logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
Build faster with M5Stack »
Build faster with M5Stack » Stick • Unit • Cardputer
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

NiceMCU XH-WB3S BK7238 Flashing, Testing, Pinout, Development, Porting

divadiow 18300 361
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #331 21696066
    divadiow
    Level 38  
    cool. will try it in a mo.

    was thinking maybe EF would benefit from a little info button labelled "Flash Info" or something. It'd bring up a little box with some basic wiring text and a little ASCII diagram maybe, basically what LT has. Sometimes I forget which PAxx for AmebaZ/Z2 so it's kinda handy. I know Ameba Z/Z2 isn't in EF yet, but new users may appreciate a little pointer for all chips. Could bolster each with a link to key thread on Elektroda.

    eg.

    Code: Text
    Log in, to see the code


    Added after 6 [minutes]:

    something jazzier

    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
  • Helpful post
    #333 21701945
    insmod
    Level 31  
    https://github.com/openshwprojects/BK7231GUIFlashTool/pull/65
    Always overwrite bootloader for BK7238/T1, since we can't ota with default T1 bootloader. And overwrite 7252N, 7236 and 7258 for the future.
    Can now override default 8710_2M key. 8711AM_4M decrypts WRG1 config successfully, and 8721D decrypts 8720DN configs.
    There is some strangeness to WBR1D and T5 configs. Tuya magic is after data, so nothing gets extracted. If manually moved magic before data - extraction is successful.
    Will now extract at least something if no pin/baud data is in the config.
    Code: text Expand Select all Copy to clipboard
    {
   "uuid":"22527ceacb5223f3",
   "psk_key":"null",
   "auth_key":"pX5PvwBmZ5ATsFbu3oDk8O6LZqKbXwA9",
   "ap_ssid":"SmartLife",
   "ap_passwd":"null",
   "country_code":"null",
   "bt_mac":"null",
   "bt_hid":"null",
   "prod_test":"false",
   "fac_pin":"w57tepkyqlsegcov",
   "psk30_key":"null "
}

    Code: text Expand Select all Copy to clipboard
    Sorry, no meaningful pins data found. This device may be TuyaMCU or a custom one with no Tuya config data.
No module information found.
And the Tuya section starts at 2015232, which is a default LN882H offset.

    Code: text Expand Select all Copy to clipboard
    {
   "uuid":"2bf63b86ce95a65a",
   "psk_key":"nt7Eq07Z0UDOFRZdGKbDADIFbYBos5hyhg0fO",
   "auth_key":"xM5nse6ey9qZBkhDFpfZzt1p4MvWo9yr",
   "ap_sB[rcd-sub_dev_ddintry_code":"null",
   "bt_mac":"null",
   "bt_hid":"null",
   "prod_test":"false",
   "fac_pin":"0",
   "random":"0",
   "wfb64":"1",
   "stat":"0",
   "token":"null",
   "region":"null",
   "reg_key":"null",
   "dns_prio":"2bf63b86ce95a65a",
   "ap_ssid":"SmartLife",
   "ap_passwd":"null",
   "country_code":"null",
   "ssid":"null",
   "passwd":"null",
   "md":"0",
   "dp5":"2",
   "dp30":"1",
   "dp39":"1",
   "dp40":"1",
   "dp44":"100",
   "dp41":"50",
   "dp46":"1",
   "id":"null",
   "swv":"1.7.2",
   "bv":"40.00",
   "pv":"2.2",
   "lpv":"3.4",
   "pk":"keym557nqw3p8p7m",
   "firmk":"null",
   "cadv":"1.0.4",
   "cdv":"1.0.0",
   "dev_swv":"1.7.2",
   "s_id":"null",
   "dtp":"0",
   "sync":"0",
   "attr_num":"1",
   "mst_tp_0":"3",
   "mst_ver_0":"2.4.1",
   "mst_md5_0":"null",
   "mst_tp_1":"0",
   "mst_ver_1":"null",
   "mst_md5_1":"null",
   "mst_tp_2":"0",
   "mst_ver_2":"null",
   "mst_md5_2":"null",
   "mst_tp_3":"0",
   "mst_ver_3":"null",
   "mst_md5_3":"2"
}

