logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[BL602] How to flash Magic Home over WiFi without soldering

alwas 13644 89
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #61 21507933
    divadiow
    Level 35  
    >>21507396

    as in your pin assignments in the config page aren't saving?
  • ADVERTISEMENT
  • #62 21585608
    kellerto
    Level 5  
    >>21418610 Any luck with 33_227_20231220_ZG-BL?
  • #63 21585743
    divadiow
    Level 35  
    we could do with a backup of a 33_227_20231220_ZG-BL device firmware for the collection and to test mhflasher
  • ADVERTISEMENT
  • #64 21585983
    kellerto
    Level 5  
    >>21585743 thank you for help. I was able to read (dump) the original Flash firmware. I was also able to run AT+LVER\r with packetsender app in order to find the version: 33_227_20231220_ZG-BL\r
    I'm trying to flash MagicHome RGB controller without success. Tried by soldering approach accepts which seems to work but no AP appears (even after 5 power cycles) also firmeware installation via OTA by using AT+UPURL and powershell http listener on Port.1111

    Here the original flash bin
    Attachments:
  • #65 21586017
    p.kaczmarek2
    Moderator Smart Home  
    AP may not work if you power device from USB to UART converter. You need a good 3.3V power supply that can provide enough current.

    You can just watch UART log output via UART to see if it crashes.
    Helpful post? Buy me a coffee.
  • #66 21586037
    kellerto
    Level 5  
    Unfortunately problem exists even when I power up via regular DC 5….28V input socket (I used 12VDC)
  • ADVERTISEMENT
  • #69 21586062
    p.kaczmarek2
    Moderator Smart Home  
    Why would you want it to be full size? We only overwrite main application, there is no need to overwrite full flash. I will say even more - we need to do this that way, otherwise we would:
    - overwrite RF partition and lose calibration (get worse WiFi quality, known problem on Beken)
    - overwrite MAC address and get MAC collisions (on some platforms)
    - overwrite Tuya GPIO Config (which we can extract on Beken and use to configure device)
    - overwrite your OBK config (only if you reflash)
    So, we obviously provide only app section, not full flash, just like Tasmota does.
    Helpful post? Buy me a coffee.
  • #70 21586076
    kellerto
    Level 5  
    Makes sense, thank you for clearing this thought.
  • #71 21586087
    p.kaczmarek2
    Moderator Smart Home  
    If you think that you may misconfigured your device and want to "refresh" it, then the recommended method is to rewrite full 2MB factory flash (assuming you have taken it), and then flash our firmware again.

    Still, I'm saying that just for other readers, because in your case I am not sure if that's the problem... maybe something else is incorrect, let us know when you manage to take the debug log.

    Btw, did you make sure to disconnect BOOT pin before trying?
    Helpful post? Buy me a coffee.
  • #72 21586110
    kellerto
    Level 5  
    …was thinking the same. First instal the original backup, which I pulled at the beginning. Then instal the newest OpenBL602.bin
    Which is exactly what I did at the beginning of this journey. :-)
    And get us the debug log. Hope debug log is possible with bouffalolab flasher.
  • #73 21586120
    p.kaczmarek2
    Moderator Smart Home  
    Any UART client can set debug log as long as you set valid baud rate
    Helpful post? Buy me a coffee.
  • #74 21586157
    divadiow
    Level 35  
    for the record your backup does work and here is the debug log from that. 2000000 baud
    Code: Text
    Log in, to see the code


    mhflasher OTA method fails, as you know. this is log for when pushing 'flash' button in mhflasher app
    Code: Text
    Log in, to see the code
  • #75 21586228
    p.kaczmarek2
    Moderator Smart Home  
    @divadiow can you try with older OBK binary? The one before we introduced size check with @insmod ?
    Helpful post? Buy me a coffee.
  • #76 21586235
    insmod
    Level 26  
    Size check only matters when OTA is performed from OBK, not to it.

