WA2 module BEKEN BK7231QN40 / Beken/HLK-B30 WA2 does not work with openbk7231

Question

I tried to flash openbk in the WA2 module, it flashes successfully but it doesn't work. Could anyone help me to solve the problem?

btsimonh · Accepted Answer

hmm.. that's not working too well for me. I tested decrypt of the SDK encrypted bootloader, and it matches the unencrypted one, so I know the encrypt command line is correct, yet the data in your dump seems garbage (after de-crc and decrypt).

I suspect as @p.kaczmarek2 said, you need to use hid_download_py (https://github.com/OpenBekenIOT/hid_download_py) with the appropriate options to read 0x0 - 0x11000.

If your then take the resulting file (no spaces in name please!) and run:
python uartprogram "yourname.bin" -p
this will un-crc your file (reduce each 34 bytes to 32 bytes).
BUT discard yourname.unpackage.cpr, yourname.unpackage.out, yourname.unpackage_enc.out - these have been unencrypted with wrong start address.
then use:
encrypt yourname.unpackage.bin 510fb093 a3cbeadc 5993a17e c7adeb03 0
to get un-encrypted executable data.

Then with a hex editor, examine yourname.unpackage_enc.bin you should find some readable text...

We'd expect the original encrypted file to have possible (unencrypted) partition data on the end.
Upon 'decryption' this will become encrypted....

If success, pls post both files here.

P.s. I can find all the text from your logs in the normal bootloader.
Once you have hid_program_py, please try the flashing procedure using that... maybe it just did not flash correctly...

p.kaczmarek2 · Answer

Hello, I will try to help you, but in those cases, can you provide some basic diagnostic information?
1. Do you get OpenBeken access point visible and if so, have you managed to configure your WiFi SSID and pass?
2. If not, have you tried connecting UART RX to TX2 (log output; TX1 is programming; TX2 is log), what does the log say?
3. Can you show us the screenshot from programming tool to confirm that it did flash correctly? Did you use a correct bin file for your platform? For T, you flash UA at default offset. For N, you flash QIO at 0.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

anderson007104 · Answer

I have a doubt how to use Writer V1.60 to get the log. My WA2 module only has the TX2 I didn't find the RX2. Here flash image successfully

p.kaczmarek2 · Answer

TX2 is good. You have to connect RX of USB to UART dongle to TX2 to receive log. Use any app for UART communication, RealTerm can work, Putty can work as well. Remember to set 115200 baud rate

anderson007104 · Answer

The log repeats this message infinitely =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2022.10.28 21:56:27 =~=~=~=~=~=~=~=~=~=~=~= )��gu�%cH J)wn �H �����v1.1 [32;22m Fal(V0.4.0)success[0m [36;22m RT-Thread OTA package(V0.2.4) initialize success.[0m v1.1 [32;22m Fal(V0.4.0)success[0m [36;22m RT-Thread OTA package(V0.2.4) initialize success.[0m v1.1 [32;22m Fal(V0.4.0)success[0m [36;22m RT-Thread OTA package(V0.2.4) initialize success.[0m v1.1 [32;22m Fal(V0.4.0)success[0m [36;22m RT-Thread OTA package(V0.2.4) initialize success.[0m v1.1 [32;22m Fal(V0.4.0)success[0m [36;22m RT-Thread OTA package(V0.2.4) initialize success.[0m v1.1 [32;22m Fal(V0.4.0)success[0m [36;22m RT-Thread OTA package(V0.2.4) initialize success.[0m v1.1 [32;22m Fal(V0.4.0)success[0m [36;22m RT-Thread OTA package(V0.2.4) initialize success.[0m v1.1 [32;22m Fal(V0.4.0)success[0m [36;22m RT-Thread OTA package(V0.2.4) initialize success.[0m

anderson007104 · Answer

I tested two firmware versions and the log is the same

p.kaczmarek2 · Answer

It looks like it may be using a different variation of BK chip. What was the original firmware printing?

