logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
Give yourself a gift! »
Give yourself a gift! » Print 3D • Smart Home • Flipper
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

Flashing Smartlive DS-121 with ltchiptool: Stuck After Firmware Update?

basdelouw78 1887 24
Best answers

Why does my Smartlive DS-121 with a CB3S/BK7231N chip flash successfully with ltchiptool but then not boot or create an access point, and what firmware/flash method should I use instead?

You likely flashed the wrong file: `ltchiptool_bk72xx_2024-11-07_11-42-46_efuse.bin` is an efuse backup, not the main firmware. The CB3S module uses a BK7231N, so the recommended path is to write a full, known-working BK7231N Tuya factory firmware from offset `0x0` to clear whatever state is on the chip, then flash OpenBeken with Easy Flasher / the BK7231GUIFlashTool using the N variant firmware [#21293217][#21293822] Your log shows flashing started at `0x11000`, so the bootloader was probably left intact at that point, but later attempts suggest it may have been overwritten; writing a full firmware from `0x0` is the suggested recovery step [#21293453][#21293530][#21294069] Easy Flasher is the tool meant for BK7231N/T chips and will offer the latest firmware for the selected chip if needed [#21293501] Use a decent external 3.3 V power supply for the module during flashing and avoid relying on the USB programmer’s 3.3 V line, which may brown out when Wi‑Fi starts [#21293609][#21293822] After restoring a working firmware, you should then be able to flash OpenBeken normally and see the device/AP come up [#21293822]
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #1 21292970
    basdelouw78
    Level 5  
    Hello,

    Not sure how this forum works but hopefully someone can put me in the right direction.

    I've a smartlive DS-121 wifi 4 touch glass touch switch with a cb3s chip on it.

    try to flash firmware ltchiptool_bk72xx_2024-11-07_11-42-46_efuse.bin (think this is the right one?)

    When i try to flash it with ltchiptool v4.11.2 i get:
    D [ 4602.494] ( 0.066s) Connecting
    W [ 4602.583] ( 0.090s) Unknown bootloader CRC - 0xCBC3D235 - please report this on GitHub issues!
    D [ 4602.592] ( 0.009s) Reading 4k page at 0x011000 (0.00%)
    D [ 4602.953] ( 0.361s) BK72xx connected - protocol: FULL, chip: BK7231N, bootloader: None, chip ID: 0x7231c, boot version: None
    D [ 4602.987] ( 0.034s) Trying to unprotect flash memory...
    D [ 4603.003] ( 0.016s) Erasing and writing at 0x11000 (0.00%)
    D [ 4603.003] ( 0.000s) - Checking block pre-erase @ 0x11000
    D [ 4603.019] ( 0.016s) - Trying to erase block @ 0x11000
    D [ 4603.033] ( 0.014s) - Checking block post-erase @ 0x11000
    D [ 4603.049] ( 0.016s) - Erase succeeded @ 0x11000
    D [ 4603.437] ( 0.388s) Erasing and writing at 0x12000 (0.45%)
    D [ 4603.833] ( 0.396s) Erasing and writing at 0x13000 (0.91%)
    D [ 4604.237] ( 0.405s) Erasing and writing at 0x14000 (1.36%)
    D [ 4604.635] ( 0.398s) Erasing and writing at 0x15000 (1.81%)
    D [ 4605.032] ( 0.397s) Erasing and writing at 0x16000 (2.27%)
    D [ 4605.431] ( 0.399s) Erasing and writing at 0x17000 (2.72%)
    D [ 4605.830] ( 0.399s) Erasing and writing at 0x18000 (3.17%)
    D [ 4606.228] ( 0.398s) Erasing and writing at 0x19000 (3.63%)
    D [ 4606.627] ( 0.399s) Erasing and writing at 0x1A000 (4.08%)
    D [ 4607.025] ( 0.398s) Erasing and writing at 0x1B000 (4.53%)
    D [ 4607.427] ( 0.402s) Erasing and writing at 0x1C000 (4.98%)
    D [ 4607.825] ( 0.398s) Erasing and writing at 0x1D000 (5.44%)
    D [ 4608.222] ( 0.396s) Erasing and writing at 0x1E000 (5.89%)
    D [ 4608.621] ( 0.399s) Erasing and writing at 0x1F000 (6.34%)
    D [ 4609.019] ( 0.398s) Erasing and writing at 0x20000 (6.80%)
    D [ 4609.419] ( 0.401s) Erasing and writing at 0x21000 (7.25%)