    Offtopic: did xr809 ota ever work? I get rtos scheduler shutting down when erasing, and if erase is skipped - when writing first payload. In that case it is either scheduler or hard fault.
    Curiously, if flash debugging is enabled it goes a little further, but will still hang or crash.
  • #77 21586245
    divadiow
    Level 35  
    insmod wrote:
    did xr809 ota ever work?

    previous chats about it here https://www.elektroda.com/rtvforum/topic4055254.html#21131093

    Added after 10 [minutes]:

    p.kaczmarek2 wrote:
    can you try with older OBK binary?


    I have burnt user's backup and then flashed 1.18.100 as per:
    Screenshot of BouffaloLabDevCube log showing the BL602 chip memory flashing process.
    4mb board. OpenBL AP broadcasts as expected. Not sure what that proves though because even with an entirely blank flash (erase whole chip- read back 4mb from 0x0 - all FF) BLDevCube seems to add/erase/carve all the needed bits up to make working flash

    Code: Text
    Log in, to see the code


    eg
    Code: Text
    Log in, to see the code
  • #78 21586308
    p.kaczmarek2
    Moderator Smart Home  
    insmod wrote:

    did xr809 ota ever work?.

    XR809 OTA never worked for me. XR809 was the first IoT device I flashed (except ESP), then I flashed BK and backported XR809 support to OpenBK (that was the first non-BK platform supported).
    I remember I was doing some debugging with printfs in XR809 OTA SDK code but failed to find anything, however, I know I was using the same binary I use for UART, which was most likely incorrect.
    https://github.com/openshwprojects/OpenXR809/commit/3c964113f1be89f749e4619483590bf5e2842a6a
    Recently we've looked into those XR872 cameras with @divadiow and I seemed to see more OTA code there, maybe OTA file generation.

    @insmod how far have you managed with that, do you know how to build flash OTA file for XR?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #79 21586374
    insmod
    Level 26  
    >>21586308
    From what i understood in the SDK code, the same binary that is used for UART is used for OTA.
    And it probably works like two partition scheme on ESP.
    I did some debugging, and it stops RTOS scheduler and disables XIP on flash opening. That is probably the problem, and i'm don't know how to solve it. And i'm not sure if it would affect LFS and EF.


    Currently i separated pins for all XRs, added easyflash, LFS, and started using heap_4, not heap_stdlib.
    Coded pwm, but it's not working yet. Also coded ADC, but can't test it for now.
    Decided against updating freertos and lwip, binary size is already too much.
    Will see if i manage to successfully enable compression, like tuya uses by default.
  • #80 21586388
    kellerto
    Level 5  
    …was thinking the same. First instal the original backup, which I pulled at the beginning. Then instal the newest OpenBL602.bin
    Which is exactly what I did at the beginning of this journey. :-)
    And get us the debug log. Hope debug log is possible with bouffalolab flasher.
  • #81 21586431
    p.kaczmarek2
    Moderator Smart Home  
    Nice, which XR do you have, @insmod ? The first thing I would try to do for Xr809/XR806 is enabling the UART flashing method without pulling two pins down... it seems that XR872 has this possible via AT command (UPGRADE). Maybe we could also strip other AT commands to get more space.
    Helpful post? Buy me a coffee.
  • #82 21586469
    insmod
    Level 26  
    >>21586431
    I have XR809 and testing everything there.
    I also have XR872 doorbell with 4MB flash. But there are almost no pins wired out. Tried to find UART port, but no luck.
    Got PWM and ADC working.
    Binary size is already past 1024K limit, had to change it to 1056K. Currently at 1044 kb.

    UART for XR809 is easy, there is one pin combination for UART0, and one for UART1.
    But for XR806, one for UART0, 3 for UART1 and 3 for UART2.
  • #84 21586480
    insmod
    Level 26  
    >>21586478
    Didn't try it. Bot on W600 gcc-8 increased size by 3kb.
    I will later try to use gcc-10.3
  • #85 21586571
    kellerto
    Level 5  
    >>21586157
    I can confirm, original backup worked. It also opens an AP soon power supply is applied.
    Code: text Expand Select all Copy to clipboard
    

[17:49:11.452] -  
sysTick:90127
7C3E82C16F17
10.10.123.3
fh:62544
st1:21 st2:0 st3:0
life:%100
repT:0s
pwr:0
wanT:0 lanT:0
ping:0 (0) 9999
rssi:-9999 (0) 9999


