logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

C01W/C02W/C03W/C04W WiFi&BT LED Controller with TuyaMCU UART protocol

williamgibsonwg 7545 58

TL;DR

  • This teardown covers C01W/C02W/C03W/C04W WiFi+BT LED controllers built around a CBU BK7231N module and a CMS32L051 microcontroller.
  • The CBU module is sandwiched between two boards, while the CMS32L051 handles Bluetooth and drives buffered RGBCW PWM outputs through a 74HC245.
  • Desoldering the CMS32L051 exposed RX/TX on pins 5/6 and allowed flashing the CBU with a 3.3V FTDI TTL-232R-3V3 cable.
  • The modified C02W now works with OpenBeken after jumpering CMS32L051 pins 10 and 16 to CBU pins 8 and 9 and mapping extra channels.
  • Desoldering and splitting the controller from the base board was difficult, and flashing was impossible with the CMS32L051 installed.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #31 21238379
    theosoft
    Level 10  
    Posts: 37
    Help: 1
    Rate: 2
    >>21238371
    Yes. Give it a try. May be the step to push the button twice is most important.
    But my first mistake was, that the device was discovered by the tuya app and i didn't realized it is bluetooth :-)
  • ADVERTISEMENT
  • #32 21238473
    jrhenk
    Level 10  
    Posts: 59
    Help: 1
    Rate: 8
    >>21238379 >>21238379
    Just tried it with the device where it never worked but unfortunately this wasn't it. I was also wrong about the version, it's a tuya 1.3.1, always ends with "[!] The profile you selected did not result in a successful exploit"... too bad, guess it will remain on that pile for now :)
    I do however noticed that my tuyacloudcutter raspberry pi kills my openwrt access points, interesting random find. Did not connect the dots the last time I tinkered with cloudcutter
  • ADVERTISEMENT
  • #33 21238512
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    jrhenk wrote:
    it's a tuya 1.3.1

    Just curious, is your device firmware 1.3.1 or 1.3.10?
  • #34 21239695
    jrhenk
    Level 10  
    Posts: 59
    Help: 1
    Rate: 8
    >>21238512 lol that's actually a very good question, gonna check and report back :)
  • #36 21253730
    theosoft
    Level 10  
    Posts: 37
    Help: 1
    Rate: 2
    Some notes:
    My devices.
    C05W 2.1.6. Cloudcutted
    HW5 MiBoxer 2.1.6: Flashed with interrupted RX (cutted with knife)

    Both now on Version: 1.17.740
    I played arround with scenes:
    1. I don't know if there are fixed scenes.
    2. Sending messages to DP25 sets scene parameters. The setting is confirmed from Tuya by sending the config back
    3. The format is, against the tuya specification, String. So when the message should be 0x01 0x02 ... you have to send the ASCII char 0x31 0x32
    4. Device has to be set to scene mode before sending message

    As an example for autoexec.bat:
    Code: text Expand Select all Copy to clipboard
    setButtonLabel 0 "Set Mode White"
setButtonColor 0 "#00FFFF"
setButtonEnabled 0 1
setButtonCommand 0 "tuyaMcu_sendCmd 0x06 1504000100"

setButtonLabel 1 "Set Mode Color"
setButtonColor 1 "#FF0000"
setButtonEnabled 1 1
setButtonCommand 1 "tuyaMcu_sendCmd 0x06 1504000101"

setButtonLabel 2 "Set Mode Scene"
setButtonColor 2 "#00FF00"
setButtonEnabled 2 1
setButtonCommand 2 "tuyaMcu_sendCmd 0x06 1504000102"

setButtonLabel 3 "Set Mode Music"
setButtonColor 3 "#0000FF"
setButtonEnabled 3 1
setButtonCommand 3 "tuyaMcu_sendCmd 0x06 1504000103"


alias soft tuyaMcu_sendCmd 0x06  19030036303434363436303230303738303345383033453830303030303030303436343630323030373830334538303030413030303030303030
setButtonLabel 5 "Soft"
setButtonColor 5 "#F0F0FF"
setButtonEnabled 5 1
setButtonCommand 5 soft 


    As you can see, the header is still HEX, but the Tuya message is ASCII coded.
    19: DP25
    03: String type
    0036: Lenght (54 char)
    303434363436303230303738303345383033453830303030303030303436343630323030373830334538303030413030303030303030

    decoded: 04 46 46 02 0078 03E8 03E8 0000 0000 46 46 02 0078 03E8 000A 0000 0000

    I wrote a tool for encode/decode scene messages...

