Converting Moes Tuya Matter Bulb with CBLC5 Module to OpenBeken: Discoveries

Unlike the uHome UAMxxx Matter devices with Beken modules and different efuse/coeff keys, this Moes Tuya Matter bulb appears to be a lot easier to convert to OpenBeken.

https://www.aliexpress.com/item/1005006924194407.html



Inside is a CBLC5 module which when independently powered presented itself to Alexa as


The boot log


Not seen bootloader BK7231N_2.0.0 before

And Easy Flasher backup. Yes, it uses the standard Tuya key 510fb093 a3cbeadc 5993a17e c7adeb03



EF even extracted some config



This was a little worrying at the end of the backup though



Is it like the uHomes with its network info in a different location?

Flashing OpenBeken was successful but the AP name broadcast was suspiciously generic. PC connected to it and it was accessible



This OBK flash was with the "overwite bootloader (for N/M)" unchecked. I wanted to see if BL 2.0 was OK booting OpenBeken. It was



Next up, overwrite the BL with standard BK7231N_1.0.1. Boots into OBK fine, but same mac issue



Next it's time to write the whole of a standard non-Matter Tuya BK7231N factory firmware (from 0x0 - all data) (backup of QM-02L CB2L RGBW Bulb), with network info at the usual address, then flash to OpenBeken. Success. Complete with a unique mac and name derived from the mac.



Next I'll probably try to find the new location of the network info to see if all that needs changing is an address here https://github.com/openshwprojects/OpenBK7231...beken378/func/user_driver/BkDriverFlash.c#L78

then maybe it can be a new general release binary for Tuya Matter devices, assuming all Tuya Matter devices have the same partitions.

For the moment, the module is still unsoldered in case more flashing is needed, so not a working finished, proven device conversion yet.

Nice find, maybe it would be possible to check for MAC address after pairing with original app and then search for it in the flash?

Was there any date code on the board? Bootloader 2.0 may be relatively new thing.

hmm. no date code on the PCB I can see.



I see 2023 dates in the log firmware compiled at Oct 26 2023 16:39:00

I've flashed the backup to a CB3S and it boots and broadcasts as if the original bulb. I've paired it to the Tuya app



not found the network partition start yet

Added after 8 [minutes]:

other tools show this is the content of the storage area



Added after 1 [hours] 55 [minutes]:



mac. 0x1E3000

TLV also seems to be a good indicator of that partition. If I remember correctly, TLV is a header of flash block used to store variables. Maybe we should add a TLV search for our flasher?

well that sounds like a cool idea!

one step at a time, but if you wanted to extend detected info, the BL/APP/OTA partition addresses could also be read from the BL after location of 01PEbootloader, 01PEapp and 01PEdownload.

OK so, BL and APP always seem to the same but OTA has varied.

bootloader has 0 start

00 00 01 00 -> 0x10000 length



app partition 00 00 01 00 -> 0x10000 start

00 87 10 00 -> 0x108700 length



download partition 00 A0 12 00 -> 0x12A000 start

00 60 0A 00 -> 0xA6000 length


Added after 12 [minutes]:

to demonstrate that further, here is the OTA/download start address for the uHome firmwares on which I've been flashing RBLs to 0x143000


Added after 16 [minutes]:

and now the correct mac address with modified BkDriverFlash.c

1.17.669 vs 1340_merge_c9033419dbae

UART to 1340_merge_c9033419dbae from full factory Matter reflash to CB3S.
--->

Wait, does it apply to all dumps or only those new Matter? It sounds interesting, I could add it to our flasher today or tomorrow.

all I believe.

I made a little script to find strings in all .bin files in a specified folder. Just trying it out on a collection of all my bin files
eg


and this one for "PEbootloader". It should have detected more but when you open some bin files in HxD there's the odd wrong character in the middle of the decoded text, even though the backup can be flashed back to device and works 🤷🏼‍♂







Dunno, good idea or not? I don't know how you'd programmatically find the correct byes that are the start and length addresses if theyre not always at the same offset.

script if any use is:



Added after 24 [minutes]:

obviously "01PE" search would produce more hits

I flashed the CBLC5 back to 100% factory then did OBK again. Module soldered back into PCB and the bulb reconstructed. I appear to have a working Moes RGBCW E27 wifi bulb that was a Matter device. It's working with bootloader BK7231N_2.0.0






https://github.com/OpenBekenIOT/webapp/pull/1...mits/22a3abf3889f29a50fc079e7dc308201331d21d3

Added after 9 [minutes]:



anyone doing their own Moes Tuya Matter bulb should use the binaries in https://github.com/openshwprojects/OpenBK7231T_App/actions/runs/10749108481?pr=1340

stable

bulb was lit for >12 hours yesterday and temperatures were fine at 35 degrees or lower

But still without MQTT?

oh. I never configured MQTT...

build your own custom firmware for this device using the latest code - demonstration here https://www.elektroda.com/rtvforum/topic4082682.html

Once post is ready, create it as separate topic in Smart Home Tutorials, and here just link to it. Good job!

done. feel free to amend/revise etc