    Test2: Installed OpenBL602_1.18.123.bin by using Single Download option
    Screenshot of a BL602 microcontroller boot log showing system messages and configuration data.
    UART Log after disconnected boot resistor connecting to 12V source. No UART Logging received
    Code: text Expand Select all Copy to clipboard
    [17:56:47.813] - serial type is general
[17:56:50.190] - Open COM5 Success


    Test3: Installed OpenBL602_1.18.123.bin by using Firmware options
    Note: As you mentioned this kind of installation messes with chip and wifi config. Just did it to compare with Test 1 and 2.
    and please note, the IP Address listed in logfile is not mine and not related with my network. not sure where this setting is coming from. looks like build in into one of the other 3 firmware options (files) ?    .

    UART console output during BL602 startup with OpenBL602_1.18.123.bin, showing detailed system logs.
    Code: text Expand Select all Copy to clipboard
    [19:49:31.413] - Starting bl602 now....
Booting BL602 Chip...
██████╗ ██╗      ██████╗  ██████╗ ██████╗
██╔══██╗██║     ██╔════╝ ██╔═████╗╚════██╗
██████╔╝██║     ███████╗
[19:49:31.413] -  ██║██╔██║ █████╔╝
██╔══██╗██║     ██╔═══██╗████╔╝██║██╔═══╝
██████╔╝███████╗╚██████╔╝╚██████╔╝███████╗
╚═════╝ ╚══════╝ ╚═════╝  ╚═════╝ ╚══════╝
------------------------------------------------------------
RISC-V Core Feature:RV32-ACFIMX
Build Version: release_bl_iot_sdk_1.6.39-238-gf5ba0a7ee
Build Date: Jun 21 2025
Build Time: 05:56:26
------------------------------------------------------------
blog init set power on level 2, 2, 2.
[IRQ] Clearing and Disable all the pending IRQ...
[         0][INFO: hal_boot2.c: 282] [HAL] [BOOT2] Active Partition[0] consumed 596 Bytes
[         0][INFO: hal_boot2.c:  82] ======= PtTable_Config @0x4200f250=======
[         0][INFO: hal_boot2.c:  83] magicCode 0x54504642; version 0x0000; entryCnt 7; age 0; crc32 0x12DF9A26
[         0][INFO: hal_boot2.c:  89] idx  type device activeIndex     name   Address[0]  Address[1]  Length[0]   Length[1]   age
[         0][INFO: hal_boot2.c:  91] [00]  00     0         0            FW  0x00010000  0x000e8000  0x000d8000  0x00088000  0
[         0][INFO: hal_boot2.c:  91] [01]  02     0         0           mfg  0x00170000  0x00000000  0x00032000  0x00000000  0
[         0][INFO: hal_boot2.c:  91] [02]  03     0         0         media  0x001a2000  0x00000000  0x00047000  0x00000000  0
[         0][INFO: hal_boot2.c:  91] [03]  04     0         0           PSM  0x001e9000  0x00000000  0x00008000  0x00000000  0
[         0][INFO: hal_boot2.c:  91] [04]  05     0         0           KEY  0x001f1000  0x00000000  0x00002000  0x00000000  0
[         0][INFO: hal_boot2.c:  91] [05]  06     0         0          DATA  0x001f3000  0x00000000  0x00005000  0x00000000  0
[         0][INFO: hal_boot2.c:  91] [06]  07     0         0       factory  0x001f8000  0x00000000  0x00007000  0x00000000  0
[         0][INFO: bl_flash.c: 391] ======= FlashCfg magiccode @0x42049c18=======
[         0][INFO: bl_flash.c: 392] mid       0x5E
[         0][INFO: bl_flash.c: 393] clkDelay    0x1
[         0][INFO: bl_flash.c: 394] clkInvert    0x1
[         0][INFO: bl_flash.c: 395] sector size   4KBytes
[         0][INFO: bl_flash.c: 396] page size   256Bytes
[         0][INFO: bl_flash.c: 397] ---------------------------------------------------------------
[         0][INFO: hal_board.c:1249] [MAIN] [BOARD] [FLASH] addr from partition is 001f8000, ret is 0
