logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Flashing Aubess Plug via Serial Adapter: BK7231M/CB2S Not Creating Open AP Post-Flash

nitr0mankr 1029 6
ADVERTISEMENT
| New topic
  • #1 20836938
    nitr0mankr
    Level 3  

    Hi all. I'm trying to flash Aubess plug via serial adapter. Flashing completed successfully, but no open AP was created. LED lights dark, after 30-60 seconds it starts to light bright.

    Code: text Expand Select all Copy to clipboard
    
$ sudo ./uartprogram ../OpenBK7231N_QIO_1.17.308.bin -d /dev/ttyUSB0 --unprotect -w --startaddr 0x0 
UartDownloader....
program....
Write Successful: ||[ 15.3k/s]


    flashing 1.14.1 like in similar thread here https://www.elektroda.com/rtvforum/topic3926632.html had same results

    what did I wrong?

    P.S. chip looks like BK7231M (marking is unclear)
    Close-up of a BK7231M chip on a circuit board.
  • ADVERTISEMENT
  • #2 20837164
    ferbulous
    Level 18  
    Did you plug it to the ac line yet?
  • ADVERTISEMENT
  • #3 20837165
    nitr0mankr
    Level 3  
    original dump flashed back OK. I tried to look at dump with bk7231tools - it seems like it isn't similar to bk7231n firmware

    here's debug log of original firmware:
    Code: text Expand Select all Copy to clipboard
    
BK7231n_1.0.11
REG:cpsr        spsr        r13         r14
SVC:0x000000D3              0x00401C1C  0x000033AC
IRQ:0x000000D2  0x00000010  0x00401E0C  0xAC48E012  
FIR:0x000000D1  0x00000010  0x00401FFC  0x0501614F  
SYS:0x000000DF              0x0040192C  0x00000158  
ST:0x00000000
[I/FAL] Fal(V0.4.0)success
                          [I/OTA] RT-Thread OTA package(V0.2.4) initialize success.
[E/OTA] (ota_main:171) App verify failed! Need to recovery factory firmware.


go os_addr(0x10000)..........
 0
prvHeapInit-start addr:0x40f300, size:134400
[Flash]id:0xeb6015
[Flash]init over
sctrl_sta_ps_init
SDK Rev: 3.0.56 7e6923f
[THD]app:[tcb]4104d0 [stack]40f4c8-4104c8:4096:5
[THD]extended_app:[tcb]410d40 [stack]410538-410d38:2048:4
[THD]idle:[tcb]4111b0 [stack]410da8-4111a8:1024:0
[THD]timer_thd:[tcb]411f38 [stack]411330-411f30:3072:2
OSK Rev: F-3.0.35 7e6923f
cset:0 0 0 0
[D/FAL] (fal_flash_init:42) Flash device |                bl7231n2m | addr: 0x00000000 | len: 0x00025000 | blk_size: 0x00001000 |initialized finish.
[I/FAL] ==================== FAL partition table ====================
[I/FAL] | name     | flash_dev |   offset   |    length  |
[I/FAL] -------------------------------------------------------------
[I/FAL] | usercfg  | bl7231n2m | 0x00000000 | 0x00010000 |
[I/FAL] | fac_data | bl7231n2m | 0x00010000 | 0x00004000 |
[I/FAL] | log      | bl7231n2m | 0x00014000 | 0x00010000 |
[I/FAL] =============================================================
[I/FAL] Flash Abstraction Layer (V0.5.99) initialize success.
[FlashDB][kv][usercfg] (fdb_kvdb_init:1638) KVDB size is 65536 bytes.
[FlashDB][kv][usercfg] (fdb_kvdb_init:1642) kv load result 0 
[FlashDB]FlashDB V1.1.2 is initialize success.
[FlashDB]You can get the latest version on https://github.com/armink/FlashDB .
[FlashDB][kv][fac_data] (fdb_kvdb_init:1638) KVDB size is 16384 bytes.
[FlashDB][kv][fac_data] (fdb_kvdb_init:1642) kv load result 0 
[FlashDB][kv][log] (fdb_kvdb_init:1638) KVDB size is 65536 bytes.
[FlashDB][kv][log] (fdb_kvdb_init:1642) kv load result 0 
[THD]ves_event:[tcb]4150f8 [stack]4138f0-4150f0:6144:4
[THD]ves_scanner:[tcb]415a58 [stack]415250-415a50:2048:6
[SDK W vesync_button_reg_cb_arr:366] No button found
[THD]app_vloop:[tcb]416f78 [stack]415f70-416f70:4096:5
[THD]app_task:[tcb]418838 [stack]417030-418830:6144:3
[APP W app_flash_fmt_read:71] read flash fail, ret[1]
[THD]ves_init:[tcb]419960 [stack]418958-419958:4096:3
bandgap_calm_in_efuse=0x5d
[load]bandgap_calm=0x20->0x1d,vddig=4->5
[FUNC]rwnxl_init
chip id=7231c device id=20521011
IP Rev: W4-3.0.56-P0
txdesc flush
[FUNC]intc_init
[FUNC]calibration_main
get rfcali_mode:1
device_id=0x20521011
calibration_main over
flash txpwr table:0x1f
dif g and n20 ID in flash:4
dif g and n40 ID in flash:4
load txpwr tabe n20 in flash
read txpwr tab from flash success
calibrate low value:[6c8]
calibrate high value:[da4]
temp in flash is:322
[THD]temp_detct:[tcb]419f50 [stack]419b48-419f48:1024:3
lpf_i & q in flash is:123, 120
found flash XTAL:63
xtal in flash is:63
xtal_cali:63
--init_xtal = 63
[FUNC]ps_init
int watchdog enabled, period=10000
task watchdog enabled, period=60000
[FUNC]func_init_extended OVER!!!