    DP25 Editor V1.03 software interface with scene definitions.
  • ADVERTISEMENT
  • #38 21254597
    theosoft
    Level 10  
    Posts: 37
    Help: 1
    Rate: 2
    >>21254523
    Do i have to ask @p.kaczmarek2 before distributing EXE files :-)

    Added after 51 [seconds]:

    p.kaczmarek2
  • #40 21254903
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12349
    You can even post it as separate topic in Smart Home Tutorials with a brief description what it is and how it works. You can include source code as well, but not necessary.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #41 21255298
    theosoft
    Level 10  
    Posts: 37
    Help: 1
    Rate: 2
    >>21254903

    Done. Should be in the temporary forum and published after acceptens...

    Added after 8 [minutes]:

    Is there a way to have a button in homeassistant to send profiles to tuya RGB?
    The OpenBeken flashed device is able to define a webbutton. See autoexec,bat sample above.
    But these buttons are not in homeassistant :-)
  • #42 21255321
    DeDaMrAz
    Level 22  
    Posts: 596
    Help: 34
    Rate: 125
    theosoft wrote:
    Is there a way to have a button in homeassistant to send profiles to tuya RGB?
    The OpenBeken flashed device is able to define a webbutton. See autoexec,bat sample above.
    But these buttons are not in homeassistant


    Assign a channel to the button, set that chanel to toggle (I think) and do rediscovery and go from there.
  • #43 21255856
    theosoft
    Level 10  
    Posts: 37
    Help: 1
    Rate: 2
    >>21255321
    Till now no sucess to see a scene button in homeassistant
  • #44 21255918
    DeDaMrAz
    Level 22  
    Posts: 596
    Help: 34
    Rate: 125
    @theosoft

    This is a general idea that you can expand on.

    Code: text Expand Select all Copy to clipboard
    
startDriver tuyaMcu

alias TEST tuyaMcu_sendCmd 0x06 1504000100

setChannelLabel 6 TEST
publishChannel 6

addChangeHandler Channel6 == 1 TEST


    To set the CH6 to Toggle go to webapp/config.

    Screenshot of the configuration of pin settings and channel types in a TuyaMCU device.

    There are other ways to do this, it is just one example of course, and idea to play around with.

    Screenshot from the simulator of TEST toggle.

    Screenshot showing CMD console on the left with MQTT information, and a device configuration panel in a web app on the right.

    Remember after these changes delete the device from HA and do rediscovery.

    Let us know if that worked for you.
  • #45 21256532
    theosoft
    Level 10  
    Posts: 37
    Help: 1
    Rate: 2
    >>21255918
    Thanks for advice, I am closer to goul. I have to work on the logics.

    My solution at the moment:

    alias Soft backlog tuyaMcu_sendCmd 0x06 1504000102; tuyaMcu_sendCmd 0x06 19030036303434363436303230303738303345383033453830303030303030303436343630323030373830334538303030413030303030303030; addRepeatingEvent 1 1 setChannel 4 0

    // Doesn't work. Must be set with WebApp ??
    setChannelType 4 Toogle
    //
    setChannelLabel 4 Soft
    addChangeHandler Channel4 == 1 Soft
    publishChannel 4

    Added after 12 [minutes]:

    Some info:

    My HW5 modul is "strange". Set timing is different as tuya spec. Set Intervall to 100 results in 1sec blinking (Mode 1). Setting to 1 results in 10sec. An out of spec value 105 (0x69) results in 1/10 sec...
    An the modul seems to accept timings only from scene definition 0 ....

    Strange :-(

    Remote controll is allso not working, but i haven't tryed with original tuya firmware. The modul reacts, but is falling back to colormode....

    regards
  • #46 21256554
    DeDaMrAz
    Level 22  
    Posts: 596
    Help: 34
    Rate: 125
    theosoft wrote:
    tuyaMcu_sendCmd 0x06 1504000102; tuyaMcu_sendCmd 0x06...


