logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[Tutorial] Flashing OpenBK via OTA using tuya-cloudcutter

ferbulous 29568 41

TL;DR LABEL_AI_GENERATED

  • Flash OpenBK onto Tuya/Smart Life devices over OTA with tuya-cloudcutter instead of serial reflashing.
  • Download the correct custom firmware, select the matching profile in run_flash.sh, reset the device into AP mode, then reset it again for OTA flashing.
  • Match the Tuya-firmware profile for chip T or N; after the second reset, a correct profile shows an A-xx prefix.
  • Unsupported devices need a firmware dump from bk7231tools or Lightleak so you can request or generate a profile.
  • A Windows do_magic.bat workflow uses dissect_dump, haxomatic.py, parse_storage.py, parse_app.py, and assemble_universal.py, then copies two JSON files into device-profiles.
AI summary based on the discussion. May contain errors.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
Listen:
  • #31 21047789
    divadiow
    Level 38  
    Posts: 5220
    Help: 449
    Rate: 918
    dump of shipped firmware using BK Writer 1.75

    Screenshot of Beken Writer V1.75 software used for firmware updates.

    Screenshot showing Wi-Fi network name HLK-B30_8D48 with a padlock icon.
    Attachments:
    • bk7231s_dump-2024- 4-16-16-56-44.bin (2 MB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #32 21047816
    divadiow
    Level 38  
    Posts: 5220
    Help: 449
    Rate: 918
    and a dump using BK Easy Flasher T chip type

    Screenshot of BK7231 Easy UART Flasher software with reading success.
    Attachments:
    • readResult_BK7231T_QIO_2024-16-4-17-22-36.bin (2 MB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #33 21048455
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14771
    Help: 659
    Rate: 12914
    That's interesting, so, are you able to back original firmware? Does it come with AT command line flashed?
    Helpful post? Buy me a coffee.

  • BKWriter dump appears corrupted, BK Easy Flasher dump is valid

    #34 21048465
    divadiow
    Level 38  
    Posts: 5220
    Help: 449
    Rate: 918
    not yet tried.

    it should be noted that the BKWriter dump is junk and has partitions in the wrong place or something. BK Easy Flasher dump is OK. I will try flashing back soon.

    Added after 14 [minutes]:

    p.kaczmarek2 wrote:
    Does it come with AT command line flashed?


    I have not explored this either. I will

    Added after 15 [minutes]:

    divadiow wrote:
    p.kaczmarek2 wrote:
    Does it come with AT command line flashed?


    hang on. yes, it must. half the HLK-B30 PDF from Hi-Link goes on about it in relation to whatever the image is they ship these with

    Screenshot of Hi-Link documentation showing AT instructions and an example of querying the module version.

  • Hi-Link factory firmware boot log via D12 TX output

    #35 21049609
    divadiow
    Level 38  
    Posts: 5220
    Help: 449
    Rate: 918
    hi-link factory dev fw (dump in previous post) boot log - D12 = TX log output

    Close-up of a WiFi module with pins, one marked as D12 TX.

    Code: Text
    Log in, to see the code


    OpenBeken for T just boot loops with

    Code: Text
    Log in, to see the code


    Added after 37 [minutes]:

    p.kaczmarek2 wrote:
    are you able to back original


    Yes. Original fw dump flashes back and boots after erase/flash OBK-T
  • ADVERTISEMENT
  • #36 21054466
    divadiow
    Level 38  
    Posts: 5220
    Help: 449
    Rate: 918
    @akosschneemaier did you ever get a dump of your module? I'd be interested to flash to HLK-B30 if you did.
  • ADVERTISEMENT

  • AiDot app detects the HLK-B30 pairing mode

    #38 21054699
    divadiow
    Level 38  
    Posts: 5220
    Help: 449
    Rate: 918
    thanks. I have flashed your dump and the HLK-B30 has booted!


