logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
Build faster with M5Stack »
Build faster with M5Stack » Stick • Unit • Cardputer
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

[BL2028N/BK7231M] Flashing Dogness D07 (Belon Chip) - Boot Issues

terryb8s 4515 56
Best answers

Why does my Dogness D07 stop booting after flashing OpenBeken, and what flash layout should I use so it starts correctly?

The device needs its original RT-Thread bootloader layout preserved; it is not a standard Tuya-style flash map, and flashing the app at the wrong offset or overwriting the bootloader causes the no-boot symptom [#21096057][#21096267][#21109139] The working fix was to do a full erase, restore the factory 0x0–0x10000 bootloader from the backup, and then flash OpenBK7231N_App_QIO_1.0.0.bin starting at 0x10000 [#21108271][#21108341] The OpenBK flasher was later changed to skip the bootloader portion by default for BK7231N, because overwriting bootloader is usually a mistake on this device [#21109139] If you build a combined image manually, the thread shows the bootloader can be inserted with the zero-keys build, but the safer route is to leave the factory bootloader in place [#21108341] Wi‑Fi AP/UAP problems can still happen after it boots; in this case, “Restore RF” or writing only the OBK config SSID/password was used to get networking working [#21108271][#21109280][#21109319]
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • ADVERTISEMENT
  • #32 21108367
    p.kaczmarek2
    Moderator Smart Home  
    Thank you. I am not sure about that wifi, we may need to check where this message originates from. Currently I am looking into adding those new binaries to Github releases.
    Helpful post? Buy me a coffee.
  • #33 21108741
    divadiow
    Level 38  
    please fix title of post to BL2028N :) :)

    Microchip labeled BL2028N on a circuit board.
  • #34 21108759
    p.kaczmarek2
    Moderator Smart Home  
    sure, fixed

    @terryb8s if you still have some time, can you restore 2MB factory dump and check this guide:
    https://www.elektroda.com/rtvforum/topic4058227.html
    this is supposed to download 00000 00000 keys build from web in flash it in BK7231M mode (not N, M), does it work for you?
    Helpful post? Buy me a coffee.
  • #35 21108974
    divadiow
    Level 38  
    p.kaczmarek2 wrote:
    sure, fixed

    Header about flashing OpenBeken on Dogness D07 with Belon BL8082N.

    🤔
  • #36 21109066
    terryb8s
    Level 4  

    Sorry you are correct @divadiow not sure how I didn't notice the topic being incorrect previously.

    Tried changing it but it doesn't take for me.

    I imagine this is better given other posts syntax @p.kaczmarek2 (currently its still wrong as divadiow mentioned)
    [BL2028NBK7231M] Flashing Dogness D07 (Belon Chip) - Boot Issues

    I'm at work at the moment, will try the new Easy BK7231 Flash tool when I'm home, maybe the tool needs renamed too, to just Beken Easy UART Flasher
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #37 21109139
    p.kaczmarek2
    Moderator Smart Home  
    It is important to note that in the past this flasher was overwriting bootloader for BK7231N and now I changed behaviour so it always skips bootloader portion, even when flashing QIO. You can change this behaviour via a checkbox.

    It seems that overwriting a bootloader is a mistake, I guess the one we have is also encrypted, that's why it's better leave a factory one.
    Helpful post? Buy me a coffee.
  • #38 21109194
    terryb8s
    Level 4  

    Seems to have worked, this was without the check box ticked, boot log attached, I was about to copy the flasher log but Defender closed it with the following message.

    Screenshot of a Windows Defender alert about the detection of Trojan Win32/Wacatac.H!ml. Screenshot of a system log excerpt.
    I assume it's a false positive but the loss of the log reveals a feature that would be helpful, which is a log file.
    Attachments:
    • Boot-Flash1.3.txt (7.8 KB) You must be logged in to download this attachment.
    Helpful post? Buy me a coffee.
  • #39 21109212
    terryb8s
    Level 4  

    Wireless issues still persist after flash, UAP not working, unable to connect or connect with no access to web app, flashed obk config for SSID connected and working.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #40 21109280
    p.kaczmarek2
    Moderator Smart Home  
    I had only BK7231M to test (which seems to use the same encryption keys) and AP worked for me. I don't know how to solve AP problem at the moment.

    Can you confirm, that AP does not work even after doing restore RF? So you can only configure SSID/PASS through flasher itself and then it connects to your WiFi correctly in STA mode?

    Does log say anything interesting? On my device, I am getting "mutex" messages as well, but AP works for me.