    Are you sure you should send 0x06 command twice?? What I have seen previously (as I don't know your device) is that there is usually a power on or set mode command (I guess 0x06) followed by the different command for scene depending on the dpID.
  • #47 21257076
    theosoft
    Level 10  
    Posts: 37
    Help: 1
    Rate: 2
    >>21256554
    I tried to compine both commands, but doesn't work.
    BUT.
    I think there is a limit for message len.
    When i try to send this message from autoexec.bat :
    tuyaMcu_sendCmd 0x06 19030036303035413030303130303738303345383033453830303030303030303030303030313030303030303030303030303030303030303030
    On the RS242 interface the last 4 30 "0" are missing ...
    And maybe this is the reason for failures ...

    sending direct on CLI it is OK.

    regards
  • #48 21257143
    DeDaMrAz
    Level 22  
    Posts: 596
    Help: 34
    Rate: 125
    @theosoft

    Take a look at this thread - https://www.elektroda.pl/rtvforum/topic4014389.html

    It may help you in some way.

    We will try to help you out more but we are limited with time so please be patient.

    And as far as I remember there we change the limit some time ago so what you are sending is not close to that limit.
  • #49 21257161
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12349
    The limit is 128 bytes packet and you reach 58 bytes it seems:
    Screenshot of Visual Studio editor with a source code file open.
    Code editor window in Visual Studio with a C language code snippet.
    I've tried to replicate your problem with a self test, but is passes correctly both when run from command interface, and also when run from LittleFS....
    https://github.com/openshwprojects/OpenBK7231...mmit/f5d8d602c4526363e31af5309fab2704306de597
    @DeDaMrAz can you check on any device whether this command really sends what we expect on UART?
    Expected result is:
    Code: text Expand Select all Copy to clipboard
    
55 AA 00 06 00 3A 19030036303035413030303130303738303345383033453830303030303030303030303030313030303030303030303030303030303030303030 18

    spaces added only for clarity, treat it as hex string (remove spaces)
    Helpful post? Buy me a coffee.
  • #50 21257187
    theosoft
    Level 10  
    Posts: 37
    Help: 1
    Rate: 2
    >>21257161

    I found a buffer with the size of 128 in the autoexec.bat part. Made a quick search :-)

    file: src/cmnds/cmd_main.c Line 940.

    commandResult_t CMD_ExecuteCommand(const char* s, int cmdFlags) {
    const char* p;
    const char* args;

    char copy[128];

    Is the line in the autoexec.bat to long to be executed correctly?

    Edit: I checked the string inside of autoexec.bat and it is exectly at pos 128 where the string is cutted. So i think the buffer to copy the command as string is to small.
    With the long messages for scenedefinitions i reached that limit. Is it possible to increase the buffer char copy[128] up to 1024? Or dynamic?

    regards
  • #51 21257212
    DeDaMrAz
    Level 22  
    Posts: 596
    Help: 34
    Rate: 125
    This is the result I got from this command on a CBU module

    Code: text Expand Select all Copy to clipboard
    tuyaMcu_sendCmd 0x06 19030036303035413030303130303738303345383033453830303030303030303030303030313030303030303030303030303030303030303030


    Screenshot showing the TuyaMCU Explorer/Analyzer for OpenBeken with raw packet data in hexadecimal format.

    Code: text Expand Select all Copy to clipboard
    55 AA 00 06 00 3A 19030036303035413030303130303738303345383033453830303030303030303030303030313030303030303030303030303030303030303030 18


    @theosoft

    That is not the case, each character in your command is a single byte, for example 30 is a hex converted to byte it is 1 byte or 8 bits (00110000) so in theory for you to oversaturate that buffer you will have to send 256+ hex characters. Or at least this is what I think as I didn't look into the code for any other checks and conditions.

    You can also see that in the output where converted to 005A0001007803E803E80000000000000100000000000000000000 you are only sending 54 bytes.

    EDIT: it is maybe because it is unclear that tuyaMCu_sendCmd is using HEX and that is causing confusion.
  • #52 21257239
    theosoft
    Level 10  
    Posts: 37
    Help: 1
    Rate: 2
    >>21257212
    Here my log from TX side. Wifi Modul send message to Tuya MCU
    55h AAh 00h 06h 00h 35h 19h 03h 00h 36h 30h 30h 36h 34h 30h 30h 30h 31h 30h 30h 30h 30h 30h 33h 45h 38h 30h 33h 45h 38h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 31h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h F0h C8h
    55h AAh 00h 06h 00h 3Ah 19h 03h 00h 36h 30h 30h 36h 34h 30h 30h 30h 31h 30h 30h 30h 30h 30h 33h 45h 38h 30h 33h 45h 38h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 31h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h FDh