anderson007104 · Answer

This is the original firmware log 12:14:58.749 -> [36;22m RT-Thread OTA package(V0.2.4) initialize success.[0m 12:14:58.749 -> [01-01 18:12:15 TUYA Info][lr:0x998a5] mqc app init ... 12:14:58.749 -> [01-01 18:12:15 TUYA Info][lr:0xa297f] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:5 12:14:58.796 -> [01-01 18:12:15 TUYA Info][lr:0xa297f] thread_create name:cmmod,stackDepth:4096,totalstackDepth:8192,priority:4 12:14:58.796 -> [01-01 18:12:15 TUYA Debug][lr:0x99853] mq_pro:5 cnt:1 12:14:58.796 -> [01-01 18:12:15 TUYA Debug][lr:0x99853] mq_pro:31 cnt:2 12:14:58.796 -> [01-01 18:12:15 TUYA Debug][lr:0xa280b] Thread:sys_timer Exec Start. Set to Running Stat 12:14:58.796 -> [01-01 18:12:15 TUYA Err][lr:0x95373] logseq empty 12:14:58.796 -> [01-01 18:12:15 TUYA Debug][lr:0xa22ef] svc online log init success 12:14:58.796 -> [01-01 18:12:15 TUYA Info][lr:0xa297f] thread_create name:wk_th-0,stackDepth:5120,totalstackDepth:13312,priority:3 12:14:58.796 -> [01-01 18:12:15 TUYA Notice][lr:0x749dc] < TUYA IOT SDK V:2.3.1 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.3_CD:1.0.0 > 12:14:58.843 -> < BUILD AT:2021_09_26_11_33_20 BY embed FOR ty_iot_sdk_bk7231 AT bk7231 > 12:14:58.843 -> IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 SHUTDOWN_MODE:0 LITTLE_END:1 T[01-01 18:12:15 TUYA Notice][lr:0x749ec] oem_bk7321_bk_1_switch:1.1.3 12:14:58.843 -> [01-01 18:12:15 TUYA Notice][lr:0x749fc] compile at:Nov 9 2021 14:22:42 12:14:58.843 -> [PLATFORM NOTICE]bk_rst:0 [01-01 18:12:15 TUYA Notice][lr:0x74a18] ---> rst reason:0 12:14:58.843 -> [01-01 18:12:15 TUYA Notice][lr:0x73670] read uf buf {fsw_cnt_key:0} 12:14:58.890 -> [01-01 18:12:15 TUYA Notice][lr:0x74a3c] rst_cnt:[1] 12:14:59.077 -> [01-01 18:12:15 TUYA Notice][lr:0x72ab4] IO - wifi_stat: pin-7 type low 12:14:59.124 -> [01-01 18:12:15 TUYA Notice][lr:0x72b48] IO - relay[0]: pin-18 type high 12:14:59.124 -> [01-01 18:12:15 TUYA Notice][lr:0x72b70] IO - button[0]: pin-6 type low 12:14:59.124 -> [01-01 18:12:15 TUYA Notice][lr:0x72c5c] CH[0], DPID[1] 12:14:59.124 -> [01-01 18:12:15 TUYA Notice][lr:0x72c74] CH[0], CDDPID[102] 12:14:59.124 -> [01-01 18:12:15 TUYA Notice][lr:0x72c84] CH[0], RSDPID[101] 12:14:59.124 -> [01-01 18:12:15 TUYA Err][lr:0xbd26d] uf_open default_stat_save err 8 12:14:59.124 -> [01-01 18:12:15 TUYA Err][lr:0x74b6c] cannot open file 12:14:59.124 -> [01-01 18:12:15 TUYA Notice][lr:0x74c24] fast read def mode error 12:14:59.124 -> [01-01 18:12:15 TUYA Notice][lr:0x74bb0] relay_stat:1 12:14:59.170 -> [01-01 18:12:15 TUYA Notice][lr:0xb81f7] key_addr: 0x1eb000 block_sz 4096 12:14:59.170 -> [01-01 18:12:15 TUYA Notice][lr:0xb82cb] get key: 12:14:59.170 -> 0xcb 0x4e 0x3e 0xa4 0x0 0x30 0x9d 0xab 0x65 0x6d 0x8d 0xbf 0xe4 0xb9 0x3f 0x35 12:14:59.358 -> temp in flash is:302 12:14:59.358 -> Initializing TCP/IP stack 12:14:59.826 -> [01-01 18:12:16 TUYA Notice][lr:0x71fdc] mf_init succ 12:14:59.826 -> [01-01 18:12:16 TUYA Notice][lr:0x73670] read uf buf {fsw_cnt_key:1} 12:14:59.826 -> [01-01 18:12:16 TUYA Notice][lr:0x7207c] current product ssid name:tuya_mdev_test1 12:14:59.826 -> scan_start_req_handler 12:15:02.166 -> [PLATFORM ERROR]tuya_os_adapt_wifi_assign_ap_scan [tuya_mdev_test1] error 12:15:02.166 -> [PLATFORM NOTICE]bk_rst:0 [01-01 18:12:18 TUYA Notice][lr:0x92903] Last reset reason: 0 12:15:02.166 -> [01-01 18:12:18 TUYA Notice][lr:0x92a71] serial_no:84e342040de8 12:15:02.166 -> [01-01 18:12:18 TUYA Notice][lr:0x92aa9] gw_cntl.gw_wsm.stat:1 12:15:02.166 -> [01-01 18:12:18 TUYA Notice][lr:0x92b37] gw_cntl.gw_wsm.nc_tp:0 12:15:02.166 -> [01-01 18:12:18 TUYA Notice][lr:0x92b3f] gw_cntl.gw_wsm.md:0 12:15:02.166 -> [01-01 18:12:18 TUYA Notice][lr:0x92d27] gw_cntl.gw_if.abi:0 input:0 12:15:02.212 -> [01-01 18:12:18 TUYA Notice][lr:0x92d33] gw_cntl.gw_if.product_key:keys83qyuhuqrdn7, input:keys83qyuhuqrdn7 12:15:02.212 -> [01-01 18:12:18 TUYA Notice][lr:0x92d3f] gw_cntl.gw_if.tp:0, input:0 12:15:02.212 -> [01-01 18:12:18 TUYA Notice][lr:0x92d4f] gw_cntl.gw_if.firmware_key:keys83qyuhuqrdn7, input:keys83qyuhuqrdn7 12:15:02.212 -> [01-01 18:12:18 TUYA Notice][lr:0x74508] device_init ok free_mem_size:56128 12:15:03.195 -> [01-01 18:12:19 TUYA Notice][lr:0x73c8c] get wf state:0 12:15:03.195 -> [01-01 18:12:19 TUYA Notice][lr:0x72f10] wifi_stat:0 12:15:04.084 -> [01-01 18:12:20 TUYA Notice][lr:0x7387c] clear onoff cnt!

