logo elektroda
logo elektroda
X
logo elektroda

[Youtube] LN882H module pinout and setup for flashing - step by step video guide

p.kaczmarek2 3708 66
ADVERTISEMENT
  • Close-up of an LN882H electronic module with text explaining the flashing process.
    Here's a step by step guide showing LN882HKI flashing process along with soldering. LN882HKI can be easily flashed with OpenBeken port and run cloudfree, it can be also paired with Home Assistant. Our LN882H firmware also supports new features and sensors, like DHT11 or SSDP discovery, that can be later enabled via OBK scripting.
    LN882 flashing is very similiar to ESP8266, you just need to ground one BOOT pin and then new firmware can be flashed via UART.
    Here's detailed guide:



    We also have a text guide for the same process. See:
    English guide:
    How to flash LN882H with open source Tasmota/Esphome style firmware - backup procedure included
    Polish guide:
    Jak sflashować LN882H oprogramowaniem OpenBeken aby uwolnić od chmury

    What to do after flashing?
    Home Assistant pairing:



    SSDP discovery:



    DHT sensor support:



    Tasmota Control support:



    See other guides on our channel:
    https://www.youtube.com/@elektrodacom

    Flash tools download -> https://www.elektroda.com/rtvforum/topic4028087.html
    Firmware Binaries -> https://github.com/openshwprojects/OpenBK7231T_App/releases
    Devices list: https://openbekeniot.github.io/webapp/devicesList.html

    Let us know if you have encountered any LN882 devices and how the flashing went! We can also help you with firmware change process, feel free to ask any questions.

    Cool? Ranking DIY
    Helpful post? Buy me a coffee.
    About Author
    p.kaczmarek2
    Moderator Smart Home
    Offline 
    p.kaczmarek2 wrote 12012 posts with rating 10032, helped 575 times. Been with us since 2014 year.
  • ADVERTISEMENT
  • ADVERTISEMENT
  • #3 21376292
    p.kaczmarek2
    Moderator Smart Home
    That's very nice! How did you know the UART protocol details? I didn't research it yet, so I don't know if it's documented, or available somewhere, or did you have to reverse-engineer it?

    @divadiow , do you have LN882H to give his tool a try?

    EDIT: I also saw you posted in the previous LN882H guide topic, there: How to flash LN882H with open source Tasmota/Esphome style firmware - backup procedure included, so in order to avoid confusion, I decided to lock the previous topic and we can discuss here.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #4 21376397
    divadiow
    Level 34  
    p.kaczmarek2 wrote:
    @divadiow , do you have LN882H to give his tool a try?

    I'll give it a spin.
    A better, faster, LN882H flash READ option would be cool too if that could be added.
  • #5 21376407
    p.kaczmarek2
    Moderator Smart Home
    He seems to have this in main:
    Code: Python
    Log in, to see the code

    which resolves to:
    Code: Python
    Log in, to see the code

    which seems very interesting, so commands are ASCII?
    Here's a larger snipper of code:
    Code: Python
    Log in, to see the code
    Helpful post? Buy me a coffee.
  • #7 21376509
    p.kaczmarek2
    Moderator Smart Home
    Try to edit main file to run that mentioned h.readFlash() command and let's see what you'll get?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #8 21376644
    divadiow
    Level 34  
    not entirely sure how you mean to achieve that. I went into a GPT hole..

    Screenshot showing debug logs from a file transfer process, with messages about task completion and waiting for RAMCODE.

    looked like it was doing something but it wasn't

    Screenshot of a hex editor with a binary file displayed as hex and text.

    maybe OP @stefanmandl1 is working on it ;)
  • #9 21376683
    p.kaczmarek2
    Moderator Smart Home
    I've checked his code futher and it seems that LN882H is using YMODEM protocol for UART communication:
    https://en.wikipedia.org/wiki/YMODEM
    It may be relatively easily to implement it in our flasher as we....
    Helpful post? Buy me a coffee.
  • Helpful post
    #10 21376767
    stefanmandl1
    Level 5  
    Hello @p.kaczmarek2,

    all my work is based on reverse engineering. I didn't find any documentation about the protocol.

    I found a new command for flash dumping ... fdump

    Regards and happy hacking ...