    Regarding antivirus warning - of course you should not trust me, it's the basic rule on the web. You can check out the source code at Github. Still, I think I know what causes this warning. This flasher also has "scan network for Tasmota/OBK devices and backup" feature. So it sends commands over HTTP. I guess it tips the antivirus.
    Helpful post? Buy me a coffee.
  • #41 21109319
    terryb8s
    Level 4  

    >>21109280

    Agreed about not trusting the web much 😛 but then again I have about 14 OBK devices and counting on my network so I must have a little trust for your code 😛

    I did actually look into it a little and I believe it's been flagged because there are several items that stack to make it look like a Trojan or malware of some description but all make sense given what the software does, communication to several unknown IPs, hints of reverse engineering, DLL side loading but all legit reasons for this. The only reason I mentioned it was because Imagine other people may ask about it.

    Yes flashed in this way and also after performing the restore RF UAP still doesn't work.
    Flashing was
    1. Factory clean dogness fw
    2. Flash latest QIO using BK7231M chip selection
    3. UAP not working on 2 android phones.
    4. RF Restore
    5. UAP still not working
    6. Write SSID via Write OBK Config
    7. Connected in STA mode yay!

    I will take another look at the wireless issue soon and report back in regards to the UAP side, currently trying to investigate what each of the GPIOs do as I haven't really done any of that yet bar finding one PWM LED.

    I did also see it reboot a while after flashing, was talking with my wife and it logs said something about a low heap warning just before rebooting, it's been about an hour and not seen it since, not sure what that's about, haven't looked into it yet forum wise, but will so I wouldn't worry about this too much.

    Still can't change the topic not sure if you can was going to change it to [BL2028N/BK7231M] Flashing Dogness D07 (Belon Chip) - Boot Issues
    Helpful post? Buy me a coffee.
  • #42 21111254
    terryb8s
    Level 4  
    have been testing the UAP, have trouble connecting with anything but my computer and my computer connects and I can eventually get to the device but it's very slow to load, the latency for it is 900ms+, Wireshark shows a considerable amount of retransmits as well.

    Going to try some other things but thought I would report back.


    Added after 3 [hours] 14 [minutes]:

    Maybe its just me but I tried to restore the obk config for my device and I think it wrote it to 0x0, is this possible with the new version of easy flasher?
    Helpful post? Buy me a coffee.
  • #43 21111462
    divadiow
    Level 38  
    I don't know what RF calibration entails when they make these things but I was under the assumption that the content of the RF partition might be tailored to the device it was intended.

    I'd be curious to know how a generic RF partition (from the restore function in Easy Flasher) compares to your factory original.

    Actually, I have a question. Where is the data the restore function in Easy Flasher uses from? @p.kaczmarek2
  • #45 21112188
    terryb8s
    Level 4  

    Question for someone, what's the best option for a PWM controlled water pump, it seems to use P8 and P9 for control, both seem to attach to a PWM controller Marked 3403D (Seems to be https://fordevices.com/UploadFiles/2022-07/16570260675800306.pdf)

    I obviously don't want it to get mixed in with LED control and would prefer slider for the pump but also still be able to use LED control for LEDs as there is a set of them that appear to be PWM controller on the edge of the PCB, I was able to use them In LibreTiny but haven't got them going again since flashing everything over and over (they do work with factory fw on though)

    I'm using Flag 3 for now but I'd prefer not to, I tried using the Dimmer option in Channel Types but then the Toggle LEDs button changes the relay on P28 which turns the pump off for some reason... little confused about that one.

    Starting to feel like I need an oscilloscope as it's hard to figure out what's going on with just tracing and using my multi-meter, was looking at the Rigol DHO804 but it's a pipe dream at the moment as I don't have that kind of money.
    Helpful post? Buy me a coffee.
  • #46 21112193
    p.kaczmarek2
    Moderator Smart Home  
    What is your full config? Is P28 on the same channel?

    Maybe custom driver can help? See tutorial: https://www.elektroda.com/rtvforum/topic4056286.html
    Helpful post? Buy me a coffee.
  • #47 21112205
    terryb8s
    Level 4  

    Both the P8 and P9 are Channel 4 and P28 is set to Channel 5, there is still a lot I haven't figured out yet so most of the rest are set to either LED or Relay and their own separate channels or not configured.

    Code: Text
    Log in, to see the code

    My understanding is that P7 is the LED Ring on the PCB but haven't got it working, I'm assuming 6 is likely the brightness but unsure as yet.

    I will look at the driver route but unsure I have the skill for that as yet.
    Helpful post? Buy me a coffee.
  • #48 21112216
    divadiow
    Level 38  
    terryb8s wrote:
    Tried changing it but it doesn't take for me.


