OpenBeken Compatibility with CKW04 Chip in Woolley Smart Touch Switch?

Question

Openbeken for CKW04 chip? I’ve recently replaced the pcb with esp for this switch But I was wondering if there was any work done to add openbeken support if possible? Woolley Smart Touch Switch WiFi Push Button Light Switch No Neutral Wire Required RF Remote Control Smart Home Automation Module

divadiow · Accepted Answer

not yet. will try shortly.

Added after 52 [minutes]:

hmm. I think this tool might be actual USB programming? there's no mention of UART and:

and there is USB interface

Added after 5 [minutes]:

relevant docs

divadiow · Accepted Answer

seems GPIO13 - nReset - needs to be low on reset for download mode or maybe GPIO4? 3 and 4 seems exposed on Sonoff, not 13. pulling 3 and 4 low doesn't seem to do anything but boot device normally

divadiow · Accepted Answer

this is the serial port method for HF-LPD1x0

requiring the use of SecureCRT to do xmodem stuff. Don't know if the method to achieve this relies on HF-specific bootloader abilities, in which case it'd be no good for the CKW04 I guess.

divadiow · Answer

I see a few mentions of this around the web, but at initial glance I don't see much mention of a full datasheet or SDK. Did you ever capture the UART boot log?

ferbulous · Answer

I tried getting the logs from rx/tx/uart0_tx/uart0_rx pins but nothing with 115200 baudrate. Maybe different baudrate? There's a LOG pad there but I'm not sure how to connect it to the uart

divadiow · Answer

I think I'd start by trying both of these to see which gives any output then try different bauds depending on how legible any of it is.

Added after 5 [minutes]:

unless of course it's like some other devices where the RXs are to where they're to go TO not where they're FROM, in which case I'd try all 4 UARTs

ferbulous · Answer

>>21301206 What are the usual baudrates that i could try?

divadiow · Answer

115200 feels the most common. 921600 perhaps. 74880 on some ESPs. I had 120000 on the ELM327 device the other day.

p.kaczmarek2 · Answer

Try to get boot log, maybe it will have some mentions of used SDK/toolset.

divadiow · Answer

I didn't clock this whole post, or you added more info. anyway, I don't bother connecting the RX for log capture, only TX, so it doesn't need to be in pairs. Treat LOG as a TX and connect only that, common ground and 3V3 power as normal. Before that though, worth seeing if there's continuity from LOG to GND? Could LOG be some acronym for another ground? dunno

p.kaczmarek2 · Answer

That's not good news, but still, a bootlog could give us some more basic information. Maybe this chip is like T34 and is compatible with some other platform?

ferbulous · Answer

Ok, i'm getting something from LOG pad (as TX) with 115200. No continuity with GND

bootloader start

can not find ota_info.bin
can not find ota.bin, plz use xmodem
press 'm' to enter boot menu , remain 1 second
fs addr ='0xfe000'
heap size 142096
invalid psram heap base
===================
RT Config:        5  5  5  5  5  5  5 130 130  7  9 10  7  7  7  7  7  1
HT Config:        5  5  5  5  5  5  5 170 170  7  9 10  7  7  7  7  7  1
LT Config:        5  5  5  5  5  5  5 125 125  7  9 10  7  7  7  7  7  1
===================
RF Gain:         4
B Rate Gain:      7
G Rate Gain:     13, 11,  9,  7
20N Rate Gain:   13, 11,  9,  7
40N Rate Gain:   13, 11,  9,  7
Temperature Boundary:    35, 80
===================
5G RT Config:    13 13 10  8 0x9264924a 0x96dbb6cc
5G HT Config:    13 13 10  8 0x9264924a 0x96dbb6cc
5G LT Config:    13 13 10  8 0x9264924a 0x96dbb6cc
5G Band Threshold:       5150 5500 5700
===================
rf config ch = -1, current ch = 7
rf config tempe state = -1, current tempe state = 2
page index byte len:         256
object lookup pages:         1
page pages per block:        16
page header length:          5
object header index entries: 105
object index entries:        124
available file descriptors:  4
free blocks:                 257
remove ota.bin rlt = -10002
remove ota_info.bin rlt = -10002
task Radio_Receive_T created
radio init s
radio init e
if0 44:5D:5E:42:9B:82
if1  44:5D:5E:42:9B:83
MAC[44:5d:5e:42:9b:82]
MAC[44:5d:5e:42:9b:83]
task tcpip_task created
task mode_task created
[BUILD TIME]: Sep  6 2019 17:22:21
task IDLE created
task Tmr Svc created
[fileInit] <2.dat> open failed, fd: -10002
[fileInit] file not found
task event_handle_ta created
task pair_task created
sniffer_mac:6
start_sniffer_mode
reset key tbl
tx flow: 735
rx flow: 4

divadiow · Answer

excellent. so LOG really is just the log output ;D

I've not many leads from searching for any of those strings. Icomm-Semi use start_sniffer_mode in their code it seems https://github.com/search?q=start_sniffer_mode&type=code
but that could be a coincidence I guess

divadiow · Answer

I've found nothing else, but for the hell of it I ordered a Sonoff Micro-CFH and they do still come with a CKW04 chip

LOG:

Log in, to see the code

Added after 16 [minutes]:

quite a few of those "ffs..." strings get results in Github. eg:

https://github.com/search?q=ffsInitializeConfigurationMapEntryStream&type=code
https://github.com/search?q=ffsInitializeUserContext&type=code

Maybe it's a MicrochipTech chip at heart.

Added after 31 [minutes]:

divadiow wrote:
Icomm-Semi use start_sniffer_mode

oh maybe it is Icomm Semi - https://www.cnx-software.com/2019/12/12/icomm...-andes-risc-soc-for-iot-and-embedded-systems/

Added after 1 [hours] 45 [minutes]:

Assuming it's an Icomm Semi SV6166F, here's where the pads on the Sonoff trace to. CKW04 and SV6166F and the function of pads appear to line up.

and from the CKW info pages for those traced:

These 4 test holes are clearly for programming

The only thing I'm not sure about is why GPIOs 3 and 4 need test pads.

ferbulous · Answer

Thanks @divadiow for your extra work on this
How were you able to get more log output? Mine just stops after tx/rx line and I’m not too sure about wiring to the main line with the uart tx/rx/gnd still connected to it

divadiow · Answer

I assume it's because I have a different device and it was coded to output more. definitely don't do this. I guess there's a possibility yours is dying from lack of power around the time wifi initialises, but I would think it would boot loop and you'd see the same output repeated. Does the log repeat over and over or does it show once and the device remains steady in pairing mode?

p.kaczmarek2 · Answer

If GPIO roles match up with existing known chip, then it may be it. The UART log output can say more when it's being paired to the cloud or when you control it via Tuya app.

divadiow · Answer

also there are a few mentions of SV6166F in association with Sonoff devices when Googling, including one here:

insmod · Answer

>>21312234 A partial sdk can be found for ssv6006 target on hi-flying ftp you posted earlier.
Download LPD100 and look inside, perhaps it contains something for 6166.
target_def.mk mentions ANDES_N10 arch, same as in 6166.

divadiow · Answer

plenty of 6006, like you say

and actually some 6166 and ICOMM, presumably the ICOMM Semi mentioned months ago

Added after 2 [minutes]:

interesting

Added after 21 [minutes]:

Added after 24 [minutes]:

HF-LPD100 = SV6266F

insmod · Answer

>>21478292 From what i understood the only difference between them is that 6266 supports 5ghz wifi. Did you try to take a backup yet?

divadiow · Answer

Code: TextLog in, to see the code on every boot from TXD1/GPIO7 @9600 baud

p.kaczmarek2 · Answer

I've actually seen HSDP and HSDM, which suggests D+ and D- in a related topic: So it's an USB, after all?

OpenBeken Compatibility with CKW04 Chip in Woolley Smart Touch Switch?

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Post #24

Post #25

Topic summary