    Code: text Expand Select all Copy to clipboard
    Sorry, no meaningful pins data found. This device may be TuyaMCU or a custom one with no Tuya config data.
No module information found.
And the Tuya section starts at 8220672, which is a default 8MB RTL8720D/WBRG1 offset.
  • #334 21701969
    p.kaczmarek2
    Moderator Smart Home  
    Cool, merged. Let me know what are your next plans for flasher, as I am considering looking into that as well. I am thinking about next RTLs or BL602, or maybe ESP for sport.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #335 21701974
    divadiow
    Level 38  
    nice. very useful. the pid and pk are useful just themselves. anything extracted is a bonus

    LN
    Screenshot of BK7231 Easy UART Flasher with loaded JSON configuration
  • #336 21701981
    insmod
    Level 31  
    >>21701969
    I think about moving it to .NET 4.8 (or at least 4.6).
    Some code cleaning, using tasks instead of threads, system.text.json instead of newtonsoft.json etc.
    .NET 8 and Avalonia for the future? This would make it cross-platform without mono, but that would be really hard.
  • ADVERTISEMENT
  • #340 21714675
    divadiow
    Level 38  
    maybe interesting
    Screenshot of file explorer showing a .bin file and debugging error messages.
    Attachments:
    • bk7258_video_lock_ty_kiwi_lvgl_tx_uvc_QIO_1.0.74_tx_1.0_4.5.bin (3.83 MB) You must be logged in to download this attachment.
  • #342 21750930
    p.kaczmarek2
    Moderator Smart Home  
    Wow so BK7258 has reached Aliexpress?
    https://www.elektroda.com/rtvforum/find.php?q=wb5e
    Helpful post? Buy me a coffee.
  • #343 21750945
    divadiow
    Level 38  
    still not as attractively priced as NiceMCU XH-WB3S BK7238 though!
  • #344 21750999
    p.kaczmarek2
    Moderator Smart Home  
    How big flash is it?

    Btw, from datasheet:
    Beken memory specifications including Flash, PSRAM, ROM, and eFuse
    I wonder if we could attach external flash (or RAM) to Beken easily? It would be great, especially for BK7231.
    Helpful post? Buy me a coffee.
  • #346 21751027
    p.kaczmarek2
    Moderator Smart Home  
    Interesting, I only used external SRAM on ESP32 ( https://www.elektroda.pl/rtvforum/topic4126144.html ), I don't know how it works under the hood. I assume there is also possible to have a pointer to block of memory in external SRAM, so, how does it get translated, when I access it? Like buff[1] = 1; ? Is it done by C driver, or by hardware? Does it send/write to chip via SPI on every access, or does it cache? Just curious.
    Helpful post? Buy me a coffee.
  • #347 21777597
    max4elektroda
    Level 24  
    insmod wrote:
    Nearly finished porting 3.0.78 SDK.
    Plus fixed UART.

    Yes, I know it was some time ago, but could you explain how to use UART?
    I was trying to get some input from uart, but won't get any.
    I tried with an USB uart "in parallel" to see, if there is any input, but as soon as I connect the line to RX of the board, there is even no more input visible on the "external uart" (this works fine with other boars).
    RX input pin seems "always high" for me. Is there anything else to do to use uart? Or maybe my board is simply broken ?!?
  • #348 21777598
    insmod
    Level 31  
    >>21777597
    Did you start any driver that uses uart?
  • #349 21777601
    max4elektroda
    Level 24  
    Yes, used my NEO6 driver (https://github.com/openshwprojects/OpenBK7231T_App/pull/1890). At least it works on other Beken platforms.
    Uart is started with:

    UART_InitUART(NEO6M_baudRate, 0, 0);

    NEO6M_baudRate = 9600
  • #350 21777612
    insmod
    Level 31  
    TuyaMCU works fine for me on UART1 BK7238 with debug assistant
  • #351 21777616
    divadiow
    Level 38  
    insmod wrote:
    TuyaMCU works fine for me on UART1 BK7238 with debug assistant


    same. will try NEO6M on BK7238 as soon as I can, unless solved before.
  • #352 21777629
    max4elektroda
    Level 24  
    So if I start TuyaMCU driver and then connect something on UART1, I should also see "non-Tuya" input in Log?
    Seems the same in this case: as soon as input is connected, input (on the parallel connected UART) "stops".
    So maybe it's really my board having a problem here, sorry for bothering you.
  • #353 21777657
    divadiow
    Level 38  
    hmm.