    2025-01-04 16:24:29,684 - DEBUG - Packet 37 >>>
    2025-01-04 16:24:29,712 - DEBUG - <<< ACK
    2025-01-04 16:24:29,712 - DEBUG - EOF
    2025-01-04 16:24:29,713 - DEBUG - >>> EOT
    2025-01-04 16:24:29,715 - DEBUG - <<< 0x15
    2025-01-04 16:24:29,716 - DEBUG - >>> EOT
    2025-01-04 16:24:29,718 - DEBUG - <<< 0x6
    2025-01-04 16:24:29,718 - DEBUG - <<< 0x43
    2025-01-04 16:24:29,719 - DEBUG - Packet End >>>
    2025-01-04 16:24:29,733 - DEBUG - <<< 0x6
    2025-01-04 16:24:29,733 - DEBUG - Task Done!
    2025-01-04 16:24:29,734 - DEBUG - File: LN882H_RAM_BIN.bin
    2025-01-04 16:24:29,734 - DEBUG - Size: 37872 Bytes
    2025-01-04 16:24:29,734 - DEBUG - Packets: 37
    Start program. Wait 10 seconds
    send version... wait for: RAMCODE
    b'version\r\n'
    b'RAMCODE\r\n'
    flash_uid
    flash uid:0x433031373839372E30300900C30073FF
    b'fdump 0x0 0x2000'
    b'0x0000: 00 00 00 20 8C 26 20 00 03 47 D8 54 00 01 00 20'
    b'0x0010: 00 00 00 00 14 20 D1 31 01 00 00 00 00 00 00 00'
    b'0x0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b'0x0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b'0x0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b'0x0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b'0x0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b'0x0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b'0x0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b'0x0090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b'0x00A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b'0x00B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b'0x00C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b'0x00D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b'0x00E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b'0x00F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
    b''
  • #11 21376851
    divadiow
    Level 34  
    cool. will have a play when I am back home. I have Windows laptop and LN882H with me but py script doesn't seem to be playing ball at the moment.

    I'm curious about what you reverse-engineered. was it LN882H_RAM_BIN.bin?

    If so, I notice I have 4 unique versions of that file in all my SDK and tool repo folders. I wonder what the differences are...

    Screenshot showing a search for duplicate binary files on Windows.


    List of binary files LN882H_RAM_BIN.bin with different modification dates.
  • #12 21376859
    p.kaczmarek2
    Moderator Smart Home
    Well, there are at least 3 options, he could have:
    - captured communication with UART sniffer or separate USB to UART tool or Sigrok etc etc
    - decompiled flashing tool that runs on PC with IDA pro or Ghidra etc
    - or maybe decompiled LN882H firmware
    Helpful post? Buy me a coffee.
  • #13 21377361
    jhatter55
    Level 3  
    I am looking for help with the Wemo driver for the LN88H. I have started the service and it shows in the setup.xml file but Alexa will not discover it. Wemo support has been successfully discovered by Alexa on some devices I have with the BL602 clip.
    Extract from an XML file showing the configuration of a Wemo device with type and service information.
  • #14 21377399
    insmod
    Level 24  
    >>21377361 You need SSDP support (alongside startdriver ssdp), and it is not currently enabled on LN.
  • #15 21377443
    p.kaczmarek2
    Moderator Smart Home
    My memory must be failing me, didn't you ask the same question recently? Or maybe I'm wrong...
    Anyway, SSDP requires IGMP Flag:
    Code snippet with highlighted IGMP flags line in ethernetif.c file on GitHub.
    It seems that it can be added there:
    https://github.com/openshwprojects/OpenLN882H...wip-2.1.3/src/port/ln_osal/netif/ethernetif.c
    However... the #define LWIP_IGMP is already set?
    Well if that's the case, then we only need to enable the driver. Let's try:
    https://github.com/openshwprojects/OpenBK7231T_App/pull/1493
    Helpful post? Buy me a coffee.
  • #17 21378212
    divadiow
    Level 34  
    >>21376767

    @stefanmandl1 what are the args to dump to file?

    Added after 17 [minutes]:

    ah. uncomment h.dumpFlash()

    Screenshot showing terminal command results related to flash memory reading.

    Added after 3 [hours] 1 [minutes]:

    I've had a play.

    The attached, coupled with the rest of the git content, appears to work downloading from LN882H to a file called dump.hex

    This is a paired-down test that will only dump

    Code: Python
    Log in, to see the code


    Console screenshot showing the debugging and data transfer process from flash memory.

    fdump address range expanded to cover 2mb. It takes approximately 14 minutes to dump 2mb, despite self.ser.baudrate = 115200 being set. Any higher and the script errors with:

    Screenshot of a UnicodeDecodeError message in a Python script while decoding a message.

