logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11)

JustAnotherUser 9774 26
ADVERTISEMENT
Report a violation of the law
Reply | New topic

  • SH4 RF section appears to use CMT2300-compatible SPI

    #1 20566501
    JustAnotherUser
    Level 2  
    Posts: 4

    Pictures:
    [CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11) [CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11)

    [CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11)

    [CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11)[CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11)

    [CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11) [CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11)

    Purchased on Amazon https://www.amazon.com/dp/B0BY2C68BJ
    [CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11)
    [CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11) [CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11)


    Pinout:
    CBU PinBK7231NFunctionBoard TP
    1P14 (SPI_SCK)SH4 CLKSCK
    2P16 (SPI_MOSI)SH4 SDIO via R9
    3P20SH4 GPIO1INT1
    4P22SH4 GPIO2INT2
    5ADCButton via RC networkADC
    6RX2
    7TX2
    8P8IR receiver
    9P7IR tx
    10P6
    11P26
    12P24
    13GNDGNDGND
    143V33V33V3
    15TX1TXD
    16RX1RXD
    17P28
    18CENCEN
    19P9Status LED
    20P17 (SPI_MISO)SH4 SDIO via (not populated) R18
    21P15 (SPI_CS)CSN

    The button is connected to ADC via a RC network:
    [CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11)

    As the IR section is identical to the well-covered S08 at https://www.elektroda.com/rtvforum/topic3920360.html I'm mainly focusing on the RF section.

    According to https://developer.tuya.com/en/docs/iot/sh4-module-datasheet?id=Ka04qyuydvubw the SH4 module is based around a CMTOV30-EQR chip. While I was not able to find information on this chip, CMOSTEK's CMT2300 has a suspiciously similar part number (CMT2300A-EQR) and the same pinout. Looking at the SPI traffic it looks like the register map is the same as well.

    The SH4 is connected to the CBU via 2 interrupt lines, 2 chip select lines, a clock line, and a bi-directional data line. Although the datasheet for the CMT chip says it can do SPI at 5 MHz, the CMU is only moving data at approximately 500 kHz. Looking at it with a logic analyzer it looks like they might be bit-banging the data instead of using the hardware SPI peripheral as the frequency changes slightly between sending and receiving:
    [CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11)

    SPI traffic on boot: sh4-boot..b.csv (1.64 kB)You must be logged in to download this attachment.

    That's about as far as I've gotten so far. It looks like using this RF chip involves a whole lot of copying and pasting.
    eufyMake E1 - łatwa personalizacja za pomocą druku UV [sponsorowany]
  • ADVERTISEMENT
  • #2 20567155
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14765
    Help: 659
    Rate: 12899
    Very interesting, so they are using a SPI protocol to communicate with RF module? Do you have any idea what kind of protocol are they using, is it documented somewhere, or do we have to capture all their data and reverse engineer the protocol ourselves?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT

  • CMT2300A uses bidirectional SPI data line

    #3 20567166
    JustAnotherUser
    Level 2  
    Posts: 4
    It's SPI, but it uses a bi-directional data line so the master needs to write the register address out on it and then change it to an input to read the response. It's described in the CMT2300A datasheet http://www.cmostek.com/download/CMT2300A-EN-Rev0.7.pdf page 27, and the register table is on page 40. Basically the CSB line goes low, the master writes 7 address bits plus the read/!write bit, and then either reads or writes 8 bits of data before setting CSB high again.
  • #4 20595851
    codyroseman
    Level 2  
    Posts: 3
    Does anyone have a dump of the original firmware? I've flashed OpenBeken and since the rf module isn't supported I'd like to return it to stock. Thanks

  • Stock firmware cannot be fully restored without backup

    #5 20595876
    JustAnotherUser
    Level 2  
    Posts: 4
    Unfortunately unless you have a backup of that specific module you're not going to be able to completely get it back to stock as each module has a serial number and key burned in. The best you'll get is local-only control with TinyTuya or HA. There's a stock firmware image posted lower down in the discussion over at https://github.com/tuya-cloudcutter/tuya-clou...mmit/3736ae997a30db7e8c379dd5472521922f6cd43f
  • #6 20595877
    codyroseman
    Level 2  
    Posts: 3
    No it's literally the same board

    Added after 7 [minutes]:

    [CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11) [CBU/BK7231N and SH4/CMTOV30] Wi-Fi IR+RF Remote Control (S11)