[         0][INFO: hal_board.c:1257] [MAIN] [BOARD] [XIP] addr from partition is 231e7000, ret is 0
[         0][INFO: hal_board.c: 208] MAC address mode length 3
[         0][INFO: hal_board.c: 212] MAC address mode is MBF
Read slot:0
[         0][INFO: hal_board.c: 187] Set MAC addrress 7C:3E:82:C1:6F:17
[         0][INFO: hal_board.c: 955] country_code : 86
[         0][INFO: hal_board.c: 342] xtal_mode is MF
Read slot:0
[         0][INFO: hal_board.c: 374] get xtal from M ready 31 31 1 60 60
[         0][INFO: hal_board.c: 846] pwr_table_11b :20 20 20 18
[         0][INFO: hal_board.c: 860] pwr_table_11g :18 18 18 18 18 18 14 14
[         0][INFO: hal_board.c: 878] pwr_table_11n :18 18 18 18 18 16 14 14
No written slot found
[         0][BUF: hal_board.c: 606]   0   0   0   0   0   0   0   0   0   0   0   0   0   0
[         0][INFO: hal_board.c: 902] set pwr_table_ble = 13 in dts
[         0][INFO: hal_board.c: 687] ap_ssid string[0] = bl_test_005, ap_ssid_len = 11
[
[19:49:31.429] -     0][INFO: hal_board.c: 698] ap_psk string[0] = 12345678, ap_psk_len = 8
[         0][INFO: hal_board.c: 707] ap_channel
[19:49:31.429] - = 11
[         0][INFO: hal_board.c: 635] [STA] ap_ssid string[0] = yourssid, ap_ssid_len = 8
[         0][INFO: hal_board.c: 646] [STA] ap_psk string[0] = yourapssword, ap_psk_len = 12
[         0][INFO: hal_board.c: 654] auto_connect_enable = 0
[         0][INFO: hal_board.c: 749] Troom_os = -1, lentmp = 4
[         0][INFO: hal_board.c: 758] linear_or_follow = 1, lentmp = 4
[         0][INFO: hal_board.c: 767] Tchannels:2412,2427,2442,2457,2472,
[         0][INFO: hal_board.c: 781] Tchannel_os:180,168,163,160,157,
[         0][INFO: hal_board.c: 795] Tchannel_os_low:199,186,170,165,160,
[         0][INFO: hal_board.c: 808] en_tcal = 0, lentmp = 4
[OS] Starting aos_loop_proc task...
[OS] Starting OS Scheduler...
[MTD] >>>>>> Hanlde info Dump >>>>>>
name PSM
id 0
offset 0x001e9000(2002944)
size 0x00008000(32Kbytes)
xip_addr 0x231d8000
[MTD] <<<<<< Hanlde info End <<<<<<
[EF] Found Valid PSM partition, XIP Addr 231d8000, flash addr 001e9000, size 32768
ENV AREA SIZE 32768, SECTOR NUM 8
*default_env_size = 0x00000001
ENV start address is 0x00000000, size is 32768 bytes.
[19:49:31.476] - EasyFlash V4.0.99 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
[MTD] >>>>>> Hanlde info Dump >>>>>>
name media
id 0
offset 0x001a200
[19:49:31.476] - 0(1712128)
size 0x00047000(284Kbytes)
xip_addr 0x23191000
[MTD] <<<<<< Hanlde info End <<<<<<
[        38][ERROR : bl_romfs.c: 158] romfs magic is NOT correct
[        39][INFO  : hosal_adc.c: 459] offset = 2132
[        39][INFO  : hosal_adc.c: 233] ADC freq: 284Hz. div:6
[OS] Starting proc_mian_entry task...
[OS] Starting TCP/IP Stack...
-------------------->>>>>>>> LWIP tcp_port 58301
[MTD] >>>>>> Hanlde info Dump >>>>>>
name PSM
id 0
offset 0x001e9000(2002944)
size 0x00008000(32Kbytes)
xip_addr 0x231d8000
[MTD] <<<<<< Hanlde info End <<<<<<
[EF] Found Valid PSM partition, XIP Addr 231d8000, flash addr 001e9000, size 32768
ENV AREA SIZE 32768, SECTOR NUM 8
*default_env_size = 0x00000001
EasyFlash V4.0.99 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
Start Wi-Fi fw @95ms
[19:49:31.554] - 1th channel,lo_vco_freq_cw=154
2th channel,lo_vco_freq_cw=153
3th channel,lo_vco_freq_cw=152
4th channel,lo_vco_freq_cw=151
5th channel,lo_vco_freq_cw=149
6th channel,lo_vco_freq_cw=148
7th channel,lo_vco
[19:49:31.554] - _freq_cw=147
8th channel,lo_vco_freq_cw=145
9th channel,lo_vco_freq_cw=144