    It is cutted some how. I checked meanwhile allso the message send by homeassistant. The result is the same. Message is cutted. In text commandlines the byte demand is twice as much as in hex. You need 2 char for one byte description. May be to debug the situation in line 940, there should be a debug output for the copy buffer.

    regards
  • #53 21257462
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12349
    Are you using latest OBK?

    theosoft wrote:

    I found a buffer with the size of 128 in the autoexec.bat part. Made a quick search :-)

    file: src/cmnds/cmd_main.c Line 940.
    Code: C / C++
    Log in, to see the code

    This buffer is only used to store command name, not arguments. Check the whole code. Futhermore, as I said, self-test with UART passes correctly, so I would rather suspect that Beken UART queue is at fault.

    theosoft wrote:

    With the long messages for scenedefinitions i reached that limit. Is it possible to increase the buffer char copy[128] up to 1024? Or dynamic?

    This won't change anything due to the reason said above.

    I will repeat what I said in my previous post.
    I've tried sending this message from autoexec.bat and from alias in self-test:
    Code: C / C++
    Log in, to see the code

    All those tests are passing correctly. So either problem is somewhere else or is platform-specific, but buffer sizes are the same on all platforms?

    Maybe you have wrong trail and you meant that http button has limited buffer?
    Helpful post? Buy me a coffee.
  • #54 21257562
    theosoft
    Level 10  
    Posts: 37
    Help: 1
    Rate: 2
    >>21257462
    But my cmdline in autoexec.bat looks like this and the alias is used in channal cmd.
    alias Alarm backlog tuyaMcu_sendCmd 0x06 1504000102; delay_ms 500; tuyaMcu_sendCmd 0x06 19030036303036343030303130303030303345383033453830303030303030303030303030313030303030303030303030303030303030303030; addRepeatingEvent 1 1 setChannel 5 0

    And the tuyaMcu_sendCmd is sending a message, but not complete. Anyway....
    BTW. Alias in Alias is possible?

    regards
  • #55 21257816
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12349
    We don't have support for delay in backlog yet. Currently, it will not delay. And you can't send two TuyaMCU command without delay if you don't enable TuyaMCU queue. You should rather see this topic:
    https://www.elektroda.com/rtvforum/topic4014389.html
    Also search for "startScript" there:
    https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/autoexecExamples.md
    Helpful post? Buy me a coffee.
  • #56 21360665
    T3elektroda
    Level 2  
    Posts: 3
    Rate: 3
    I have a C02W over here Version 2.1.6. I'd like to cloudcut. Is there a profile available?
  • #57 21361236
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    >>21360665

    try any profile with matching version
  • #58 21526233
    Ogurezzz
    Level 5  
    Posts: 10
    Rate: 2
    Hi!
    Got something wrong with my C01W
    Linux Mint 22.1
    Mono JIT compiler version 6.8.0.105:
    Spoiler:
    ~$ mono --version
    Mono JIT compiler version 6.8.0.105 (Debian 6.8.0.105+dfsg-3.6ubuntu2 Sun Mar 31 02:55:28 UTC 2024)
    Copyright (C) 2002-2014 Novell, Inc, Xamarin Inc and Contributors. www.mono-project.com
    TLS: __thread
    SIGSEGV: altstack
    Notifications: epoll
    Architecture: amd64
    Disabled: none
    Misc: softdebug
    Interpreter: yes
    LLVM: supported, not enabled.
    Suspend: hybrid
    GC: sgen (concurrent by default)

    Fresh BK7231Flasher.exe (v19)
    Log:
    Code: text Expand Select all Copy to clipboard
    
Backup name is set to C01W.

Starting read!
Read parms: start 0x00 (sector 0), len 0x200000 (0 sectors)
Now is: 21 апреля 2025 г. 16:01:12.
Flasher mode: BK7231N
Going to open port: /dev/ttyUSB1.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (921600)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to read encryption key...
Encryption key read done!
Encryption key: 510fb093 a3cbeadc 5993a17e c7adeb03
Going to start reading at offset 0x00...
Reading 0x00... failed with serial.BytesToRead 4095 (expected 4111)
The beginning of buffer in UART contains 040EFF01E0FCF4061009000000200069 data.
Failed! There was no result to save.


