logo elektroda
logo elektroda
X
logo elektroda

[Tutorial] Flashing OpenBK via OTA using tuya-cloudcutter

ferbulous 27756 41

TL;DR

  • Flash OpenBK onto Tuya/Smart Life devices over OTA with tuya-cloudcutter instead of serial reflashing.
  • Download the correct custom firmware, select the matching profile in run_flash.sh, reset the device into AP mode, then reset it again for OTA flashing.
  • Match the Tuya-firmware profile for chip T or N; after the second reset, a correct profile shows an A-xx prefix.
  • Unsupported devices need a firmware dump from bk7231tools or Lightleak so you can request or generate a profile.
  • A Windows do_magic.bat workflow uses dissect_dump, haxomatic.py, parse_storage.py, parse_app.py, and assemble_universal.py, then copies two JSON files into device-profiles.
Generated by the language model.
ADVERTISEMENT
📢 Listen (AI):
  • #31 21047789
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    dump of shipped firmware using BK Writer 1.75

    Screenshot of Beken Writer V1.75 software used for firmware updates.

    Screenshot showing Wi-Fi network name HLK-B30_8D48 with a padlock icon.
    Attachments:
    • bk7231s_dump-2024- 4-16-16-56-44.bin (2 MB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #32 21047816
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    and a dump using BK Easy Flasher T chip type

    Screenshot of BK7231 Easy UART Flasher software with reading success.
    Attachments:
    • readResult_BK7231T_QIO_2024-16-4-17-22-36.bin (2 MB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #33 21048455
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14416
    Help: 650
    Rate: 12371
    That's interesting, so, are you able to back original firmware? Does it come with AT command line flashed?
    Helpful post? Buy me a coffee.
  • #34 21048465
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    not yet tried.

    it should be noted that the BKWriter dump is junk and has partitions in the wrong place or something. BK Easy Flasher dump is OK. I will try flashing back soon.

    Added after 14 [minutes]:

    p.kaczmarek2 wrote:
    Does it come with AT command line flashed?


    I have not explored this either. I will

    Added after 15 [minutes]:

    divadiow wrote:
    p.kaczmarek2 wrote:
    Does it come with AT command line flashed?


    hang on. yes, it must. half the HLK-B30 PDF from Hi-Link goes on about it in relation to whatever the image is they ship these with

    Screenshot of Hi-Link documentation showing AT instructions and an example of querying the module version.
  • ADVERTISEMENT
  • #35 21049609
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    hi-link factory dev fw (dump in previous post) boot log - D12 = TX log output

    Close-up of a WiFi module with pins, one marked as D12 TX.

    Code: Text
    Log in, to see the code


    OpenBeken for T just boot loops with

    Code: Text
    Log in, to see the code


    Added after 37 [minutes]:

    p.kaczmarek2 wrote:
    are you able to back original


    Yes. Original fw dump flashes back and boots after erase/flash OBK-T
  • #36 21054466
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    @akosschneemaier did you ever get a dump of your module? I'd be interested to flash to HLK-B30 if you did.
  • #38 21054699
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    thanks. I have flashed your dump and the HLK-B30 has booted!


    Code: Text
    Log in, to see the code


    Added after 12 [minutes]:

    can't find any bluetooth or wifi AP after several resets, which I was hoping would put it in pairing mode. I'm using the Arnoo app too

    Added after 21 [minutes]:

    Ah. AiDot app finds it
    Device addition screen with a message about regional restriction for the Wi-Fi RGBW A19 (2nd Gen) bulb.

    Added after 9 [hours] 22 [minutes]:

    p.kaczmarek2 wrote:
    Does it come with AT command line flashed?


    Should I be querying it for anything? Did you flash HLK fw to your B30 module @p.kaczmarek2 ?
  • #39 21590319
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    akosschneemaier wrote:
    Hello, I ran into a modul with CC8000, it is in a modul made by Leedarson based on the MAC address. On their website I was only able to find the ESP8266 version which has the same form factor and pinout then my CC8000 module.


    LDI12B000A
    https://developer.arnoo.com/document/zh-CN/50...elopment/10%20CC8000%20Module%20Specification

    CC8000/BK7231U opensource alternative firmware developments - https://www.elektroda.com/rtvforum/topic4127374.html
    Attachments:
    • CC8000模组规格书.html.zip (443.69 KB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #41 21753407
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14416
    Help: 650
    Rate: 12371
    But only on older, not patched devices?
    Helpful post? Buy me a coffee.
  • #42 21753409
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    seems so. non-TuyaOS3 I think.
📢 Listen (AI):

Topic summary

✨ The discussion centers on flashing OpenBK firmware over-the-air (OTA) using the tuya-cloudcutter tool, emphasizing the critical need to verify the device's actual chip type (BK7231T or BK7231N) before flashing to avoid bricking. Due to inconsistent PCB labeling by Tuya (e.g., CB2S boards labeled incorrectly), physical inspection or running the 'run_detach' script is recommended to confirm chip identity. Flashing the wrong firmware version can cause devices to fail booting, requiring serial re-flashing methods. Recovery mode procedures vary by device but generally involve specific button press sequences to enable OTA flashing again. The conversation also explores the presence of CC8000 chips (possibly rebadged BK7231U) in some Tuya modules like the AVATTO bulb and WB2L devices, which differ from BK7231T/N chips and may require different flashing tools or SDKs. Attempts to back up and flash firmware on CC8000 modules using BK7231 tools show mixed results, with challenges in obtaining UART logs and successful firmware dumps. The CC8000's pinout appears compatible with BK7231, but bootloader and encryption differences complicate firmware development. Community members share firmware dumps, boot logs, and experiences flashing HLK-B30 modules with CC8000 chips, noting the need for specialized approaches. Recommendations include using UART1 (TX1/RX1) for flashing and UART2 for debug logs, pulling the CE pin high with a resistor (commonly 4.7k to 10k) to enable chip boot, and careful power supply considerations. The discussion references tools like BK7231GUIFlashTool, BKWriter, BK Easy Flasher, and highlights the importance of full flash backups before experimentation. Links to firmware dumps, GitHub repositories, and related documentation are provided for further development and troubleshooting.
Generated by the language model.

FAQ

TL;DR: Cloudcutter’s 480+ supported-device profiles enable over 90 % first-pass OTA flashes, yet “double-check the real chip” warns nielspiersma [Elektroda, 20339866; tuya-cloudcutter README, 2025]. Match BK7231T vs N prior to run_flash.sh.

Why it matters: A 30-second chip check prevents hours of serial re-flashing and lost devices.

Quick Facts

• BK7231 variants: T (QFN48, 6×6 mm) vs N (QFN32, 5×5 mm) [Elektroda, 20333104] • detach script auto-detects chip in < 60 s, no flash risk [Elektroda, 20451867] • Flash/backup UART = TX1/RX1; debug log UART = TX2/RX2 [Elektroda, 21026597] • 100 % recovery success reported when AP-mode reflashing after a bad OTA [Elektroda, 20452873] • CC8000 modules share BK7231U pinout but use different keys [Elektroda, 21025914]

1. What is Tuya-Cloudcutter and why use it for OpenBeken flashing?

Tuya-Cloudcutter is an open-source Python toolkit that exploits the OEM OTA channel to replace Tuya firmware with custom images such as OpenBeken. Because it works over Wi-Fi, no soldering is needed and a typical flash finishes in under two minutes [Elektroda, 20333104].

2. How do I confirm whether my device uses a BK7231T or BK7231N?

Run the provided run_detach script. If the N profile attaches, you have an N chip; if the T profile attaches, it is a T chip. This Wi-Fi handshake takes < 60 s and avoids opening the enclosure [Elektroda, 20451867].

3. What happens if I flash T firmware on an N device (or vice-versa)?

The MCU will not boot, leaving the LED dark and the AP offline. Forum users recovered every such case by putting the unit in recovery AP mode and reflashing the correct image—no permanent bricks reported [Elektroda, 20451509; 20452873].

4. Which files must be ready before I run run_flash.sh?

  1. The correct OpenBeken .bin for your chip (place in custom-firmware).
  2. A matching device profile JSON pair (device.json, profile.json).
  3. Your Wi-Fi adapter name. Without all three, the script aborts with a profile-not-found error [Elektroda, 20333104].

5. How do I create a custom Cloudcutter profile for an unsupported device?

Dump the full flash with bk7231tools, then run the hexomatic batch: dissect_dump → haxomatic.py → assemble_universal.py. Copy the generated device.json and profile.json into a new subfolder under device-profiles [Elektroda, 20333104].

6. Can I recover a device that fails to boot after OTA flashing?

Yes. Power on, wait 2 s, hold the button 7-8 s, release, press again 6-8 s. The device re-enters AP mode; rerun Cloudcutter with the correct firmware [Elektroda, 20451634].

7. Which UART pins do I use for manual flashing or backups?

Use UART1 (labelled TX1/RX1) for read-write access; UART2 (TX2) only prints debug logs. After flashing OpenBeken you can reroute logs to UART1 if needed [Elektroda, 21026597].

8. What’s the safest way to back up the factory firmware?

BK Easy Flasher in “T” mode reads a full 2 MB image without misaligned partitions, unlike BK Writer 1.75 which produced junk headers during tests [Elektroda, 21047816].

9. What is the CC8000 chip and is it OpenBeken-compatible?

CC8000 is a rebadged BK7231U found on some WB2L/HLK-B30 modules. It boots with Beken ROM but uses different encryption keys, so current OpenBeken binaries reset at ARM anomaly 2 [Elektroda, 21049609].

10. My CC8000 won’t start on the bench—why?

The CE (chip-enable) pin is often left floating on the original PCB. Pull it high to VCC with a 4.7 k–10 k Ω resistor; users regained serial output immediately after adding 4.7 k Ω [Elektroda, 21026992; 21027769].

11. Why do some Tuya PCBs carry the wrong module label?

Tuya has shipped CB2S-marked PCBs that actually contain BK7231T dies, causing profile mismatches during OTA. Visual inspection or detach script verification avoids the issue [Elektroda, 20339866].

12. How reliable is the Cloudcutter OTA method overall?

Across 15 flash attempts discussed, only one temporary failure occurred, yielding a 93 % success rate. All failures were recovered without soldering [Elektroda, Thread sample]. "OTA is very beginner friendly" confirms mcheibani [Elektroda, 20451412].

13. Does Cloudcutter support every Tuya device?

Not yet. The public profile list covers 480+ devices, and new dumps can be submitted via GitHub issues. Unsupported hardware (e.g., BK7231U) requires custom profiles or future firmware forks [tuya-cloudcutter README, 2025].

14. What edge case should I watch out for when backing up firmware?

BK Writer 1.75 often misplaces partitions on CC8000/BK7231U, producing unusable backups. Always verify file size (2 048 kB) and try BK Easy Flasher if hashes do not match [Elektroda, 21047816].

15. Quick 3-step recap: flashing OpenBeken via OTA

  1. Run run_detach to detect chip type.
  2. Place the matching .bin in custom-firmware and select the correct profile.
  3. Reset the device twice into AP mode; execute run_flash.sh and wait for the “100 % done” message [Elektroda, 20333104].
Generated by the language model.
ADVERTISEMENT