    Added after 2 [minutes]:

    more importantly I have the partial binary dump containing the boards keys
  • ADVERTISEMENT
  • #7 20595902
    JustAnotherUser
    Level 2  
    Posts: 4
    Yes, it was the keys I was referring to. If you have those then great, the firmware posted in that thread should work fine once they're spliced in.
  • #8 20595905
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14765
    Help: 659
    Rate: 12899
    @codyroseman if you flashed with BK7231tool easy gui flash tool:
    https://github.com/openshwprojects/BK7231GUIFlashTool
    you should have a backup, the default option is "Create backup and read"
    Helpful post? Buy me a coffee.
  • #9 20595929
    codyroseman
    Level 2  
    Posts: 3
    Nah I flashed it with https://github.com/OpenBekenIOT/hid_download_py, I could only dump the first 1.2mb before the device became unresponsive. Unfortunately I think I deleted the partial dump off my pc, ahh well I think this one is destined for the bin

    Added after 3 [minutes]:

    Unless either of you would like this unit
  • ADVERTISEMENT
  • Helpful post

    Mini diagram for non-square CBU/BK7231N board

    #10 20734835
    romsenin
    Level 1  
    Posts: 1
    Help: 1
    Rate: 2
    Hi, i have the same board but my device is not square.
    Black circular electronic device with Bluetooth, WiFi, and Tuya labels, featuring IR and RF433 functions.
    I confirm that it use CBU/BK7231N and SH4/CMTOV30
    I have draw a mini diagram
    Code: text Expand Select all Copy to clipboard
    
  ┌─────────────────────────────────────────────────────────────────────┐
  │                                                                     │
  │                      CBU                                            │                  SH4
  │         ┌──────────────────────────┐                                │           ┌──────────────┐
  │         │                          │                                │           │              │
  └───────► │ P14                 P15  │                                │           │ NC       ANT │
            │                          │                                │           │              │
  ┌───────► │ P16                 P17  │                                │           │ GPIO3     NC │
  │         │                          │                                │           │              │
  │ ┌─────► │ P20                  P9  │ LED                            │           │ GND      GND │
  │ │       │                          │                                │           │              │
  │ │   ┌─► │ P22                 CEN  │                                └────────── │ SCLK      NC │
  │ │   │   │                          │                                            │              │
  │ │   │   │ ADC                 P28  │                                      ┌──── │ SDIO      NC │
  │ │   │   │                          │                                      │     │              │
  │ │   │   │ RX2                 RX1  │                                  ┌───┼──── │ CSB    GPIO1 │ ────────────────┐
  │ │   │   │            P P G 3       │                                  │   │     │              │                 │
  │ │   │   │ TX2  P P P 2 2 N V  TX1  │                              ┌───┼───┼──── │ FCSB   GPIO2 │ ─────────────┐  │
  │ │   │   │      8 7 6 6 4 D 3       │                              │   │   │     │              │              │  │
  │ │   │   │                          │                              │   │   │     │ VCC      GND │              │  │
  │ │   │   └──────────────────────────┘                              │   │   │     │              │              │  │
  │ │   │          I I ▲ ▲                                            │   │   │     └──────────────┘              │  │
  │ │   │          R R │ └────────────────────────────────────────────┘   │   │                                   │  │
  │ │   │              │                                                  │   │                                   │  │
  │ │   │          R T └──────────────────────────────────────────────────┘   │                                   │  │
  │ │   │          X X                                                        │                                   │  │
  └─┼───┼─────────────────────────────────────────────────────────────────────┘                                   │  │
    │   │                                                                                                         │  │
    │   │                                                                                                         │  │
    │   │                                                                                                         │  │
    │   └─────────────────────────────────────────────────────────────────────────────────────────────────────────┘  │
    │                                                                                                                │
    └────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘


    Also the CBU use the 3 wires SPI (SDIO) protocol to communicate with SH4.
    And in the log when we use the RF is mention "CMT2300A_IsExist" so it seems that we can use the CMT2300A as reference.

