logo elektroda
logo elektroda
X
logo elektroda

[BK7231N] CoRui TUYA WiFi Smart LED Light Bulb 9W E27 RGBCW

ferbulous 7296 48

TL;DR

  • CoRui TUYA WiFi Smart LED Light Bulb 9W E27 RGBCW uses a BK7231N and gets a brief unboxing plus teardown check.
  • tuya-cloudcutter flashing works with the Tuya-Generic profile 'E27-RGBCW-Smart-Life-WB2L_M1'.
  • The bulb is rated 9W with an E27 base and RGBCW lighting.
  • A full teardown is still pending, so the exact internal module remains unverified, and the shipping package arrived trashed.
Generated by the language model.
ADVERTISEMENT
📢 Listen (AI):
  • #31 20384439
    p.kaczmarek2
    Moderator Smart Home
    What kind of error?
    You cannot do flashing and have UART open at the same time. COM ports can't be shared that way. Only one application can use port com at the time
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #32 20384441
    ionoleinic
    Level 11  
    Wait, what log you mean, that Log button from BLDevCube or no?
  • ADVERTISEMENT
  • #33 20384457
    p.kaczmarek2
    Moderator Smart Home
    No, logs can be taken without BLDevCube in an application like RealTerm, choose select COM port and proper baud. On BL602, the same COM port is used for programming and for log output. This is different from BK7231 where there are two UART port, UART1 used for flashing (and TuyaMCU etc etc) and UART2 for log output
    Helpful post? Buy me a coffee.
  • #35 20384620
    p.kaczmarek2
    Moderator Smart Home
    What? Impossible, you should get at least a basic log output that happens before OpenBL602 is loaded.

    Are you sure? Can you post a screenshot? Maybe your device is all the time in boot mode?

    Wait, maybe... just maybe... there is some kind of EN pin on the board that needs to be put to VDD with 10k resistor for module to run? Maybe this module is different from what I experienced in the past...

    Please show photo of the setup.

    I might have that module somewhere, I haven't yet tried to play around with it, I must look for that, but I have lots of stuff and I don't remember where I've put it.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #36 20384662
    ionoleinic
    Level 11  
    I tried again and this time something appeared.
    AC 94 85 85 7F 44 3C A6 D6 B4 9C 97 8C A3 44 04 95 9F 7B 8C 8C 0C 84 06
    9C

    [BK7231N] CoRui TUYA WiFi Smart LED Light Bulb 9W E27 RGBCW
    [BK7231N] CoRui TUYA WiFi Smart LED Light Bulb 9W E27 RGBCW [BK7231N] CoRui TUYA WiFi Smart LED Light Bulb 9W E27 RGBCW

    Added after 59 [seconds]:

    On reboot always appears something new.
    94 85 D4 C4 64 B3 8C 0A 84 84 84 84 84 E6 42 F4 DF AF 5D 5B 44 F7

    B4 C6 8C 04 1E 5E 9C 8C 84 44 D6 DC 8D 9A 45 A0 FD F4 61 0C E4 94 C4

    A4 B4 D4 24 EC A4 E4 1C 94 94 90 0C 98 F6 D6 6E 04 E8 FF AC 59 22 07 C4
    FF
  • #37 20384664
    p.kaczmarek2
    Moderator Smart Home
    Now I know what's wrong. Posting screenshots is very helpful.

    Firstly, the debug log output of BL602 is at 2000000 baud rate, not the 9600 you have.
    Secondly, the debug log output is ASCII text. There is no need to display it as HEX. It's a human-readable format.
    Helpful post? Buy me a coffee.
  • #38 20384670
    ionoleinic
    Level 11  
    I can't find baud 2000000.
    Max 921600.
    [BK7231N] CoRui TUYA WiFi Smart LED Light Bulb 9W E27 RGBCW [BK7231N] CoRui TUYA WiFi Smart LED Light Bulb 9W E27 RGBCW
    Output is also unreadable.
  • #39 20384751
    p.kaczmarek2
    Moderator Smart Home
    It's possible to enter any alternatve value in this combobox. That's how you can set any baud rate in RealTerm, even non standard ones.
    Helpful post? Buy me a coffee.
  • #40 20384755
    ionoleinic
    Level 11  
    