    xbuild of flasher from source was failed:
    Spoiler:
    >>>> xbuild tool is deprecated and will be removed in future updates, use msbuild instead <<<<

    XBuild Engine Version 14.0
    Mono, Version 6.8.0.105
    Copyright (C) 2005-2013 Various Mono authors

    Build started 21.04.2025 15:54:41.
    __________________________________________________
    /home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher.sln: warning : Don't know how to handle GlobalSection ExtensibilityGlobals, Ignoring.
    Project "/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher.sln" (default target(s)):
    Target ValidateSolutionConfiguration:
    Building solution configuration "Debug|Any CPU".
    Target Build:
    Project "/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/BK7231Flasher.csproj" (default target(s)):
    Target PrepareForBuild:
    Configuration: Debug Platform: AnyCPU
    Created directory "bin/Debug/"
    Created directory "obj/Debug/"
    Target ResolveAssemblyReferences:
    /usr/lib/mono/xbuild/14.0/bin/Microsoft.Common.targets: warning : Reference 'System.Deployment' not resolved
    For searchpath {CandidateAssemblyFiles}
    Warning: {CandidateAssemblyFiles} not supported currently
    For searchpath {HintPathFromItem}
    HintPath attribute not found
    For searchpath {TargetFrameworkDirectory}
    For searchpath {PkgConfig}
    Considered System.Deployment, but could not find in any pkg-config files.
    For searchpath {GAC}
    Considered System.Deployment, but could not find in the GAC.
    For searchpath {RawFileName}
    Considered 'System.Deployment' as a file, but the file does not exist
    For searchpath bin/Debug/
    Considered '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/System.Deployment' as a file, but the file does not exist
    Considered '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/System.Deployment.exe' as a file, but the file does not exist
    Considered '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/System.Deployment.dll' as a file, but the file does not exist
    /usr/lib/mono/xbuild/14.0/bin/Microsoft.Common.targets: warning : Reference 'System.Net' not resolved
    For searchpath {CandidateAssemblyFiles}
    Warning: {CandidateAssemblyFiles} not supported currently
    For searchpath {HintPathFromItem}
    HintPath attribute not found
    For searchpath {TargetFrameworkDirectory}
    For searchpath {PkgConfig}
    Considered System.Net, but could not find in any pkg-config files.
    For searchpath {GAC}
    Considered System.Net, but could not find in the GAC.
    For searchpath {RawFileName}
    Considered 'System.Net' as a file, but the file does not exist
    For searchpath bin/Debug/
    Considered '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/System.Net' as a file, but the file does not exist
    Considered '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/System.Net.exe' as a file, but the file does not exist
    Considered '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/System.Net.dll' as a file, but the file does not exist
    Target CopyFilesMarkedCopyLocal:
    Copying file from '/home/ogurezzz/Projects/BK7231GUIFlashTool/packages/Newtonsoft.Json.13.0.3/lib/net35/Newtonsoft.Json.dll' to '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/Newtonsoft.Json.dll'
    Done building project "/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/BK7231Flasher.csproj".-- FAILED
    Task "MSBuild" execution -- FAILED
    Done building target "Build" in project "/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher.sln".-- FAILED
    Done building project "/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher.sln".-- FAILED

    Build FAILED.

    Warnings:

    /home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher.sln: warning : Don't know how to handle GlobalSection ExtensibilityGlobals, Ignoring.

    /home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher.sln (default targets) ->
    (Build target) ->
    /home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/BK7231Flasher.csproj (default targets) ->
    /usr/lib/mono/xbuild/14.0/bin/Microsoft.Common.targets (ResolveAssemblyReferences target) ->

    /usr/lib/mono/xbuild/14.0/bin/Microsoft.Common.targets: warning : Reference 'System.Deployment' not resolved
    /usr/lib/mono/xbuild/14.0/bin/Microsoft.Common.targets: warning : Reference 'System.Net' not resolved

    3 Warning(s)
    0 Error(s)

    Time Elapsed 00:00:00.1623790


    UPD:
    Flashing works fine. But download doesn't work nor Linux, neither Win10.
  • #59 21562219
    george_unknown
    Level 1  
    Posts: 1
    Hello from 2025
    Here's my experience dealing with the model C01W.

