logo elektroda
logo elektroda
X
logo elektroda

[Youtube] LN882H module pinout and setup for flashing - step by step video guide

p.kaczmarek2 13596 207

TL;DR

  • A step-by-step video shows how to flash the LN882HKI/LN882H module and set it up for cloud-free OpenBeken use.
  • The process uses soldered wires, grounds one BOOT pin, and then flashes new firmware over UART, much like ESP8266 recovery.
  • As of 2026, read/write support also works with BK7231GUIFlashTool, replacing the legacy flashing tool for the same wiring setup.
  • After flashing, the firmware can pair with Home Assistant and later enable features such as DHT11 support, SSDP discovery, and Tasmota Control via OBK scripting.
Generated by the language model.
ADVERTISEMENT
📢 Listen (AI):
  • #121 21607742
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    Another combination, where i reduced reading size to 16 bytes (+2 bytes crc), and increased baud rate to 1500000
    Tried once and it worked, it was very fast.
    Attachments:
    • Debug.zip (15.57 KB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #122 21607746
    divadiow
    Level 38  
    Posts: 4835
    Help: 420
    Rate: 851
    divadiow wrote:
    I'll do 10

    Success 7
    Fail 3

    Added after 2 [minutes]:

    insmod wrote:
    it was very fast

    18s. nice
  • #123 21607755
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14390
    Help: 650
    Rate: 12313
    Very nice, can you open PR to flasher or do you want me to integrate it?
    Helpful post? Buy me a coffee.
  • #124 21607766
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    >>21607755
    Up to you, since i've commented out everything but dumping.
    I can create several other baud/buffer combinations though. The one i posted earlier, with 1500000baud/16buf, i got crc error 4 out of 5 times.
    The lower the baud, the more chance for success there is.
    Now i've had a successful reading with 115200/512.
    With higher baud rates, it is probably failing at flushing TX buffer.
  • ADVERTISEMENT
  • #125 21607781
    divadiow
    Level 38  
    Posts: 4835
    Help: 420
    Rate: 851
    divadiow wrote:
    will do proper dump then convert from hex

    I'll wait to see what v17 is?
  • #126 21607791
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    Ramcode compilation, from 115200 to 921600, with buffer size from 32 to 512 (and 16 with 921600).
    I'm too lazy to test them.
    Attachments:
    • Debug.zip (137.61 KB) You must be logged in to download this attachment.
  • #127 21607804
    divadiow
    Level 38  
    Posts: 4835
    Help: 420
    Rate: 851
    oh god 😭. I don't think I have the energy to do 10 rounds on each of those.
    Just give the user all the options in IoTFlasher? 😁🤣
  • #128 21607806
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14390
    Help: 650
    Rate: 12313
    But we can do it automatically. As long as we have flashing tool with RTS/DTS and connect RESET to it, I guess. LN882H requires reboot between flash attempts, it seems.
    Helpful post? Buy me a coffee.
  • #129 21607883
    divadiow
    Level 38  
    Posts: 4835
    Help: 420
    Rate: 851
    I know we've mostly seen this but I thought I'd listen in to what official flasher sends (and module replies with) for erase and then program

    erase send to module
    Code: Text
    Log in, to see the code

    erase receive from module
    Code: Text
    Log in, to see the code


    program send to module
    Code: Text
    Log in, to see the code

    program receive from module
    Code: Text
    Log in, to see the code
  • #130 21607908
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14390
    Help: 650
    Rate: 12313
    I am trying to help that guy with AC : https://www.elektroda.com/rtvforum/topic4130109.html#21607906 , so @insmod, if you can, just open PR to Sharp LN882H flasher, replace flash read code, maybe rename old function so it's left as reference
    Helpful post? Buy me a coffee.
  • #131 21608190
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    It's still in progress.
    But, i've changed UART from TX interrupt to polling, and now i've done 5 for 5 successful readings with 1500000 baud.
    2000000 baud attached. Succeeds for me in 12.5sec
    Is there a function to reboot to bootloader? (Never mind, hal_misc_reset_all does the trick)

    And did anyone tried to flash a backup back?
    Attachments:
    • Debug.zip (15.62 KB) You must be logged in to download this attachment.
  • #132 21608214
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14390
    Help: 650
    Rate: 12313
    I am not sure if I tested that, but here is a run of your binary:
    [Youtube] LN882H module pinout and setup for flashing - step by step video guide
    [Youtube] LN882H module pinout and setup for flashing - step by step video guide
    but binary looks correct in the end
    Helpful post? Buy me a coffee.
  • #133 21608220
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    >>21608214
    If CRF FAIL - then it is for sure incorrect. And even final binary size is 2047kb, not 2048.
  • #135 21608233
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    Strange, it works fine for me.
    Version with 921600 baud and integrated ramcode
    Attachments:
    • SharpLN882HTool.exe (29 KB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #137 21608238
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14390
    Help: 650
    Rate: 12313
    [Youtube] LN882H module pinout and setup for flashing - step by step video guide
    Helpful post? Buy me a coffee.
  • #138 21608239
    divadiow
    Level 38  
    Posts: 4835
    Help: 420
    Rate: 851
    >>21608233

    Code: Text
    Log in, to see the code



    [Youtube] LN882H module pinout and setup for flashing - step by step video guide
  • #140 21608274
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14390
    Help: 650
    Rate: 12313
    merged, I will test it few times and probably later begin merge with Easy Flasher
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #141 21608281
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    You can later play with ramcode yourself.
    Since final binary is about 10kb, there is no need to buy keil license (free maximum binary size is 32kb)
    Main code:
    int main(int argc, char* argv[])
    {
    		SetSysClock();
    		set_interrupt_priority();
    		__enable_irq();
    
    		hal_flash_init();
    		flash_cache_disable();
    
    		//bootram_ctrl_init();
    		//bootram_ctrl_loop();
    	
    		bootram_serial_init();
    		bootram_serial_setbaudrate(921600);
    		uint32_t		flash_size				 = 0;
    		uint32_t		startAddr				 = 0;
    		uint32_t		readLen				 = 512;
    		uint8_t buf[readLen+2];
    		uint32_t ret = bootram_flash_info();
    
    		flash_size = ((1 << ((ret & 0xFF) - 0x11)) / 8) * 0x100000;
    		bootram_serial_write(&flash_size, sizeof(flash_size));
    		for(int k = 0; k < 0x10000; k++)
    		{
    			__ASM("nop");
    		}
    		for(uint32_t remaining =	flash_size; remaining > 0; remaining -= readLen){
    			hal_flash_read(startAddr, readLen, buf);
    			uint16_t crc = crc16_ccitt(buf, readLen);
    			memcpy(&buf[readLen], &crc, sizeof(crc));
    			startAddr += readLen;
    			size_t sent = 0;
    			bootram_serial_write(buf, readLen + 2);
    			memset(buf, 0, readLen + 2);
    		}
    		for(int k = 0; k < 0x10000; k++)
    		{
    			__ASM("nop");
    		}
    		hal_misc_reset_all();
    		while (1)
    			__ASM("nop");
    }

    Most importantly, comment out this line https://github.com/openshwprojects/OpenLN882H...oject/bootcode/ramcode_dl/bsp/serial_hw.c#L72
    Replace #if 0 with #if 1 here https://github.com/openshwprojects/OpenLN882H...oject/bootcode/ramcode_dl/bsp/serial_hw.c#L93
    And replace https://github.com/openshwprojects/OpenLN882H...ject/bootcode/ramcode_dl/bsp/serial_hw.c#L161
    with
    .txStart     = hw_uart_tx_start_polling,


    Added after 36 [minutes]:

    On another note, newer sdk
    https://gitee.com/lightningsemi/ln882h
  • #142 21608348
    divadiow
    Level 38  
    Posts: 4835
    Help: 420
    Rate: 851
    insmod wrote:
    On another note, newer sdk
    https://gitee.com/lightningsemi/ln882h

    pop it on the list ;)

    insmod wrote:
    Additional challenge for me - to port without modifying anything in SDK, like i've done ESP-IDF.
  • #143 21608687
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14390
    Help: 650
    Rate: 12313
    How do you build it in keil? I think I did some basic stuff in uVision, but I don't even know the basics well (my related topic about APM32F003F6 - Mini Board i Geehy Programmer)

    Added after 53 [seconds]:

    Also, can you PR latest ramcode to SDK?
    Helpful post? Buy me a coffee.
  • #144 21608690
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    [postid:0dd1c57eee][/postid:0dd1c57eee]
    I already did a git reset.
    I've never before used keil, but it was rather straightforward.
    Just open uvprojx and build

    Added after 47 [minutes]:

    I see easyflash header (EF40 and KV40) in dump at 0x1E4000, even if there is no easyflash in sdk.
    Will we adopt it later? Assuming that EF get adopted by flasher.
    And its not hard to implement backwards compatibility (just keep writing at an offset, at least for several major releases).
  • #145 21609056
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14390
    Help: 650
    Rate: 12313
    Nice trick with single blob for multiple bauds:
    Code: C / C++
    Log in, to see the code

    I cleared up code a bit, @divadiow can you soon check if it's release-ready? Then I will merge it with main flasher.

    @insmod so it must be Tuya's or of manufacturer? Well, it's better to preserve all data, in case we can extract GPIO configs later.
    Helpful post? Buy me a coffee.
  • #146 21609063
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    >>21609056
    My module is LN-02 from some cozylife switch.
    But, there is nothing important stored there from what i can see
  • #147 21609065
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14390
    Help: 650
    Rate: 12313
    Btw, any potential suggestions for next flashing tool that is relatively easy to port so that I can do it within few days at most?
    Helpful post? Buy me a coffee.
  • #148 21609074
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    >>21609065
    AmebaZ? It basically uses the same protocol as AmebaD.

    The most important is AmebaZ2, but its protocol is somewhat different - even requires separate flash tool, while even AmebaZ is supported by latest flash tools.
  • #149 21609078
    divadiow
    Level 38  
    Posts: 4835
    Help: 420
    Rate: 851
    p.kaczmarek2 wrote:
    can you soon check if it's release-ready?

    will try asap.

    insmod wrote:
    AmebaZ? It basically uses the same protocol as AmebaD.

    agreed. a logical next choice
  • #150 21609082
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14390
    Help: 650
    Rate: 12313
    I've had to add few fixes, for example, it seems that either myself or @insmod changed flash size to read to baud :D so I had to update batch scripts

    We still probably need a "read at offset", either fake it with current quick reader, or just use old slow read code
    Helpful post? Buy me a coffee.
📢 Listen (AI):

Topic summary

✨ The discussion centers on flashing the LN882H (specifically LN882HKI) module using open-source tools and firmware such as OpenBeken and OpenBK7231T_App, with detailed guides and video tutorials available. Flashing involves grounding the BOOT pin and using UART communication, which employs ASCII commands and the YMODEM protocol for data transfer. Several tools have been developed and shared, including LN882Loader (Linux-based) and Windows GUI wrappers, with ongoing improvements to support faster flash reading and dumping via commands like "fdump." Users report challenges with UART adapters, power supply stability, and correct COM port usage, highlighting the importance of proper hardware setup (e.g., CH340G vs. FTDI232 UART adapters). SSDP support and Home Assistant integration are discussed, with SSDP requiring IGMP flag enabling and driver activation in firmware. GPIO pin behavior and limitations are examined, noting that certain pins (A13 to B2) are reserved for QSPI flash and should not be used as GPIO outputs. Firmware versions and SDK updates are tracked, with reverse engineering efforts revealing internal flash structures and configuration data. WiFi stability issues on LN882H modules are reported, potentially linked to power supply quality or environmental factors, distinct from BK7231N platform behavior. Pinout details for LN882HK1 modules are clarified, identifying UART TX and RX pins and the BOOT pin for flashing mode entry. Overall, the community collaborates on improving flashing tools, firmware features, and hardware understanding to enable cloud-free operation and integration with smart home systems.
Generated by the language model.

FAQ

TL;DR: Backing up 2MB from LN882H went from about 14 minutes to 12.5–24.8 seconds, and one tester confirmed, "SmartLife AP seen and pairs in Tuya app." This FAQ is for people flashing LN882H/LN882HKI modules with OpenBeken, restoring Tuya backups, and fixing UART, Wi‑Fi, GPIO, and SSDP issues. [#21609499]

Why it matters: LN882H devices often look simple to flash, but real success depends on correct boot wiring, stable 3.3V power, the right RAM loader, and avoiding reserved GPIOs.

Tool Best use OS Read/backup speed reported Notes
SharpLN882HTool Flash, erase, backup, restore Windows 24.77s at 921600; 47.52s at 460800 Later builds restored full Tuya dumps successfully
LN882Loader Linux flashing and backup Linux Earlier full 2MB dumps around 10–14 min Reverse-engineered, YMODEM-based
Tuya flasher / tyutool_cli Vendor flashing Windows / Linux extraction Read not supported in tyutool_cli One user saw: "Don't support read."

Key insight: The biggest breakthrough was not the firmware itself but the RAMCODE path: once the custom dumper switched to raw binary reads with CRC and stable UART polling, LN882H backup and restore became fast enough to be practical for everyday recovery and migration. [#21608266]

Quick Facts

  • Full-flash backup size is 2MB, and one successful custom dumper run finished in 12.5 seconds at 921600 baud after RAMCODE improvements. [#21608190]
  • Earlier dump methods were much slower: 2MB in ~14 min 20 s with LN882H_RAM_BIN.bin, and about 9 min 50 s after changing baud and stub choices. [#21605883]
  • A validated speed comparison for SharpLN882HTool v22 showed 184.05 s at 115200, 47.52 s at 460800, and 24.77 s at 921600, with identical SHA-256 hashes across those dumps. [#21609499]
  • Safe UART access points identified on a bare LN882HK1-on-PCB board were A2 = TX0, A3 = RX0, A9 = pull low for UART download mode, and B9 = TX1 boot log, often at 921600 baud. [#21593199]
  • One reproducible GPIO failure on LN882H was P13 crashing on “Set Output High” in firmware 1.18.42, later linked to flash/QSPI-reserved pins that should not be driven as normal outputs. [#21446468]

1. How do I flash an LN882H or LN882HKI module with OpenBeken step by step using UART and the BOOT pin?

You flash LN882H over UART by grounding one BOOT pin, powering the board at 3.3V, and sending a RAM loader before the firmware. 1. Solder GND, 3.3V, TX, RX, and the BOOT pin. 2. Hold BOOT low, power up, then connect with a flasher tool. 3. Upload the RAM loader, then write OpenBeken to flash at 0x0. The original guide says LN882H flashing is “very similiar to ESP8266,” with BOOT grounded to enter flashing mode. [#21372895]

2. Where are TX, RX, and boot-mode pins on an LN882HK1 chip mounted directly on the PCB, and how do I identify them safely?

On one directly mounted LN882HK1 board, the reported pins were A2 for TX0, A3 for RX0, A9 for boot-mode entry, and B9 for TX1 boot logs. Safest identification uses labeled pads, board photos, and UART observation before soldering to tiny chip legs. 1. Find GND, 3.3V, and EN first. 2. Check nearby pads against known LN882H pin maps. 3. Confirm with a logic analyzer or boot log on B9 before forcing boot mode. [#21593199]

3. Why does LN882H flashing fail with a USB-to-UART adapter even when it has a 3.3V output, and how can I troubleshoot power and COM port issues?

LN882H flashing often fails because the adapter is not actually transmitting, the COM port is wrong or busy, or the 3.3V rail is unstable under load. One user fixed repeated failures by replacing a faulty FTDI232 adapter with a CH340G unit; another was told to verify COM6 and check for port-hogging software like Cura. A separate report also found that an AMS1117-based 3.3V source improved flashing stability. [#21443865]

4. What is YMODEM, and how is it used by LN882H flashing tools and RAM loaders?

“YMODEM” is a serial file-transfer protocol that sends block-based data with acknowledgements and CRC checks, enabling reliable firmware or RAM loader transfer over UART. LN882H tools use YMODEM to upload the temporary RAM loader first, then often use it again to write the actual firmware image. Reverse-engineering in the thread identified YMODEM as the protocol behind the loader flow, and later tool logs showed ACK, EOT, CRC, and packet counters exactly matching that process. [#21376683]

5. What is SSDP discovery, and why did Alexa or Wemo emulation not work on LN882H until SSDP support was enabled?

Alexa and Wemo emulation did not work because LN882H lacked SSDP support in earlier builds. “SSDP discovery” is a local-network service discovery protocol that advertises devices over multicast, letting controllers like Alexa find compatible endpoints automatically. In the thread, Wemo emulation showed up in setup.xml, but Alexa still could not discover it until SSDP and the related networking support were enabled on LN882H. A later post said SSDP had been enabled the previous week. [#21430384]

6. LN882Loader vs SharpLN882HTool vs Tuya's LN882H flasher — which tool is best for flashing, backup, and restore on Windows or Linux?

SharpLN882HTool became the best all-around choice for Windows once fast dump, erase, and restore worked; LN882Loader stayed strong for Linux; Tuya’s tools were useful for reference but weaker for backup. A tester confirmed SharpLN882HTool erased flash, wrote OpenLN882H, restored a full Tuya dump, and then saw the “SmartLife AP” pair in the Tuya app. Another user also reported tyutool_cli could communicate with the chip but ended with “Don't support read.” [#21609499]

7. Why is dumping LN882H flash so slow with flash_read or fdump, and how did the custom RAMCODE speed it up?

The old dump path was slow because it read tiny chunks as ASCII hex over UART instead of sending raw bytes. One developer explained that flash_otp_read 0x0 0x100 returned text like AE BE 4F 2D 5A, meaning roughly 3 characters per stored byte. The custom RAMCODE changed the method to raw binary blocks plus CRC, which removed the ASCII overhead and made full 2MB reads practical in seconds instead of minutes. [#21607145]

8. How can I back up the full 2MB flash from an LN882H module and restore that backup later without losing Tuya or OpenBeken data?

You can back up the full 2MB flash, erase the chip, and later restore that exact image to recover Tuya or OpenBeken. 1. Use a tool that reads the full 0x200000 flash range to a file. 2. Save that dump before experimenting. 3. If needed, erase flash and write the saved file back at 0x0. A tester erased an LN882H, reflashed a Tuya dump with SharpLN882HTool, and confirmed the SmartLife AP appeared and paired in the Tuya app. [#21609499]

9. Which LN882H GPIOs are unsafe to drive as outputs, and why do some pins cause WDT resets or crashes in GPIO Doctor?

Some LN882H pins mapped to the internal flash/QSPI area are unsafe as normal outputs and can trigger crashes or WDT resets. One contributor stated that pins from A13 to B2 should not be used because they are reserved for QSPI, likely internal flash. Real testing also showed repeatable crashes, including P13 on “Set Output High” in version 1.18.42, and later fixes focused on disabling those dangerous pins in HAL. [#21446533]

10. How do I use GPIO Doctor or manual testing to find the relay, button, LED, and PWM pins on an unknown LN882H device?

Use GPIO Doctor carefully, starting with inputs and low-risk checks, then test outputs one at a time while watching for crashes. 1. Back up flash first. 2. Probe candidate pins as digital input or input-pullup before driving outputs. 3. Map relay, LED, button, and PWM by changing one pin at a time and noting physical responses. This matters on LN882H because some pins can crash the device, yet the same method still helped users identify working relay and PWM pins on unknown boards. [#21446543]

11. What Wi-Fi settings are actually available in OpenBeken for LN882H besides Power Save, and what else can cause random disconnects on one network but not another?

Beyond Power Save, the thread only names Quick Connect as another practical LN882H Wi‑Fi option in OpenBeken. A developer added that Wi‑Fi behavior mainly comes from the LN882H SDK, not shared OBK code, so stability can change by platform. In the reported disconnect case, likely causes included local RF noise, supply quality, MQTT load, and possibly flash state or calibration, especially because the same device stayed stable for 3 days on a different network. [#21579867]

12. Why did WPA3 or WPA2/WPA3 connections fail on older LN882H SDK builds, and what changed in the newer Wi-Fi library versions?

Older LN882H builds failed on WPA3 because the Wi‑Fi library rejected association, including repeated reason code 43 errors. That changed after the SDK moved to newer Wi‑Fi libraries, including WiFi Lib 1.5.0, where one tester successfully joined a WPA‑SAE (CCMP) access point and verified fast reconnection after the AP returned. The same tester also said WPA2-only and mixed WPA2/WPA3 then behaved correctly. [#21615134]

13. How does the faster custom LN882H RAM dumper work, including baud rate, CRC checks, and polling vs interrupt-based UART TX?

The faster dumper uploads a custom RAMCODE, reads flash in fixed binary blocks, appends a 2-byte CRC16 to each block, and transmits over a high UART baud rate. One implementation used 512-byte flash blocks plus CRC and achieved stable dumps at 921600 baud after switching UART TX from interrupt mode to polling mode. The author said polling was not faster by itself, but it was more stable and fixed CRC failures seen at higher baud rates. [#21610067]

14. What does LN882H RAMCODE do during flashing, and how is it different from the normal bootloader or secondary boot stage?

RAMCODE is a temporary program sent over UART into RAM so the chip can erase, write, dump, and inspect flash using richer commands than the ROM alone provides. “RAMCODE” is a RAM-resident helper program that runs after UART boot, adds flash commands, and then hands control back or resets after the task finishes. The SDK description in the thread distinguishes it from the normal bootload stage, which is the secondary boot path from flash to app during standard startup. [#21605903]

15. How can I build a custom OpenBeken OTA firmware for LN882H with extra drivers like SHT3X enabled, either locally or through GitHub Actions?

You can build it locally or through GitHub Actions by enabling the driver macro for LN882H. The thread’s build steps say to add #define ENABLE_DRIVER_SHT3X 1 under #elif PLATFORM_LN882H in src/obk_config.h, then run make OpenLN882H locally. If you do not have the toolchain, fork the repository, enable Actions on the fork, commit the config change, and download the finished firmware artifact from the workflow summary. [#21709798]
Generated by the language model.
ADVERTISEMENT