    I erased my LN after dump, flashed Tuya factory, then reflashed the LN882Loader backup back to the board - it booted OpenBK in AP mode and contained the small customisations I made before dump - a working backup - the state it was left before backup.

    So I guess:

    -is 115200 (2mb/14 mins= ~20,000bps?) really the fastest we can get
    -how can the OPs loader.py be modified to offer the user the option to backup flash and choose a filename
    -is the way in this modified script even good? it was done with GPT :)
  • #18 21378652
    stefanmandl1
    Level 5  
    Hello @divadiow,

    try this for more speed.


    Screenshot of Python code with baud rate adjustment.
  • #22 21391484
    aaziumair
    Level 1  
    I have been trying to flash using this USB to uart adapter. It has a 3.3 v output. I didn't use a 3.3v supply like originally done in the tutorial. I keep getting this error

    Computer screen showing an error message when trying to use a USB to UART converter.


    Added after 6 [minutes]:

    This is the USB to uart converter


    USB to UART adapter connected to a laptop with colored wires.
  • #23 21391539
    p.kaczmarek2
    Moderator Smart Home
    Are you sure that your COM port is COM6?

    Maybe you have some software installed that takes control over COM port, like Cura (3D slicer)?
    Helpful post? Buy me a coffee.
  • #25 21391661
    p.kaczmarek2
    Moderator Smart Home
    It has,,, non-standard TXD pin placement?
    Helpful post? Buy me a coffee.
  • #26 21391694
    divadiow
    Level 34  
    v. interesting. all those pads along the edges. are they NC or functional I wonder
  • #27 21391708
    p.kaczmarek2
    Moderator Smart Home
    It looks a bit like CBU module:


    Top view of an electronic module with dimension markings and the label CBU.
    Helpful post? Buy me a coffee.
  • #28 21397971
    jhatter55
    Level 3  
    >>21377443 Sorry for the late response and yes you answered me before in the old thread and I provided some info but then the thread was moved so I asked again. So I saw your proposed change to enable SSDP. I guess I would have to compile against that change? I'm currently not setup to do that. I flashed the latest firmware but SSDP still isn't an option.
  • #29 21430175
    niterian
    Level 8  
    I'm trying to flash my WL2S with LN882H on it.

    While trying different tools I've found Tuya's LN882H flasher: https://github.com/tuya/tuyaopen?tab=readme-ov-file#command-line-flashing, they also have a GUI wrapper.
    I can't tell if it works, because nothing seems to work for me, but the protocol looks similar to the one in https://github.com/mandl/LN882Loader
    The Windows based tools I've only tried under wine so far.

    About the sources...
    It's technically just a binary downloaded from: https://images.tuyacn.com/smart/embed/package/vscode/data/ide_serial/tyutool_cli.tar.gz
    Interestingly when it fails, it sometimes leaves a python stack trace.

    Running:
    
    $ strings tyutool_cli | grep import
    import sys; sys.stdout.flush();                 (sys.__stdout__.flush if sys.__stdout__                 is not sys.stdout else (lambda: None))()
    import sys; sys.stderr.flush();                 (sys.__stderr__.flush if sys.__stderr__                 is not sys.stderr else (lambda: None))()
    

    there's even some traces of python

    It turns out it's just python byte-compiled and packaged into an executable.

    It can be unpacked with:
    
    $ git clone https://github.com/extremecoders-re/pyinstxtractor.git
    $ cd pyinstxtractor
    # it only worked partially with a different python version, it has to match the python used in the binary
    $ python38 pyinstxtractor.py tyutool_cli
    [+] Processing tyutool_cli
    [+] Pyinstaller version: 2.1+
    [+] Python version: 3.8
    [+] Length of package: 9832132 bytes
    [+] Found 55 files in CArchive
    [+] Beginning extraction...please standby
    [+] Possible entry point: pyiboot01_bootstrap.pyc
    [+] Possible entry point: pyi_rth_inspect.pyc
    [+] Possible entry point: pyi_rth_multiprocessing.pyc
    [+] Possible entry point: pyi_rth_pkgutil.pyc
    [+] Possible entry point: tyutool_cli.pyc
    [+] Found 798 files in PYZ archive
    [+] Successfully extracted pyinstaller archive: tyutool_cli
    