    I don't seem to have got a reading yet.

    USB-C is power only - ie no P10/P11 UART with PC.

    1890_merge_73e135eabfe4
    Code: Text
    Log in, to see the code


    Code: Text
    Log in, to see the code


    ? character is when flag26 is unchecked.

    NiceMCU WB3S microcontroller board with wired modules on cardboard surface

    same if using the second RX/TX labelled headers on NiceMCU by GND/3V3

    WB3S module with color-coded pin labels for GPIO, UART, I2C, SPI, and power

    Added after 4 [minutes]:

    but using P0/P1 and flag 26 CHECKED = readings

    Screenshot of the OpenBK7238 interface with GPS data and driver status
  • Helpful post
    #354 21777679
    max4elektroda
    Level 24  
    Thanks for reminding me on flag 26 - works here with P0/P1, too!

    User interface of OpenBK7238 system with sensor readings and control buttons
  • ADVERTISEMENT
  • #356 21788276
    p.kaczmarek2
    Moderator Smart Home  
    So many pins, nice. Did they actually route out all of them?
    Helpful post? Buy me a coffee.
  • #358 21832723
    divadiow
    Level 38  
    3.0.78 but different https://dl.bekencorp.com/SDK/bk_7252n/

    BK7251 default target, libs scattered about, RTT, older toolchain, newer/different bootloaders

    Code: Text
    Log in, to see the code


    Added after 58 [minutes]:

    up_boot_rtt_bootloader_34be6bf.rar - RTT bootloader source? but still some precompiled libs in there
  • #359 21834153
    p.kaczmarek2
    Moderator Smart Home  
    Link doesn't work for me, can you attach up_boot_rtt_bootloader_34be6bf?
    Helpful post? Buy me a coffee.
  • #360 21834161
    divadiow
    Level 38  
    p.kaczmarek2 wrote:
    Link doesn't work for me, can you attach up_boot_rtt_bootloader_34be6bf?
    Attachments:
    • up_boot_rtt_bootloader_34be6bf.rar (9.17 MB) You must be logged in to download this attachment.
    • beken_rtt_sdk_release-SDK_3.0.X_Windows_env.tar.gz (277.06 MB) You must be logged in to download this attachment.
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion centers on the NiceMCU XH-WB3S development board featuring the BK7238 SoC, initially suspected to be BK7231T but confirmed as BK7238. Users share experiences with flashing, testing, and porting firmware, including challenges with encryption keys, flash IDs, and bootloader compatibility. The BK7238 uses 2MB flash with varying encryption keys per chip, complicating universal firmware flashing. Tools like BKFIL and Easy Flasher (EF) are used for backup and restore, with EF supporting full flash erase and restore including bootloader. Flash ID support was extended to include missing flash chips to avoid CRC errors. Arduino SDK and Beken FreeRTOS SDK (version 3.0.70.1 and newer 3.0.76) are referenced for development, with partial support for BK7238 and related chips (BK7231N, BK7231U, BK7252). Porting efforts include adapting delay functions for 160MHz BK7238, resolving flashvars alignment issues due to 64-bit time_t, and addressing HTTP server and TCP socket stability problems in LWIP. OTA updates are functional but require correct image types and bootloader versions. Power save modes and their impact on peripherals like BL0937 energy meter and DS18B20 sensors are discussed, with some instability noted under power save. SPI flashing and UART flashing methods are compared, with SPI preferred for some devices. BK7231U (CC8000 chip) support is emerging, with builds available but some undefined references and boot issues. BK7252 camera module support is experimental, with encrypted flash complicating firmware use. Users report issues with DS18B20 sensor timing on BK7238 due to delay_us inaccuracies, partially fixed by new SDK delay implementations. Logging and MQTT load affect system stability and sensor reading consistency. The community shares flash dumps, toolchain links, and SDK forks to aid development and testing. Overall, the thread provides detailed technical insights into BK7238-based NiceMCU boards' flashing, SDK porting, peripheral support, and firmware development challenges and progress.
Today's popular

FAQ

TL;DR: A NiceMCU XH-WB3S board (BK7238, 2 MB flash) can run OpenBeken if you erase the whole SPI and re-flash with a CRC-fixed 7238 image; boards cost ≈ US $1.50 each and need >300 mA during Wi-Fi start-up. “Boot loops usually mean undervoltage” [Elektroda, insmod, post #21562748]

Why it matters: Correct flashing and stable power prevent endless reboots and CRC errors.