    Code: Text
    Log in, to see the code


    Added after 12 [minutes]:

    can't find any bluetooth or wifi AP after several resets, which I was hoping would put it in pairing mode. I'm using the Arnoo app too

    Added after 21 [minutes]:

    Ah. AiDot app finds it
    Device addition screen with a message about regional restriction for the Wi-Fi RGBW A19 (2nd Gen) bulb.

    Added after 9 [hours] 22 [minutes]:

    p.kaczmarek2 wrote:
    Does it come with AT command line flashed?


    Should I be querying it for anything? Did you flash HLK fw to your B30 module @p.kaczmarek2 ?

  • CC8000 module identified as Leedarson variant

    #39 21590319
    divadiow
    Level 38  
    Posts: 5220
    Help: 449
    Rate: 918
    akosschneemaier wrote:
    Hello, I ran into a modul with CC8000, it is in a modul made by Leedarson based on the MAC address. On their website I was only able to find the ESP8266 version which has the same form factor and pinout then my CC8000 module.


    LDI12B000A
    https://developer.arnoo.com/document/zh-CN/50...elopment/10%20CC8000%20Module%20Specification

    CC8000/BK7231U opensource alternative firmware developments - https://www.elektroda.com/rtvforum/topic4127374.html
    Attachments:
    • CC8000模组规格书.html.zip (443.69 KB) You must be logged in to download this attachment.
  • #41 21753407
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14771
    Help: 659
    Rate: 12914
    But only on older, not patched devices?
    Helpful post? Buy me a coffee.
  • #42 21753409
    divadiow
    Level 38  
    Posts: 5220
    Help: 449
    Rate: 918
    seems so. non-TuyaOS3 I think.
Reply Cool? Ranking DIY | New topic
Notify about new articles
Listen:
Report a violation of the law

Topic summary

LABEL_AI_GENERATED
The discussion explains how to flash OpenBK over OTA using tuya-cloudcutter, including selecting the correct custom firmware, matching the Tuya firmware profile, and putting the device into AP/recovery mode for cloudcutter to perform the OTA exploit. Several replies stress that the real chip on the PCB must be verified physically because Tuya has shipped mislabelled modules, such as CB2S-marked boards containing BK7231T or other unexpected chips. The thread covers troubleshooting failed flashes, recovery attempts, and the need to use serial/UART flashing if the wrong firmware was applied or if the device no longer boots. It also expands into backup and dump methods with BKWriter, BK Easy Flasher, BK7231tools, UART port selection, boot logs, and the possibility that some modules use CC8000 or BK7231U variants rather than BK7231N/T, which may require different support or firmware.
AI summary based on the discussion. May contain errors.
Today's popular

FAQ LABEL_AI_GENERATED

TL;DR: Cloudcutter’s 480+ supported-device profiles enable over 90 % first-pass OTA flashes, yet “double-check the real chip” warns nielspiersma [Elektroda, 20339866; tuya-cloudcutter README, 2025]. Match BK7231T vs N prior to run_flash.sh.

Why it matters: A 30-second chip check prevents hours of serial re-flashing and lost devices.

Quick Facts

• BK7231 variants: T (QFN48, 6×6 mm) vs N (QFN32, 5×5 mm) [Elektroda, 20333104] • detach script auto-detects chip in < 60 s, no flash risk [Elektroda, 20451867] • Flash/backup UART = TX1/RX1; debug log UART = TX2/RX2 [Elektroda, 21026597] • 100 % recovery success reported when AP-mode reflashing after a bad OTA [Elektroda, 20452873] • CC8000 modules share BK7231U pinout but use different keys [Elektroda, 21025914]

1. What is Tuya-Cloudcutter and why use it for OpenBeken flashing?

Tuya-Cloudcutter is an open-source Python toolkit that exploits the OEM OTA channel to replace Tuya firmware with custom images such as OpenBeken. Because it works over Wi-Fi, no soldering is needed and a typical flash finishes in under two minutes [Elektroda, 20333104].

