logo elektroda
logo elektroda
X
logo elektroda

[Youtube] LN882H module pinout and setup for flashing - step by step video guide

p.kaczmarek2 5295 172
ADVERTISEMENT
📢 Listen (AI):
  • #91 21607001
    p.kaczmarek2
    Moderator Smart Home
    Strange, looks like it gets stuck in flash_program, but maybe I need to give it bigger timeout. Hm, I used 200ms and original code has 1s
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #92 21607008
    divadiow
    Level 34  
    v13
    Code: Text
    Log in, to see the code


    Code: Text
    Log in, to see the code


    Code: Text
    Log in, to see the code


    Added after 8 [hours] 40 [minutes]:

    v14
    Code: Text
    Log in, to see the code


    Code: Text
    Log in, to see the code


    Code: Text
    Log in, to see the code
  • #93 21607129
    p.kaczmarek2
    Moderator Smart Home
    I've found my dev board.
    https://www.elektroda.com/news/news4062695.html
    It breaks after first flash read send, it timeouts, but only when it comes to sending reply, not when sending...
    [Youtube] LN882H module pinout and setup for flashing - step by step video guide
    Hmmm... could it be that internal UART buffer is too small? no... or wait... there are bytes to read?
    [Youtube] LN882H module pinout and setup for flashing - step by step video guide
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #94 21607132
    divadiow
    Level 34  
    hmm. are these 5s delays really necessary too? LN882Loader had them originally at 10s but then the author changed it down. 5s for baud change ack??

    ALSO. Not that this helps probably because it should work with the same ramcode file, but if you change to the 17k LN882H_HIGH_SPEED_BIN.bin one
    [Youtube] LN882H module pinout and setup for flashing - step by step video guide

    it does flash and OBK booted
    Code: Text
    Log in, to see the code


    Added after 1 [minutes]:

    dump no change with diff ramcode
  • #95 21607138
    p.kaczmarek2
    Moderator Smart Home
    I added custom read function on c# side and it goes futher
    [Youtube] LN882H module pinout and setup for flashing - step by step video guide

    Added after 8 [minutes]:

    very interesting findings @divadiow , I wasn't aware about that. I'm not sure about the delays, maybe it could retry communication quicker and just allow for it to fail silently.

    By the way, it currently reads flash in 0x100 chunks, futhermore, the read is done via text - ASCII. So two chars per byte. So already twice as slow as it could be.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #96 21607141
    divadiow
    Level 34  
    p.kaczmarek2 wrote:
    By the way, it currently reads flash in 0x100 chunks, futhermore, the read is done via text - ASCII. So two chars per byte. So already twice as slow as it could be.

    oh this is interesting. explains why dump has been so slow. 10 minutes for 2mb is currently the quickest I've ever seen for LN882H

    Added after 1 [minutes]:

    dumping now with v15. damn, not timing it. start again
    [Youtube] LN882H module pinout and setup for flashing - step by step video guide
  • #97 21607145
    p.kaczmarek2
    Moderator Smart Home
    It literally sends this string via uart:
    
    flash_otp_read 0x0 0x100\r\n
    

    for each offset, step 0x100 bytes, and reads reply in format:
    
    AE BE 4F 2D 5A
    

    etc etc, with spaces, so 3 chars per single byte.
    Helpful post? Buy me a coffee.
  • #98 21607149
    divadiow
    Level 34  
    is that changeable or a limitation that cannot be overcome?
  • #99 21607157
    p.kaczmarek2
    Moderator Smart Home
    Well if you find/have (maybe you do, you posted something like that) source code of the used ramcode and change it to send bytes directly and recompile it, then we can change flasher on our side as well
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #101 21607175
    p.kaczmarek2
    Moderator Smart Home
    cmd_mode.c from your attachment has some commands used in flasher but not all of them?
    Code: C / C++
    Log in, to see the code
    Helpful post? Buy me a coffee.
  • #102 21607218
    divadiow
    Level 34  
    p.kaczmarek2 wrote:
    cmd_mode.c from your attachment has some commands used in flasher but not all of them?

    oh. 🤷🏼‍♂

    it's taken from v0.0.3 which seems to be the latest Tuya zip that has that in. File dates are Jan 2023.