    On the product page of CMT2300A, there is two demo with some source code (where there is a function "CMT2300A_IsExist"):
    * CMT2300A_DemoEasy_v1.2
    * CMT2300A_Demo(STM32)V1.0.1

    I don't know if this can help you and if we can use it in OpenSource project, let me know.
  • #11 20809098
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14765
    Help: 659
    Rate: 12899
    Very nice find! It indeed seems like CMT2300A-EN-Rev0.7.pdf document contains all the information we need. I need to find time to check this out.
    Attachments:
    • CMT2300A-EN-Rev0.7.pdf (1.08 MB) You must be logged in to download this attachment.
    Helpful post? Buy me a coffee.
  • Helpful post
    #12 20809439
    DeDaMrAz
    Level 23  
    Posts: 620
    Help: 34
    Rate: 130

    Just so we have some idea of what we are dealing with, attached here is a schematic of a version of this device that I have.

    We were planning on working on this device for the longest time but there is always something more important :)

    I think we will begin soon though.
    Attachments:
    • Device schematsics.pdf (46.82 KB) You must be logged in to download this attachment.
  • #14 21094187
    merni99
    Level 6  
    Posts: 7
    Rate: 4

    I just bought the S11. Any progress on supporting/implementing S11 with SH4 RF module?
  • #15 21155943
    olivluca
    Level 7  
    Posts: 16
    I just got a moes UFO-R2-RF and it uses the same CBU/SH4 combo. I didn't check (yet) if the connections are the same. (edit: I checked now and they seem to match).
    Any progress on this module?
    Electronic board with CBU modules and antenna Image of a circular printed circuit board with various electronic components such as LEDs and capacitors.
  • #16 21156233
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14765
    Help: 659
    Rate: 12899
    We've started working on new IR library that can more or less capture data and send Flipper Zero IR format:
    https://www.elektroda.com/rtvforum/topic4062643.html#21137604
    https://www.elektroda.pl/rtvforum/topic4062643.html#21137604
    Helpful post? Buy me a coffee.

  • Tuya CMT2300A RF driver sources found

    #17 21156286
    olivluca
    Level 7  
    Posts: 16
    And what about the RF part?

    Added after 5 [minutes]:

    thementor wrote:
    I wonder if this source code can be of any use for us

    https://github.com/zhangmeng5337/Hardware/blo.../code/CMT2300A_DemoEasy/USER/radio/cmt2300a.h


    That link doesn't work, but there is this one

    https://github.com/tuya/tuya-bsp-gpl-public-c...main/driver_src_tuya/ty_driver/src/subg/radio

    And this one (I searched github for the RF_StartRx function)

    https://github.com/jabc1/CMT2300A_DemoEasy

    Added after 11 [hours] 17 [minutes]:

    Seaching "cmt2300a" on github gives some interesting results, e.g.:
    https://github.com/tbnobody/OpenDTU/tree/master/lib/CMT2300a
    (which is part of an esphome component)
    the parameters files are for a different frequency (860 or 900 MHz) but using the one from the tuya driver should use the correct frequency.
  • #18 21162440
    olivluca
    Level 7  
    Posts: 16
    I'm trying to get the RF part working using libretiny
    https://github.com/olivluca/TestTuya
    So far no success.
    The spi part seems to be working (I tried with a bogus pin for data and it couldn't initialize the radio, with the correct definition it initializes, I can put it in RX mode and see the state transitions), but I see no data (the fifo is always filled with 0).

  • RFPK tool generates CMT2300A RF parameters

    #19 21164026
    olivluca
    Level 7  
    Posts: 16
    I fixed the gpio assignment in the code and I'm using the RF parameters (registers from 0x00 to 0x5f) in the csv of the first post.
    With that I had some limited success: I can see some data but it's not correct (i.e. I see the same bytes for more than one button of my remote) besides I see some stray codes (maybe there's another transmitter nearby).
    It turns out you can generate the parameters using the RFPK tool, available here https://www.hoperf.cn/ic/rf_receiver/CMT2219A.html, the register values can be exported to a text file then a simple python script will convert it to the cmt2300a_params.h
    The problem is I cannot find a way to do the reverse (i.e. from the registers derive the parameters) so I can tweak it to see if I can decode my remote. The datasheet doesn't document most of them, it just says to use the RFPK tool.
    @JustAnotherUser did you per chance capture the spi conversation while trying to learn some buttons?
    Maybe it uses different sets of parameters doing several attempts.


    Ç

  • Direct spi capture enables direct mode control

    #20 21181007
    olivluca
    Level 7  
    Posts: 16
    I bit the bullet, soldered some more cables and captured the spi communication of the original firmware.
    Now sending mostly works (sometimes I have to repeat the same button more than once before it is received), receiving is still not working.
    Oh, and the trick is to use direct mode, avoiding the decoding/encoding on the cmt2300a and its fifo.

