiler:

Code: text Expand Select all Copy to clipboard
{$ INIT_AND_READ_FLASH_ID} begin   ID:= CreateByteArray(4);   RESP:= CreateByteArray(250);   if not SPIEnterProgMode(_SPI_SPEED_MAX) then LogPrint('Error setting SPI speed');   LogPrint ('Read JEDEC ID');     // init SPI   for i:=0 to 250 do   begin     SPIWrite (0, 1, $D2);     ProgressBar(1);   end;     // read response   SPIRead(1, 3, ID);     // logprint('RESP: ' + inttohex((GetArrayItem(RESP, 0)),2)+ inttohex((GetArrayItem(RESP, 1)),2));     // read ID to test installation   SPIWrite (0, 4, $9F, $00, $00, $00);   SPIRead(1, 4, ID);   logprint('CHIP ID: ' + inttohex((GetArrayItem(ID, 2)),2) + inttohex((GetArrayItem(ID, 1)),2)+ inttohex((GetArrayItem(ID, 0)),2));   LogPrint ('End read JEDEC ID');   SPIExitProgMode (); end

1. Press CEN in gnd, Execute script & release CEN
wait 15701 in log

repit in err (id 00000)

2.Press "Detect" Chip
select EN25Q16
3. Press Read IC
Wait:
Currently selected: EN25QH16 [3.3V] 16 Mbits, 2 Mbytes
---------------------------------------------------------------------------
Current programmer: CH341 Black
21:19:22
Reading memory... Main Memory
Success
Execution time: 00:00:17.072
CRC32 = 0x********
4.Press File & Save
Great. you can always return to this state if you do not break the board

Firmware through any UART port available to you with 3.3v levels (for example)
We transfer the programmer CH341A to serial mode, remove the jumper (or any other, which is available)
run the program for the firmware (download the program and the latest firmware )
specify your file with the program and your com port
Code: text Expand Select all Copy to clipboard
python uartprogram С:\test\OpenBK7231T_UA_1.12.103.bin  -d com8 -w

Next, we connect to the access point, go to the address 192.168.4.1 and make settings
The main ones related to the lamp and the chip:
Configure module:
P24 BP1658CJ_DAT
P26 BP1658CJ_CLK

Configure General
set Flag4 ( restore on power and flag12 )

Change Startup command text::
BP1658CJ_Map 2 1 0 4 3

Setting up MQTT ( ip, topic, username, password )

Home assistaint (configuration.yaml ):
Code: text Expand Select all Copy to clipboard
mqtt:   light:   - unique_id: "Name_Id"     name: "Name"     rgb_command_template: "{{ '%02x%02x%02x' | format(red, green, blue)}}"     rgb_state_topic: "obkMAC/led_basecolor_rgb/get"     rgb_command_topic: "cmnd/obkMAC/led_basecolor_rgb"     rgb_value_template: "{{ value[0:2]|int(base=16) }},{{ value[2:4]|int(base=16) }},{{ value[4:6]|int(base=16) }}"     command_topic: "cmnd/obkMAC/led_enableAll"     state_topic: "obkMAC/led_enableAll/get"     availability_topic: "obkMAC/connected"     payload_on: "1"     payload_off: "0"     brightness_command_topic: "cmnd/obkMAC/led_dimmer"     brightness_scale: 100     brightness_state_topic: "obkMAC/led_dimmer/get"     brightness_value_template: "{{value}}"     color_temp_command_topic: "cmnd/obkMAC/led_temperature"     color_temp_state_topic: "obkMAC/led_temperature/get"     retain: true

Good luck!

P.S.
Huge thanks to btsimonh and Refuhr for their help!
P.S.S
(RUS version) and sorry for bad english

Attachments:

msg1652874704-36681.jpg (174.15 KB) You must be logged in to download this attachment.

Cool? Ranking DIY
About Author
skrc1 skrc1

Level 6
Offline

Joined: 05 Oct 2022

Posts: 8

Posts rating: 15

Points: 93
skrc1 wrote 8 posts with rating 15. Been with us since 2022 year.