    You can now use a python decompiler on the pyc files within the extracted directory
    $ cd tyutool_cli_extracted
    $ ls
    base_library.zip    importlib_metadata-8.5.0.dist-info  lib-dynload    liblzma.so.5         libssl.so.1.1  pyiboot01_bootstrap.pyc  pyimod03_ctypes.pyc          pyi_rth_pkgutil.pyc   struct.pyc
    certifi             libbz2.so.1.0                       libexpat.so.1  libmpdec.so.2        libuuid.so.1   pyimod01_archive.pyc     pyi_rth_inspect.pyc          PYZ-00.pyz            tyutool_cli.pyc
    charset_normalizer  libcrypto.so.1.1                    libffi.so.7    libpython3.8.so.1.0  libz.so.1      pyimod02_importers.pyc   pyi_rth_multiprocessing.pyc  PYZ-00.pyz_extracted  yaml
    


    For decompiling .pyc files, decompyle3 worked well (2 files failed to decompile):
     
    $ mkdir -p src/tyutool/
    $ decompyle3 -o src tyutool_cli.pyc
    $ decompyle3 -r -o src/tyutool PYZ-00.pyz_extracted/tyutool/
    


    A snippet from an interesting file:
    
    $ cat src/tyutool/flash/ln882h/ln882h_flash.py | grep -A20 'def check_ram_mode'
        def check_ram_mode(self, times=2, timeout=1):
            data = "version\r\n"
            self.reset()
            self.send_data(data.encode("utf-8"))
            uart_rx_byte = self.read_line(times, timeout)
            self.log.debug(f"check_ram_mode receive: {uart_rx_byte}")
            if "RAMCODE".encode("utf-8") in uart_rx_byte:
                return True
            return False
    
        def get_flash_uuid(self):
            data = "flash_uid\r\n"
            self.reset()
            self.send_data(data.encode("utf-8"))
            flash_uid = self.read_line(2, timeout=1)
            if len(flash_uid) >= 30:
                return flash_uid
            return False
    
        def flash_set_addr(self):
            data = "startaddr 0x0\r\n"
    



    src/tyutool/flash/ln882h/ram_bin.py contains a binary similar to LN882H_RAM_BIN.bin.
  • #30 21430384
    p.kaczmarek2
    Moderator Smart Home
    jhatter55 wrote:
    >>21377443 Sorry for the late response and yes you answered me before in the old thread and I provided some info but then the thread was moved so I asked again. So I saw your proposed change to enable SSDP. I guess I would have to compile against that change? I'm currently not setup to do that. I flashed the latest firmware but SSDP still isn't an option.

    I'm pretty sure that SSDP was enabled on LN882h last week:
    https://github.com/openshwprojects/OpenBK7231...mmit/a5b536b0d514624114cf91a8c45a1cc5dded1307
    Screenshot of source code for platform LN882H with various enabled options.

    @niterian Are you looking for other tools because flashing does not work for you? Then please show your connections. I don't think that the tool is at fault.
    Helpful post? Buy me a coffee.

Topic summary

The discussion centers on flashing the LN882H (specifically LN882HKI) module using open-source tools and firmware such as OpenBeken and OpenBK7231T_App, with detailed guides and video tutorials available. Flashing involves grounding the BOOT pin and using UART communication, which employs ASCII commands and the YMODEM protocol for data transfer. Several tools have been developed and shared, including LN882Loader (Linux-based) and Windows GUI wrappers, with ongoing improvements to support faster flash reading and dumping via commands like "fdump." Users report challenges with UART adapters, power supply stability, and correct COM port usage, highlighting the importance of proper hardware setup (e.g., CH340G vs. FTDI232 UART adapters). SSDP support and Home Assistant integration are discussed, with SSDP requiring IGMP flag enabling and driver activation in firmware. GPIO pin behavior and limitations are examined, noting that certain pins (A13 to B2) are reserved for QSPI flash and should not be used as GPIO outputs. Firmware versions and SDK updates are tracked, with reverse engineering efforts revealing internal flash structures and configuration data. WiFi stability issues on LN882H modules are reported, potentially linked to power supply quality or environmental factors, distinct from BK7231N platform behavior. Pinout details for LN882HK1 modules are clarified, identifying UART TX and RX pins and the BOOT pin for flashing mode entry. Overall, the community collaborates on improving flashing tools, firmware features, and hardware understanding to enable cloud-free operation and integration with smart home systems.
Summary generated by the language model.
ADVERTISEMENT