    Edit: I labeled the test points, P6 (CSB) and P16 (FCSB) are not available on this side of the pcb, you have to get them from the cpu on the other side.
    Circuit board with test point markings and LEDs
  • #22 21225830
    divadiow
    Level 38  
    Posts: 5216
    Help: 448
    Rate: 917
    DeDaMrAz wrote:
    We were planning on working on this device for the longest time but there is always something more important :)

    @DeDaMrAz @p.kaczmarek2 I'm going to pickup one of these IR devices with SH4 if that's any help with testing in the future...

  • Flexible aerial pad on the back of the circular unit

    #23 21234412
    divadiow
    Level 38  
    Posts: 5216
    Help: 448
    Rate: 917
    Circular type. Interesting flexible aerial pad stuck to the back

    Circuit board with electronic components and communication modules. Green, rectangular printed circuit board with visible traces on a beige background. Black flexible antenna pad YL1447-W-V4 433MHz with FORCE written on it, placed on a carpet. Electronic board with components including a module marked with QR codes. Components of AI universal remote with Wi-Fi IR+RF, including manual, electronics, and box.

    Code: Text
    Log in, to see the code
    Attachments:
    • readResult_BK7231N_QIO_2024-22-9-06-24-38.bin (2 MB) You must be logged in to download this attachment.
  • #24 21538886
    alaei
    Level 1  
    Posts: 1
    @olivluca Thanks for the work.https://github.com/olivluca/tuya_rf works like a charm.
    It would be wonderful if we could extract formula RFPK tool is using and add support for other frequencies. One simple idea is to get multiple const configuration for example 315/433 and switch between those.
  • #25 21538942
    olivluca
    Level 7  
    Posts: 16
    @alaei as I said, I couldn't succeed in generating a working configuration using RFPK. You could try generating a random configuration for 433MHz, another for 315 and see what are the differences, then "plug" those differences in cmt2300a_params_captured.h.
  • #26 21586848
    divadiow
    Level 38  
    Posts: 5216
    Help: 448
    Rate: 917
    I don't know what this is but it's labelled as "SH4 production test baseboard driver"
    Attachments:
    • 1614911275-TY_SMESH_SH4_NODE_DEMO_QIO_1.0.1.hex (161.39 KB) You must be logged in to download this attachment.
  • #27 21656299
    ngocnguyenme
    Level 4  
    Posts: 7
    >>21186520 Thanks for sharing. I have a similar device (https://moeshouse.com/products/wifi-rf-ir-universal-remote-controller). I tried to flash the device with libretiny according to this guide https://docs.libretiny.eu/docs/platform/realtek-ambz/#wiring. But in the first backup step, I couldn't get the device into the download mode. Could you tell me how to do it right, please?
Reply | New topic
Report a violation of the law

Topic summary

LABEL_AI_GENERATED
Discussion about a Wi‑Fi IR+RF universal remote controller based on CBU/BK7231N paired with an SH4/CMT2300A RF module. The board pinout and SPI-style communication with the RF chip were identified, including the need for bidirectional data handling and direct mode operation. Participants referenced the CMT2300A datasheet, Tuya/OpenBeken/libretiny support, and reverse engineering of RF parameters using captured SPI traffic and RFPK-generated register sets. Progress included partial firmware backups, extraction of board keys, a working ESPHome/Tuya RF component for sending IR/RF commands, and ongoing issues with reliable RF receive support and parameter generation for different frequencies.
AI summary based on the discussion. May contain errors.
Today's popular

FAQ LABEL_AI_GENERATED

TL;DR: For S11 and Moes IR+RF owners, this FAQ maps 21 CBU pins and explains why “direct mode” matters for SH4 RF work. It helps preserve Tuya backups, trace 3-wire SPI/SDIO, and test OpenBeken, LibreTiny, or ESPHome paths. [#20566501]

Why it matters: The S11 uses a BK7231N Wi‑Fi module plus an SH4 RF board, so flashing without a key backup can permanently remove full Tuya cloud restore.

Option Best use in this thread Current RF status Main risk
Stock Tuya firmware Full original IR+RF behavior Works with original keys Needs device-specific serial and keys
OpenBeken Local BK7231N experimentation RF module not fully supported in early reports May require stock backup to revert
LibreTiny / ESPHome component CMT2300A RF experiments Sending reported working; receiving still limited Requires soldering and parameter tuning

Key insight: Treat the SH4 as a CMT2300A-compatible RF front end on a 3-wire SPI/SDIO bus. The practical breakthrough was bypassing FIFO decoding and using CMT2300A direct mode for RF transmission.

Quick Facts

  • The CBU module exposes 21 listed pins; key RF lines include P14 SCLK, P16 SDIO through R9, P15 CSN, P20 INT1, and P22 INT2. [#20566501]
  • The SH4 link uses about 500 kHz in captures, although the referenced CMT chip datasheet allows 5 MHz SPI. [#20566501]
  • Power and service points include 3V3 on CBU pin 14, GND on pin 13, TXD on pin 15, and RXD on pin 16. [#20566501]
  • A failed hid_download_py attempt dumped only the first 1.2 MB before the BK7231N device became unresponsive. [#20595929]
  • RFPK can export CMT2300A register values for parameter files, but the thread reports no working reverse conversion from registers back to radio settings. [#21164026]

What pinout does the CBU/BK7231N module use in the S11 Wi-Fi IR+RF remote with the SH4 RF module?

The S11 maps the 21-pin CBU to SH4 RF, IR, UART, LED, ADC, power, and reset lines. RF uses P14 as SH4 CLK, P16 as SH4 SDIO through R9, P20 as GPIO1/INT1, P22 as GPIO2/INT2, and P15 as CSN. IR uses P8 for receiver and P7 for transmitter. The status LED sits on P9. UART flashing points are TX1/TXD on pin 15 and RX1/RXD on pin 16. Power is 3V3 on pin 14 and GND on pin 13. [#20566501]

How does the CBU communicate with the SH4/CMTOV30 or CMT2300A RF module over 3-wire SPI/SDIO?

The CBU uses 3-wire SPI with a bidirectional SDIO data line. The master pulls CSB low, writes 7 address bits plus the read/write bit, then reads or writes 8 data bits. For reads, it changes the SDIO pin from output to input. "3-wire SPI/SDIO" is a serial bus that shares one data line for input and output, reducing pins while requiring direction switching during each transaction. Captures showed about 500 kHz traffic. [#20567166]

What is the SH4 module in Tuya Wi-Fi IR+RF remotes, and how is it related to the CMT2300A RF transceiver?

The SH4 is the Tuya RF module paired with the CBU/BK7231N in these IR+RF remotes. The thread identifies it as based around CMTOV30-EQR, with a pinout and register behavior matching the CMT2300A-EQR. A later boot log explicitly mentioned “CMT2300A_IsExist,” strengthening the CMT2300A reference path. "SH4" is a Tuya sub-GHz RF module that handles RF remote functions, using a CMT2300A-like transceiver interface and external antenna connection. [#20734835]

How can I back up and restore the original Tuya firmware on a BK7231N S11 remote before flashing OpenBeken or LibreTiny?

Back up the full BK7231N flash before writing OpenBeken, LibreTiny, or test firmware. The safer path in the thread is BK7231GUIFlashTool, because its default option creates a backup and reads the flash. Use this workflow:
  1. Connect UART TXD, RXD, 3V3, and GND.
  2. Run BK7231GUIFlashTool with “Create backup and read.”
  3. Store the dump before flashing replacement firmware. A stock image can help only if the original keys remain available. [#20595905]

Why can’t a stock firmware image fully restore a Tuya BK7231N device without the original serial number and keys?

A stock firmware image cannot fully restore Tuya cloud identity without that module’s burned serial number and key. The thread states each module has its own serial number and key. Without them, the best expected recovery is local-only control using TinyTuya or Home Assistant. This is the key failure case: the board can run firmware, yet lose full Tuya pairing and cloud restoration. [#20595876]

How do I splice saved Tuya device keys into a stock firmware image after flashing OpenBeken?

Use a compatible stock firmware image and insert the saved device-specific key data from your own dump. The thread gives the condition clearly: if you have the keys, the posted firmware image “should work fine once they’re spliced in.” Do not use another board’s keys. They belong to a specific module identity. Keep the partial binary dump that contains the board keys before writing any 2023 or later test firmware. [#20595902]

What is the difference between using BK7231GUIFlashTool and hid_download_py for flashing or dumping BK7231N firmware?