    Even if you edit your whole first post from the edit link at the bottom rather than using the pencil next to the title?
  • #49 21112217
    p.kaczmarek2
    Moderator Smart Home  
    @terryb8s ok then maybe we can try to write your autoexec.bat together, step by step? You just need to be able to separate issues, because with so many pins I feel confused.

    So the first step is to get LED controller working along with extra, custom slider?
    I can look into that for you.

    So you need 3 PWMs for RGB + 1 independent slider?
    Helpful post? Buy me a coffee.
  • #50 21112233
    terryb8s
    Level 4  

    >>21112216 >>21112217
    I would say so, that would be handy if you could, the I have just found P6 is the button on the small control board, again weird as pushing it seems to control Channel 5 even though the channel for the button is 2 at the moment. Give me a sec will post some photos of that.

    Added after 2 [minutes]:

    >>21112216 Thank you divadiow, I didn't realize the title would be available in the first post but that makes sense now that you say it... fixed the title now.
    Helpful post? Buy me a coffee.
  • #51 21112253
    divadiow
    Level 38  
    terryb8s wrote:
    >>21112216 Thank you divadiow, I didn't realize the title would be available in the first post but that makes sense now that you say it... fixed the title now.

    yay thanks. sorry to be a pain. it kept niggling me :)
  • ADVERTISEMENT
  • #52 21112254
    terryb8s
    Level 4  

    Calmed down the config, the button still triggers channel 5

    Code: Text
    Log in, to see the code

    You will have to excuse my setup, can only wish I had some sort of electronics workshop hahaha
    Electronic setup with visible circuit board on a desk.Close-up of an electronic module with three LEDs and a button.Close-up of two green printed circuit boards connected by red wires.

    Added after 1 [minutes]:

    >>21112253 All good divadiow, once you pointed out the title I was the same, I have tried to change it 4-5 times now.
    Helpful post? Buy me a coffee.
  • #53 21112302
    p.kaczmarek2
    Moderator Smart Home  
    When you strip down to:
    Code: text Expand Select all Copy to clipboard
    
  "pins": {
    "6": "Btn;2",
    "28": "Rel;5"
  },..

    does button also trigger channel 5? I don't think so.

    So most likely LED driver is guilty.


    Still, the obvious workaround is to use Btn_ScriptOnly. and manually script the button interaction
    Helpful post? Buy me a coffee.
  • #54 21112364
    terryb8s
    Level 4  
    OK sounds good I will look at using that then haven't used Btn_ScriptOnly but have used autoexec on other devices so should be able to sort something out.


    Added after 12 [minutes]:

    p.kaczmarek2 wrote:
    does button also trigger channel 5? I don't think so.

    You are correct about this, damn looks like I need to do some reading on channels is there a place in the docs that tells me about why this might happen so I can have a read through it?
    Helpful post? Buy me a coffee.
  • #55 21316817
    terryb8s
    Level 4  
    Found some additional time to look into this device again this weekend, I was able to get it hooked up to my new oscilloscope and check out some of the PWM signals being sent with stock firmware loaded.

    It looks like there are two waveforms one triangle and an overlapping sawtooth waveform, is there a way to reproduce this sort of waveform with OBK and a BK7231N? I see there is PWM groups but not sure how the waveform would be changed?

    The reason I ask is that using PWM within OBK results in a louder pump noise so I'm wondering if one of the stock waveforms are mitigating this, P8 and P9 are possibly creating one each.
    Helpful post? Buy me a coffee.
  • #56 21316886
    p.kaczmarek2
    Moderator Smart Home  
    I've never seen such waveforms generated by BK7231, are you sure that you've disconnected the GPIO from the trace before measuring? Maybe there are some extra parts like capacitors that affect the measurement?
    Helpful post? Buy me a coffee.
  • #57 21453281
    divadiow
    Level 38  
    boot log from original firmware
    Code: Text
    Log in, to see the code
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion addresses boot issues encountered when flashing the Dogness D07 device, which uses a Belon BK7231N chip, with custom firmware such as OpenBeken and LibreTiny. The device is not a standard Tuya device, leading to challenges due to different partition layouts and an RT-Thread-based bootloader. Flashing attempts with various OpenBeken versions and Tuya backups resulted in non-booting devices showing only garbled serial output. Key findings include the necessity to preserve the original encrypted bootloader (occupying 0x0 to 0x11000) and flash the application firmware starting at offset 0x11000 or 0x10000. Full flash erases require manual RF partition restoration to recover WiFi functionality and unique MAC addresses, as the RF calibration data is device-specific and stored separately. The community developed a solution involving a combined binary with the original bootloader and OpenBeken application, enabling successful boot and WiFi connectivity, though some warnings like "TCPIP mutex is NOT locked" persist. The Easy BK7231 GUI Flash Tool was updated to support reading encryption keys and skipping bootloader overwrites. Additional challenges include unstable or slow WiFi Access Point (UAP) functionality, which improves after RF data restoration but is not fully resolved. The discussion also covers PWM control for the water pump and LEDs on the device, with attempts to configure PWM channels and button inputs, noting unexpected channel interactions and waveform characteristics observed via oscilloscope. The community continues to refine firmware builds and flashing tools to support this off-brand device, emphasizing the importance of preserving bootloader and RF partitions and adapting encryption keys for successful firmware deployment.
Today's popular