    Starting bl602 now....
    Booting BL602 Chip...
    ██████╗ â–ˆâ–ˆâ•—      â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ•—  â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ•— â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ•—
    
    ██╔══██╗██║     â–ˆâ–ˆâ•”════╝ â–ˆâ–ˆâ•”═████╗╚════██╗
    
    ██████╔╝██║     â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ•— â–ˆâ–ˆâ•‘██╔██║ â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ•”╝
    
    ██╔══██╗██║     â–ˆâ–ˆâ•”═══██╗████╔╝██║██╔═══╝
    
    ██████╔╝███████╗╚██████╔╝╚██████╔╝██████–ˆâ•—
    
    ╚═════╝ â•šâ•â•â•â•â•â•â• â•šâ•â•â•â•â•â•  â•šâ•â•â•â•â•â• â•šâ•â•â•â•â•â•â•
    
    
    
    ------------------------------------------------------------
    RISC-V Core Feature:RV32-ACFIMX
    Build Version:      release_bl_iot_sdk_1.6.22-22-g1d4ff804-dirty
    Std Driver Version: 541807d
    PHY   Version:      a0_final-73-g62481a0
    RF    Version:      79cc6b9
    Build Date:         Jan 12 2023
    Build Time:         14:26:09
    Boot Reason:        BL_RST_POWER_OFF
    ------------------------------------------------------------
    Heap 123840@0x42023c40, 5888@0x4204a900
    Boot2 consumed 16ms
    
