Moes Smart LED Bulb WB-TD5-RWW-GU10-MS (BP5758): Flashing Troubleshooting & Tips

Name: Moes Smart LED Bulb WB-TD5-RWW-GU10-MS (BP5758): Flashing Troubleshooting & Tips
Uploaded: 2023-08-06T23:13:22+02:00
Description: Hello, I purchased these smart bulbs from AliExpress , assuming they'd be the WB-YL5 bulb that was flashed successfully in this Topic . I tried flashing them with tuya-cloudcutter but didn't have any success yet, so I opened one of them up. The front glass lifts off easily and there's a chip on...

Question

Hello, I purchased these smart bulbs from AliExpress , assuming they'd be the WB-YL5 bulb that was flashed successfully in this Topic . I tried flashing them with tuya-cloudcutter but didn't have any success yet, so I opened one of them up. The front glass lifts off easily and there's a chip on...

p.kaczmarek2 · Answer

Hello. Cloudcutter requires you to make the firmware dump first. so you might need to disassemble at least one bulb. But don't worry! Just make some detailed photos of the device, and you might get a free SD card from us, once you make a full teardown/review of the bulb:
https://www.elektroda.com/rtvforum/topic3950844.html
Before you disassemble bulb, you might consider trying similar device profiles from the Cutter, but I don't know what are the chances of getting a match.

BP5758 is already supported by OpenBeken, so once you flash Obk, there will be no problems. You might also note how is the BP5758 connected, which two signals are used for SDA and SCL, but that's not necessary, you can also resort to guessing or just hope that they will be set in the flash dump you do.

As for flash dumping, you can use:
https://github.com/openshwprojects/BK7231GUIFlashTool
or just any older tool, bkWriter 1.60 or hid_download_py

For generic procedure with bulbs, you can consult this video:

You can also watch BL602 + BP5758 video. It's also about OpenBeken:
[youtube]
https://www.youtube.com/watch?v=L6d42IMGhHw
[/youtube]

Please note that when done correctly, the bulb teardown is not a destructive process. I have tore down ALL of my bulbs and only one of them didn't go back together after that, the Gu10 one, so... yea, you have a bit harder bulb to handle, but still, it should be doable.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

dennis_g · Answer

Thanks for your reply. Do you think it's worthwhile to try to make a firmware dump using Lightleak instead of the other methods you posted?

I tried using the existing profiles for the Moes WB-YL5 and Nous P8 bulb that seem to have the chips but didn't have any success.

p.kaczmarek2 · Answer

That may be a good idea! Please try it out, it's just that I have never really used all those OTA method before. I don't have much experience when it comes to them.

I am basically always buying one piece of each bulb and then do a teardown for our list:
https://openbekeniot.github.io/webapp/devicesList.html
So every bulb in my house is different. I have never flashed any devices over the air.

Okay, so please the Leak method first, and then if it fails, fall back to doing flash dump by wires. Once you have a flash dump, please also submit it here. Then I can help you with OBK configuration.

dennis_g · Answer

I didn't have any luck with Lightleak unfortunately. I'll see how I'll get a dump by wires working. I also didn't find a way to remove the PCB non-destructively yet.

p.kaczmarek2 · Answer

Where is exactly the problem? Taking out the PCB out of GU10 case? Or accessing the pads of WiFi module? It should be possible to detach the GU10 legs/pins

dennis_g · Answer

I couldn't get the PCB to move at all from the top. How would I remove the pins from the bottom?

p.kaczmarek2 · Answer

GU10s are very problematic when it comes to this, but in theory, the pins should be removable:

there is a real risk that the pin will not come back into it's place but I don't know any better method. It depends on the exact bulb model you have, some are harder to put back together than others

dennis_g · Answer

I got one of them apart now and the Chip is BK7231N and the PCB says CBLC5.

With that information, I tried to flash a firmware using the Immax 6W E14 bulb profile and it seems to work. Would a dump still be of interest though?

p.kaczmarek2 · Answer

Huh, you are lucky, well done. If you've found a matching profile, then there is no real need to do the dump, maybe just to extract the pins config or something... BP5758 requires two pins, SDA and SCL and you need to know which pins are used for that.

ferbulous · Answer

@dennis_g did the bulb case cracked after pulling the bottom pins? did you just use pliers for that or a different tool?

dennis_g · Answer

@p.kaczmarek2 Is there something I can measure to determine the pinout before trying to reassemble?