BK7231GUIFlashTool defaults to creating a backup, while hid_download_py did not protect one user from an incomplete dump. In the thread, BK7231GUIFlashTool’s default option was described as “Create backup and read.” Another user used hid_download_py and could dump only 1.2 MB before the device became unresponsive. That failure made stock recovery difficult after the partial dump was deleted. For BK7231N S11 work, backup-first tooling reduces irreversible loss. [#20595929]

How can I capture SPI traffic from the original S11 firmware to reverse engineer the SH4/CMT2300A RF module?

Attach a logic analyzer to SH4 SCLK, SDIO, CSB, FCSB, and interrupt lines while the original firmware boots or learns RF codes. The first capture in the thread recorded SPI traffic on boot. Later work added more soldered wires and captured original firmware communication during RF use. Capture both transmit and learn actions, because parameter sets can change by mode. Keep the original firmware installed until you record the register writes and direct-mode timing. [#21181007]

What CMT2300A datasheet registers and SPI commands are needed to initialize the SH4 RF module?

Use the CMT2300A-style SPI command format and the register table as the starting point. The thread points to page 27 for the bus transaction and page 40 for the register table. The master sends 7 address bits plus the read/write bit, then transfers 8 data bits. Early experiments used registers 0x00 to 0x5f from a captured CSV. "CMT2300A registers" are configuration bytes that set radio behavior, including frequency, packet handling, and mode control. [#20567166]

How can the HopeRF RFPK tool be used to generate CMT2300A register parameters for 315 MHz or 433 MHz remotes?

Use RFPK to export CMT2300A register values, then convert the text export into a parameter header. One experiment generated values through the HopeRF RFPK tool and used a Python script to build cmt2300a_params.h. The limitation is important: the thread found no reverse path from existing registers back to human-readable radio parameters. For 315 MHz and 433 MHz, compare exported configurations and apply only verified differences to a captured working header. [#21164026]

Why does the CMT2300A FIFO show zeros or repeated bytes when trying to receive RF data from a remote?

The FIFO shows zeros or repeated bytes when packet decoding parameters do not match the remote’s raw OOK signal. One LibreTiny test initialized the radio, entered RX mode, and saw state transitions, but the FIFO stayed filled with 0. After using registers 0x00 to 0x5f, it showed data, but repeated bytes appeared for multiple buttons. Stray codes also appeared, suggesting another nearby transmitter or mismatched demodulation. Direct capture avoids relying on incorrect FIFO decoding. [#21164026]

What does “direct mode” mean on the CMT2300A, and why can it help with sending RF signals from Tuya IR+RF remotes?

Direct mode bypasses the CMT2300A’s packet FIFO and internal decoding or encoding. It helps because Tuya RF remotes can use raw OOK timing that packet mode misreads. After capturing original firmware SPI, sending “mostly works” by using direct mode, though some button commands needed repeats. "Direct mode" is a transceiver operating mode that exposes raw RF modulation timing, avoiding packet framing so software controls the waveform more directly. [#21181007]

OpenBeken vs ESPHome with LibreTiny — which is better for experimenting with CBU/BK7231N and SH4 RF support?

ESPHome with LibreTiny became the more practical RF experiment path in this thread. OpenBeken was flashed successfully, but the RF module was not supported at that stage. A contributor later wrote an ESPHome component for the CBU/SH4 combination. By August 10, 2024, that component could send RF but not receive. In May 2025, another user reported the tuya_rf project “works like a charm,” still with frequency-parameter questions open. [#21538886]

How can I get a Moes UFO-R2-RF or similar BK7231N device into download mode for LibreTiny flashing and backup?

The thread does not provide a confirmed download-mode procedure for the Moes UFO-R2-RF. It only reports that a similar Moes device uses the same CBU/SH4 combo, and another user later could not enter download mode during the backup step. Use the known board points first: TXD, RXD, 3V3, and GND. Do not erase or flash until a full backup succeeds. The unresolved edge case is a device that never enters download mode. [#21656299]

What are the test points and soldering locations for CSB, FCSB, SCLK, SDIO, interrupts, UART, 3.3V, and GND on the S11 or Moes IR+RF remote PCB?

Use the labeled test points where available, but expect some chip-side soldering. The original pinout lists SCK for SH4 clock, INT1, INT2, ADC, GND, 3V3, TXD, RXD, and CSN. Later labeling noted P6 for CSB and P16 for FCSB were not available on that PCB side, so they had to be taken from the CPU side. For UART, use TXD and RXD. For power, use 3V3 and GND. [#21181007]
AI summary based on the discussion. May contain errors.
ADVERTISEMENT