    [Youtube] LN882H module pinout and setup for flashing - step by step video guide
  • #103 21607240
    p.kaczmarek2
    Moderator Smart Home
    Maybe it's in other file, search for flash_otp_read and flash_read
    Helpful post? Buy me a coffee.
  • #105 21607245
    divadiow
    Level 34  
    >>21607240

    plenty for "flash_read"
    [Youtube] LN882H module pinout and setup for flashing - step by step video guide

    fdump
    [Youtube] LN882H module pinout and setup for flashing - step by step video guide

    nothing for flash_otp_read
  • #106 21607256
    p.kaczmarek2
    Moderator Smart Home
    https://github.com/search?q=flash_otp_read+ln882h&type=code
    https://github.com/search?q=flash_otp_read&type=code
    The function flash_otp_read exists in the RAM binary as ASCII string as well, or, should I say, it's obviously an ASCII string because it's send over UART as ASCII, so if your package does not have flash_otp_read, then it's most likely not the correct source code of the LN882H_RAM_BIN.bin we have...
    [Youtube] LN882H module pinout and setup for flashing - step by step video guide
    Btw this bin comes with help text:
    [Youtube] LN882H module pinout and setup for flashing - step by step video guide
    I probably could add a "terminal" mode to Sharp LN882H flasher where you can type any command to play around with it
    Helpful post? Buy me a coffee.
  • #107 21607278
    divadiow
    Level 34  
    nice

    just doing a big search. anything catch your eye? as before, nothing in all Tuya LN zips for flash_otp_read

    [Youtube] LN882H module pinout and setup for flashing - step by step video guide
  • #108 21607282
    insmod
    Level 25  
    Now that i looked at the code, why flash_read is used instead of fdump?
    flash_read is very limited from what i can see (0x100 in single read?), while fdump can read several sectors.
  • #109 21607286
    p.kaczmarek2
    Moderator Smart Home
    I saw fdump but:
    
    Command formate: fdump flash_offset dump_size(dump_size < 0x100)
    	Example: fdump 0xD000 0x100
    
    Helpful post? Buy me a coffee.
  • #111 21607297
    p.kaczmarek2
    Moderator Smart Home
    Interesting, I didn't notice that. It seems that I will just add a "command line" feature to exe and we will try with @divadiow

    Added after 36 [minutes]:


    [Youtube] LN882H module pinout and setup for flashing - step by step video guide

    Added after 3 [minutes]:


    [Youtube] LN882H module pinout and setup for flashing - step by step video guide

    Added after 1 [minutes]:

    There is no limit for fdump it seems
    [Youtube] LN882H module pinout and setup for flashing - step by step video guide
    Helpful post? Buy me a coffee.
  • #112 21607366
    insmod
    Level 25  
    But is it flash content?
    If so, then bootcode source can be modified to print it as it is, which would speed backup significantly.
    And is there a checksum verification? It would probably need to be implemented in source as well.
  • #113 21607400
    divadiow
    Level 34  
    v16 - have you tested and are working on the next, or..?
  • #114 21607402
    p.kaczmarek2
    Moderator Smart Home
    Currently pushed exe has terminal enabled by default, it will load RAM loader and then you can try various commands
    Helpful post? Buy me a coffee.
  • #116 21607417
    divadiow
    Level 34  
    will do proper dump then convert from hex asap, but as a quick test here is dump test with sharptool matching bytes of real Cozylife LN dump

    Screenshot showing a utility window displaying a test hexadecimal dump from a Cozylife LN device.

    Added after 50 [seconds]:

    >>21607415
    oh! ha. ok
  • Helpful post
    #117 21607514
    insmod
    Level 25  
    I got it to compile (the one from SDK) with keil, but it prints this:
    version
    
    ERROR
    
    Not found <"  > command!
    


    Added after 3 [hours] 30 [minutes]:

    Managed to create a more or less working ramcode for flash reading only.
    Baud is 460800, if 921600 or more it always fails to pass a CRC check early into reading.
    Full flash dump in about a minute.
    int main(int argc, char* argv[])
    {
        SetSysClock();
        set_interrupt_priority();
        __enable_irq();
    
        hal_flash_init();
        flash_cache_disable();
    
        //bootram_ctrl_init();
        //bootram_ctrl_loop();
       
        bootram_serial_init();
        //hal_wdt_en(WDT_BASE,HAL_DISABLE);
         bootram_serial_setbaudrate(460800);
        uint32_t    flash_size         = 0;
        uint32_t    startAddr         = 0;
        uint32_t    readLen         = 32;
          uint8_t buf[readLen+2];
        uint32_t ret = bootram_flash_info();
    
        flash_size = ((1 << ((ret & 0xFF) - 0x11)) / 8) * 0x100000;
          bootram_serial_write(&flash_size, sizeof(flash_size));
          for(int k = 0; k < 0x10000; k++)
          {
             __ASM("nop");
          }
          for(uint32_t remaining =  flash_size; remaining > 0; remaining -= readLen){
             hal_flash_read(startAddr, readLen, buf);
             uint16_t crc = crc16_ccitt(buf, readLen);
             memcpy(&buf[readLen], &crc, sizeof(crc));
             startAddr += readLen;
             size_t sent = 0;
             for(int j = 0; j < readLen + 2; j++) 
             {
                bootram_serial_write(&buf[j], 1);
             }
             bootram_serial_flush();
             memset(buf, 0, readLen + 2);
          }
        while (1)
             __ASM("nop");
    }

