Flashing Winner Micro W600 / TW-02 Module - GUI and Command Line Experience

I picked up a TW-02 module from Ali Express because I haven't got any W600 devices and wanted to see OpenBeken in action on that platform.



https://www.aliexpress.com/item/1005004549433294.html

The single module arrived in a little black packaging tray.



I immediately soldered short cables to 3V3, GND and RESET pins and used a pogo probe on TX to see what a (presumably) blank module would output on boot, if anything.





Only this:



115200 baud.

First flashing attempt was with the Windows GUI program "Upgrade Tools V1.5.4" available from this post.

After running I switched language to English



With RX, TX, GND and 3V3 (to external PSU - common ground with USB serial adaptor) connected, but PSU powered off, I browsed for the UART .fls full firmware Openbeken firmware for the W600, chose correct COM port and decided to leave it on 115200 baud. Opened the serial port with the button first then clicked the big download button. It will then monitor for the W600 to be in the correct boot mode before it begins flashing.

Because my PSU was off, simply turning it on let the flasher pick it up to begin flashing. If the module was already powered a quick grounding of the RESET cable/pin would have reset the module to enable flashing to begin. Continuous output of CCC... shows it's in flash mode.



After successful flash (this attempt was with different baud):



After resetting by grounding RESET, the OpenW600 AP broadcast as expected.



OBK boot log on W600:



and the web console ready for config after connecting to the AP and browsing to 192.168.4.1



I also gave the command line flasher a go. wm_tool.exe can be downloaded from the tools folder here https://github.com/openshwprojects/OpenW600

I did not set a flash speed, but the time taken felt like 115200. Same on/off/reset procedure as above to get into flash mode.





For ref, the options used, and others available, are:



As expected the AP broadcast after successful flash and module reboot. Nice and easy!

Added after 5 [minutes]:

forgot to add that current is mostly 0.021-0.023A with the module doing nothing but acting as an AP. There is the occasional burst to 0.049, 0.063 and higher up to 200mA sometimes- this is with no powersave options set (so effectively powersave 0)

Is it really 22mA? My module sits at ~100mA doing nothing. With some odd drops to 20mA.
Example trace with Power profiler:

Or is it my network preventing it to go low power?

tbh I wouldn't be surprised if this PSU wasn't that accurate. Yours is probably better?

Mine should be accurate, I also get similar with accurate USB testers.

there is an updated W6xx and W8xx flasher - Upgrade Tools - available http://www.isme.fun/?log=blog&id=34

since 1.5.4:

Update 2026
As of 2026, this platform read/write is also supported by our flash tool:
https://github.com/openshwprojects/BK7231GUIFlashTool
The connection (soldering, wires), is the same, but you can use our tool instead of the legacy one.
Please check it out and use it instead of legacy tools, let us know how it works for you!

a couple of Tuya W600 OTA downloads. Can OTA straight from OBK

http://s3-us-west-2.amazonaws.com/airtake-pub...574047100-TC0025_TW02_PLUG_L1_P0_ug_1.4.0.bin


http://s3-us-west-2.amazonaws.com/airtake-pub...7665-TC0364_W600_STRIP3_IRRGB_P0_ug_1.4.6.bin


Added after 1 [hours] 27 [minutes]:




Added after 10 [hours] 26 [minutes]:

http://s3-us-west-2.amazonaws.com/airtake-pub...13015-TC0084_TW03_PLUG_DLTJL2_P0_ug_1.4.2.bin

with recent ROM adventures I wondered what secrets a W600 might have inside. Maybe, finally, some undocumented SPI flash read command?

Wrote a little app to read mask rom and efuse and send to a PC-side collector over UART0



py w600_maskrom_capture.py -p COM53 -b 115200 -o w600


the device mac

286DCD0A369D

can be seen in the efuse files.

the 256k mask rom is mostly empty, but it does reveal the known supported list of commands, plus a few new ones. Sadly no uart read.

Cmd	Seen in this mask ROM	Publicly documented?	Known/Inferred Meaning
0x31	yes	yes	Switch UART baudrate, max 2,000,000
0x32	yes	yes	Erase image area
0x33	yes	yes	Set security level
0x34	yes	yes	Get security level
0x35	yes	yes	Set RF/gain parameters
0x36	yes	yes	Get RF/gain parameters
0x37	yes	yes	Set MAC address
0x38	yes	yes	Get MAC address
0x39	yes	no	Selector-based QFLASH/key-parameter-field write; not arbitrary flash write
0x3A	yes	no	Read selector-2 parameter field and print it as CID: string, max 16 bytes
0x3B	yes	no	Write selector-2 CID: parameter field, max 16 bytes
0x3C	yes	yes	Get QFLASH ID
0x3E	yes	no	Prints R: then ASCII 1; likely revision/status, exact meaning unconfirmed

Dumps are from an Air602