10th channel,lo_vco_freq_cw=143
11th channel,lo_vco_freq_cw=141
12th channel,lo_vco_freq_cw=140
13th channel,lo_vco_freq_cw=139
14th channel,lo_vco_freq_cw=138
15th channel,lo_vco_freq_cw=136
16th channel,lo_vco_freq_cw=135
17th channel,lo_vco_freq_cw=134
18th channel,lo_vco_freq_cw=133
19th channel,lo_vco_freq_cw=132
20th channel,lo_vco_freq_cw=130
21th channel,lo_vco_freq_cw=129
0th channel,vco_idac_cw=7
1th channel,vco_idac_cw=6
2th channel,vco_idac_cw=6
3th channel,vco_idac_cw=6
4th channel,vco_idac_cw=6
5th channel,vco_idac_cw=6
6th channel,vco_idac_cw=6
7th channel,vco_idac_cw=6
8th channel,vco_idac_cw=6
9th channel,vco_idac_cw=6
10th channel,vco_idac_cw=5
11th channel,vco_idac_cw=5
12th channel,vco_idac_cw=5
13th channel,vco_idac_cw=5
14th channel,vco_idac_cw=5
15th channel,vco_idac_cw=6
16th channel,vco_idac_cw=5
17th channel,vco_idac_cw=5
18th channel,vco_idac_cw=5
19th channel,vco_idac_cw=5
20th channel,vco_idac_cw=5
LO locked 9 144
rosdac_i_gc3=27
rosdac_i_gc2=27
rosdac_i_gc1=27
rosdac_i_gc0=27
rosdac_q_gc3=33
rosdac_q_gc2=33
rosdac_q_gc1=33
rosdac_q_gc0=33
rbb_cap1_fc_i=30,rbb_cap2_fc_i=30,rbb_cap1_fc_q=30,rbb_cap2_fc_q=30
new rbb_cap1_fc_i=54,rbb_cap2_fc_i=54,rbb_cap1_fc_q=54,rbb_cap2_fc_q=54
LO locked 9 144
amp=128,step=32,adc_mean_i=85
amp=160,step=16,adc_mean_i=111
tmx_cs=0, tmxcs_pwr_avg=50712, tmxcs_pwr_avg>>10=49
tmx_cs=1, tmxcs_pwr_avg=57332, tmxcs_pwr_avg>>10=55
tmx_cs=2, tmxcs_pwr_avg=66924, tmxcs_pwr_avg>>10=65
tmx_cs=3, tmxcs_pwr_avg=81456, tmxcs_pwr_avg>>10=79
tmx_cs=4, tmxcs_pwr_avg=98581, tmxcs_pwr_avg>>10=96
tmx_cs=5, tmxcs_pwr_avg=112166, tmxcs_pwr_avg>>10=109
tmx_cs=6, tmxcs_pwr_avg=110187, tmxcs_pwr_avg>>10=107
tmx_cs=7, tmxcs_pwr_avg=95296, tmxcs_pwr_avg>>10=93
tmx_cs_max=5, tmxcs_pwr_max=112166, tmxcs_pwr_max>>10=109
amp=256,step=64,adc_mean_i=112
amp=320,step=32,adc_mean_i=228
tosdac_i=30,tosdac_q=44,tx_iq_gain_comp=1054,tx_iq_phase_comp=1
tosdac_i=28,tosdac_q=42,tx_iq_gain_comp=1042,tx_iq_phase_comp=5
tosdac_i=28,tosdac_q=44,tx_iq_gain_comp=1029,tx_iq_phase_comp=4
tosdac_i=31,tosdac_q=47,tx_iq_gain_comp=1040,tx_iq_phase_comp=2
tosdac_i=31,tosdac_q=47,tx_iq_gain_comp=1040,tx_iq_phase_comp=7
tosdac_i=29,tosdac_q=47,tx_iq_gain_comp=1032,tx_iq_phase_comp=2
tosdac_i=27,tosdac_q=48,tx_iq_gain_comp=1040,tx_iq_phase_comp=0
tosdac_i=27,tosdac_q=46,tx_iq_gain_comp=1042,tx_iq_phase_comp=-3
[WF] [KEY] [CFG] nVAP is 2, endidx 12, startidx 8
td_init
td_reset idx=0
td_reset idx=1
Start Wi-Fi fw is Done @169ms
[APP] [EVT] INIT DONE 118
[BL] Initi Wi-Fi with MAC #### 7C:3E:82:C1:6F:17 ####
hostname: OpenBL602_82c16f17
[WF] country code CN used, num of channel 13
-----------------------------------------------------
[IPC] [TX] Low level size 204, driver size 100, total size 304
Enable BMX IRQ
[WF] [KEY] [CFG] nVAP is 2, endidx 12, startidx 8
td_init
td_reset idx=0
td_reset idx=1
[version] lmac 5.4.0.0
[version] version_machw_1 000055FB
[version] version_machw_2 000001B3
[version] version_phy_1 00822111
[version] version_phy_2 00000000
[version] features 001089DF
[ME] HT supp 1, VHT supp 0
[WF][SM] reload tsen
[WF][SM] Exiting ifaceDown state
[WF][SM] State Action ###ifaceDown### --->>> ###idle###
[WF][SM] Entering idle state
[APP] [EVT] MGMR DONE 130, now 182ms
[19:49:32.017] - Entering initLog()...
Commands registered!
initLog() done!
[MTD] >>>>>> Hanlde info Dump >>>>>>
na
[19:49:32.017] - me PSM
id 0
offset 0x001e9000(2002944)
size 0x00008000(32Kbytes)
xip_addr 0x231d8000
[MTD] <<<<<< Hanlde info End <<<<<<
