One of these bulbs was one of my first purchases back in November 2023, but I destroyed the DT-BL200 module accidentally. I've since bought another from Ali. The product page is already gone https://vi.aliexpress.com/item/1005005730079037.html
It is perhaps the same CozyLife bulb @blakadder posted about here https://www.elektroda.com/rtvforum/topic3889041-120.html#20151469
The DT-BL200 is a Bouffalo Labs BL602L20 (L=Light, 2=16mbit/2mb flash) and is rarely mentioned on the forums.
One of the first posts with some info is here https://www.elektroda.com/rtvforum/topic3900145.html
Inside is the DT-BL200 without RF shield in this instance. Using my own photo and other images around, I made this to help orient me from the top looking down. I did not desolder the module.
D8 = GPIO8 = pull high using 10k resistor/3.3v to enter flash download mode on power-up
First, I captured the boot log at UART 2000000 baud.
then the flash ID using BLDevCube 1.8.9
I also took a 2mb backup of the flash, attached. The whole chip tick is for the erase function only. Read chip requires address input.
Now, despite having soldered each pin to a dupont cable, keeping my wires short and using an external <5A 3.3v PSU, I had great difficulty getting the device to boot after flashing OBK. DevCube 1.8.9 would flash successfully, using old (from the Elektroda 1.4.8 pack) and new boot2, partition files, but it would never boot to AP or even give any UART boot output. I tried several versions of OpenBL602 going back to April 2022.
Using 1.4.8 DevCube however (it seemed happy with the flashID for once) was successful, but the boot would either loop or the AP would show briefly and disappear or show but nothing could connect to it. Suspect boot log errors would change between flash attempts. I've seen unknown gpio like here https://www.elektroda.com/rtvforum/topic3889041-120.html#20135575 and romfs magic now correct, like here https://www.elektroda.com/rtvforum/topic3889041-390.html#20973684
Flashing gpio app booted OK https://github.com/lupyuen/lupyuen.github.io/blob/master/src/led.md
Powering from the mains as if a normal finished device made no difference to times when it was boot looping on 3.3v. I was at a loss, but after quite a number of attempts I think my final working one was using blflash! Maybe just a fluke. I think I'll get a BL602 dev board to see if I can find a pattern to what works and what doesn't. I also tried CH340 and FTDI USB-TTL adaptors.
After finally getting into OBK console (browsing to 192.168.169.1) I could use the GPIO doctor to find all 5 PWM pins. Those were
P14 - RED - PWM1
P20 - GREEN - PWM2
P21 - BLUE - PWM3
P22 - COLD WHITE - PWM4
P3 - WARM WHITE - PWM5
which makes the OBK template
PCB text: XLD-QFLWP-YT2.1
Various pics:

It is perhaps the same CozyLife bulb @blakadder posted about here https://www.elektroda.com/rtvforum/topic3889041-120.html#20151469
The DT-BL200 is a Bouffalo Labs BL602L20 (L=Light, 2=16mbit/2mb flash) and is rarely mentioned on the forums.

One of the first posts with some info is here https://www.elektroda.com/rtvforum/topic3900145.html
Inside is the DT-BL200 without RF shield in this instance. Using my own photo and other images around, I made this to help orient me from the top looking down. I did not desolder the module.

D8 = GPIO8 = pull high using 10k resistor/3.3v to enter flash download mode on power-up
First, I captured the boot log at UART 2000000 baud.
[20:23:59.220] - serial type is general
[20:23:59.269] - Open COM10 Success
[20:24:25.113] - Starting bl602 now....
Reset cause 0: BL_RST
[20:24:25.118] - _POWER_OFF
Heap 127408@0x42020e50, 5920@0x420488e0
blog init set power on level 2, 2, 2.
[IRQ] Clearing and Disable all the pending IRQ...
[ 0][[36mBUF[0m: hal_board.c: 606] 10 10 10 10 10 10 10 10 10 10 10 10 10 10
[BL] [SEC] TRNG Handler
====== bloop dump ======
--->>> timer list:
[MTD] >>>>>> Hanlde info Dump >>>>>>
name PSM
id 0
offset 0x000f8000(1015808)
size 0x00002000(8Kbytes)
xip_addr 0x230e7000
[MTD] <<<<<< Hanlde info End <<<<<<
[EF] Found Valid PSM partition, XIP Addr 230e7000, flash addr 000f8000
*default_env_size = 0x00000001
ENV start address is 0x00000000, size is 8192 bytes.
