logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Backup Flash on Zigbee XT-ZB2 BL702 Series Module Without Exposed GPIO8

XJ_ 7275 33
Best answers LABEL_AI_GENERATED

How can I back up the flash on an XT-ZB2 BL702 module when GPIO8 is not exposed?

You can read and write the XT-ZB2 BL702 flash through UART boot mode by using IO28/D28 as the boot pin instead of GPIO8. Use Bouffalo Lab Dev Cube v1.8.9, wire TX/RX/GND/3V3 normally, and pull D28 up to the SoC’s 3V3 with a 1 kΩ resistor; the 1 kΩ is mainly a safety measure, and IO28 is the BL702 BOOT pin [#21790781][#21796585][#21797103] With EN tied to DTR, power on the board and press ReadFlash; without DTR, hold EN low during power-up, start the read, then release EN [#21790781] The working read range shown was 0x00000 to 0x0FFFFF, and the flash JEDEC ID read back as c2201480 with a 1 MB flash size [#21790781] The same setup also works for writing: use Create & Download on the IOT tab, then let Dev Cube erase, load, and verify the image [#21790781]
AI summary based on the discussion. May contain errors.
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #31 21909321
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14770
    Help: 659
    Rate: 12913
    For me this looks okay, I can merge it:
    https://github.com/openshwprojects/BK7231GUIFlashTool/pull/124
    Do you confirm it's ready for merge?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #32 21909382
    divadiow
    Level 38  
    Posts: 5220
    Help: 449
    Rate: 918
    it's working well for me. erase, custom read/write. obk config. all bauds tested. I think it's good.
  • ADVERTISEMENT
  • #33 21909387
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14770
    Help: 659
    Rate: 12913
    Ok, that one has been merged. What about previous PR for Easy Flasher?
    Helpful post? Buy me a coffee.
  • #34 21909511
    divadiow
    Level 38  
    Posts: 5220
    Help: 449
    Rate: 918
    p.kaczmarek2 wrote:
    What about previous PR for Easy Flasher?

    hmm.

    I've been using for the last few weeks and it seems OK, but I haven't checked EVERY platform and I appreciate it's rather large for others to review. So, not sure. Could abandon it and only make RTL-B better when cancelling or when it fails, which was the original aim.
Reply | New topic
Report a violation of the law

Topic summary

LABEL_AI_GENERATED
Discussion about backing up and restoring flash on an XT-ZB2 Zigbee module based on the BL702 SoC, which works with Zigbee2MQTT out of the box but initially seemed locked for UART flash access because GPIO8 was not exposed. Early attempts with BLDevCube produced JEDEC ID and EFUSE errors, and the pinout was later identified: D28 is the boot/UART bootloader pin, while TX/RX run at 2,000,000 baud. The issue was eventually solved by using Bouffalo Lab Dev Cube v1.8.9 and wiring IO28/D28 high to the module’s own 3V3, with a mandatory pull-up resistor between 3V3 and D28; EN could be tied to DTR for automated reset. Later testing confirmed that BL702 bootrom mode is entered via IO28, not IO8, and flash read/write works reliably on XT-ZB2 modules. The discussion also covered flash dump/restore, baud-rate tuning, and follow-up work to adapt BL702 flashing support in GUI tools.
AI summary based on the discussion. May contain errors.
Today's popular

FAQ LABEL_AI_GENERATED

TL;DR: To back up XT-ZB2 BL702 without GPIO8, pull D28 high; burning mode draws 5–7 mA; "it is necessary to connect D28 to high". Use UART0 at 2,000,000 baud; some units show EFUSE errors and JEDEC ID read fails. [Elektroda, XJ_, post #21103904]

Why it matters: This FAQ helps Zigbee modders and repair techs reliably enter boot mode, read flash, and troubleshoot BL702-based XT-ZB2 modules that lack GPIO8.

Quick Facts

How do I put an XT-ZB2 BL702 into UART bootloader mode without GPIO8?

Pull D28 up to 3.3 V through ~10 kΩ. D28 has an internal pulldown. Power-cycle or toggle EN low then release to reset. Connect to the module’s TX/RX header at 2,000,000 baud. This sequence enters the BL702 flashing mode on XT-ZB2. [Elektroda, XJ_, post #21104476]

What UART settings and pins should I use on the XT-ZB2 header?

Use UART0 at 2,000,000 baud, 8N1. Wire your USB‑UART adapter to the module’s TX and RX header pins. Provide 3.3 V to the 3V3 header pin and GND to the GND pin. Keep signal levels at 3.3 V. [Elektroda, XJ_, post #21104476]

Do I need to use Chip_EN/EN to flash the BL702?

Not strictly. The module entered flashing mode with D28 pulled high and worked without using ChipEn. EN held low disables the module, and releasing it restarts. Use EN only if you need a clean reset. [Elektroda, XJ, post #21103904]

Why do I see FL0104 and FL0402 errors when attempting a backup?

Logs showed FL0104 (command sequence error) and FL0402 (efuse write address error). The handshake succeeded, but clock PLL setting failed, and JEDEC ID read then failed. Edge case: handshake OK, but PLL set fails and blocks subsequent operations. [Elektroda, XJ_, post #21103904]

Why does “Read flash JEDEC ID fail” appear in BLDevCube?

A maintainer noted this commonly happens with older BLDevCube builds. Update to the latest BLDevCube for BL702/BL702L targets and retry. “BFLB READ FLASH JEDEC ID FAIL” is a known symptom. [Elektroda, divadiow, post #21106215]

Which Bouffalo Lab Dev Cube version should I use for BL702?

Use the latest BLDevCube release recommended in the BL702 guidance. Older versions can trigger JEDEC ID read failures during backup or flashing. Update first, then retest connectivity. [Elektroda, divadiow, post #21106215]

Should I lower the UART baud rate if flashing is unstable?

Yes. If 2,000,000 baud is unreliable, try 1,500,000 or 1,000,000. Community reports confirm successful BL702 flashing at these lower data rates. This can improve handshake stability. [Elektroda, divadiow, post #21106291]

Can eFuse settings block flash readout on some BL702 units?

Yes, that is a realistic possibility. Expert note: “efuse setting is such that flash read out is disallowed.” If so, readback will fail despite correct wiring and boot mode. [Elektroda, divadiow, post #21109516]

Has anyone recently succeeded in reading BL702 flash?

Yes. A contributor reported successful flash reads on multiple BL702 modules using the documented method and published several dumps. Follow the linked guide in that post for steps. [Elektroda, p.kaczmarek2, post #21498994]

What is the XT-ZB2 pinout and what do the pins do?

Highlights: EN (Pin 1) disables when low and restarts when released. D25 is the button (short=toggle, long=pair). D26 drives the LED (blinks in pairing). D0 controls the relay (active low). D28 is the boot pin; add ~10 kΩ to 3.3 V for flash mode. TX/RX are 2,000,000 baud. [Elektroda, XJ_, post #21104476]

Does XT-ZB2 work with Zigbee2MQTT out of the box?

Yes. The module based on BL702 worked with Zigbee2MQTT without any modifications. It operated with an SLZB‑06 coordinator and Home Assistant. [Elektroda, XJ_, post #21103904]

What firmware and flash geometry appear in the stock boot log?

Boot shows CozyLife SDK 0.2.0, Product ID c22w32, and Firmware 1.0.0 built Nov 22, 2021. Reported flash geometry: 4 KB sector size and 256‑byte page size. These details help size backups and validate dumps. [Elektroda, XJ_, post #21103904]

How do I back up full flash safely?

How-To
  1. Pull D28 up to 3.3 V via ~10 kΩ, then power-cycle to enter bootloader.
  2. Open the latest BLDevCube, select the BL702(L) target and your COM port.
  3. Use the flash read function to dump and save the entire image. An author confirmed successful BL702 reads and shared a guide. [Elektroda, p.kaczmarek2, post #21498994]

Can I reassign pins in BL702 Zigbee firmware for custom hardware?

Stock Zigbee firmware uses predefined pins. Reassigning pins requires rebuilding or modifying the BL702 Zigbee SDK and firmware. One user planned this to replace Wi‑Fi modules in weak-signal areas, noting the preset pin limitation. [Elektroda, XJ_, post #21110063]
AI summary based on the discussion. May contain errors.
ADVERTISEMENT