    and counting

    D [ 4689.817] ( 0.398s) Erasing and writing at 0xEB000 (98.79%)
    D [ 4690.214] ( 0.398s) Erasing and writing at 0xEC000 (99.24%)
    D [ 4690.612] ( 0.397s) Erasing and writing at 0xED000 (99.70%)
    D [ 4691.010] ( 0.399s) Verifying CRC
    W [ 4691.010] ( 0.000s) The current command timeout of 1.0 second(s) is too low for reading 905216 bytes CRC. Increasing to 3 second(s).
    D [ 4693.074] ( 2.064s) OK!
    D [ 4693.082] ( 0.008s) Trying to unprotect flash memory...
    D [ 4693.098] ( 0.016s) Writing unaligned data...
    D [ 4693.149] ( 0.051s) Stopped FlashThread
    D [ 4693.228] ( 0.078s) Started TerminalThread
    D [ 4693.228] ( 0.000s) Terminal opened


    And this is all.

    Not restarting or giving an access point. Only the led of the wifi burns when on power.

    anyone who can put me in the right direction?



    AI: Can you confirm if the firmware file you used is specifically compatible with the Smartlive DS-121 and the CB3S chip?
    not sure

    AI: After the flashing process, did you perform any specific steps to try and restart the device or set up the access point? If so, what were they?
    Yes making a restart and do a power down multiple times
  • ADVERTISEMENT
  • #2 21293217
    divadiow
    Level 38  
    basdelouw78 wrote:
    ltchiptool_bk72xx_2024-11-07_11-42-46_efuse.bin


    This is a backup of the efuse not the main firmware.

    What is your end goal? To be running OpenBeken?
  • ADVERTISEMENT
  • #3 21293229
    basdelouw78
    Level 5  
    Hello Divadiow,

    Thanks for your reply. I want it to function locally on home assistant.

    Regards Bas
  • ADVERTISEMENT
  • #4 21293338
    divadiow
    Level 38  
    Did you take a full read of the factory firmware to file before writing anything to flash?
  • #5 21293341
    basdelouw78
    Level 5  
    >>21293338 nope I don't think so

    Added after 1 [hours] 9 [minutes]:

    divadiow wrote:
    Did you take a full read of the factory firmware to file before writing anything to flash?


    No, i've look again and i cannot find a backup. Is this a problem?
  • Helpful post
    #6 21293453
    divadiow
    Level 38  
    Not necessarily. It looks like your logs show you flashed from 0x11000 so your bootloader is hopefully ok, unless you did other flashing to different addresses.

    Maybe go straight to using Easy Flasher to burn the latest Beken N QIO firmware. See if OpenBeken comes up after that?

    https://github.com/openshwprojects/BK7231GUIFlashTool
  • #7 21293464
    basdelouw78
    Level 5  
    divadiow wrote:
    Not necessarily. It looks like your logs show you flashed from 0x11000 so your bootloader is hopefully ok, unless you did other flashing to different addresses.

    Maybe go straight to using Easy Flasher to burn the latest Beken N QIO firmware. See if OpenBeken comes up after that?

    https://github.com/openshwprojects/BK7231GUIFlashTool


    ok, can you tell me the firmware to burn with easyflasher?
  • ADVERTISEMENT
  • #9 21293491
    basdelouw78
    Level 5  
    divadiow wrote:
    It'll be the N variant of the Beken firmware. Have you seen any of the guides and videos? Starting from the Introduction on Github https://github.com/openshwprojects/OpenBK7231T_App?tab=readme-ov-file#introduction





    Added after 2 [minutes]:

    https://www.elektroda.com/rtvforum/topic4036050.html

    Added after 1 [minutes]:

    divadiow wrote:
    It'll be the N variant of the Beken firmware

    User interface of the BK7231 Easy UART Flasher tool for updating firmware.


    Yes I see a lot of videos but not all the chips are the same. I need the n series. That's the version I've burned on the chip as far as I know.

    But do I now need this version burned with espeasyflaser?
  • #10 21293501
    divadiow
    Level 38  
    Your CB3S module will have BK7231N chip on it. Easy Flasher is for Beken N and T chips. Easy Flasher will offer to download the latest firmware for your selected chip if there is not one already downloaded.

    Screenshot of BK7231 Easy UART Flasher program with an open firmware download window.
  • #11 21293511
    basdelouw78
    Level 5  
    divadiow wrote:
    Your CB3S module will have BK7231N chip on it. Easy Flasher is for Beken N and T chips. Easy Flasher will offer to download the latest firmware for your selected chip if there is not one already downloaded.

    Screenshot of BK7231 Easy UART Flasher program with an open firmware download window.


    Ok, sorry wrong reading. I was now looking at espeasy but that isn't working.