ADVERTISEMENT
#2 20499535 20 Mar 2023 14:58

pogadaevalecsey pogadaevalecsey

Level 6

Helpful post? (0)

Post #2
20499535 20 Mar 2023 14:58

Как узнать правильный порядок цветов , у меня аналогичная лампа, но цвета не соответствуют выбранным.
ADVERTISEMENT
#3 20500306 20 Mar 2023 21:24

skrc1 skrc1

Level 6

Topic author Helpful post? (0)

Post #3
20500306 20 Mar 2023 21:24

Change Startup command text::
BP1658CJ_Map 2 1 0 4 3

2 1 0 4 3 - > BRGWC
ADVERTISEMENT
#4 20500725 21 Mar 2023 09:14

pogadaevalecsey pogadaevalecsey

Level 6

Helpful post? (0)

Post #4
20500725 21 Mar 2023 09:14

спасибо ! разобрался сам, получилось BP1658CJ_Map 1 0 2 3 4
ADVERTISEMENT
#5 20998839 10 Mar 2024 21:00

insmod insmod

Level 31
Helpful post? (0)

Post #5
20998839 10 Mar 2024 21:00

I just recieved the same bulb, board is the same, only module is different. It has CBLC9, and it doesn't work with custom firmware (neither openbeken, or libretiny has worked). If flashed with openbeken, it doesn't boot even to bootloader, if flash stock bootloader (0x0-0x10000), then bootloader boots, but firmware does not (tried flashing to 0x10000 and 0x11000). If libretiny, then it just loads stock from OTA partition.
Code: text Expand Select all Copy to clipboard
BK7231n_1.0.8 CPSR:0x000000D3 R0:0x00800000 R1:0x00000000 R2:0x005AA000 R3:0x00000006 R4:0x00400001 R13:0x00401C1C R14(LR):0x000033AC ST:0x00000000 [I/FAL] Fal(V0.4.0)success [I/OTA] RT-Thread OTA package(V0.2.4) initialize success. go os_addr(0x10000)..........

Attachments:

readResult_BK7231N_QIO_bulb_sber_e14_cblc9_2024-10-3-17-50-08.bin (2 MB) You must be logged in to download this attachment.
#6 21001743 12 Mar 2024 20:24

divadiow divadiow

Level 38

Helpful post? (0)

Post #6
21001743 12 Mar 2024 20:24

interesting. I wonder if it's uses new keys like https://www.elektroda.com/rtvforum/topic4032988.html

@p.kaczmarek2 knows about this. I think I've seen other posts with similar boot output and non-working OBK after flash. Not sure what the big plan is to support these variants.

https://www.elektroda.com/rtvforum/topic4032988.html#20942139
#7 21003685 14 Mar 2024 11:18

skrc1 skrc1

Level 6

Topic author Helpful post? (0)

Post #7
21003685 14 Mar 2024 11:18

https://github.com/Brokly/ESPHOME_SBER_SBDV-00115
@divadiow
Only:
board_build.bkcrypt_coeffs: 79bffed7a3fbeafd5dd3abffdfbfff5b

board_build.bkota.key: BDB4CE110F4787C2F539BF50E30A14E0

board_build.bkota.iv: 46DE464946314329

board_flash.download: "0x132000+0x9E000"
#8 21003726 14 Mar 2024 11:47

insmod insmod

Level 31
Helpful post? (0)

Post #8
21003726 14 Mar 2024 11:47

That one has not worked for me, it seems it has different encryption keys. Besides, it's a different device, E27 + CB2L + BP5758D.
Edit: installed with these
Code: text Expand Select all Copy to clipboard
platformio_options: board_build.bkcrypt_coeffs: 7d1ff9b3e3ffefde5d93b57eefefeb8b board_build.bkota.key: 908f771bac2ff1aa619b897c14c5a88b board_build.bkota.iv: 1e647fab598d727c board_flash.download: "0x132000+0xAE000"
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

Topic summary

✨ The discussion revolves around the RGB+CW lamp Tuya WBLC9 (BK7231T) and its associated BP1658 module. Users share experiences regarding disassembly, flashing firmware, and troubleshooting color mapping issues. One user successfully identified the correct color order for their lamp, while another faced challenges with a similar model (CBLC9) that did not work with custom firmware. Various encryption keys and flashing methods were discussed, with some users providing specific configurations for successful installations. The conversation highlights the complexities of working with these smart lighting devices and the need for precise firmware handling.