start_type:0
[THD]kmsgbk:[tcb]41b018 [stack]41a010-41b010:4096:6
[THD]init_thread:[tcb]41b858 [stack]41b080-41b850:2000:5
Initializing TCP/IP stack
tcp_port:65499
[THD]tcp/ip:[tcb]41c2a8 [stack]41baa0-41c2a0:2048:7
[THD]wpas_thread:[tcb]41d770 [stack]41c768-41d768:4096:4
bk_wlan_app_init finished
[THD]core_thread:[tcb]41e6d0 [stack]41dec8-41e6c8:2048:7
[THD]rf_arbitrate:[tcb]41f038 [stack]41e830-41f030:2048:8
rf_thread_init ok
[THD]ble:[tcb]41f950 [stack]41f148-41f948:2048:5
ble mac:2c-05-47-ff-76-f1
xvr_reg_init
h4tl_init-1 ok
hci_init ok
!!!!!!init_type=0
rwble_hl_init ok
BLE Rev: B5-3.0.56-P0
rwble_init ok
rwip_driver_init ok
.....

    (I skipped latest part - IMHO there's nothing interesting here).

    Added after 2 [minutes]:

    ferbulous wrote:
    Did you plug it to the ac line yet?


    No, I powered it via 5V supply, connecting it at output capacitor of AC-DC converter


    P.S. Original firmware dump is attached.
    Attachments:
  • ADVERTISEMENT
  • #4 20849460
    nitr0mankr
    Level 3  

    Any ideas?
    I tried to flash the extracted decrypted app from OpenBK image - no luck.
    The stock firmware is for Vesync Cloud.
  • ADVERTISEMENT
  • #6 20850697
    nitr0mankr
    Level 3  

    Yes, I saw this topic. It seems like the trouble is more likely in the bootloader, not in the chip itself. Just because the serial dump is unencrypted and doesn't look like firmware with a bootloader, it looks like an app module. And the dump is flashed back successfully and works OK. Maybe there's a difference in bootloader dump/restore handling (something like BK7231T).

    I can try to dump flash via SPI (I have ch341, AFAIR there's ch341 SPI driver for Linux).
  • #7 21109473
    p.kaczmarek2
    Moderator Smart Home  
    Thanks to the reader who send me BK7231M, I've been able to solve the flashing issue. This BK7231M requires a binary built with different encryption keys. Here is final solution:
    How to flash BK7231M/BL2028N non-Tuya devices with 000000 keys?
    Helpful post? Buy me a coffee.
| New topic
Report a violation of the law

Topic summary

The discussion revolves around the issue of flashing an Aubess plug using a serial adapter, specifically the BK7231M chip. After a successful flash, the user reports that no open AP is created, and the LED behavior is abnormal. Responses suggest checking the power connection and indicate that the original firmware dump is not compatible with the BK7231N firmware. Further investigation reveals that the problem may lie in the bootloader rather than the chip itself. A solution is eventually found, indicating that the BK7231M requires a binary built with different encryption keys for successful flashing.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT