logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

RTL8720DN, RTL8710B, RTL8710BX Compatibility with OpenBeken?

divadiow 31089 392
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #181 21421721
    insmod
    Level 31  
    >>21421647 No, i'm trying to setup j-link programmer to try to dump via it.
    Originally it was a st-link v2 clone, with cks32f103c8t6 chip, with not enough storage for j-link binary.
    After i replaced it with original stm32 chip, it flashed and started working.

    I'm currently trying to dump bw16 with it, but so far without success.

    Added after 8 [minutes]:

    I see you've found uart dump utility, so all my efforts to perform it via jtag were useless... :(
    And i just managed to successfully connect it to another stm32
  • ADVERTISEMENT
  • #182 21421742
    divadiow
    Level 38  
    :(

    yes. I did wonder about that. not looked at it though. Could it be adapted for use in dumping other RTLs maybe?
  • #183 21421759
    insmod
    Level 31  
    >>21421742 I have yet to tune it, when trying to dump from 0x0, it is not flash that is dumped.
    Flash begins at 0x08000000, and when i try to set it up at that value, gdb prints this:
    Code: text Expand Select all Copy to clipboard
    
Using memory regions provided by the target.
There are no memory regions defined.
dump_bw16.txt:5: Error in sourced command file:
Invalid memory address range (start >= end).

    What to adapt it to? all but ameba1 can now be uart dumped, and on ameba1 you can load obk directly to ram and take the backup from there.

    Added after 22 [minutes]:

    backup
    Attachments:
    • wbrg1.bin (8 MB) You must be logged in to download this attachment.
  • #184 21421791
    divadiow
    Level 38  
    insmod wrote:
    all but ameba1 can now be uart dumped

    how do you mean? with this new py script? isn't it setup for RTL872xDx only right now?

    I am trying it on BW16E/ RTL8720DN but getting this currently

    Code: Text
    Log in, to see the code


    there's also https://github.com/pvvx/RTL0B_SDK/blob/master/mkb/rtltool.py

    Added after 52 [seconds]:

    insmod wrote:
    backup

    nice. was this with py?
  • #185 21421808
    insmod
    Level 31  
    >>21421791 Yes, backup was done with py, 1500000 baud.
    amebaz/z2 can be backup'd with ltchiptool, amebad with py,
    rtltool from RTL0B_SDK only for amebaz.
  • #186 21421810
    divadiow
    Level 38  
    insmod wrote:
    amebaz/z2 can be backup'd with ltchiptool

    oh for sure, but it'd be nice to have an OBK/Elektroda option...

    Added after 4 [hours] 18 [minutes]:

    meh. not getting past Error read data head id! with the DN at any baud

    Added after 7 [minutes]:

    interesting. not seen this was being output on PB1

    Code: Text
    Log in, to see the code
  • #187 21422386
    insmod
    Level 31  
    >>21421810 Maybe it errors out because selected length is too big? Unsure about that.
    Your command has 0x800000 size, standard bw16 only has 2mb flash so length should be 0x200000.
  • #188 21422390
    divadiow
    Level 38  
    insmod wrote:
    Your command has 0x800000 size

    yes, indeed, but sadly no change with other sizes.

    not to worry. I'll keep playing

    Added after 21 [minutes]:

    curious on your connections to WBRG1 from USB-TTL - did you have to connect to RTS/CTS too to module?
  • #189 21422397
    insmod
    Level 31  
    >>21422390 Why? RTS/CTS is only for standard (wifi) uart, not log one.
    Log uart, afaik doesn't have hw flow control.
  • ADVERTISEMENT
  • #190 21422404
    divadiow
    Level 38  
    ah OK, nope, just a thought. I thought the script was using to reset chip or something. Probably just shows I don't know the function of RTS/CTS.
  • #191 21423823
    divadiow
    Level 38  
    is this any good?

    For AmebaZ.

    pvvx's rtltool but updated for Python3. Added a simple cmd run menu for most functions
    Menu of the Realtek AmebaZ Bootloader Utility version 0.1.

    I've tested reading, writing, erasing sectors, erasing whole chip. I've written Tuya RTLB fw backup using it and it boots and pairs with Tuya. I've dumped backups after flashing and compared files - identical. I've erased whole flash then dumped flash and file is FF as expected.

    The user gets to customise filenames to flash and dump to and the start and length addresses

    Screenshot of RTL AmebaZ Bootloader Utility showing a menu of operations.Screenshot of RTL AmebaZ Bootloader Utility tool with flash options menu.
    RTL AmebaZ bootloader tool screen with menu options. RTL AmebaZ Bootloader Utility 0.1 menu for flash memory management.

    Comparison of two binary files in a program window with a message about file identity

    https://github.com/divadiow/FlashTools/tree/main/Realtek/AmebaZ_FlashTool
  • ADVERTISEMENT
  • #192 21425061
    p.kaczmarek2
    Moderator Smart Home  
    What a great progress guys, I'm getting out of the loop. Keep it on @insmod @divadiow !

    I've ordered this board now:
    Product page for RTL8720DN development board on AliExpress
    It's not yet supported? Ah, it's DN and not BN...

    Also, I'm working on WBR3/WBR2 video tutorial, to be released soon.
    Helpful post? Buy me a coffee.
  • #193 21425248
    divadiow
    Level 38  
    @insmod do you have an RTL8720DN/BW16(E) and does the rtltool for CSM work on it?

    I'm not sure I fully understand the CSM relationship to DN. The WBRG1.zip has an amebad floader in it, so the CSM is not AmebaZ2? And so RTL8720DN dev board should be expected to work with rtltool?

    but then the dump in the zip is named with a dm - ff_rtl872xdm.bin - typo?

    rtl8720dn in the WBRG1 dump
    Code: Text
    Log in, to see the code


    Added after 8 [hours] 16 [minutes]:

    I've been fiddling.

    if you add printf to def WaitResp you get this as the response from DN

    Code: Text
    Log in, to see the code


    that hex response converts to #Flash D

    Code: Python
    Log in, to see the code


    the original script is expecting 31 (CMD_RWA) (?)

    so with this as the def WaitResp

    Code: Python
    Log in, to see the code


    and then python .\rtltool.py --port COM49 -b 921600 rf 0x0 0x200000 firmware.bin

    starts to do something
    Code: Text
    Log in, to see the code


    and the resultant file looks to be a full dump
    Fragment of a binary file displayed in a hex editor.
    Attachments:
    • rtl8720dn_nicemcu_at_maybe.bin (2 MB) You must be logged in to download this attachment.
  • #194 21425403
    insmod
    Level 31  
    >>21425248
    I got a backup from bw16 without problems
    Code: text Expand Select all Copy to clipboard
    python rtltool.py -p COM7 -b1500000 rf 0x0 0x400000 bw16_rtltool.bin
Connecting...
Set baudrate 1500000
Write SRAM at 0x00082000 to 0x00083250 from file: imgtool_flashloader_amebad.bin
Set baudrate 1500000
Read Flash data from 0x00000000 to 0x00400000 in file: bw16_rtltool.bin
Read block at 0x000000...ok
Read block at 0x010000...ok
Read block at 0x020000...ok
Read block at 0x030000...ok
Read block at 0x040000...ok
Read block at 0x050000...ok
Read block at 0x060000...ok
Read block at 0x070000...ok
Read block at 0x080000...ok
Read block at 0x090000...ok
Read block at 0x0a0000...ok
Read block at 0x0b0000...ok
Read block at 0x0c0000...ok
Read block at 0x0d0000...ok
Read block at 0x0e0000...ok
Read block at 0x0f0000...ok
Read block at 0x100000...ok
Read block at 0x110000...ok
Read block at 0x120000...ok
Read block at 0x130000...ok
Read block at 0x140000...ok
Read block at 0x150000...ok
Read block at 0x160000...ok
Read block at 0x170000...ok
Read block at 0x180000...ok
Read block at 0x190000...ok
Read block at 0x1a0000...ok
Read block at 0x1b0000...ok
Read block at 0x1c0000...ok
Read block at 0x1d0000...ok
Read block at 0x1e0000...ok
Read block at 0x1f0000...ok
Read block at 0x200000...ok
Read block at 0x210000...ok
Read block at 0x220000...ok
Read block at 0x230000...ok
Read block at 0x240000...ok
Read block at 0x250000...ok
Read block at 0x260000...ok
Read block at 0x270000...ok
Read block at 0x280000...ok
Read block at 0x290000...ok
Read block at 0x2a0000...ok
Read block at 0x2b0000...ok
Read block at 0x2c0000...ok
Read block at 0x2d0000...ok
Read block at 0x2e0000...ok
Read block at 0x2f0000...ok
Read block at 0x300000...ok
Read block at 0x310000...ok
Read block at 0x320000...ok
Read block at 0x330000...ok
Read block at 0x340000...ok
Read block at 0x350000...ok
Read block at 0x360000...ok
Read block at 0x370000...ok
Read block at 0x380000...ok
Read block at 0x390000...ok
Read block at 0x3a0000...ok
Read block at 0x3b0000...ok
Read block at 0x3c0000...ok
Read block at 0x3d0000...ok
Read block at 0x3e0000...ok
Read block at 0x3f0000...ok
Set baudrate 115200
Done!
  • #195 21425404
    divadiow
    Level 38  
    whaat. hmm OK.

    would you mind adding the printf bit? what response does your BW16 give?
  • #196 21425420
    insmod
    Level 31  
    >>21425404
    With your WaitResp mod it fails
    Code: text Expand Select all Copy to clipboard
    python rtltool_printf.py -p COM7 -b1500000 rf 0x0 0x400000 bw16_rtltool.bin
Connecting...
Set baudrate 1500000
Received: 15 (b'\x15')
Error Set Baud!

    With just printf added:
    Code: text Expand Select all Copy to clipboard
    python rtltool_printf.py -p COM7 -b1500000 rf 0x0 0x400000 bw16_rtltool.bin
Connecting...
Set baudrate 1500000
Received: 06
Received: 31
Write SRAM at 0x00082000 to 0x00083250 from file: imgtool_flashloader_amebad.bin
Received: 06
Received: 06
Received: 06
Received: 06
Received: 06
Received: 06
Received: 06
Set baudrate 1500000
Received: 06
Read Flash data from 0x00000000 to 0x00400000 in file: bw16_rtltool.bin
Read block at 0x000000...Received: 02
  • #197 21425443
    divadiow
    Level 38  
    <sigh> ok thanks.

    Maybe the BW16E, which is what I have, is more different than just the IPEX connector. I dunno.

    Added after 30 [minutes]:

    oh. it's not just "#Flash D"
    change to 100 rest = self._port.read(100) in def WaitResp

    and the response is

    Code: Text
    Log in, to see the code


    so I am getting 06. but with stuff before
  • #198 21430142
    @GUTEK@
    Level 31  
    Thanks a lot for adding the RTL8710B.
    I have uploaded to T102_V1.1, looks like it is working ok.
  • #199 21432548
    erdeidominik1999
    Level 8  
    Hello!
    I have an rtl8710BX chip, I tried to flash it with ltchiptool, but it does not boot, can you help me how to flash it?
  • #200 21432608
    divadiow
    Level 38  
    >>21432548

    give this tool a go: https://github.com/openshwprojects/FlashTools...tek/Ameba_MP_ImageTool_1_N_v2.5.27_AmebaZ.zip

    ref: https://www.elektroda.com/rtvforum/topic4093142-60.html#21361242

    flash the UART file to 0x0800B000 address first. You may have to flash back factory backup from 0x8000000 then the above if ltchiptool has written to some random place.

    I think this is the case, I can't check right now.

    also see this: https://www.elektroda.com/rtvforum/topic4093142-90.html#21377607
  • #201 21432622
    insmod
    Level 31  
    There should also be a OpenRTL8710B_boot.bin file, to flash it at 0x08000000 , but it seems that workflows are not picking it up. This file should include partitions, so if a device has partitions that are different from OBK bin ones (or tuya ones), then it should either not work, or fail at/after ota.
    Attachments:
    • OpenRTL8710B_boot.bin (4.56 KB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #202 21432631
    erdeidominik1999
    Level 8  
    Thank you, I will test it tomorrow.
  • Helpful post
    #203 21433931
    divadiow
    Level 38  
    thanks for device firmware backup @erdeidominik1999. I thought I'd switch to the public thread so there's record of what may need doing to get this working in some cases.

