BK7231N Sber Smart Relay SBDV-00050 Pin Assignment and Teardown

Question

PIN Assignment ADC3 P8 Switch P24 P16 Button P7 TX1 GND GND PIN Assignment EN P9 RELAY P6 P14 P26 LED RX1 VD0 3.3v

kuba2k2 · Accepted Answer

Encryption keys for ESPHome: Code: YAMLLog in, to see the code

divadiow · Answer

Cool. What are your plans for this device regarding the firmware?

divadiow · Answer

interesting module. doesn't seem these are for sale outside of Russia/Kazakhstan though

tehb13 · Answer

>>21278408

divadiow · Answer

>>21279094 When this happens I use BKFIL to erase/flash

insmod · Answer

>>21279480 If erased without backup, then the original bootloader is lost - guaranteed brick. Or then separating the bootloader from backup image, and flashing just it. Alongside losing RF partition.
>>21279094 Besides, there is no need to flash a full image, just flashing ota package is enough. Bootloader will then update the firmware. In my case on a different device - bkcrypt_coeff is probably wrong - flashing didn't work. But writing rbl at ota address, and subsequent updates from esphome works ok.

tehb13 · Answer

I flashed the backup. The device works.I got this error when flashing the sbdv-00050-ota.rblWhen flashing sbdv-00050.uf2, no errors occur, but the device does not work, as well as without adding: Code: YAMLLog in, to see the code

divadiow · Answer

yes, I should have been clearer. The user has posted a backup on Github. BKFIL can be used to erase/flash specific address areas in flash.

insmod · Answer

>>21279522 At what address did you flash sbdv-00050-ota.rbl?
Try to get uart1 connected, if bootloader version is something like 1.0.13, then it will print what is wrong with OTA package (like wrong enc keys).
You can also erase main firmware (for first attempt - 0x10000 to 0x12000) after flashing OTA. Maybe it will work then.

tehb13 · Answer

BK7231n_1.0.8
CPSR:0x000000D3
R0:0x00800000
R1:0x00000000
R2:0x005AA000
R3:0x00000006
R4:0x00400001
R13:0x00401C1C
R14(LR):0x000033AC
ST:0x00000000
[I/FAL] Fal(V0.4.0)success
[I/OTA] RT-Thread OTA package(V0.2.4) initialize success.

go os_addr(0x10000)..........

the device can be pinged, but it doesn't have a web interface and doesn't connect to homeassistant.
please write step-by-step instructions on which files to flash to which addresses

Spoiler:

Log in, to see the code

insmod · Answer

>>21284726 If you are using ltchiptool, then choose rbl and just flash it, it should be autodetected as beken ota image with 0x132000 address.
Btw, you are missing a "+" sign in board_flash.download, it should be "0x132000+0xCC000"
And please add log to esphome configuration, it will be easier to debug. And maybe enable api encryption?
Also, what esphome version are you using? In the OTA config in the latest versions you need to select the platform (just esphome for now) like that


ota:
  - platform: esphome
    password: !secret ota_password

tehb13 · Answer

I have not lost the plus symbol in yaml. This probably happened when publishing the post
Screenshot of a YAML file named sbdv-00050.yaml with a configuration for esphome.

Screenshot of a YAML file named sbdv-00050.yaml with a configuration for esphome.

When I try to flash sbdv-00050-ota.rbl via ltchiptool, over the factory, I get an error
Error displayed during an attempt to flash a file using ltchiptool

Error displayed during an attempt to flash a file using ltchiptool

BKFIL flashes it without an error.

logs_sbdv-..050.txt (40.54 kB)You must be logged in to download this attachment.

insmod · Answer

>>21284811 Considering there is no log after go os_addr(0x10000), then it probably flashed successfully. Now try reflash backup, then flash new ota image with logging enabled.
Your esphome version is rather old, 2024.4.1. But nothing much should have changed for beken, so updating is probably unnecessary.

lesder1986 · Answer

Hello everyone. I also have a problem with this relay. I took a dump in the "M" mode. Then I flashed different firmware, but it didn't work out. I tried to return the dump, it doesn't work either. The LED does not light up when turned on. I've tried different programs. And I inserted the code above into yaml and compiled the firmware in esphome, but it still doesn't work. There were no firmware errors.

Log in, to see the code

divadiow · Answer

open your backup in this tab in Easy Flasher and try to find keys. if the backup is mostly OK maybe it will come back with the same key as below?

if it's the same key then the bootloader attached (flashed to 0x0) should boot (no OBK AP will broadcast) and you'll see the bootloader log if you're watching TX debug with a terminal.

lesder1986 · Answer

The keys match, and I can decompile my backup the same way. Do I need to flash the attached bootloader via BKFIL at 0x0 to the native firmware? Then flash the Ota already compiled with my code through itchiptool? Thanks.

insmod · Answer

Flash it via any tool at 0x0, but OTA image must use default Tuya OTA key (simply remove all platformio_options). OpenBK7231N OTA image would work too.

Added after 4 [minutes]:

Oh, and OTA image must be flashed to 0x12A000

lesder1986 · Answer

I flashed the bootloader, then OTA, the terminal constantly writes [20][ERR][DEVINFO] boot partition signature not found.

insmod · Answer

This is what original firmware prints. Try to fully erase chip, write bootloader and then write OTA.

lesder1986 · Answer

I deleted everything in BKFIL and saved the loader to 0x0 and the file image_bk7231n_app.ota.ug.bin compiled from my computer in ESPHome at 0x12A000. After flashing the bootloader, the ICE indicator flashed white three times. The terminal is silent, outputs nothing, and is empty.

insmod · Answer

>>21914912 Not ug, you must use .rbl file

lesder1986 · Answer

I flashed through bkfil, it does not allow me to flash the .rbl format. Therefore, I had to sew.bin. After the firmware, the terminal was empty, I decided to connect 220 V, from the first turn on, the indicator did not work, turned on the power, the LED lit up, the device connected to the network and web access appeared, the relay and the indication are triggered. Thanks!

divadiow · Answer

rename the .rbl to .bin

lesder1986 · Answer

Thanks, I've updated the firmware, everything is working.

divadiow · Answer

good stuff. there's also the option to restore your original device's rf info, including mac, from the backup if you need to or the same with Easy Flasher if UART still wired

lesder1986 · Answer

>>21915242
Thank you, I restored it using a full backup via the firmware, I did not make a separate RF backup, but I understood that it would not be possible to restore the full bin file over the Internet.

divadiow · Answer

rf = wifi calibration etc

and yes, I forgot the TLV section would need to be cut out of the backup for the web app flash to work. I do have a PR that includes full-flash scan for the TLV section and will lift that bit out for flashing, but the other changes in the PR might need reviewing first.

lesder1986 · Answer

Yes))) Thanks.

divadiow · Answer

wondering if a static set of SBER OBK binaries for initial flashing is an idea. One for each of the 5 unique keys we know of.

BK7231N Sber Smart Relay SBDV-00050 Pin Assignment and Teardown

Topic summary

FAQ

Quick Facts

What are the pin assignments for the SBDV-00050 (BK7231N)?

Which pins drive the relay and the status LED?

How do I flash the ESPHome OTA RBL with ltchiptool?

ltchiptool errors when flashing the RBL—can I use BKFIL instead?

Do I need to flash a full image, or just the OTA package?

What happens if I erase the flash without a backup?

Where do the encryption keys go in ESPHome for this device?

Device pings but no web UI after OTA—how do I fix it?

What’s the correct board_flash.download format in ESPHome?

Which ESPHome OTA schema should I use right now?

My .uf2 flashed fine but the device stayed dead—why?

How can I view boot logs to verify the bootloader is running?

Is the SBDV-00050 sold outside Russia/Kazakhstan?

Which ESPHome board target should I select for BK7231N here?

OTA flashed but no logs—what recovery sequence should I try?