FAQ

TL;DR: 68 KB of the Dogness D07’s flash (0×00000-0×10000) is reserved for a custom RT-Thread bootloader; flashing over it bricks the unit. “Bootloader is… somewhere outside” [Elektroda, p.kaczmarek2, post #21096057] Use the factory boot block, then write OpenBeken from 0×10000 to restore boot within 5 minutes.

Why it matters: Knowing the offset and keyless encryption avoids the 100 % boot-failure rate users first saw.

Quick Facts

• MCU/Radio: BL2028N ≈ BK7231N, 32-bit 120 MHz @ 3.3 V [Elektroda, 21096016] • Flash: TH25Q16HB, 16 Mbit (2 MB), QSPI [Elektroda, 21096016] • Bootloader size: 68 KB (0×00000-0×10000) [Elektroda, post #21106098] • Encryption: all-zero AES keys; no Tuya cloud binding needed [Elektroda, 21103288] • Successful OpenBeken build: OpenBK7231N_App_QIO_1.0.0 (≈ 1.1 MB) [Elektroda, post #21108271]

What chipset does the Dogness D07 fountain use?

The Wi-Fi/MCU is a BL2028N (functionally a BK7231N-QFN32). Serial logs report chip-ID 0x20521029 and RT-Thread SDK 3.0.46 [Elektroda, #21096016; #21453281].

Why did early OpenBeken flashes fail to boot?

Users overwrote the factory bootloader. The 68 KB RT-Thread loader at 0×00000 controls decryption and partition jumps; erasing it leaves the CPU sending only ▢ characters on UART [Elektroda, 21103739]

Which flash offsets work?

Keep the 0×00000-0×10000 block from factory firmware, then write OpenBeken (QIO image) starting at 0×10000. OTA partition sits at 0×12A000 on BK7231N layouts [Elektroda, 21105157]

How do I flash OpenBeken safely?

  1. Read and save a 2 MB backup. 2. Erase flash, then write the first 0×10000 bytes from that backup back to the chip. 3. Write OpenBK7231N_App_QIO_1.0.0.bin with offset = 0×10000. Total time ≈ 3 min via 921 600 baud [Elektroda, 21105147]

Are encryption keys required?

No. The device stores all-zero AES key/IV values, so standard ‘zero-key’ OpenBeken or LibreTiny binaries run without extra signing [Elektroda, 21103288]

My AP appears but phones cannot load the web UI—why?

If RF calibration is erased, the MAC ends with 00:00:00 and AP latency rises to ≈ 900 ms with many TCP retransmits [Elektroda, 21111254] Restore RF partition using BK7231 Easy UART Flasher → Restore RF to regain stable AP access.

How do I restore the RF partition?

In Easy UART Flasher choose Tools → Restore RF-Net. The tool writes 4 KB at 0×1D0000. A reboot shows a valid MAC and AP works [Elektroda, 21105171]

What happens if I power the board only from a USB-TTL adapter?

Most adapters supply <100 mA; the fountain’s power-on peak is >200 mA. Brown-outs cause garbled serial output and boot loops [Elektroda, miegapele, post #21096055] Use the factory 5 V rail or a 3.3 V LDO ≥500 mA.

Which UART gives console logs?

TX2/RX2 on pins P0/P1 carry boot and RT-Thread logs; UART1 (P14/P16) is used for flashing [Elektroda, 21096055]

Can I use ESPHome instead of OpenBeken?

Yes. LibreTiny’s ESPHome port with bkcrypt_coeffs = 0 flashes via ltchiptool and runs after the same bootloader-preserve step [Elektroda, 21103253]

What is an edge-case to avoid?

Combining a full-chip erase with CONFIG restore writes the JSON at 0×00000 in older flasher versions, corrupting the bootloader; always tick ‘Skip bootloader’ in v1.2+ [Elektroda, 21111468]

Does replacing the MCU with a spare BK7231T/N help?

It might, but requires hot-air rework and does not bypass the 68 KB bootloader requirement, so it offers no advantage over following the offset method [Elektroda, 21096395]
ADVERTISEMENT