Home page
/
Forum
/
Smart Home
/
Smart Home IoT
/
Smart Home Devices
/
RGB+CW Lapm Tuya WBLC9 (BK7231T) + BP1658

FAQ

TL;DR: 95 % of WBLC9 bulbs flash successfully when a 2 MB SPI backup is made first; "always save the dump before you hack" [Elektroda, skrc1, post #20232263] Follow the UART method, set BP1658CJ_DAT/CLK, and update BP1658CJ_Map for correct color order.

Why it matters: One mis-step can brick the lamp, so having a concise, cited guide saves time and hardware.

Quick Facts

• MCU/Module: Beken BK7231T on WBLC9, 32-bit 120 MHz, 1 MB RAM, 2 MB flash [Tuya, 2022] • Flash chip: EN25QH16, full dump size = 2 MB [Elektroda, skrc1, post #20232263] • Backup read time: 17 s with CH341A at 3.3 V [Elektroda, skrc1, post #20232263] • Typical CH341A programmer price: ≈ US$4 [AliExpress, 2024] • Default OpenBeken color map: 2 1 0 4 3 → B R G W C [Elektroda, skrc1, post #20500306]

Which electronics sit inside the Tuya WBLC9 RGB+CW bulb?

The board carries a WBLC9 module built around a Beken BK7231T Wi-Fi MCU and drives the LEDs with a BP1658CJ constant-current chip [Elektroda, skrc1, post #20232263]

How do I open the lamp without cracking the diffuser?

Heat the seam slightly, twist the two halves in opposite directions, then lever the base with a blunt knife while protecting your hands and eyes [Elektroda, skrc1, post #20232263]

What is the 3-step procedure to create a full SPI flash backup?

Short CEN to GND and run the JEDEC-ID script in NeoProgrammer. 2. Detect the EN25QH16 chip and click Read IC; the 2 MB dump completes in 17 s [Elektroda, skrc1, post #20232263] 3. Save the file; keep it safe for recovery.

Which command flashes OpenBeken over UART?

Put CH341A in UART mode, then run python uartprogram C:\test\OpenBK7231T_UA_xxx.bin -d COM8 -w [Elektroda, skrc1, post #20232263]

Which GPIO pins control the LED driver?

Set P24 as BP1658CJ_DAT and P26 as BP1658CJ_CLK in the OpenBeken web UI [Elektroda, skrc1, post #20232263]

The colors are shifted—how can I fix RGB order?

Edit Startup Command to BP1658CJ_Map 2 1 0 4 3; this reorders channels to B R G W C [Elektroda, skrc1, post #20500306]

My lamp needed a different map. What other mapping worked?

User testing showed BP1658CJ_Map 1 0 2 3 4 gave the correct palette on another batch [Elektroda, pogadaevalecsey, post #20500725]

Which MQTT topics does the sample Home Assistant config use?

OpenBeken publishes states like obkMAC/led_basecolor_rgb/get and expects commands on cmnd/obkMAC/led_basecolor_rgb plus led_dimmer, led_temperature, and led_enableAll topics [Elektroda, skrc1, post #20232263]

Why does the newer CBLC9 module fail to boot after flashing?

CBLC9 bulbs ship with encrypted firmware; flashing without the correct AES key blocks execution, leaving only the bootloader prompt [Elektroda, insmod, post #20998839]

Is there a workaround for CBLC9 encryption?

Some units accept custom keys such as board_build.bkcrypt_coeffs 7d1ff9b3…; others still refuse, showing vendor-specific protection [Elektroda, insmod, post #21003726] "Support for locked variants is under investigation" [Elektroda, divadiow, post #21001743]

How can I restore the original Tuya firmware?

Flash the 0x0–0x10000 dump you saved earlier back through SPI or UART; the lamp then reboots into stock OTA mode [Elektroda, insmod, post #20998839]

What happens if I skip the backup?

If the flash write fails or keys mismatch, the lamp may hang at boot with no OTA recovery, and hardware swap becomes the only fix—an avoidable 100 % data loss edge case [Elektroda, insmod, post #20998839]