[EF] Found Valid PSM partition, XIP Addr 231d8000, flash addr 001e9000, size 32768
ENV AREA SIZE 32768, SECTOR NUM 8
*default_env_size = 0x00000001
EasyFlash V4.0.99 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
[19:49:32.050] - [       651][WARN  : bl_mtd.c: 205] addr@0x230a4d1c is xip flash, size 8
[19:49:32.150] - [MTD] >>>>>> Hanlde info Dump >>>>>>
name media
id 0
offset 0x001a2000(1712128)
size 0x00047000(284Kbytes)
xip_ad
[19:49:32.167] - dr 0x23191000
[MTD] <<<<<< Hanlde info End <<<<<<
Main_Init_Before_Delay done
Main_Init_Delay
Main_Init_Delay done
Info:MAIN:Main_Init_Before_Delay
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 2 changes count.
Error:CMD:lfs is absent
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Error:HTTP:Created HTTP SV thread with (stack=2048)
Info:MQTT:MQTT_RegisterCallback called for bT obl82C16F17/ subT obl82C16F17/+/set
Info:MQTT:MQTT_RegisterCallback called for bT bl602s/ subT bl602s/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obl82C16F17/ subT cmnd/obl82C16F17/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/bl602s/ subT cmnd/bl602s/+
Info:MQTT:MQTT_RegisterCallback called for bT obl82C16F17/ subT obl82C16F17/+/get
Info:CMD:CMD_StartScript: started @startup at the beginning
Error:CMD:LFS_ReadFile: lfs is absent
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
[19:49:33.051] - Info:MAIN:Time 1, idle 0/s, free 112736, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21
[19:49:34.005] - Info:MAIN:Time 2, idle 0/s, free 112736, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21
[19:49:34.975] - Info:MAIN:Time 3, idle 0/s, free 112736, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21
[19:49:35.928] - Info:MAIN:Time 4, idle 0/s, free 112736, MQTT 0(0), bWifi 0, secondsWithNoPing
[19:49:35.928] -  -1, socks 2/21
[19:49:36.900] - [lwip] netif status callback
IP: 192.168.11.1
MK: 255.255.255.0
GW: 0.0.0.0
[WF] MM_ADD_IF_REQ Sending: AP
td_start idx=0
[W
[19:49:36.900] - F] MM_ADD_IF_REQ Done
[WF] vif_index from LAMC is 0
[lwip] netif status callback
IP: 192.168.169.1
MK: 255.255.255.0
GW: 0.0.0.0
[DHCP] ip_start: [192.168.169.2]
[DHCP] ip_start: [192.168.169.254]
[WF][SM] start AP with ssid OpenBL602_82C16F17;
[WF][SM]               pwd  ;
[WF][SM]               channel  1;
[WF] APM_START_REQ Sending with vif_index 0
[WF] received APM Start apm_start_req_handler:74
[WF] return with other handler
[WF] APM_START_REQ Done
[WF] status is 00
[WF] vif_idx is 00
[WF] ch_idx is 00
[WF] bcmc_idx is 05
[WF][SM] stateGlobalGuard_AP: AP iface has started!
Info:MAIN:Time 5, idle 0/s, free 112736, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21
[APP] [EVT] Unknown code 11, 5706
[19:49:37.878] - [      6710][WARN  : bl_mtd.c: 205] addr@0x230a4d1c is xip flash, size 8
Info:MAIN:Time 6, idle 0/s, free 112424, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21
Info:MAIN:Boot complete time reached (5 seconds)
[19:49:38.816] - In
[19:49:38.832] - fo:MAIN:Time 7, idle 0/s, free 112424, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21
[19:49:39.801] - Info:MAIN:Time 8, idle 0/s, free 112424, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21
[19:49:40.754] - Info:MAIN:Time 9, idle 0/s, free 112424, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21
[19:49:41.722] - Info:MAIN:Time 10, idle 0/s, free 112424, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21
[19:49:42.682] - Info:MAIN:Time 11, idle 0/s, free 112424, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21
[19:49:43.096] - Close COM5 Success