    Console is disabled.
    On reader side, i've removed any delays, since ramcode starts printing almost instantly.
    
    public void read_flash_to_file(string filename, int flash_size, bool is_otp = false)
    {
    	int addr = 0;
    	_port.BaudRate = 460800;
    	byte[] flashsize = new byte[4];
    	var read = 0;
    	while(read < 4)
    	{
    		read += _port.Read(flashsize, read, 4 - read);
    	}
    	int total_flash_size = flashsize[3] << 24 | flashsize[2] << 16 | flashsize[1] << 8 | flashsize[0];
    	Console.WriteLine($"Reading flash to file {filename}, flash size is {total_flash_size / 0x100000} MB");
    	int packetsize = 32 + 2;
    	using(FileStream fs = new FileStream("test.bin", FileMode.Create))
    	{
    		while(addr < 0x200000)
    		{
    			byte[] buf = new byte[packetsize];
    			byte[] nocrc = new byte[packetsize - 2];
    			byte[] crc = new byte[2];
    			//if (read_flash(addr, is_otp, out byte[] data))
    			//{
    			//    fs.Write(data, 0, data.Length);
    			//}
    			//Console.Write(".");
    			//addr += 0x100;
    			read = 0;
    			while(read < packetsize)
    			{
    				read += _port.Read(buf, read, packetsize - read);
    			}
    			Array.Copy(buf, nocrc, packetsize - 2);
    			Array.ConstrainedCopy(buf, packetsize - 2, crc, 0, 2);
    			ushort calc_crc = YModem.calc_crc(nocrc);
    			ushort sentcrc = (ushort)(crc[1] << 8 | crc[0]);
    			if(sentcrc != calc_crc)
    			{
    				Console.WriteLine("CRC FAIL");
    				break;
    			}
    			addr += packetsize - 2;
    			fs.Write(buf, 0, packetsize - 2);
    
    		}
    	}
    	Console.WriteLine("\ndone");
    }


    Ramcode attached. Though even with 460800 baud i once encountered CRC error.
    Also attached exe, dump is always on.
  • #118 21607732
    divadiow
    Level 34  
    yes, crc every other go. took 50s/2mb
    Code: Text
    Log in, to see the code
  • #119 21607733
    insmod
    Level 25  
    >>21607732
    Every other go? I've had it like once in 10 tries. Wonder why...
  • #120 21607736
    divadiow
    Level 34  
    my sample size was too small to be definitive. I'll do 10
📢 Listen (AI):

Topic summary

The discussion centers on flashing the LN882H (specifically LN882HKI) module using open-source tools and firmware such as OpenBeken and OpenBK7231T_App, with detailed guides and video tutorials available. Flashing involves grounding the BOOT pin and using UART communication, which employs ASCII commands and the YMODEM protocol for data transfer. Several tools have been developed and shared, including LN882Loader (Linux-based) and Windows GUI wrappers, with ongoing improvements to support faster flash reading and dumping via commands like "fdump." Users report challenges with UART adapters, power supply stability, and correct COM port usage, highlighting the importance of proper hardware setup (e.g., CH340G vs. FTDI232 UART adapters). SSDP support and Home Assistant integration are discussed, with SSDP requiring IGMP flag enabling and driver activation in firmware. GPIO pin behavior and limitations are examined, noting that certain pins (A13 to B2) are reserved for QSPI flash and should not be used as GPIO outputs. Firmware versions and SDK updates are tracked, with reverse engineering efforts revealing internal flash structures and configuration data. WiFi stability issues on LN882H modules are reported, potentially linked to power supply quality or environmental factors, distinct from BK7231N platform behavior. Pinout details for LN882HK1 modules are clarified, identifying UART TX and RX pins and the BOOT pin for flashing mode entry. Overall, the community collaborates on improving flashing tools, firmware features, and hardware understanding to enable cloud-free operation and integration with smart home systems.
Summary generated by the language model.
ADVERTISEMENT