@ferbulous I twisted them with some pliers until they came off, the case didn't crack but I ripped apart one of the wires and a piece remains stuck in the "leg".

dennis_g · Answer

>>20450654
I flashed all my bulbs in the meanwhile and they work fine with the default order for BP5758, so I don't have to remap them in the startup command. Also, the pins for BP5758 are P24 for data and P26 for clock just like in the profile I used.
How would I go about creating a profile for these bulbs? Just copy the other one and change the name and manufacturer?

p.kaczmarek2 · Answer

OTA profile? Just submit 2MB dump and Cutter team will prepare it for you. or do you mean an entry for our teardowns list?

dennis_g · Answer

Yes, I meant an OTA profile, but I thought we didn't need the 2MB dump since I found a working profile?

p.kaczmarek2 · Answer

Ah, sorry, then... I don't know, people never resubmit profile under different name. It's okay as long as it's mentioned in this topic, I will add this topic to our database and people will find useful information here:
https://openbekeniot.github.io/webapp/devicesList.html

dennis_g · Answer

I bought some replacement bulbs because of the one I opened and some that failed, but I bought the version for 220VAC and not 90-260VAC as the previous ones by accident. The model number is similar though, it's WB-TD5-RWW-GU10-220-MS instead of WB-TD5-RWW-GU10-MS. I could flash them without a problem using the same profile, but the color channel mapping does not work at all. I then took off the plastic cover and discovered that the led pcb looks slightly different and the chip on there isn't a BP5758D but a SM2235EGH. Using the SM2235 with this startup command works well: Code: text Expand Select all Copy to clipboardSM2235_Map 1 0 2 3 4

anthonythomas · Answer

I've got a very similar bulb - can't seem to flash it via cloudcutter.
4.7W Moes RGB CW
Tuya app gives version as 1.5.21

Managed to do some dismantling.
BK7231N on a CBLC5 board

Any suggestions on profile? I don't mind sacrificing one bulb to dump the firmware but will that help me flash my other bulbs without dismantling?

ferbulous · Answer

@Anthony Thomas Is the firmware listed here?

anthonythomas · Answer

@ferbulous Ah, yes. Unfortunately!

Added after 41 [minutes]:

I guess my next question is - has anyone managed to flash this type of bulb without destroying it?
Because unfortunately the TX/RX pads are on the back.

ferbulous · Answer

@Anthony Thomas I ended up damaging the base/pins.If the cables were longer, it would've made the job easier since I wouldn't have to remove the PCB (ewelink gu10 bulbs).

p.kaczmarek2 · Answer

Is that eWeLink GU10? It's nice to see some manufacturer included a varistor in their product.

ferbulous · Answer

Yes, with bl602 chipset

dennis_g · Answer

So if the firmware is listed under the known patched versions, does it mean that even after creating a firmware dump, I won't be able to flash it using Tuya CloudCutter? I got 3 new bulbs that all have that version, and it would suck having to take all of them apart.

p.kaczmarek2 · Answer

I am sorry to say but it really looks like that. They can't be flashed via tuya-cloudcutter. You have to take them apart and solder the wires:

jrhenk · Answer

Seems my lucky tuya cloudcutter streak is also over :/ the moes gu10 shown above used to have the tuya firmware 1.3.21 which seems to work fine, but it is now shipped with 1.5.21, which cannot be exploited with tuya cloudcutter which is why it is also not listed as an option in cloudcutter.

Seeing how fragile these devices can be, I was wondering: Is there maybe a way to downgrade the firmware in tuya devices? Tuya offers this free iot developer platform and there is a page where you seem to be able to send instructions to devices (see image), which could potentially offer a possibility to downgrade to an exploitable firmware. I could imagine that for developers changing version needs to be an option, yet I haven't done enough research yet to know how.... maybe someone else did?

p.kaczmarek2 · Answer

I haven't heard anything about downgrading the firmware, but let us know if you find out something.

jrhenk · Answer

On Reddit, someone suggested that I look into the profile builder and add the version I want upstream on the Tuya IoT platform... sounds promising that there might be a way. I hope I find some time during the weekend to look into that.

ferbulous · Answer

@jrhenk sounds interesting Saw this page here, i wonder if it’s easy as it looks otherwise the devs would have considered this

p.kaczmarek2 · Answer

Interesting, I haven't tried that yet. But does it allow to downgrade the firmware?

Moes Smart LED Bulb WB-TD5-RWW-GU10-MS (BP5758): Flashing Troubleshooting & Tips

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Post #24

Post #25

Post #26

Post #27

Post #28

Post #29

Post #30

Topic summary