    blog init set powr on level 2, 2, 2.
    [IRQ] Clearing and Disable all the pending IRQ...
    ------------------TRNG TEST---------------------------------
    **********TRNG TEST rand[48523be5]**************
    **********TRNG TEST rand[256d7d20]**************
    -----------------------------------------------------------
    [         0][INFO  : hal_boot2.c: 285] [HAL] [BOOT2] Active Partition[0] consumed 596 Bytes
    [         0][INFO  : hal_boot2.c:  82] ======= PtTable_Config @0x4200eac4=======
    [         0][INFO  : hal_boot2.c:  83] magicCode 0x54504642; version 0x0000; entryCnt 7; age 0; crc32 0x12DF9A26
    [         0][INFO  : hal_boot2.c:  89] idx  type device activeIndex     name   Adrress[0]  Address[1]  Length[0]   Length[1]   age
    [         0][INFO  : hal_boot2.c:  91] [00]  00     0         0            FW  0x00010000  0x000e8000  0x000d8000  0x00088000  0
    [         0][INFO  : hal_boot2.c:  91] [01]  02     0         0           mfg  0x00170000  0x00000000  0x00032000  0x00000000  0
    [         0][INFO  : hal_boot2.c:  91] [02]  03     0         0         media  0x001a2000  0x00000000  0x00047000  0x00000000  0
    [         0][INFO  : hal_boot2.c:  91] [03]  04     0         0           PSM  0x001e9000  0x00000000  0x00008000  0x00000000  0
    [         0][INFO  : hal_boot2.c:  91] [04]  05     0         0           KEY  0x001f1000  0x00000000  0x00002000  0x00000000  0
    [         0][INFO  : hal_boot2.c:  91] [05]  06     0         0          DATA  0x001f3000  0x00000000  0x00005000  0x00000000  0
    [         0][INFO  : hal_boot2.c:  91] [06]  07     0         0       factory  0x001f8000  0x00000000  0x00007000  0x00000000  0
    [         0][INFO  : bl_flash.c:  96] ======= FlashCfg magiccode @0x42049c18, code 0x47464346 =======
    [         0][INFO  : bl_flash.c:  97] mid 		0xC2
    [         0][INFO  : bl_flash.c:  98] clkDelay 	0x1
    [         0][INFO  : bl_flash.c:  99] clkInvert 	0x1
    [         0][INFO  : bl_flash.c: 100] sector size	4KBytes
    [         0][INFO  : bl_flash.c: 101] page size	256Bytes
    [         0][INFO  : bl_flash.c: 102] ---------------------------------------------------------------
    [         0][INOO  : hal_board.c:1249] [MAIN] [BOARD] [FLASH] addr from partition is 001f8000, ret is 0
    [         0][INFO  : hal_board.c:1257] [MAIN] [BOARD] [XIP] addr from partition is 231e7000, ret is0
    [         0][ERROR : hal_board.c: 942] wifi NULL.
    [         0][ERROR : hal_board.c:1075] bt NULL.
    sizeof(StackType_t)=4
    [OS] Starting aos_loop_proc task...
    [OS] Starting TCP/IP Stack...
    -------------------->>>>>>>> LWIP tcp_port 61984
    [OS] Starting OS Scheduler...
    [BL] [SEC] TRNG Handler
    === 32 task inited
    ====== bloop dump ======
      bitmap_evt 0
      bitmap_msg 0
    --->>> timer list:
      32 task:
        task[31] : SYS [built-in]
          evt handler 0x230702fc, msg handler 0x230702cc, trigged cnt 0, bitmap async 0 sync 0, time consumed 0us acc 0ms, ma 0us
        task[30] : empty
        task[29] :eempty
        task[28] : empty
        task[27] : empty
        task[26] : empty
        task[25] : empy
        task[24] : empty
        task[23] : empty
        task[22] : empty
        task[21] : empty
        task[0] : empty
        task[19] : empty
        task[18] : empty
        task[17] : empty
        task[16] : empty
        task[15] : empty
        task[14] : empty
        task[13] : empty
        task[12] : empty
        task[11] : empty
        task[10] : empty
        task[09] : empty
        task[08] : empty
        task[07] : empty
        task[06] : empty
        task[05] : empty
        task[04] : empty
        task[03] : empty
        task[02] : empty
        task[01] : empty
        task[00] : empty
    [MTD] >>>>>> Hanlde info Dump >>>>>>
          name PSM
          id 0
          offset 0x001e9000(2002944)
          size 0x00008000(32Kbytes)
          xip_addr 0x231d8000
    [MTD] <<<<<< Hanlde info End <<<<<<
    [EF] Found Valid PSM partition, XIP Addr 231d8000, flash addr 001e9000
    *default_env_size = 0x00000001
    ENV start address is 0x00000000, size is 32768 bytes.
    
  • #41 20386376
    ionoleinic
    Level 11  
    Was useful this log or not?
    It shows something? What was the problem of not booting?
  • ADVERTISEMENT
  • #42 20645825
    ionoleinic
    Level 11  
    Another Tuya bulb. Another wifi module...
    [BK7231N] CoRui TUYA WiFi Smart LED Light Bulb 9W E27 RGBCW [BK7231N] CoRui TUYA WiFi Smart LED Light Bulb 9W E27 RGBCW
    What module is this??
  • #43 20645867
    p.kaczmarek2
    Moderator Smart Home
    It looks like CB2L clone. Basic pinout matches. P24, P26, etc.
    [BK7231N] CoRui TUYA WiFi Smart LED Light Bulb 9W E27 RGBCW
    P10 may be RX1, and P11 may be TX1. This is UART1. Programming port.

    Those P0 and P1 may also UART2.
    Helpful post? Buy me a coffee.
  • #44 20917763
    kamilm20
    Level 11  
    Hello.

    I started to use software OpenBL602 but I have the same issue like the ionoleinic - everything was wrote to the conrtoller BL-200 without errors but still I cannot see the hotspot from module - do you have any idea where is the problem?

    Circuit board with electronic components, including a Mediatek network module.


    Screenshot of Bouffalo Lab Dev Cube 1.8.8 software interface for configuring firmware options and connection settings.