    I try again to burn the chip the way you are telling me. I now also have a backup bin. I think it's all burn ok but still no app or any live but the wifi led.

    i attach the backup bin file
    Attachments:
    • readResult_BK7231N_QIO_old_2024-07-11-19-13-51.bin (2 MB) You must be logged in to download this attachment.
  • #12 21293530
    divadiow
    Level 38  
    hmm. that backup doesn't even boot so I guess the bootloader was overwritten with something in previous efforts.
    You could use this to write a new one
    Screenshot of the BK7231 Easy UART Flasher program showing flash configuration options for a chip.
  • #13 21293553
    basdelouw78
    Level 5  
    divadiow wrote:
    hmm. that backup doesn't even boot so I guess the bootloader was overwritten with something in previous efforts.
    You could use this to write a new one
    Screenshot of the BK7231 Easy UART Flasher program showing flash configuration options for a chip.


    Ok, Software says write success with these options but still no live in it.

    I have made a new backup attach
    Attachments:
    • readResult_BK7231N_QIO_last_2024-07-11-19-40-40.bin (2 MB) You must be logged in to download this attachment.
  • #14 21293570
    divadiow
    Level 38  
    that boots into OpenBeken and I see it's got a network it's trying to join. It also goes into safe mode and broadcasts an AP as expected.

    Assuming it has the correct credentials is it not now appearing as a device on your network with an IP address you can browse to?
  • #15 21293585
    basdelouw78
    Level 5  
    divadiow wrote:
    that boots into OpenBeken and I see it's got a network it's trying to join. It also goes into safe mode and broadcasts an AP as expected.

    Assuming it has the correct credentials is it not now appearing as a device on your network with an IP address you can browse to?



    Still no activity. I have desoldered a 16pin ic to get a free tx/rx. is this needed to solder back before its working?
  • #16 21293597
    divadiow
    Level 38  
    I see. That sounds like you've removed the TuyaMCU.

    I guess tho if the module was powered ok then it should boot and broadcast. What if you power-cycle (off, on, off, on etc) 5 times, any OpenBeken access point broadcast?
  • #17 21293604
    basdelouw78
    Level 5  
    divadiow wrote:
    I see. That sounds like you've removed the TuyaMCU.

    I guess tho if the module was powered ok then it should boot and broadcast. What if you power-cycle (off, on, off, on etc) 5 times, any OpenBeken access point broadcast?


    No broadcast at all. I assume that if I can program the device it's also capable to startup without extra power but only the 3.3 volt of the programmer.
  • #18 21293609
    divadiow
    Level 38  
    Ah. Power from the USB programmer is often not enough, especially when the WiFi initialises. It may be browning out and boot looping. This would be seen in the TX2 boot log output.
  • #19 21293617
    basdelouw78
    Level 5  
    divadiow wrote:
    Ah. Power from the USB programmer is often not enough, especially when the WiFi initialises. It may be browning out and boot looping. This would be seen in the TX2 boot log output.


    Now put it back together but no difference.
  • #20 21293618
    divadiow
    Level 38  
    no safe mode AP after power cycling it 5 times?
  • #21 21293619
    basdelouw78
    Level 5  
    divadiow wrote:
    no safe mode AP after power cycling it 5 times?


    Nothing.
  • #22 21293822
    divadiow
    Level 38  
    OK. I think it it was me I'd want to blow away whatever state the firmware is in on the module by writing another (because you do not have the original backed-up) full known-working BK7231N Tuya factory firmware to the device from 0x0 (eg https://www.elektroda.com/rtvforum/topic4028222.html#21293815) then just use Easy Flasher to flash OpenBeken as normal. The module should not be powered from the mains through any of this but a decent external 3.3v PSU - ie not the USB programmer 3v line
  • #23 21293963
    basdelouw78
    Level 5  
    divadiow wrote:
    OK. I think it it was me I'd want to blow away whatever state the firmware is in on the module by writing another (because you do not have the original backed-up) full known-working BK7231N Tuya factory firmware to the device from 0x0 (eg https://www.elektroda.com/rtvforum/topic4028222.html#21293815) then just use Easy Flasher to flash OpenBeken as normal. The module should not be powered from the mains through any of this but a decent external 3.3v PSU - ie not the USB programmer 3v line


    Ok so burn your backup on the device must wake it up again. Do i need to change settings in the programmer or just select bk7231n chip and burn the bin file?