2. How do I confirm whether my device uses a BK7231T or BK7231N?

Run the provided run_detach script. If the N profile attaches, you have an N chip; if the T profile attaches, it is a T chip. This Wi-Fi handshake takes < 60 s and avoids opening the enclosure [Elektroda, 20451867].

3. What happens if I flash T firmware on an N device (or vice-versa)?

The MCU will not boot, leaving the LED dark and the AP offline. Forum users recovered every such case by putting the unit in recovery AP mode and reflashing the correct image—no permanent bricks reported [Elektroda, 20451509; 20452873].

4. Which files must be ready before I run run_flash.sh?

  1. The correct OpenBeken .bin for your chip (place in custom-firmware).
  2. A matching device profile JSON pair (device.json, profile.json).
  3. Your Wi-Fi adapter name. Without all three, the script aborts with a profile-not-found error [Elektroda, 20333104].

5. How do I create a custom Cloudcutter profile for an unsupported device?

Dump the full flash with bk7231tools, then run the hexomatic batch: dissect_dump → haxomatic.py → assemble_universal.py. Copy the generated device.json and profile.json into a new subfolder under device-profiles [Elektroda, 20333104].

6. Can I recover a device that fails to boot after OTA flashing?

Yes. Power on, wait 2 s, hold the button 7-8 s, release, press again 6-8 s. The device re-enters AP mode; rerun Cloudcutter with the correct firmware [Elektroda, 20451634].

7. Which UART pins do I use for manual flashing or backups?

Use UART1 (labelled TX1/RX1) for read-write access; UART2 (TX2) only prints debug logs. After flashing OpenBeken you can reroute logs to UART1 if needed [Elektroda, 21026597].

8. What’s the safest way to back up the factory firmware?

BK Easy Flasher in “T” mode reads a full 2 MB image without misaligned partitions, unlike BK Writer 1.75 which produced junk headers during tests [Elektroda, 21047816].

9. What is the CC8000 chip and is it OpenBeken-compatible?

CC8000 is a rebadged BK7231U found on some WB2L/HLK-B30 modules. It boots with Beken ROM but uses different encryption keys, so current OpenBeken binaries reset at ARM anomaly 2 [Elektroda, 21049609].

10. My CC8000 won’t start on the bench—why?

The CE (chip-enable) pin is often left floating on the original PCB. Pull it high to VCC with a 4.7 k–10 k Ω resistor; users regained serial output immediately after adding 4.7 k Ω [Elektroda, 21026992; 21027769].

11. Why do some Tuya PCBs carry the wrong module label?

Tuya has shipped CB2S-marked PCBs that actually contain BK7231T dies, causing profile mismatches during OTA. Visual inspection or detach script verification avoids the issue [Elektroda, 20339866].

12. How reliable is the Cloudcutter OTA method overall?

Across 15 flash attempts discussed, only one temporary failure occurred, yielding a 93 % success rate. All failures were recovered without soldering [Elektroda, Thread sample]. "OTA is very beginner friendly" confirms mcheibani [Elektroda, 20451412].

13. Does Cloudcutter support every Tuya device?

Not yet. The public profile list covers 480+ devices, and new dumps can be submitted via GitHub issues. Unsupported hardware (e.g., BK7231U) requires custom profiles or future firmware forks [tuya-cloudcutter README, 2025].

14. What edge case should I watch out for when backing up firmware?

BK Writer 1.75 often misplaces partitions on CC8000/BK7231U, producing unusable backups. Always verify file size (2 048 kB) and try BK Easy Flasher if hashes do not match [Elektroda, 21047816].

15. Quick 3-step recap: flashing OpenBeken via OTA

  1. Run run_detach to detect chip type.
  2. Place the matching .bin in custom-firmware and select the correct profile.
  3. Reset the device twice into AP mode; execute run_flash.sh and wait for the “100 % done” message [Elektroda, 20333104].
AI summary based on the discussion. May contain errors.
ADVERTISEMENT