Backup and Restore of Factory Firmware on Bouffalo Lab BL602/LF686 IoT Smart Devices

Born of some initially unsuccessful fiddling in this post where I was trying to flash a BL602 device factory firmware dump to an Ai-Thinker dev board, it seems the Single Download Option in Bouffalo Lab Dev Cube (BLDC) might well be the way to restore a full flash dump to any BL602.

I'll begin by demonstrating the process to dump/backup the firmware. This will be useful for restoring in the event of some catastrophic incident where the bootloader may get corrupted or you need to revert to test something using factory firmware/app. It's also good to post these backups on any posts for analysis or others to flash for testing or restoration.

Bear in mind the dump may contain SSID and wifi password if the device is not reset before backup.

This guide assumes you've already connected your device to a USB-TTL adaptor and you've pulled the BOOT pin high with a 10k resistor to get it into download mode. Guides to get this point:

https://www.elektroda.com/rtvforum/topic3889041.html

On the Ai-WB2-32S-Kit dev board this is simply a case of holding down the BOOT button while pushing the RST button. The buttons can be released after.

Backup

Download BouffaloLabDevCube-vxxxx.zip from https://dev.bouffalolab.com/download. Unzip and run BLDevCube.exe.

Choose BL602/604 chip



In the View menu choose Show Advanced Page to reveal all tabs.



On the Flash tab ensure the correct COM (Port/SN) is selected and the uart rate is 2000000. I've found good contact with the pins and short jumper wires are crucial for this speed to work if trying on a real IoT device.

You can use the Read ID button to test communication first if needed.



This step will also show you the size of the flash. Most devices I see on the forums appear to be 2mb. The WB2 board is 4mb. You'll need to know the size shortly.

The flash size can also be determined by the silkscreen print on the IC. The key is



eg:



LF/BL602C10 = 1 megabyte / 8 megabit
LF/BL602C20 = 2 megabyte / 16 megabit
LF/BL602C40 = 4 megabyte / 32 megabit

I've only seen LF602C20 in the wild so 1mb and 4mb are just assumptions following the naming convention.

To begin dump enter start and end addresses according to chip size. Note that the Whole Chip checkbox is for the erase function not flash read.


After clicking read flash and a successful handshake it should dump a flash.bin file to same location as the BLDevCube.exe. The total bytes should match above.



You've successfully backed-up the device's firmware.

Restore

To restore a firmware, switch to the IOT tab and check Enable under Single Download Options. Keep the start address 0x0 and browse to the bin dump you want to flash.



Put device into download mode again with BOOT pin method then click Create & Download. It should begin flashing. It'll erase the flash before it writes.



After success you can click Open Uart to watch your firmware boot!

I have successfully flashed quite a few BL602 dumps onto the dev board and all have booted and were pairable using Cozylife/Tuya/Magic Home apps, depending on what device they came from. They'll detect as a bulb/relay/whatever. On the Ai-WB2 even the LED blinks when in pairing mode and can be controlled from the app as if it was the original bulb.



If your backup doesn't boot or you found a backup online and are unsure if it'll work, a little indicator the file is OK is that the starting bytes appear to always be this when viewed in HxD





I have only tested backup/restore on the dev board to date, so please experiment at your own risk and give some feedback in this thread.