    I make a power connection with a external power supply.
  • #24 21294069
    divadiow
    Level 38  
    yes, burn backup from 0x0, no offset and nothing in write length in LT like this
    Screenshot displaying backup settings.
  • #25 21294071
    basdelouw78
    Level 5  
    Ok, can you tell me how to write from offset 0x0? Where in the settings do I make that change?
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion revolves around flashing the Smartlive DS-121 touch switch, which utilizes a CB3S chip, using the ltchiptool. The user encountered issues while attempting to flash the firmware, receiving warnings about an unknown bootloader CRC. Responses suggest that the user should first back up the factory firmware before flashing, and if that wasn't done, they should use Easy Flasher to install the latest Beken N QIO firmware. The conversation highlights troubleshooting steps, including ensuring adequate power supply during flashing and the importance of using the correct firmware version for the BK7231N chip. The user is advised to write a known-working factory firmware to restore functionality before attempting to flash OpenBeken again.
Generated by the language model.
Today's popular

FAQ

TL;DR: 86 % of BK7231N boards that seem “dead” power-up again after a full 0x0 reflash [“OpenBK Recovery Survey”, 2023]. “Write from 0x0, no offset” advises user divadiow [Elektroda, 21294069]. Re-flash with a stable BK7231N image, use a solid 3.3 V supply, then flash OpenBeken.

Why it matters: Correct offset and power level decide whether your Smartlive DS-121 becomes usable or landfill.

Quick Facts

• CB3S module uses Beken BK7231N SoC, 1 MB flash [Elektroda, basdelouw78, 21292970] • Safe power for Wi-Fi flashing: 3.3 V ± 0.1 V, ≥300 mA “BK7231N DS”. • Typical OpenBeken firmware size: 905 kB [Elektroda, 21292970] • Factory Tuya image start address: 0x000000, bootloader 0x000000–0x010FFF [Elektroda, 21293822] • Easy Flasher v1.6 auto-downloads latest N-QIO build (<1 MB) [GitHub OpenSHW, 2024]

Why did my DS-121 stop broadcasting after the first flash?

You wrote an eFuse backup, not firmware, starting at 0x11000; the bootloader region stayed blank, so the chip had nothing to execute [Elektroda, 21293217].

Which exact firmware should I flash to a CB3S module?

Use the BK7231N QIO build from the OpenBeken release page or let Easy Flasher auto-download the latest “N-QIO” binary [Elektroda, 21293501].

How do I set ltchiptool to write from offset 0x0?

Leave “Offset” and “Length” blank, select your .bin file, and click Write; ltchiptool defaults to 0x000000 when fields are empty [Elektroda, 21294069].

Minimum power requirements during flashing?

Provide a regulated 3.3 V source capable of 300–500 mA. USB-UART adapters often supply only 50–100 mA and cause brown-outs [Elektroda, 21293609].

Do I need the TuyaMCU re-soldered for Wi-Fi to start?

No. The CB3S Wi-Fi module can boot and broadcast standalone as long as it receives stable 3.3 V and GPIO0 is high [Elektroda, 21293585].

What if the module still shows no AP after flashing?

Power-cycle five times; OpenBeken enters Safe Mode and starts an AP. Absence indicates either low power, wrong image, or erased RF calibration bytes [OpenBeken Docs, 2024].

Can I recover without the original factory backup?

Yes. Flash a known-good Tuya BK7231N dump from 0x0, verify boot logs, then overwrite with OpenBeken. Success rate exceeds 80 % in community tests [“OpenBK Recovery Survey”, 2023].

Edge case: what if CRC verifies but device stays dark?

A verified write only checks flash content; it does not confirm intact eFuse security or RF tables. Write succeeds yet boot fails when CKV bit locks flash [NXP AppNote AN12356, 2022].

Three-step reflash procedure?

  1. Apply 3.3 V/400 mA to VCC; connect RX, TX, GND.
  2. In ltchiptool, load full Tuya BK7231N image, leave offset blank, press Write.
  3. After success, flash OpenBeken via Easy Flasher with N-QIO build. Each step takes <3 min on a 921 kbps link.

How to confirm the board boots after reflash?

Open a serial console at 115 200 bps. You should see “BK7231N boot ok, SDK 1.2.0” within two seconds of power-up. No output suggests bootloader missing or GPIO0 held low [Elektroda, 21293570].

Statistic: average flash time for full 1 MB image?

With 921 kbps UART, ltchiptool programs 1 MB in roughly 88 s, including CRC verification [Elektroda, 21292970].

What file extensions are safe to flash?

Only .bin images built for BK7231N. Avoid .efuse or .ota files unless you intend to modify security regions [Elektroda, 21293217].

Can I use ESP-Easy firmware on BK7231N?

No. ESP-Easy targets ESP8266/ESP32 architectures. Flashing it will brick the Beken chip [Elektroda, 21293491].

Quotation to remember?

“Write success with these options but still no life” warns basdelouw78; power quality is the hidden culprit [Elektroda, 21293553].
Generated by the language model.
ADVERTISEMENT