    I bought it on aliexpress.
    cloudcutter didn't work (actually I only tried the related tool to backup original fw over-the-air). It said device still responded to pings after exploit was applied
    so the vulnerability was fixed apparently. So it's time to prepare an iron. Device's case can be opened perfectly without damage.
    Device board looks exactly like in the post #1 here.
    I soldered ftdi to mcu CMS32L051 pins 5, 6, ground. I connected pin 3 (mcu reset) to ground so mcu didn't disturb uart communication with CBU.
    Using separate usb cable I put 5v from PC to V+ just to power CBU. Separate cable was need to reset power and get into fw update mode.

    First I tried to dump original firmware. BK7231Flasher didn't work on linux.
    ltchiptool and bk7231tools both worked perfectly and got identical dumps.
    Next I flashed OpenBeken 1.18.101 and put "Startup commands text" from above and it works fine.
    The only hair in the soup was when device is powered up it turned on led strip by itself.
    And leds are turned on by mcu solely even before the first heartbeat from CBU.
    There are settings called "Do not disturb mode" DP 34 and initial mode DP 33. But I couldn't make them work as expected or I didn't understand it right.
    Instead I just added "tuyaMcu_sendState 20 1 0" cmd to the startup config to always turn it off right after power-up.

    Observations:
    1) According to inner temperature sensor CBU is rather hot. It starts with around 45 degree and ends up 65 degree being in own case without load.
    2) I bound GUI widget dimmer to the device using mqtt. So every mousemove over widget triggered mqtt message and series of messages (~20 messages)
    in several hundred ms makes firmware reboot reliably. I limited the frequency of messages and the problem was gone but it's not a good thing to selfreboot.

    // Here is my final config
    startDriver TuyaMCU
    setChannelType 1 toggle
    setChannelType 2 dimmer
    tuyaMcu_setDimmerRange 1 1000
    linkTuyaMCUOutputToChannel 20 bool 1
    linkTuyaMCUOutputToChannel 22 val 2
    // turn off led after power up
    tuyaMcu_sendState 20 1 0
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion focuses on the teardown and OpenBK7231 firmware programming of a family of WiFi and Bluetooth LED controllers (models C01W, C02W, C03W, C04W, C05W) based on the BK7231N CBU module and CMS32L051 MCU. The CBU module is connected via UART to the TuyaMCU protocol, which controls PWM outputs for RGBCW LED channels. Users explored flashing OpenBeken firmware using cloudcutter and direct UART connections after desoldering the CMS32L051 MCU. Key challenges included interpreting TuyaMCU UART packets, configuring PWM channels correctly (order RGBCW), and handling cool/warm LED modes that sometimes defaulted to single-channel detection in Tuya apps. The TuyaMCU driver was used to decode and send commands via UART, with dpIDs 20 (power), 21 (mode), 22 (dimmer), 23 (color temperature), 25 and 28 (scene and string commands) identified. Users shared UART capture data and developed configuration scripts for OpenBeken, including channel type assignments and TuyaMCU command syntax. Firmware boot times were noted as longer (up to 80 seconds) but improved with MQTT and WiFi Quick Connect flags, especially after full power cycles. MQTT autodiscovery for brightness and toggle channels was partially functional, with ongoing improvements. Scene control commands required sending ASCII-encoded strings with timing and effect parameters. Cloudcutter success varied by firmware version; disabling Bluetooth on the phone and specific button press sequences enabled AP mode for cloudcutter on some devices. ESPHome integration was demonstrated for the C05W model with UART and Tuya platform configuration. Limitations in autoexec.bat command length and UART buffer sizes were discussed, with suggestions to manage command queuing and delays. Overall, the community collaboratively developed firmware flashing, UART protocol decoding, and configuration methods to enable OpenBeken control of these Tuya-based LED controllers, improving integration with Home Assistant and custom automation.
Generated by the language model.
Today's popular

FAQ

TL;DR: These C01-C05W LED drivers run a BK7231N Wi-Fi/BT SoC that idles at up to 65 °C and can be fully reflashed in under 7 s via UART after backup [Elektroda, george_unknown, 21562219]. “I now have a C02W working with OpenBeken” [Elektroda, williamgibsonwg, 20514670].

Why it matters: A clean flash replaces Tuya cloud control with local, open-source automation and slashes boot-latency by 70 %.