    Any hint or suggestions? Maybe the OpenBL602_1.18.123.bin is corrupt?
  • #86 21586581
    p.kaczmarek2
    Moderator Smart Home  
    Your log ends at:
    Code: text Expand Select all Copy to clipboard
    

[19:49:42.682] - Info:MAIN:Time 11, idle 0/s, free 112424, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21

    What happens later? Does it continue to run?
    Helpful post? Buy me a coffee.
  • #87 21586660
    kellerto
    Level 5  
    In this Test3, I was using the firmware options together with OpenBL602_1.18.123.bin firmware.
    log continues like this.
    Since the IP address is not mine it will not reach my mqtt server nor my network.
    It also does not open an AP access point.
    I kept sweeping wifi but no AP like with original firmware ☹️
    19:49:36.900] - F] MM_ADD_IF_REQ Done
    [WF] vif_index from LAMC is 0
    [lwip] netif status callback
    IP: 192.168.169.1
    MK: 255.255.255.0
    GW: 0.0.0.0
    [DHCP] ip_start: [192.168.169.2]
    [DHCP] ip_start: [192.168.169.254]
    [WF][SM] start AP with ssid OpenBL602_82C16F17;
  • #88 21589678
    kellerto
    Level 5  
    >>21586157 thank you for checking,
    Backup will bring the device back to original state.
    And then I installed latest OpenBL602.bin
    But then device is not starting AP anymore and UART log is silent (no log)

    I tried on a second new MagicHome controller but it behaves exactly the same.