anderson007104 · Answer

This is probably a variation

btsimonh · Answer

Read the bootloader from 0x0 - 0x11000, and drop zip here or in openbeken github issue,
It looks like a different bootloader from serial output.
Compare to another read from another device?
You can re-flash the bootloader - but maybe only from SPI?

anderson007104 · Answer

How do I read the bootloader?

btsimonh · Answer

I believe BKwriter can do this if you set the startaddr to 0, and len to 11000, and read flash. But I always use hid_program ... so have not used bkwriter for ages.

anderson007104 · Answer

I did this and got an 11kb bin file

btsimonh · Answer

try again with 0x11000 br, Simon

p.kaczmarek2 · Answer

As far as I remember, bkWriter 1.60 will force-default the offset to 0x11000 and will not allow reading at 0x0 for T device. It would work only for N (BK7231N mode in bkWriter). You might need to try hid_download_py.

anderson007104 · Answer

I did and now it returned a 68kb bin file

anderson007104 · Answer

I tried and got these errors I tried to flash the firmware and it gave an unprotected error. I tried without using --unprotected in the command and it was flashing the firmware, the result is that the module does not rewrite anymore. I have another module of the same to try.

aleksnet36 · Answer

Did you manage to flash WA2 so that it worked fine?

p.kaczmarek2 · Answer

@aleksnet36 do you have WA2 module as well? In which device?

aleksnet36 · Answer

Yes. WA2. Relay

ferbulous · Answer

Hi, which firmware to flash with bk7213q? T or N?

p.kaczmarek2 · Answer

I am not currently sure if either T or N can work on that chip. If you have encountered it, please provide more information, boot log and firmware dump if possible.

kuba2k2 · Answer

Hi,I have this device as well. It is noticeably different from BK7231T (and most likely older). The main differences (incompatibilities) are:- the flash is not encrypted (existing firmware solutions will not work out-of-the-box)- the bootloader is different (a bit like T's bootloader, not N)- it doesn't have Bluetooth - thus, the T and N SDKs are not compatible with it. bdk_freertos is also incompatible- it seems not to have IrDA, real timers (only pwm timers) and few other peripherals- I have managed to compile my firmware for this chip, and got it to boot up (this required a few hacks). However, the Wi-Fi part is completely broken (STA, AP, scanning, nothing works). It requires a different WiFi blob.- the bootloader doesn't unprotect flash, which is quite an annoying issue. Flashing usually doesn't work right away. Sometimes hid_download_py is able to flash, but I need to power-cycle it first (CEN won't work). Then ltchiptool is also able to flash it, but only once.I'm not sure how to proceed from here. Adding support for this chip would be quite a challenge, as it has a different SDK (and everything is old there).

4139ggn · Answer

I have a couple of WA2 chips that I would like to be able to use with OpenBK.Is there any progress? So far I have managed to flash, but like everyone else, it doesn't start...

BDFp · Answer

Any news on this one?There are at least 4 people eagerly waiting

Hollako · Answer

Hey all,Make it 5. I also have some devices with this WA2 chip, trying to flash it without success.Hope for some support, please.Regards,

BDFp · Answer

There is a whole specification on the libretuya site, with pin layout, memory mapping, and the only thing that is missing is the info about the damn image for it or how to get one.
https://docs.libretiny.eu/boards/wa2

There you can find a link to the info & flashing guide where they make a huge jump from finding your board number straight to flashing, without explaining where to find the actual image.

They have mentioned a couple of SDKs for non-T and N devices, but I had no luck finding Q anywhere.

One SDK might be what we look for, it is Alibaba's AliOS SDK.
It has support for bk7231, but it is super complicated, although they have text instructions on how to start developing using their platform, but most of it is in CN.
Apparently, Baken is based on ARM Cortex-M4.

https://github.com/alibaba/AliOS-Things/wiki/AliOS-Things-Hardware#arm-cortex-m4

They have a quick start for Linux: https://github.com/alibaba/AliOS-Things/wiki/Quick-Start
They also have one in CN for Windows using VSCode plugin of theirs: https://github.com/alibaba/AliOS-Things/wiki/AliOS-Things-Studio

That is all great, but it means you need to build your own firmware from scratch, and that is before we even know if Q is among the supported devices or not.

BDFp · Answer

I decided to look some more into libretiny and in fact they indeed have support for Q variant.
I am capable of building an image.
I followed the esphome libretiny instructions on https://docs.libretiny.eu/docs/projects/esphome/
I did this:


    Open a terminal/cmd.exe, create esphome directory and cd into it.
    git clone https://github.com/libretiny-eu/libretiny-esphome
    cd into the newly created libretiny-esphome directory.
    Check if it works by typing python -m esphome

The last step failed so I needed to run to install esphome library into python:


    pip install -e . --break-system-packages

--break-system-package is there because it would not let me install it otherwise.