    Here are my steps to get it to OpenRTL:

    flashed your full backup to 0x08000000 (my test device - so I can simulate your situation)
    Screenshot of Ameba 1-N MP ImageTool v2.5.27 software showing device flashing configuration settings.
    Flash OpenRTL release to 0x0800B000
    Screenshot of Ameba 1-N MP ImageTool v2.5.27 with flash configuration.
    Erased 4k at 0x080D0000
    Screenshot of the Ameba Image Tool V2.7.18 showing flash options.

    then OBK boots and AP broadcasts. The second tool is not yet in the FlashTools repo, but is here now: https://github.com/divadiow/FlashTools/blob/main/Realtek/RTL_ImageTool_Legacy_v2.7.18.zip

    choose this profile file on initial run

    Screenshot of Ameba Image Tool V2.7.18 with a device profiles folder open.
  • #204 21437813
    p.kaczmarek2
    Moderator Smart Home  
    I've gotten BW16 NiceMCU RTL8720DN module and I see it was already discussed here, what's the current state of that? How can I read it's 2MB original flash?
    Helpful post? Buy me a coffee.
  • #205 21437823
    divadiow
    Level 38  
    it's be good to know what your experience with the attached is.
    Attachments:
    • rtltool_RTL872xDx.zip (8.57 KB) You must be logged in to download this attachment.
  • #207 21437842
    p.kaczmarek2
    Moderator Smart Home  
    I only get this:
    Code: text Expand Select all Copy to clipboard
    


python rtltool.py -p COM15 -b 1500000 rf 0 0x800000 ff.bin
Connecting...
Set baudrate 1500000
Error Set Baud!

python rtltool.py -p COM15 -b 115200 rf 0 0x800000 ff.bin
Connecting...
Error read data head id!
Error Read!


    Added after 3 [minutes]:

    I added more delay here:
    Code: Python
    Log in, to see the code

    I get now:

    Screenshot showing the results of the python rtltool.py command successfully reading data from flash memory.
    Helpful post? Buy me a coffee.
  • #208 21437847
    divadiow
    Level 38  
    that explains why I was getting characters in response (as seen in previous posts) before the expected response needed to continue read

    Added after 40 [seconds]:

    so we just need flasher/reader script for Z2 now
  • #209 21437865
    p.kaczmarek2
    Moderator Smart Home  
    Flash dump (probably the same as yours)
    https://github.com/openshwprojects/FlashDumps/commit/ca83dc95fdd8177c0f02065f2973c8e2a5dbcf14
    Helpful post? Buy me a coffee.
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion centers on the compatibility and support of Realtek RTL8720DN, RTL8710B, and RTL8710BX chips with the OpenBeken firmware and SDK. The RTL8720CF-based modules (e.g., BW15, WBR3) are confirmed to be supported by the AmebaZ2 family SDK and OpenBeken ports, with functional WiFi, GPIO, flash configuration, OTA, UART, and basic peripherals. However, RTL8710BX and RTL8710B (AmebaZ family) present challenges such as WiFi initialization freezes, memory management issues, and incomplete SDK support, including lack of static IP and WiFi scanning. OTA updates are functional but have occasional reboot issues, especially on RTL8710B. PWM support is mostly stable after fixes, while MQTT required patching due to missing authorization code in the Realtek LWIP stack. Power-saving modes and sensor drivers (DHT11, DS18B20) have been tested with varying success across platforms. Flashing RTL modules requires specific UART converters (e.g., CH340G) and careful wiring; some modules need manual pin pulls and special flashing tools like AmebaZ2 PGTool. TuyaMCU and energy metering ICs (BL0937, BL0942) support is under active development and testing, with UART and GPIO interrupt methods used. Memory partitioning for configuration, LittleFS, and Tuya config extraction is being optimized to avoid overwriting user data. Static IP implementation required workarounds due to sscanf inconsistencies on RTL and related platforms. A UART-to-TCP bridge driver has been developed for some modules. Overall, RTL8720CF modules have good OpenBeken support, RTL8710B is progressing but unstable, and RTL8710BX remains problematic. The community is actively testing, fixing, and improving support for these Realtek chips within OpenBeken and related tools.
Generated by the language model.
Today's popular
ADVERTISEMENT