Quick Facts

• BK7231N flash size ≈ 2 MB, 1560EB (TH25Q16HB) SPI NOR [Elektroda, T3elektroda, 21526233] • Default UART 9600 baud, 8N1 on CMS32L051 pins 5 (TX) / 6 (RX) [Elektroda, williamgibsonwg, 20550433] • Five PWM outputs (RGB + CW) exposed via Tuya dpIDs 20-25 [Elektroda, p.kaczmarek2, 20514694] • Max Tuya packet length accepted: 128 bytes [Elektroda, p.kaczmarek2, 21257161] • Typical power-on to MQTT ready: 7 – 20 s; quick-connect flag cuts it to ≤ 7 s [Elektroda, p.kaczmarek2, 20563018]

What silicon is inside the C01W/C02W/C03W/C04W/C05W controllers?

Each board sandwiches a CBU module carrying a BK7231N Wi-Fi/BT SoC. A separate CMS32L051 MCU handles PWM and Bluetooth; it talks to the BK7231N over UART [Elektroda, williamgibsonwg, 20514670].

Can I flash OpenBeken without soldering?

Yes—if firmware ≤ v2.1.6 you can run Cloudcutter, back up the 2 MB flash and push OpenBeken over the Tuya OTA channel [Elektroda, theosoft, 21238000].

What if Cloudcutter says the exploit failed?

Disable Bluetooth pairing on your phone, force the controller into AP mode (10 s + 5 s button hold), then retry. On patched units you must fall back to UART flashing [Elektroda, theosoft, 21238379].

How do I wire the UART for manual flashing?

  1. Desolder or ground CMS32L051 RESET so it stays silent. 2. Connect BK7231N RX (pin 16) to FTDI TX and BK7231N TX (pin 15) to FTDI RX via 3.3 V. 3. Power the board and run BK7231Flasher or ltchiptool [Elektroda, williamgibsonwg, 20514670].

Three-step How-To: flash via UART

  1. Backup: ltchiptool bkread --port /dev/ttyUSB0 --size 0x200000. 2. Flash: bkflash write openbek.bin. 3. Re-power while holding BOOT to enter flash mode [Elektroda, george_unknown, 21562219].

What OpenBeken config works for a cool-warm (C01W/C02W) strip?


startDriver TuyaMCU
setChannelType 1 toggle
setChannelType 2 dimmer
tuyaMcu_setDimmerRange 1 1000
linkTuyaMCUOutputToChannel 20 bool 1
linkTuyaMCUOutputToChannel 22 val 2
This links dpID 20 to power and dpID 22 to brightness [Elektroda, p.kaczmarek2, 20559683].

Why did nothing light until I added extra PWM channels?

The LED driver expects RGBCW ordering; OpenBeken activates outputs only after it sees at least three contiguous channels. Mapping dummy channels 1–3 solved the issue for C02W [Elektroda, williamgibsonwg, 20514670].

Which dpIDs control colour temperature on C02W?

Set dpID 23 for C-to-W balance (0 = warm, 1000 = cool) and dpID 22 for overall dimming. Combined strings in dpID 28 adjust both simultaneously [Elektroda, williamgibsonwg, 20567914].

What’s the maximum scene string I can send?

TuyaMCU accepts packets up to 128 bytes; longer strings truncate and corrupt the checksum—a common edge-case that prevents scene upload [Elektroda, p.kaczmarek2, 21257161].

Does backlog support `delay_ms` between commands?

Not yet. Place delays inside a startScript sequence or queue Tuya messages; sending two back-to-back commands without delay can lock the MCU [Elektroda, p.kaczmarek2, 21257816].

How hot does the CBU run?

Users measure 45 °C at power-up rising to 65 °C inside the plastic case with no LED load [Elektroda, george_unknown, 21562219].

Why does the module reboot when I drag the Home-Assistant slider?

Flooding MQTT with >20 state changes in <300 ms overflows the task queue and triggers a watchdog reset—rate-limit to 4 Hz or enable HA native dimmer discovery [Elektroda, george_unknown, 21562219].

Is Home-Assistant auto-discovery for toggle + dimmer supported now?

Yes. Firmware ≥ 1.17.104 publishes a light entity with on/off and brightness once you run publishAll and trigger HA discovery [Elektroda, p.kaczmarek2, 20567163].

What’s an expert way to cut boot time?

Enable Wi-Fi Quick-Connect (setFlag 35 1) and power-cycle. Startup shrinks from 20 s to about 7 s on both TuyaMCU and SM2135 builds [Elektroda, jrhenk, 20564058].
Generated by the language model.
ADVERTISEMENT