    Can someone confirm that lstest OpenBL602 bin works?
    Or even confirm that it works on a Magic Home RGB Controller?
  • #90 21592996
    kellerto
    Level 5  
    >>21590554
    Hi I'm back and thank you for the partition_cfg_2M_FIX file. Just reflashed the device us suggested.
    There is still no "OpenBL602_82C12029 "AP starting.
    Monitoring the log I observed some sections which caught my eyes. But not sure if this is the place to look.


    1. According UART log, Wifi seems to start with country code "CN" --> Is this a probem?

    2. Event Log says AP started and I keep scaning my Wifi but no such AP to see :-(
    Code: text Expand Select all Copy to clipboard
    [16:02:47.930] - [lwip] netif status callback
IP: 192.168.11.1
MK: 255.255.255.0
GW: 0.0.0.0
[WF] MM_ADD_IF_REQ Sending: AP
td_start idx=0
[WF] MM_ADD_IF_REQ Done
[WF] vif_index from LAMC is 0
[lwip] netif status callback
IP: 192.168.169.1
MK: 255.255.255.0
GW: 0.0.0.0
[DHCP] i
[16:02:47.946] - p_start: [192.168.169.2]
[DHCP] ip_start: [192.168.169.254]
[WF][SM] start AP with ssid OpenBL602_82C12029;
[WF][SM]               pwd  ;
[WF][SM]               channel  1;
[WF] APM_START_REQ Sending with vif_index 0
[WF] received APM Start apm_start_req_handler:74
[WF] return with other handler
[WF] APM_START_REQ Done
[WF] status is 00
[WF] vif_idx is 00
[WF] ch_idx is 00
[WF] bcmc_idx is 05
[WF][SM] stateGlobalGuard_AP: AP iface has started!


    3. searching logfile for lines with keyword error in it:

    Code: text Expand Select all Copy to clipboard
     
[        41][ERROR : bl_romfs.c: 158] romfs magic is NOT correct 
.....
Error:CMD:lfs is absent
.....
Error:HTTP:Created HTTP SV thread with (stack=2048)
.....
Error:CMD:LFS_ReadFile: lfs is absent


    4. searching for warning message
    Code: text Expand Select all Copy to clipboard
    
[16:41:54.353] - [      6763][WARN  : bl_mtd.c: 205] addr@0x230a4d1c is xip flash, size 8



    Complete logfile see txt file logfile_pa...2M_FIX.txt Download (26.03 kB)



    I don't want to give up, so I'm hope you can give me some hints to fix this.

    Additional question: Is there a way, I can preset my Wifi parameter prior flashing?
    greatings from Black Forrest
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

The discussion focuses on flashing Magic Home devices equipped with the BL602 chip over WiFi without soldering, using the manufacturer's OTA mechanism redirected to a custom server. The procedure involves resetting the device to factory settings by cycling power, hosting the OpenBeken firmware OTA binary on a local HTTP server, and sending an AT command to the device to initiate the firmware download and installation. Users report success with this method on certain BL602 devices, notably Magic Home RGB controllers, using tools like netcat and PowerShell for serving the firmware and sending commands. Challenges include firmware version compatibility, with newer Zengge firmwares apparently patched against OTA flashing exploits, resulting in errors like "+ok=up_ErrType" or no response. Some devices require specific partition tables or flash size considerations (2MB vs 4MB flash). Debugging via UART logs is recommended to diagnose boot and WiFi AP startup issues. The community also explores similar flashing approaches for related chips such as LN882H, LN8825B, BK7231N, and XR809/XR872, noting differences in communication ports, protocols (JSON over UDP/TCP), and firmware architectures (RISC-V vs ARM). JSON-based command protocols on UDP/TCP ports (e.g., 5555, 6095) are used for device communication and OTA initiation in CozyLife and Ewelink devices. Some users successfully restored factory firmware dumps and then flashed OpenBeken firmware, achieving AP mode broadcasting. However, issues persist with saving settings post-flash and AP visibility. The latest OpenBL602 builds work on some devices but may require partition table adjustments. Overall, the OTA flashing method without soldering is feasible but depends heavily on device firmware version, chip variant, and correct command syntax. Physical flashing remains a fallback for patched or incompatible devices.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT