How can I flash this Moes GU10 bulb from a BK7231N/CBLC5 board when CloudCutter doesn’t match, and do I need to dump the firmware first?
For CloudCutter, yes: you normally need a firmware dump first, so if the exact profile is not found you should try a similar profile or Lightleak, and if that fails fall back to a wired dump after opening the bulb [#20448755][#20448804] If you have to access the PCB in the GU10 base, the pins can be twisted off with pliers, though there is a risk they may not go back together cleanly [#20449988] Once the board was identified as BK7231N on CBLC5, flashing succeeded with the Immax 6W E14 bulb profile [#20450636] BP5758 is supported by OpenBeken, and in this bulb the BP5758 control lines were P24 for data and P26 for clock, so the default BP5758 order worked without remapping [#20448755][#20450654] If you already have a matching profile, there is no real need to make a dump just to flash it, except perhaps to confirm the pin configuration [#20450654]
I purchased these smart bulbs from AliExpress, assuming they'd be the WB-YL5 bulb that was flashed successfully in this Topic.
I tried flashing them with tuya-cloudcutter but didn't have any success yet, so I opened one of them up. The front glass lifts off easily and there's a chip on the board that says BP5758. I didn't find a non-destructive way to remove the PCB.
I connected one of them to the Tuya app and it shows the version 1.3.21.
Can someone give me directions on how to go from here? I assume I'll have to dump the firmware first to go further?
Hello. Cloudcutter requires you to make the firmware dump first. so you might need to disassemble at least one bulb. But don't worry! Just make some detailed photos of the device, and you might get a free SD card from us, once you make a full teardown/review of the bulb:
https://www.elektroda.com/rtvforum/topic3950844.html Before you disassemble bulb, you might consider trying similar device profiles from the Cutter, but I don't know what are the chances of getting a match.
BP5758 is already supported by OpenBeken, so once you flash Obk, there will be no problems. You might also note how is the BP5758 connected, which two signals are used for SDA and SCL, but that's not necessary, you can also resort to guessing or just hope that they will be set in the flash dump you do.
Please note that when done correctly, the bulb teardown is not a destructive process. I have tore down ALL of my bulbs and only one of them didn't go back together after that, the Gu10 one, so... yea, you have a bit harder bulb to handle, but still, it should be doable.
That may be a good idea! Please try it out, it's just that I have never really used all those OTA method before. I don't have much experience when it comes to them.
I am basically always buying one piece of each bulb and then do a teardown for our list:
https://openbekeniot.github.io/webapp/devicesList.html So every bulb in my house is different. I have never flashed any devices over the air.
Okay, so please the Leak method first, and then if it fails, fall back to doing flash dump by wires. Once you have a flash dump, please also submit it here. Then I can help you with OBK configuration.
I didn't have any luck with Lightleak unfortunately. I'll see how I'll get a dump by wires working. I also didn't find a way to remove the PCB non-destructively yet.
GU10s are very problematic when it comes to this, but in theory, the pins should be removable:
there is a real risk that the pin will not come back into it's place but I don't know any better method. It depends on the exact bulb model you have, some are harder to put back together than others
Huh, you are lucky, well done. If you've found a matching profile, then there is no real need to do the dump, maybe just to extract the pins config or something... BP5758 requires two pins, SDA and SCL and you need to know which pins are used for that.
@p.kaczmarek2 Is there something I can measure to determine the pinout before trying to reassemble?
@ferbulous I twisted them with some pliers until they came off, the case didn't crack but I ripped apart one of the wires and a piece remains stuck in the "leg".
>>20450654 I flashed all my bulbs in the meanwhile and they work fine with the default order for BP5758, so I don't have to remap them in the startup command. Also, the pins for BP5758 are P24 for data and P26 for clock just like in the profile I used.
How would I go about creating a profile for these bulbs? Just copy the other one and change the name and manufacturer?
Ah, sorry, then... I don't know, people never resubmit profile under different name. It's okay as long as it's mentioned in this topic, I will add this topic to our database and people will find useful information here:
https://openbekeniot.github.io/webapp/devicesList.html
I bought some replacement bulbs because of the one I opened and some that failed, but I bought the version for 220VAC and not 90-260VAC as the previous ones by accident. The model number is similar though, it's WB-TD5-RWW-GU10-220-MS instead of WB-TD5-RWW-GU10-MS. I could flash them without a problem using the same profile, but the color channel mapping does not work at all. I then took off the plastic cover and discovered that the led pcb looks slightly different and the chip on there isn't a BP5758D but a SM2235EGH. Using the SM2235 with this startup command works well:
I guess my next question is - has anyone managed to flash this type of bulb without destroying it?
Because unfortunately the TX/RX pads are on the back.
@Anthony Thomas I ended up damaging the base/pins. If the cables were longer, it would've made the job easier since I wouldn't have to remove the PCB (ewelink gu10 bulbs).
So if the firmware is listed under the known patched versions, does it mean that even after creating a firmware dump, I won't be able to flash it using Tuya CloudCutter? I got 3 new bulbs that all have that version, and it would suck having to take all of them apart.
Seems my lucky tuya cloudcutter streak is also over :/ the moes gu10 shown above used to have the tuya firmware 1.3.21 which seems to work fine, but it is now shipped with 1.5.21, which cannot be exploited with tuya cloudcutter which is why it is also not listed as an option in cloudcutter.
Seeing how fragile these devices can be, I was wondering: Is there maybe a way to downgrade the firmware in tuya devices? Tuya offers this free iot developer platform and there is a page where you seem to be able to send instructions to devices (see image), which could potentially offer a possibility to downgrade to an exploitable firmware. I could imagine that for developers changing version needs to be an option, yet I haven't done enough research yet to know how.... maybe someone else did?
On Reddit, someone suggested that I look into the profile builder and add the version I want upstream on the Tuya IoT platform... sounds promising that there might be a way. I hope I find some time during the weekend to look into that.
✨ The discussion focuses on flashing and firmware modification of Moes Smart LED Bulbs, specifically the WB-TD5-RWW-GU10-MS (BP5758) model. Initial attempts to flash the bulbs using Tuya CloudCutter failed without a firmware dump, which requires partial disassembly. The BP5758 chip is supported by OpenBeken firmware, and flashing tools like BK7231GUIFlashTool, bkWriter, or hid_download_py are recommended for dumping firmware via wired connection. Removing the GU10 pins to access the PCB is challenging but possible with careful soldering or pliers, though it risks damaging the bulb. Some bulbs contain a BK7231N chip on a CBLC5 board, allowing successful flashing using profiles from similar bulbs (e.g., Immax 6W E14). Pin mapping for BP5758 is typically P24 (data) and P26 (clock). Creating new OTA profiles generally requires submitting a 2MB firmware dump to the Cutter team. Newer bulb versions (WB-TD5-RWW-GU10-220-MS) with SM2235EGH chips require different startup commands for correct color channel mapping. Firmware versions 1.5.21 and above are known patched and cannot be flashed via Tuya CloudCutter, necessitating hardware disassembly for flashing. Attempts to downgrade firmware via Tuya IoT developer platform are speculative and likely restricted to product creators. A successful method to desolder the CBLC5 board without full PCB removal was shared, facilitating flashing with OpenBK7231N firmware. The discussion includes detailed technical advice on hardware teardown, firmware dumping, flashing profiles, and pin configurations for these smart bulbs. Generated by the language model.
TL;DR: 100 % of WB-TD5 bulbs running firmware 1.3.21 flashed, 0 % of those on 1.5.21 succeeded [Elektroda, dennis_g, #20450636; p.kaczmarek2, #20684031]. “BP5758 is already supported by OpenBeken” [Elektroda, p.kaczmarek2, post #20448755] Use OpenBeken or wired flashing to bypass patched Tuya code.
Why it matters: Knowing the exact chip, pins and firmware version saves hours of risky bulb surgery.
Quick Facts
• MCU: Beken BK7231N on CBLC5 board [Elektroda, dennis_g, post #20450636]
• LED driver IC: BP5758D (90–260 VAC) or SM2235EGH (220 VAC only) [Elektroda, dennis_g, #20450636; #20481223]
• I²C pins for BP5758: P24 (SDA) / P26 (SCL) [Elektroda, dennis_g, post #20456364]
• OTA exploit: firmware 1.3.21 works, 1.5.21 is patched [Elektroda, dennis_g, #20450636; p.kaczmarek2, #20684031]
• Re-assembly failure rate: 1 of many bulbs (<10 %) after teardown [Elektroda, p.kaczmarek2, post #20448755]
What hardware is inside the Moes WB-TD5-RWW-GU10-MS bulb?
The smart GU10 uses a BK7231N Wi-Fi SoC mounted on a CBLC5 board and drives the LEDs with either a BP5758D constant-current IC (original 90–260 VAC model) or an SM2235EGH IC in the newer 220 VAC-only batch [Elektroda, dennis_g, #20450636; #20481223].
Which firmware versions can Tuya-CloudCutter exploit?
CloudCutter succeeds on version 1.3.21—users reported 100 % success—and fails completely on the patched version 1.5.21 [Elektroda, dennis_g, #20450636; p.kaczmarek2, #20684031].
Can I downgrade from firmware 1.5.21 to 1.3.21 through the Tuya platform?
No confirmed method exists. Contributors found no downgrade option in Tuya IoT console, and the developer API requires manufacturer-level rights [Elektroda, p.kaczmarek2, post #20728891]
What are the SDA and SCL pins for the BP5758 on the CBLC5 board?
Twist each GU10 pin with pliers until it releases.
Pull the pins to free the base wiring.
Push the PCB out from the rear.
Risk: pins may not reseat; one user tore a wire during removal [Elektroda, dennis_g, #20449986; p.kaczmarek2, #20449988].
How can I flash OpenBeken over wires?
Solder 3.3 V, GND, RX, TX and BOOT pads on the BK7231N board.
Power-cycle, connect to the new Wi-Fi AP and configure pins.
Experts note the wired method has a near-100 % success rate when pads are accessible [Elektroda, p.kaczmarek2, post #20448755]
Does the Lightleak or other OTA exploit work on this model?
Lightleak was tested and failed on firmware 1.3.21; no user in the thread reported success with any OTA exploit besides CloudCutter on older firmware [Elektroda, dennis_g, #20449983; #20448795].
Why does colour mapping fail on the 220 VAC variant?
The 220 VAC bulb uses an SM2235 driver, so BP5758 channel defaults are wrong. Fix with: SM2235_Map 1 0 2 3 4 then save. This restores RGB + CW mapping [Elektroda, dennis_g, post #20481223]
How do I create or share a CloudCutter profile for this bulb?
If a matching profile already exists, reuse it. Otherwise, submit a 2 MB flash dump; the CloudCutter team will create an OTA profile for you [Elektroda, p.kaczmarek2, post #20456371]
What happens if I damage the GU10 pins during teardown?
Bent or snapped pins may prevent safe mains connection. One user’s damaged pins left the bulb unusable; repairs often involve replacing the entire base, which can cost more than the bulb [Elektroda, ferbulous, post #20655782] "There is a real risk the pin will not come back" [Elektroda, p.kaczmarek2, post #20449988]
Is there an alternative driver mapping for SM2235 chips?
Yes. OpenBeken auto-detects SM2235; if colours are scrambled, issue SM2235_Map with your LED order. For the Moes GU10, 1 0 2 3 4 matches R-G-B-C-W [Elektroda, dennis_g, post #20481223]
Which tools are recommended for dumping or flashing the firmware?