I'm trying to flash (well, start by
reading the flash) a device which I am pretty certain is near-identical under the hood to this one. It's an Aubess-branded one-gang no-neutral-required touch switch. , with a printed model number of DS-1211SL. It's got a six-pin header on the power-supply/relay board which mates with six pins on a board with a touch-sensor and CB3S board. It looks a lot like the DS-101, although the MCU is mounted "upside-down" -- the metal shielding with a QR code is visible, instead of the printed pin labels and bulls-eye. I've cut the trace from pin 16 of the touch-control IC to RXD1, which seems to be generally necessary based on conversation here. I have a kind of janky setup with headers on the GND and VCC pins, a loose branched ground wire to brush against CEN, and dupont pins which I physically hold against the TXD1 and RXD1 points while flashing. It does seem to actually communicate, but I'm getting some failures. First, a successful result, from just trying to talk to the chip at all:
$ ltchiptool flash info -d /dev/ttyUSB0 BK7231N
I: Connecting to 'Beken 7231N' on /dev/ttyUSB0 @ 115200
I: |-- Success! Chip info: None
I: Reading chip info...
I: Chip: None
I: +--------------------+---------------------------+
I: | Name | Value |
I: +--------------------+---------------------------+
I: | Chip Type | Unrecognized (0x9671FEB5) |
I: | Bootloader Version | Unspecified |
I: | Protocol Type | BASIC_BEKEN |
I: +--------------------+---------------------------+
I: |-- Finished in 0.076 s
That seems right, but trying to read produces an early error:
$ ltchiptool flash read -d /dev/ttyUSB0 BK7231N test-image
I: Connecting to 'Beken 7231N' on /dev/ttyUSB0 @ 115200
I: |-- Success! Chip info: None
I: Reading Flash (2 MiB) to 'test-image'
[----------------------------------------------------------------] 0% 00:0
[----------------------------------------------------------------] 0% 00:0
[----------------------------------------------------------------] 1% 00:03:10
E: ValueError: Chip CRC value 41F76468 does not match calculated CRC value FC74788D (at 0x0)
E: |-- File "/home/dwildstr/.local/pipx/venvs/ltchiptool/lib/python3.11/site-packages/ltchiptool/soc/bk72xx/flash.py", line 234, in flash_read_raw
Running ltchiptool with the "-C" option keeps it from failing, and pulls 2 megabytes off in 193 seconds, but trying to use bk7231flasher's config extraction tool on it gives the error "Failed to extract Tuya keys - magic constant header not found in binary" when run on the result.
I want to read before trying to write, because (a) it's a nondestructive test of the system, and (b) I want to pull the Tuya config out, just in case this particular model uses atypical GPIO mappings. I hope I'm making a simple dumb error here --- I rarely do serial flashes, and have never physically flashed a Tuya MCU before, just ESP8266s and ESP32s, so I'd welcome the news that there's an easy way to fix the problem I'm having.