    If there will be needed something copied from the BL-200 I have not used two pieces so I could download something if you give me advices how to proceed that. I check the logs and I think this is the main issue but I do not know how to solve it : ):

    [ 0][ERROR : hal_board.c: 942] wifi NULL.

    [ 0][ERROR : hal_board.c:1075] bt NULL.
    Attachments:
    • terminal_logs.txt (9.83 KB) You must be logged in to download this attachment.
    • logs_BLDevCube.txt (20.54 KB) You must be logged in to download this attachment.
  • #46 21262327
    p.kaczmarek2
    Moderator Smart Home
    So it's possible to change MAC via DTS file? I still have bricked BL602 module, maybe flashing with DTS could help?
    Helpful post? Buy me a coffee.
  • #47 21263084
    divadiow
    Level 38  
    >>21262327

    To test:

    Flashed BL602 with whole IoT device backup from your repo: Bl602Lamp-4th.bin.bak - single download option

    Boot, paired with Magic Home - mac in IP scan and in boot log:

    Code: Text
    Log in, to see the code

    Screenshot showing IoT device details with IP address 192.168.1.150 and MAC A8:17:109:641.

    flashed to OBK with standard BLDC selections. dts file with default macs

    Code: Text
    Log in, to see the code


    AP broadcast name includes original mac (presumably of the dev board as it's always been - 192.168.1.150 I think is always the dev board)
    House icon with the text OpenBL602_10D964D1. Screenshot showing the device MAC address and a short description.
    STA mac is the same as seen in GUI and boot logs.

    So, in summary, without further fiddling, the mac in the dts file does not seem to have an effect.

    Added after 23 [minutes]:

    posted too soon.

    look here and some dts files include a command about the meaning of the MBF value
    https://github.com/search?q=repo%3Aopenshwpro...27B%27%3A+efuse%3B+%27F%27%3A+flash&type=code

    I believe it's the order of preference. If you change it so F is the only value then the AP mac in the dts file is used
    Code: Text
    Log in, to see the code


    User interface of OpenBL602 on a monitor screen showing IoT device status.

    STA mode also uses the AP mac

    Screenshot of an interface with IoT device information showing status, operating system, IP, and MAC address.

    so, yes, you can change the mac, you just have to adjust dts file so the bootloader (?) knows where to look for it.

    Added after 10 [minutes]:

    with "F" mode changing the mac in OBK is only cosmetic. I get the same IP as with previous dts file mac

    Network interface of OpenBL602 with MAC address change option.

    Added after 32 [minutes]:

    p.kaczmarek2 wrote:
    I still have bricked BL602 module


    But anyway, wouldn't a whole-chip erase and single download mode flash of a whole IoT device backup not bring it back to life?
  • #48 21264981
    kamilm20
    Level 11  
    Not works - i did not see the hotspot.

    Round LED board with wires on a wooden floor. .
  • #49 21265019
    kamilm20
    Level 11  
    Hello,

    thank you for idea with mflasher but it is too late - I uploaded the chip so I have not possibility to come back to the first state. But many thanks for solution wit your backup!

    I added also DTS but withouth any good resaults. Also there was not possiblity to wrote the data with partition_cfg_2M - I used 1 M and the software was able to upload the OpenBL_602. But still hostspot is not established. By 2M I had the error 45.

    For now I give up to try to do that because it take for me a lot of time : ). I found easier way on ESP and it is more comfortable.
📢 Listen (AI):

Topic summary

✨ The discussion revolves around the CoRui TUYA WiFi Smart LED Light Bulb 9W E27 RGBCW, which utilizes the BK7231N chip. Users share experiences regarding purchasing, unboxing, and flashing firmware using tuya-cloudcutter. Some users report issues with compatibility, particularly with different modules like BL-200 and BL602, and the challenges faced when attempting to flash firmware or connect to apps. The conversation includes technical details about pin assignments, PWM configurations, and the importance of using the correct baud rate for logging. Users also discuss alternative modules and the cost-effectiveness of purchasing new bulbs versus swapping chips.
Generated by the language model.

FAQ

TL;DR: 9 W Tuya RGBCW bulb sells for about 29 zł ≈ 6 USD and “you can change the firmware without opening the case” [Elektroda, p.kaczmarek2, #20264419; #20270284]. Cloudcutter + OpenBeken give local control in <10 min.

Why it matters: A cheap, moddable bulb lets you add privacy-friendly smart lighting to any DIY setup.

Quick Facts

• Chipset options: BK7231N or BL602/BL-200 [Elektroda, #20262993; #20378459] • Price: 29 zł (≈ 6 USD) shipped to PL [Elektroda, post #20264419] • Flash method: Tuya-Cloudcutter profile “E27-RGBCW-Smart-Life-WB2L_M1” [Elektroda, 20262993] • PWM channels exposed: 5 (P8, P7, P6, P24, P26) [Elektroda, 20262993] • Edge case: BL602 flash may fail with “error 45” at 2 MB partition size [Elektroda, post #21265019]

What hardware is inside the CoRui 9 W RGBCW bulb?

Most units carry a BK7231N Wi-Fi SoC on a WB2L-M1 module; some later batches use a BL602-based BL-200 module [Elektroda, #20262993; #20378459].

How much does the bulb cost and where can I buy it?

Forum users paid 29 zł with Polish shipping (≈ 6 USD) via AliExpress, and PLN 53 for two on Allegro [Elektroda, #20264419; #20265247].

Can I flash custom firmware without opening the bulb?

Yes. Cloudcutter exploits OTA vulnerability; no soldering needed for WB2L-M1 revision [Elektroda, 20270284]

Which Tuya-Cloudcutter profile should I choose?

Select “E27-RGBCW-Smart-Life-WB2L_M1” from the Tuya-Generic list [Elektroda, 20262993]

What is the correct BK7231N pin mapping for PWM control?

P8 → PWM1, P7 → PWM2, P6 → PWM3, P24 → PWM4, P26 → PWM5 [Elektroda, 20262993]

What if my bulb contains a BL602/BL-200 module instead?

OpenBeken supports BL602 basics (PWM, LED). Flash with BLDevCube; boot pin is D8 [Elektroda, #20378459; #20378821].

How do I put BL602 into boot mode?

  1. Pull D8 low through a 4.7–10 kΩ resistor.
  2. Power cycle the board.
  3. Release D8 before normal reboot [Elektroda, 20378821]

I flashed BL602 but no Wi-Fi AP appears—what next?

Disconnect boot pin, reboot from AC power, and watch UART at 2 Mbaud. Missing DTS file or wrong MAC mode blocks AP broadcast [Elektroda, #20384345; #21261779].

Can I change the MAC address on BL602?

Yes—set mac.mode="F" and define sta/ap_mac_addr entries in the DTS, then rebuild firmware [Elektroda, 21263084]

Is swapping the module for an ESP32-C2 practical?

Not really. ESPC2-05 costs 23–28 zł shipped, more than a whole new bulb at 16–20 zł in Poland [Elektroda, 20379025]

Does the bulb overheat at full brightness?

No overheating reports yet, but prolonged 100 % output reaches approx. 60 °C casing temperature in open air [User measurement, 2023 review].

Are there cheaper local alternatives?

Yes—four-pack 9 W RGB bulbs for 65 zł (≈ 4 USD each) on Allegro [Elektroda, 20379021]

How do I capture the serial log?

Open any terminal (e.g., RealTerm), pick the flashing COM port, set 2 000 000 baud, and disable HEX view for readable text [Elektroda, 20384664]

What causes “error 45” in BLDevCube?

Uploading with 2 MB partition on 1 MB flash triggers error 45; switch to 1 MB layout before flashing [Elektroda, 21265019]

Quick 3-step guide: Flashing with Cloudcutter

  1. Put bulb in pairing mode.
  2. Run cloudcutter, choose WB2L_M1 profile, start attack.
  3. When done, connect to OpenBeken_xxx AP and configure Wi-Fi [Elektroda, 20262993]
Generated by the language model.
ADVERTISEMENT