logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Backup Flash on Zigbee XT-ZB2 BL702 Series Module Without Exposed GPIO8

XJ_ 6507 33
Best answers

How can I back up the flash on an XT-ZB2 BL702 module when GPIO8 is not exposed?

You can read and write the XT-ZB2 BL702 flash through UART boot mode by using IO28/D28 as the boot pin instead of GPIO8. Use Bouffalo Lab Dev Cube v1.8.9, wire TX/RX/GND/3V3 normally, and pull D28 up to the SoC’s 3V3 with a 1 kΩ resistor; the 1 kΩ is mainly a safety measure, and IO28 is the BL702 BOOT pin [#21790781][#21796585][#21797103] With EN tied to DTR, power on the board and press ReadFlash; without DTR, hold EN low during power-up, start the read, then release EN [#21790781] The working read range shown was 0x00000 to 0x0FFFFF, and the flash JEDEC ID read back as c2201480 with a 1 MB flash size [#21790781] The same setup also works for writing: use Create & Download on the IOT tab, then let Dev Cube erase, load, and verify the image [#21790781]
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #31 21909321
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14506
    Help: 651
    Rate: 12506
    For me this looks okay, I can merge it:
    https://github.com/openshwprojects/BK7231GUIFlashTool/pull/124
    Do you confirm it's ready for merge?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #32 21909382
    divadiow
    Level 38  
    Posts: 4936
    Help: 431
    Rate: 876
    it's working well for me. erase, custom read/write. obk config. all bauds tested. I think it's good.
  • ADVERTISEMENT
  • #33 21909387
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14506
    Help: 651
    Rate: 12506
    Ok, that one has been merged. What about previous PR for Easy Flasher?
    Helpful post? Buy me a coffee.
  • #34 21909511
    divadiow
    Level 38  
    Posts: 4936
    Help: 431
    Rate: 876
    p.kaczmarek2 wrote:
    What about previous PR for Easy Flasher?

    hmm.

    I've been using for the last few weeks and it seems OK, but I haven't checked EVERY platform and I appreciate it's rather large for others to review. So, not sure. Could abandon it and only make RTL-B better when cancelling or when it fails, which was the original aim.
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion centers on backing up the flash memory of the XT-ZB2 BL702 Series Zigbee module, which uses the BL702 SoC and is compatible with Zigbee2mqtt out of the box. The main challenge is the lack of exposed GPIO8, which complicates entering UART bootloader mode for flash backup. Documentation indicates pin D28 is used for UART bootloader mode, requiring a 10k pull-up to VCC to enable flash mode. Attempts to use BLDevCube software (version 1.8.9) to read or backup the flash resulted in errors related to EFUSE settings (e.g., BFLB_CMD_SEQ_ERROR, BFLB_EFUSE_WRITE_ADDR_ERROR), suggesting the flash is locked or protected against readout via UART. Lowering baud rates was proposed but did not resolve the issue. The module’s pinout was detailed, including EN, D23-D28, TX, RX, GND, and 3.3V pins. It was speculated that JTAG or other interfaces might be required for flash access. The user’s goal is to modify the BL702 firmware/SDK to customize pin usage for Zigbee applications, aiming to replace WiFi modules in weak signal areas. Alternative hardware like the ESP32-H2 was mentioned, though it lacks direct Zigbee2mqtt support. The topic remains unresolved, with suggestions to consult the seller or BL forums. A later contribution referenced successful flash reads on BL702 modules using a guide and shared flash dumps in a public repository.
Generated by the language model.
Today's popular

FAQ

TL;DR: To back up XT-ZB2 BL702 without GPIO8, pull D28 high; burning mode draws 5–7 mA; "it is necessary to connect D28 to high". Use UART0 at 2,000,000 baud; some units show EFUSE errors and JEDEC ID read fails. [Elektroda, XJ_, post #21103904]

Why it matters: This FAQ helps Zigbee modders and repair techs reliably enter boot mode, read flash, and troubleshoot BL702-based XT-ZB2 modules that lack GPIO8.

Quick Facts

How do I put an XT-ZB2 BL702 into UART bootloader mode without GPIO8?

Pull D28 up to 3.3 V through ~10 kΩ. D28 has an internal pulldown. Power-cycle or toggle EN low then release to reset. Connect to the module’s TX/RX header at 2,000,000 baud. This sequence enters the BL702 flashing mode on XT-ZB2. [Elektroda, XJ_, post #21104476]

What UART settings and pins should I use on the XT-ZB2 header?

Use UART0 at 2,000,000 baud, 8N1. Wire your USB‑UART adapter to the module’s TX and RX header pins. Provide 3.3 V to the 3V3 header pin and GND to the GND pin. Keep signal levels at 3.3 V. [Elektroda, XJ_, post #21104476]

Do I need to use Chip_EN/EN to flash the BL702?

Not strictly. The module entered flashing mode with D28 pulled high and worked without using ChipEn. EN held low disables the module, and releasing it restarts. Use EN only if you need a clean reset. [Elektroda, XJ, post #21103904]

Why do I see FL0104 and FL0402 errors when attempting a backup?

Logs showed FL0104 (command sequence error) and FL0402 (efuse write address error). The handshake succeeded, but clock PLL setting failed, and JEDEC ID read then failed. Edge case: handshake OK, but PLL set fails and blocks subsequent operations. [Elektroda, XJ_, post #21103904]

Why does “Read flash JEDEC ID fail” appear in BLDevCube?

A maintainer noted this commonly happens with older BLDevCube builds. Update to the latest BLDevCube for BL702/BL702L targets and retry. “BFLB READ FLASH JEDEC ID FAIL” is a known symptom. [Elektroda, divadiow, post #21106215]

Which Bouffalo Lab Dev Cube version should I use for BL702?

Use the latest BLDevCube release recommended in the BL702 guidance. Older versions can trigger JEDEC ID read failures during backup or flashing. Update first, then retest connectivity. [Elektroda, divadiow, post #21106215]

Should I lower the UART baud rate if flashing is unstable?

Yes. If 2,000,000 baud is unreliable, try 1,500,000 or 1,000,000. Community reports confirm successful BL702 flashing at these lower data rates. This can improve handshake stability. [Elektroda, divadiow, post #21106291]

Can eFuse settings block flash readout on some BL702 units?

Yes, that is a realistic possibility. Expert note: “efuse setting is such that flash read out is disallowed.” If so, readback will fail despite correct wiring and boot mode. [Elektroda, divadiow, post #21109516]

Has anyone recently succeeded in reading BL702 flash?

Yes. A contributor reported successful flash reads on multiple BL702 modules using the documented method and published several dumps. Follow the linked guide in that post for steps. [Elektroda, p.kaczmarek2, post #21498994]

What is the XT-ZB2 pinout and what do the pins do?

Highlights: EN (Pin 1) disables when low and restarts when released. D25 is the button (short=toggle, long=pair). D26 drives the LED (blinks in pairing). D0 controls the relay (active low). D28 is the boot pin; add ~10 kΩ to 3.3 V for flash mode. TX/RX are 2,000,000 baud. [Elektroda, XJ_, post #21104476]

Does XT-ZB2 work with Zigbee2MQTT out of the box?

Yes. The module based on BL702 worked with Zigbee2MQTT without any modifications. It operated with an SLZB‑06 coordinator and Home Assistant. [Elektroda, XJ_, post #21103904]

What firmware and flash geometry appear in the stock boot log?

Boot shows CozyLife SDK 0.2.0, Product ID c22w32, and Firmware 1.0.0 built Nov 22, 2021. Reported flash geometry: 4 KB sector size and 256‑byte page size. These details help size backups and validate dumps. [Elektroda, XJ_, post #21103904]

How do I back up full flash safely?

How-To
  1. Pull D28 up to 3.3 V via ~10 kΩ, then power-cycle to enter bootloader.
  2. Open the latest BLDevCube, select the BL702(L) target and your COM port.
  3. Use the flash read function to dump and save the entire image. An author confirmed successful BL702 reads and shared a guide. [Elektroda, p.kaczmarek2, post #21498994]

Can I reassign pins in BL702 Zigbee firmware for custom hardware?

Stock Zigbee firmware uses predefined pins. Reassigning pins requires rebuilding or modifying the BL702 Zigbee SDK and firmware. One user planned this to replace Wi‑Fi modules in weak-signal areas, noting the preset pin limitation. [Elektroda, XJ_, post #21110063]
Generated by the language model.
ADVERTISEMENT