OpenBeken Compatibility with CKW04 Chip in Woolley Smart Touch Switch?

Question

Openbeken for CKW04 chip? I’ve recently replaced the pcb with esp for this switch But I was wondering if there was any work done to add openbeken support if possible? Woolley Smart Touch Switch WiFi Push Button Light Switch No Neutral Wire Required RF Remote Control Smart Home Automation Module

divadiow · Accepted Answer

not yet. will try shortly. Added after 52 [minutes]:hmm. I think this tool might be actual USB programming? there's no mention of UART and: and there is USB interface Added after 5 [minutes]:relevant docs

divadiow · Accepted Answer

seems GPIO13 - nReset - needs to be low on reset for download mode or maybe GPIO4? 3 and 4 seems exposed on Sonoff, not 13. pulling 3 and 4 low doesn't seem to do anything but boot device normally

divadiow · Accepted Answer

this is the serial port method for HF-LPD1x0 requiring the use of SecureCRT to do xmodem stuff. Don't know if the method to achieve this relies on HF-specific bootloader abilities, in which case it'd be no good for the CKW04 I guess.

divadiow · Answer

I see a few mentions of this around the web, but at initial glance I don't see much mention of a full datasheet or SDK. Did you ever capture the UART boot log?

ferbulous · Answer

I tried getting the logs from rx/tx/uart0_tx/uart0_rx pins but nothing with 115200 baudrate. Maybe different baudrate? There's a LOG pad there but I'm not sure how to connect it to the uart

divadiow · Answer

I think I'd start by trying both of these to see which gives any output then try different bauds depending on how legible any of it is. Added after 5 [minutes]:unless of course it's like some other devices where the RXs are to where they're to go TO not where they're FROM, in which case I'd try all 4 UARTs

ferbulous · Answer

>>21301206 What are the usual baudrates that i could try?

divadiow · Answer

115200 feels the most common. 921600 perhaps. 74880 on some ESPs. I had 120000 on the ELM327 device the other day.

p.kaczmarek2 · Answer

Try to get boot log, maybe it will have some mentions of used SDK/toolset.

divadiow · Answer

I didn't clock this whole post, or you added more info. anyway, I don't bother connecting the RX for log capture, only TX, so it doesn't need to be in pairs. Treat LOG as a TX and connect only that, common ground and 3V3 power as normal. Before that though, worth seeing if there's continuity from LOG to GND? Could LOG be some acronym for another ground? dunno

p.kaczmarek2 · Answer

That's not good news, but still, a bootlog could give us some more basic information. Maybe this chip is like T34 and is compatible with some other platform?

ferbulous · Answer

Ok, i'm getting something from LOG pad (as TX) with 115200. No continuity with GND Code: text Expand Select all Copy to clipboardbootloader start can not find ota_info.bin can not find ota.bin, plz use xmodem press 'm' to enter boot menu , remain 1 second fs addr ='0xfe000' heap size 142096 invalid psram heap base =================== RT Config:        5  5  5  5  5  5  5 130 130  7  9 10  7  7  7  7  7  1 HT Config:        5  5  5  5  5  5  5 170 170  7  9 10  7  7  7  7  7  1 LT Config:        5  5  5  5  5  5  5 125 125  7  9 10  7  7  7  7  7  1 =================== RF Gain:         4 B Rate Gain:      7 G Rate Gain:     13, 11,  9,  7 20N Rate Gain:   13, 11,  9,  7 40N Rate Gain:   13, 11,  9,  7 Temperature Boundary:    35, 80 =================== 5G RT Config:    13 13 10  8 0x9264924a 0x96dbb6cc 5G HT Config:    13 13 10  8 0x9264924a 0x96dbb6cc 5G LT Config:    13 13 10  8 0x9264924a 0x96dbb6cc 5G Band Threshold:       5150 5500 5700 =================== rf config ch = -1, current ch = 7 rf config tempe state = -1, current tempe state = 2 page index byte len:         256 object lookup pages:         1 page pages per block:        16 page header length:          5 object header index entries: 105 object index entries:        124 available file descriptors:  4 free blocks:                 257 remove ota.bin rlt = -10002 remove ota_info.bin rlt = -10002 task Radio_Receive_T created radio init s radio init e if0 44:5D:5E:42:9B:82 if1  44:5D:5E:42:9B:83 MAC[44:5d:5e:42:9b:82] MAC[44:5d:5e:42:9b:83] task tcpip_task created task mode_task created : Sep  6 2019 17:22:21 task IDLE created task Tmr Svc created [fileInit]  open failed, fd: -10002 [fileInit] file not found task event_handle_ta created task pair_task created sniffer_mac:6 start_sniffer_mode reset key tbl tx flow: 735 rx flow: 4

divadiow · Answer

excellent. so LOG really is just the log output ;D I've not many leads from searching for any of those strings. Icomm-Semi use start_sniffer_mode in their code it seems but that could be a coincidence I guess

divadiow · Answer

I've found nothing else, but for the hell of it I ordered a Sonoff Micro-CFH and they do still come with a CKW04 chip LOG: Code: TextLog in, to see the code Added after 16 [minutes]: quite a few of those ffs... strings get results in Github. eg: Maybe it's a MicrochipTech chip at heart. Added after 31 [minutes]: oh maybe it is Icomm Semi - Added after 1 [hours] 45 [minutes]: Assuming it's an Icomm Semi SV6166F, here's where the pads on the Sonoff trace to. CKW04 and SV6166F and the function of pads appear to line up. and from the CKW info pages for those traced: These 4 test holes are clearly for programming The only thing I'm not sure about is why GPIOs 3 and 4 need test pads.

ferbulous · Answer

Thanks @divadiow for your extra work on this How were you able to get more log output? Mine just stops after tx/rx line and I’m not too sure about wiring to the main line with the uart tx/rx/gnd still connected to it

divadiow · Answer

I assume it's because I have a different device and it was coded to output more. definitely don't do this. I guess there's a possibility yours is dying from lack of power around the time wifi initialises, but I would think it would boot loop and you'd see the same output repeated. Does the log repeat over and over or does it show once and the device remains steady in pairing mode?

p.kaczmarek2 · Answer

If GPIO roles match up with existing known chip, then it may be it. The UART log output can say more when it's being paired to the cloud or when you control it via Tuya app.

divadiow · Answer

also there are a few mentions of SV6166F in association with Sonoff devices when Googling, including one here:

insmod · Answer

>>21312234 A partial sdk can be found for ssv6006 target on hi-flying ftp you posted earlier. Download LPD100 and look inside, perhaps it contains something for 6166. target_def.mk mentions ANDES_N10 arch, same as in 6166.

divadiow · Answer

plenty of 6006, like you say and actually some 6166 and ICOMM, presumably the ICOMM Semi mentioned months ago Added after 2 [minutes]:interesting Added after 21 [minutes]: Added after 24 [minutes]:HF-LPD100 = SV6266F

insmod · Answer

>>21478292 From what i understood the only difference between them is that 6266 supports 5ghz wifi. Did you try to take a backup yet?

divadiow · Answer

Code: TextLog in, to see the code on every boot from TXD1/GPIO7 @9600 baud

p.kaczmarek2 · Answer

I've actually seen HSDP and HSDM, which suggests D+ and D- in a related topic: So it's an USB, after all?

DeDaMrAz · Answer

Just dumping some links in here for future reference

OpenBeken Compatibility with CKW04 Chip in Woolley Smart Touch Switch?

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Post #24

Post #25

Post #26

Topic summary