Then you run the wizard that will create basic yml file:


    python -m esphome wizard yourdevice.yml

The file looks like this:


esphome:
  name: test

bk72xx:
  board: wa2
  family: bk7231q

# Enable logging
logger:

# Enable Home Assistant API
api:
  password: "xxxxx"

ota:
  password: "xxxxx"

wifi:
  ssid: "xx"
  password: "xxxxxx"

  # Enable fallback hotspot (captive portal) in case wifi connection fails
  ap:
    ssid: "Test Fallback Hotspot"
    password: "F0gJM6nfV6S9"

Now you need to add the rest of the config and this is where the link I mentioned in previouse post comes into use: https://docs.libretiny.eu/boards/wa2/#pin-functions
I have no clue which pin does what but I guessed that the new config looks something like this:


esphome:
  name: test

bk72xx:
  board: wa2
  family: bk7231q

# Enable logging
logger:

# Enable Home Assistant API
api:
  password: "xxxxx"

ota:
  password: "xxxxx"

wifi:
  ssid: "xx"
  password: "xxxxxx"

  # Enable fallback hotspot (captive portal) in case wifi connection fails
  ap:
    ssid: "Test Fallback Hotspot"
    password: "F0gJM6nfV6S9"

text_sensor:
  - platform: libretiny
    version:
      name: LibreTiny Version

binary_sensor:
  - platform: gpio
    id: binary_switch_1
    pin:
      number: P6
      inverted: true
      mode: INPUT_PULLUP
    on_press:
      then:
        - switch.toggle: switch_1

switch:
  - platform: gpio
    id: switch_1
    name: Relay 1
    pin: P18

status_led:
  pin:
    number: P8
    inverted: true

With that we have everything we need to build an image.

Files are located in the libretiny-esphome folder, to be precise in:


    /libretiny-esphome/.esphome/build/test/.pioenvs/test/

There is a command that allows you to upload the files directly to the device:


    python -m esphome upload testdevice.yml

For me this is where it failed.
Here you should see two options, one for ota upload and second for hardware flashing.
Maybe because I didn't have anything connected for hardware flashing, esphome tried to connect to a device for ota update and failed to find any devices

It is suppose to be as simple as in this tutorial https://www.youtube.com/watch?v=yXvPMAv4bIQ&ab_channel=thebatu89

OTA firmawere is 1.8Mb, the same is firmware.bin, so it is rather big for what wa2 has, I think.
That said raw_firmware.bin is only 526.8 KB

I can't really test if it works or not.
I don't have any flashing setup, I was really hoping for ota to work.

Build folder has tons of files pulled for compilation, there are c libraries for bk7231q, bunch of config files for it.
I'm sure it will be helpful to someone.

This is where I am now and that will be it for me, since I have no clue which files to upload, even if I would attempt to do it manually.
I really don't want to brick my device.

BDFp · Answer

I dusted off my old, can soldering iron and I managed to read from the chip.
bk7321Q_b..up.bin Download (2 MB)

Unfortunately, when I tried to write to the device using the compiled libretiny esphome image, it failed with

ValueError: Chip CRC value 6A339F12 does not match calculated CRC value 4A5A80CD

If I'm not mistaken, the above error message means that the CRC from the file does not match what was calculated after the transfer, right?
Which means either the data transfer was corrupted, the programmer is at fault, or something is wrong with the image?
I don't have another programmer, so the only thing I could try is to shorten the cables, but I don't think that would work.
I guess it is something to try another time.

Unfortunately, once again, I'm not able to proceed further.

WA2 module BEKEN BK7231QN40 / Beken/HLK-B30 WA2 does not work with openbk7231

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Post #24

Post #25

Post #26

Post #27

Post #28

Post #29

Post #30

Topic summary