Quick Facts

• Chipset: BK7238, ARM Cortex-M33, 160 MHz [Elektroda, divadiow, post #21440151] • On-board flash: 2 MB (ID 0x852015) [Elektroda, divadiow, post #21289375] • Dev-board price: US $1–1.5 on AliExpress [Elektroda, insmod, post #21327474] • Recommended supply: 3.3 V @ ≥350 mA during TX bursts [BK72xx DS] • Default UART: 115 200 bps on P0 (UART2) [Elektroda, divadiow, post #21442320]

Why do I get endless CRC-mismatch errors when flashing?

The GUI flasher lacked the Puya 25Q16HB (ID 0x152085) entry, so the chip stayed write-protected and every sector verify failed. Update to BK7231GUIFlashTool ≥v1.9.21 or add the ID manually, then erase and re-flash [Elektroda, p.kaczmarek2, post #21342531]

Which firmware file should I use for the XH-WB3S board?

Use OpenBK7238_QIO_x.xx.xx.bin (or the .rbl OTA file) because the module really contains a BK7238, not a BK7231 [Elektroda, DeDaMrAz, post #21542280]

The board reboots every few seconds—why?

A reboot loop with only the RT-Thread banner usually means the 3.3 V rail dips below 3.0 V when Wi-Fi starts. Provide a stable ≥350 mA source or add a 470 µF capacitor [Elektroda, insmod, post #21562748]

How do I force the bootloader to accept my image?

Check “Overwrite bootloader” in the GUI, flash the CRC-fixed QIO image, then reset. On BK7238 the bootloader sits at 0x0 and refuses un-CRC’d binaries [Elektroda, divadiow, post #21550671]

What is the “No TLV header found in flash” message?

It comes from the SDK’s RF-calibration code; the first boot notices that the RF OTP/TLV partition is empty, writes defaults, then continues. The notice is harmless [Elektroda, p.kaczmarek2, post #21564311]

Why does my custom MAC vanish after reboot?

BK7238 stores the MAC in the RF-OTP/TLV area. Current OpenBeken writes it to config only; on the 7238 it must be written with manual_cal_write_macaddr_to_flash(). Until patched, the chip reloads the factory MAC on cold boot [Elektroda, p.kaczmarek2, post #21564311]

How can I enter Safe-Config mode if AP never appears?

Press or toggle RESET five times within 5 s; the bootloader starts OBK in SafeConfig, creating AP “OpenBK_xxxxxx” even with invalid Wi-Fi data [Elektroda, divadiow, post #21550706]

Power-meter readings jump by 20 V—bug or feature?

Voltage spikes on BL0937 driver occur when heavy logging or MQTT runs. Disable verbose logs (loglevel 0) or MQTT to stabilise readings [Elektroda, insmod, post #21520958]

Fast-Connect flag—what does it do?

FastConnect 1 skips full scan and uses stored BSSID/PSK. It cuts connect time from ≈3 s to 300 ms and saves ≈80 mA∙s per wake-up [Elektroda, insmod, post #21507260]

I only see garbage on UART—correct pins?

UART2 TX (module P0) outputs OBK logs at 115 200 bps. Connect RX of your adapter to P0, 3.3 V tolerant [Elektroda, divadiow, post #21550104]

Edge case: What if I flashed a BK7231 image to BK7238?

The chip shows only the bootloader banner and reboots; re-flash the correct 7238 QIO binary or full 2 MB dump via SPI [Elektroda, divadiow, post #21342237]

3-step How-To: Recover a soft-bricked XH-WB3S

  1. Erase full 0-0x1FFFFF with BKFIL (SPI needed if UART locked). 2. Flash OpenBK7238_QIO_x.bin at 0x0 with “Overwrite bootloader”. 3. Reset; join AP and finish setup—done.
ADVERTISEMENT