[20:24:25.148] - EasyFlash V4.0.99 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
[20:24:25.225] -
[BL] Initi Wi-Fi with MAC #### 24:94:94:EE:7F:97 ####
hostname: Bouffalolab_BL602-ee7f97
[WF] country code CN used, num of channel 13
-----------------------------------------------------
[I
[20:24:25.226] - PC] [TX] Low level size 204, driver size 92, total size 296
Enable BMX IRQ
[version] lmac 5.4.0.0
[version] version_machw_1 000055FB
[version] version_machw_2 000001B3
[version] version_phy_1 00822111
[version] version_phy_2 00000000
[version] features 000089DF
[ME] HT supp 1, VHT supp 0
[WF] country code CN used, num of channel 13
____ _ _ __
/ ___|___ _____ _| | (_)/ _| ___
| | / _ \_ / | | | | | | |_ / _ \
| |__| (_) / /| |_| | |___| | _| __/
\____\___/___|\__, |_____|_|_| \___|
|___/
cozylife_app_info
CozyLife SDK Version: 0.3.2
CozyLife SDK Build Sep 9 2021 10:51:17
cozylife_app_info
Product Id: p93sfg
Firmware Version: 1.1.1
Firmware Build Sep 9 2021 10:51:30
dohome_hal_wifi_set_sleep_flag not support now
[20:24:25.289] -
device id:
[20:24:25.321] - [0;35m1609473600 [L] [ lib_log] udplog_init on: 0, 192.168.2.2:7789
[0mADC freq: 8333Hz. ,div:9
[20:24:25.392] - [ 279][[33mWARN [0m: bl_mtd.c: 201] addr@0x23080800 is xip flash, size 12
[20:24:28.750] - [WIFI] [IND] SCAN Done
[20:24:28.768] - AP01 rssi:-84 channel:11 ssid:EE-5XC2JC
AP02 rssi:-45 channel:8 ssid:xxxxx
AP03 rssi:-87 channel:6 ssid:xxxxx
AP04 rssi:-85 channel:6 ssid:xxxxx
AP05 rssi:-85 channel:6 ssi
[20:24:28.772] - d:xxxxx
AP06 rssi:-41 channel:6 ssid:xxxxx
AP07 rssi:-41 channel:6 ssid:xxxxx
AP08 rssi:-87 channel:1 ssid:xxxxx
AP09 rssi:-58 channel:2 ssid:xxxxx
AP10 rssi:-98 channel:1 ssid:xxxxx
AP11 rssi:-98 channel:1 ssid:xxxxx
AP12 rssi:-55 channel:1 ssid:xxxxx
AP13 rssi:-85 channel:1 ssid:xxxxx
[APP] [EVT] SCAN Done 3657, SCAN Result: OK
[20:24:30.444] - [ 5331][[33mWARN [0m: bl_mtd.c: 201] addr@0x23080800 is xip
[20:24:30.445] - flash, size 12
[20:24:32.293] - [WIFI] [IND] SCAN Done
AP01 rssi:-98 channel:11 ssid:xxxxx
AP02 rssi:-81 channel:11 ssid:xxxxx
AP03 rssi:-85 channel:11 ssid:xxxxx
AP04 rssi:-84 channel:11 ssid:xxxxx
AP05 rssi:-44 channel:8 ssid:xxxxx
AP06 rssi:-89 channel:6 ssid:xxxxx
AP07 rssi:-87 channel:6 ssi
[20:24:32.296] - d:xxxxx
AP08 rssi:-86 channel:6 ssid:xxxxx
AP09 rssi:-41 channel:6 ssid:xxxxx
AP10 rssi:-41 channel:6 ssid:xxxxx
AP11 rssi:-84 channel:1 ssid:xxxxx
AP12 rssi:-57 channel:2 ssid:xxxxx
AP13 rssi:-98 channel:1 ssid:xxxxx
AP14 rssi:-98 channel:1 ssid:xxxxx
AP15 rssi:-55 channel:1 ssid:xxxxx
AP16 rssi:-85 channel:1 ssid:xxxxx
[APP] [EVT] SCAN Done 7168, SCAN Result: OK
[0;35m1609473607 [L] [ lib_wifi] wifi_start_config
[0m[ 7180][[33mWARN [0m: bl_mtd.c: 201] addr@0x23081200 is xip flash, size 11
[20:24:32.486] - [lwi
[20:24:32.487] - p] netif status callback
IP: 192.168.11.1
MK: 255.255.255.0
GW: 0.0.0.0
[WF] MM_ADD_IF_REQ Sending: AP
[WF] MM_ADD_IF_REQ Done
[WF] vif_index from LAMC is 0
[lwip] netif status callback
IP: 192.168.4.1
MK: 255.255.255.0
GW: 0.0.0.0
[DHCP] ip_start: [192.168.4.2]
[DHCP] ip_start: [192.168.4.254]
[WF] APM_START_REQ Sending with vif_index 0
[WF] APM_START_REQ Done
[WF] status is 00
[WF] vif_idx is 00
[WF] ch_idx is 00
[WF] bcmc_idx is 03
[APP] [EVT] Unknown code 11, 7373
BD_ADDR:(MSB)24:94:94:ee:7f:98(LSB)
[20:24:32.519] - [0;35m1609473607 [L] [ lib_ble] ble mac: 24:94:94:ee:7f:98
[0m[0;35m16094
[20:24:32.520] - 73607 [L] [ lib_ble] bt_enabled
[0m
[20:24:42.531] - [ 17417][[33mWARN [0m: bl_mtd.c: 201] addr@0x23081200 is xip flash, size 11
then the flash ID using BLDevCube 1.8.9
[20:45:33.401] - 8160/38592
[20:45:33.497] - 12240/38592
[20:45:33.593] - 16320/38592
[20:45:33.689] - 20400/38592
[20:45:33.784] - 24480/38592
[20:45:33.880] - 28560/38592
[20:45:33.976] - 32640/38592
[20:45:34.072] - 36720/38592
[20:45:34.120] - 38592/38592
[20:45:34.136] - Run img
[20:45:34.265] - Load helper bin time cost(ms): 2817.768310546875
[20:45:34.375] - Flash load shake hand
[20:45:34.388] - default set DTR high
[20:45:34.498] - clean buf
[20:45:34.502] - send sync
[20:45:34.731] - ack is 4f4b
[20:45:34.776] - Read mac addr
[20:45:34.792] - macaddr: 977fee949424
[20:45:34.793] - flash set para
[20:45:34.793] - ========= flash read jedec ID =========
[20:45:34.808] - Read flash jedec ID
[20:45:34.809] - flash jedec id: ef401580
[20:45:34.809] - Finished
[20:45:34.815] - get flash size: 0x00200000
[20:45:34.816] - ========= flash read jedec ID =========
[20:45:34.824] - Read flash jedec ID
[20:45:34.825] - flash jedec id: ef401580
[20:45:34.825] - Finished
I also took a 2mb backup of the flash, attached. The whole chip tick is for the erase function only. Read chip requires address input.

Now, despite having soldered each pin to a dupont cable, keeping my wires short and using an external <5A 3.3v PSU, I had great difficulty getting the device to boot after flashing OBK. DevCube 1.8.9 would flash successfully, using old (from the Elektroda 1.4.8 pack) and new boot2, partition files, but it would never boot to AP or even give any UART boot output. I tried several versions of OpenBL602 going back to April 2022.
Using 1.4.8 DevCube however (it seemed happy with the flashID for once) was successful, but the boot would either loop or the AP would show briefly and disappear or show but nothing could connect to it. Suspect boot log errors would change between flash attempts. I've seen unknown gpio like here https://www.elektroda.com/rtvforum/topic3889041-120.html#20135575 and romfs magic now correct, like here https://www.elektroda.com/rtvforum/topic3889041-390.html#20973684
Flashing gpio app booted OK https://github.com/lupyuen/lupyuen.github.io/blob/master/src/led.md
Powering from the mains as if a normal finished device made no difference to times when it was boot looping on 3.3v. I was at a loss, but after quite a number of attempts I think my final working one was using blflash! Maybe just a fluke. I think I'll get a BL602 dev board to see if I can find a pattern to what works and what doesn't. I also tried CH340 and FTDI USB-TTL adaptors.
After finally getting into OBK console (browsing to 192.168.169.1) I could use the GPIO doctor to find all 5 PWM pins. Those were
P14 - RED - PWM1
P20 - GREEN - PWM2
P21 - BLUE - PWM3
P22 - COLD WHITE - PWM4
P3 - WARM WHITE - PWM5
which makes the OBK template
Code: JSON
PCB text: XLD-QFLWP-YT2.1
Various pics:














