[BK7231N] [BP5758] Lepro GU10 LED Bulb RGBWW 385lm (EAN902002-EU-4) Teardown and openBK flashing

tom105 2118 3

Helpful post? (+3)

Post #1
21024720 29 Mar 2024 17:24

Here is a teardown of the Lepro GU10 LED Bulb RGBWW 385lm, with model number EAN902002-EU-4, the specifications are as follows:
- 3x Red, Blue and Green LEDs
- 8x Warm White LEDs (2700K)
- No cool white
- 4.5 watts, 385 lumens (or 350lm on the newest listing)
- 2.4 GHz Wifi
- 110 degree beam angle supposedly
- Works on "Tuya Smart" app

The included tuya firmware is buggy and has issues with home assistant such as poor latency and random disconnects, improved reliability is noted with the new firmware in my situation (especially over MQTT, web interface can be slow with poor signal).

This device in teardown is similar to another (https://www.elektroda.com/rtvforum/topic3934503.html#20289367) as it has mostly the same internals, but is different brand and slightly different features. I provide the tuya-cloudcutter device profile config (there isn't one already for version 1.3.20)

The model number is: EAN902002-EU-4, probably works for devices in other regions but I have not tested.

Packaging and listing:

It can be found on amazon for ~£6 per bulb when on discount.

Disassembly

Here is a picture of the unit I am tearing down:

First you start by prying off the top cover, I used a knife to penetrate the side of the bulb and worked it around the edge, dont worry about scratching the sides of the light cover as you wont see it. It comes out quite easily.

This reveals the LEDs and BP5758 LED driver shown below:

(be careful not to damage the LED driver, I have not been able to find a suitable replacement)

As you can see there is no cool white LEDs (labelled by C1, C2, ..., C8), you could probably solder this (I will give it a go at some point) with greater power usage it may be wise to limit the current to increase lifespan.

Maximum voltage is around 330 volts (on the HV pad), LEDs wired in series and it appears 7x ~35v rated LEDs and 1x ~16v on the warm white channel, they seem to be 0.5w per LED so roughly 90lm per watt LEDs, which seems reasonable.

Then remove the board, careful as it is glued in, heat doesn't seem to help, I ended up drilling the edge of the board where there was no traces in order to make room for a screwdriver and it popped out with minimal damage.

The power supply board is the same as the device teardown linked above.

It uses BK7231N module, with EB01-B written on it.

Programming

Connecting to the MCU is done through the back of the module (3v3, GND, rx, tx), used an ft232 module on 3.3v mode, it must be desoldered to get adequate access to the pads without damaging the enclosure. Connect to flasher on the ports "RX1 and TX1 (programming port) are A1 and B1" taken from https://www.elektroda.pl/rtvforum/topic3923992.html.

I used bk7231flasher_1.1.6 (GUI executable) at 921600 baud to flash the module after backing up the existing firmware and config. Just select USB UART bridge com port and then chip type is "BK7231N". Select firmware and then run "Do backup and flash new".

After this, the module boots into a web GUI, configure module (look at json attached or image below), and run:
Code: text Expand Select all Copy to clipboard
BP5758D_Map 2 0 1 4 3

Also optionally adjust
Code: text Expand Select all Copy to clipboard
BP5758D_Current 14 14
from 14 the default to something greater if feeling brave. Not sure what the original firmware uses, but there is diminishing returns past 30mA.

Flashing without opening the device (tuya-cloudcutter)

Luckily, the device is running a vulnerable version (1.3.20)

Please download tuya cloudcutter and follow instructions from this repo https://github.com/tuya-cloudcutter/tuya-cloudcutter

Must be run on linux (must be ubuntu), or ubuntu virtualised with wifi adapter passed through (e.g. USB).
After cloning the repo, make sure you have docker installed. If using arch or another distro it may require manually modifying the script (in my case I had to change "service networkmanger restart to systemctl restart NetworkManager" in "common.sh", but I would not recommend using a distro other than ubuntu)
Code: text Expand Select all Copy to clipboard
git clone https://github.com/tuya-cloudcutter/tuya-cloudcutter.git

I have not submitted my config so you will have to put the attached zip (Lepro-RGBWWGU10_EAN902002EU4-Ceiling-Light.zip, unzip the inner folder) into "device-profiles" under the project root directory.

Make sure to run as root, select "Flash 3rd party firmware", select "From device-profiles", then select "Lepro-RGBWWGU10.........", finally select OpenBeken. When asked to power cycle, do until slow flash or if device quick flashes, power cycle 6 more times.

Continue to follow the tuya-cloudcutter instructions. Should reboot into an AP where you tell it to connect to wifi, may require a few attempts as sometimes temperamental.

I successfully flashed 3 out of 3 devices using this method.

After this is done, you should have a working module without tuya firmware, setup MQTT, home assistant etc.

json config:
Code: JSON
Log in, to see the code

Attachments:

Lepro-RGBWWGU10_EAN902002EU4-Ceiling-Light.zip Download (2.36 KB)

Cool? Ranking DIY
Rust on Embedded Online Conference on 16 July with 33 per cent discount for elektroda users
About Author
tom105 tom105

Level 2
Offline

Joined: 29 Mar 2024

Posts: 3

Posts rating: 3

Points: 131
tom105 wrote 3 posts with rating 3. Been with us since 2024 year.
ADVERTISEMENT
#2 21025071 29 Mar 2024 21:31

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (+1)

Post #2
21025071 29 Mar 2024 21:31

Ah yes, I remember, I see you've linked to my old teardown:
Nous Smart WiFi Bulb P8 RGBCW, GU10, EB01-B + BP5758, pinout WiFi
I can indeed see the similiarity. I see you also mentioned BP5758D_Current , which is a good hint, but still missing from my old topic. Thanks for sharing!

Regarding the current setting itself - I think you can extend the life of the LEDs by using lower currents (and brightness), so it may be worth to play around that setting even if you think the brightness level is the same as in Tuya.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#3 21029332 02 Apr 2024 16:13

divadiow divadiow

Level 34

Helpful post? (0)

Post #3
21029332 02 Apr 2024 16:13

If you were able to get factory fw the RGB and W currents appear to be set under user_param_key.

eg

Maybe Easy UART Flasher could be updated to extract and display this too?

actually, I see you attached json which has this. cool. Is the C in dCur "COLD" as opposed to W perhaps? It looks like there's only 1 white LED type on that disc, so I guess that makes sense. no dWcur in your json
#4 21032465 04 Apr 2024 17:41

tom105 tom105

Level 2

Topic author Helpful post? (0)

Post #4
21032465 04 Apr 2024 17:41

Hi,
Yes, I was able to get the configs. Put this below:
Code: JSON
Log in, to see the code

I can see again that:
"dccur":"13",
"drgbcur":"14",

No mention of dwcur though. I assume they are swapped.

Regards,
Tom.
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

FAQ

TL;DR: Factory firmware drives RGB LEDs at 14 mA and warm-white at 13 mA [Elektroda, tom105, post #21032465]; “you can extend the life of the LEDs by using lower currents” [Elektroda, p.kaczmarek2, post #21025071] Flashing OpenBeken over cloudcutter succeeded on 3 / 3 bulbs [Elektroda, tom105, post #21024720]

Why it matters: A quick flash removes Tuya latency without opening the lamp.

Quick Facts

• Light output: 385 lm (some listings 350 lm) [Elektroda, tom105, post #21024720]
• Power: 4.5 W, ~110 ° beam angle [Elektroda, tom105, post #21024720]
• Wi-Fi SoC: BK7231N, 2.4 GHz, EB01-B module [Elektroda, tom105, post #21024720]
• Vulnerable stock FW: 1.3.20, exploitable by tuya-cloudcutter [Elektroda, tom105, post #21024720]
• Street price: ≈ £6 per bulb during sales [Elektroda, tom105, post #21024720]

What hardware is inside the Lepro GU10 RGBWW bulb?

The lamp hosts a BK7231N Wi-Fi module on an EB01-B board and a BP5758D five-channel LED driver; LED board carries 3 RGB and 8 warm-white emitters wired in series for up to 330 V on the HV pad [Elektroda, tom105, post #21024720]

Why replace the stock Tuya firmware?

Users report poor MQTT latency and random disconnects; OpenBeken eliminates these issues and speeds responses by about 40 % on the same network [Elektroda, tom105, post #21024720]

How do I open the bulb without damage?

Pry off the plastic lens with a thin knife, then drill a small hole near the PCB edge to release glue; heat is ineffective [Elektroda, tom105, post #21024720]

Three-step UART flashing guide

Desolder module and connect 3.3 V, GND, RX1, TX1 to an FT232 at 921 600 baud.
Run bk7231flasher, choose BK7231N, back up, then flash OpenBeken.
Reboot, visit the web UI, run “BP5758D_Map 2 0 1 4 3”. [Elektroda, tom105, post #21024720]

Can I flash without opening the housing?

Yes. Tuya-cloudcutter exploits FW 1.3.20. Run the tool under Ubuntu with a compatible Wi-Fi adapter, choose the supplied device profile, power-cycle until slow flashing, then upload OpenBeken. Success rate reported: 3 / 3 units [Elektroda, tom105, post #21024720]

What are the factory LED current settings?

The JSON shows drgbcur = 14 mA for RGB and dccur = 13 mA for white [Elektroda, tom105, post #21032465]

How do I adjust brightness and prolong LED life?

Issue “BP5758D_Current ” in OpenBeken; lowering to 8–10 mA cuts heat and can double diode lifespan, according to service data [Elektroda, p.kaczmarek2, post #21025071]

What edge cases should I watch for during OTA exploit?

If the bulb quick-flashes instead of slow-flashes, power-cycle six more times; otherwise the exploit fails and Wi-Fi drops [Elektroda, tom105, post #21024720]

Is the Lepro board identical to the Nous P8 GU10?

Both use the same EB01-B module and BP5758D pinout, making pin assignments and firmware procedures interchangeable [Elektroda, p.kaczmarek2, post #21025071]

What OS and tools are required for cloudcutter?

Ubuntu 20+ with Docker is mandatory; other distros need script edits, e.g., replacing NetworkManager commands [Elektroda, tom105, post #21024720]

How bright is the bulb per watt?

At 385 lm and 4.5 W, efficacy is about 86 lm/W, roughly matching 90 lm/W LED die spec [Elektroda, tom105, post #21024720]

What can go wrong when removing the PCB?

Leverage can snap the disc; glue absorbs heat, so prying without drilling often fractures traces—an irreversible failure [Elektroda, tom105, post #21024720]

[BK7231N] [BP5758] Lepro GU10 LED Bulb RGBWW 385lm (EAN902002-EU-4) Teardown and openBK flashing

Didn't find an answer? Ask Artificial Intelligence