WBR2, WBR3, WBRU, W701-VA2-CG pinout, datasheet, flashing for Home Assistant

p.kaczmarek2 8076 76

Post #1

21375223 03 Jan 2025 17:38

Here's step by step flashing and HA Discovery guide for W701-VA2-CG (RTL8720CF)-based Tuya modules that can be programmed with AmebaZ2 PG Tool 1.2.47 (download included). This way you can run those devices cloud free, use it with Tasmota commands (Tasmota Remota app), and add new features like sensors, scripts, and so on.

This guide is applicable to the following modules with the core chip of RTL8720CF or similar, so: WBR1, WBR2, WBR3, WBR2L, WBR3L, WBRU etc.

Datasheet:
RTL872xZ2 ...asheet.pdf Download (1.99 MB)
See sample device teardown with WBR2: [WBR2/W701] Unsupported MaxCom Smart Breaker SHSB111W10

Here is a sample boot log taken from Log UAR T pins of similar device:


== Rtl8710c IoT Platform ==
Chip VID: 5, Ver: 3
ROM Version: v3.0
Test Mode: boot_cfg1=0x20
Download Image over UART2[tx=16,rx=15] baud=115200

== Rtl8710c IoT Platform ==
Chip VID: 5, Ver: 3
ROM Version: v3.0

== Boot Loader ==
Dec  5 2019:14:02:18

fwx SELE[fffffffe]
fw SELE Bitidx 1, fw1 valid 1, sn 100, fw2 valid 1, sn 101
fw2 USE, return sn 101

Boot Loader <==

== RAM Start ==
Build @ 14:44:45, Jul 29 2020

 Create Task init, stack 0x1000fb28, len 5120

 Create Task app_init, stack 0x10010f88, len 8192

 Create Task IDLE, stack 0x10012fe8, len 768

 Create Task Tmr Svc, stack 0x10013640, len 2048

 Create Task TCP_IP, stack 0x10013fb8, len 4000
interface 0 is initialized
interface 1 is initialized

In[01-01 18:12itializing :15 TUYA InfWIFI ...o][mqc_app.c:175] mqc app init ...

 Create Task sys_timer, stack 0x1001a800, len 4096

 Create Task cmmod, stack 0x1001eca8, len 4096
[01-01 18:12:15 TUYA Info][sf_mqc_cb.c:42] register mqc app callback
[01-01 18:12:15 TUYA Debug][mqc_app.c:118] mq_pro:5 mqc_handler_cnt:1
[01-01 18:12:15 TUYA Debug][mqc_app.c:118] mq_pro:31 mqc_handler_cnt:2
[01-01 18:12:15 TUYA Debug][log_seq.c:732] read from uf. max:0 first:0 last:0
[01-01 18:12:15 TUYA Debug][svc_online_log.c:288] svc online log init success

 Create Task wk_th-0, stack 0x10023e18, len 5120
[01-01 18:12:15 TUYA Err][tuya_ws_db.c:314] kvs_read fails gw_bi -1
[01-01 18:12:15 TUYA Err][ws_db_gw.c:111] gw base read fails -935
[01-01 18:12:15 TUYA Debug][tuya_bt_sdk.c:89] ty bt cmmod register finish 1
[01-01 18:12:15 TUYA Notice][tuya_ble_api.c:301] ble sdk inited
[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:1047] tuya_hal_bt_port_init

[01-01 18:12:15 TUYA Debug][uni_thread.c:215] Thread:sys_timer Exec Start. Set to Running Status
[01-01 18:12:15 TUYA Debug][uni_thread.c:215] Thread:cmmod Exec Start. Set to Running Status
[01-01 18:12:15 TUYA Debug][uni_thread.c:215] Thread:wk_th-0 Exec Start. Set to Running Status

 Create Task rtw_recv_tasklet, stack 0x10025328, len 5936

 Create Task rtw_xmit_tasklet, stack 0x10026b68, len 1024

 Create Task rtw_interrupt_thread, stack 0x10027078, len 1024

 Create Task cmd_thread, stack 0x10027588, len 2048

WIFI initialized

init_thread(55), Available hea
 Createp 0x16be0 Task trace_task, stack 0x10027ef8, len 512

 Create Task UpperStackTask, stack 0x100287c8, len 3072

 Create Task HCI I/F, stack 0x1002b2b0, len 2048
BT BUILD Date: Jul 29 2020, 16:17:09 
BT RESET LOG...
[01-01 18:12:15 TUYA Debug][tuya_hal_wifi.c:575] read wifi mac:38:1f:8d:39:13:c2
[01-01 18:12:15 TUYA Notice][tuya_hal_bt.c:893] BLE MAC: 0x38-0x1f-0x8d-0x39-0x13-0xc2

 Create Task tuya_bt_main_task, stack 0x1002c3d8, len 2560
BT Reset ok
bt_iqk_efuse_valid: has data

hci_tp_phy_efuse[0]=0,
bt_dump_iqk:    DUMP,
the IQK_xx  data is 0x127,
the IQK_yy  data is 0x3fe,
the QDAC   data is 0x1a,
the IDAC   data is 0x1b,
the QDAC2  data is 0x19,
the IDAC2  data is 0x19,

 Create Task rtw_coex_mailbox_thread, stack 0x1000fc08, len 1024
hci_read_rom_check: rom_version 0x0003, bt_hci_chip_id 0x0004

BT ADDRESS:
38:1f:8d:39:13:c2:

 WRITE  physical FLATK=tx_flatk=ff00 

We use fw_buf=1002f128, fw_len = 13a0, config_buf = 10010128, config_len= 32
Set baudrate to 921600

hci_tp_config:BT INIT success 7
Start upperStack
[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:788] tuya_bt_app_profile_callback(), service_id:255, tuya_bt_srv_id:1

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:338] tuya_bt_handle_io_msg(), msg_type:0

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:239] app_handle_gap_msg: subtype 1

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:72] app_handle_dev_state_evt: init state 1, adv state 0, cause 0x0


[BLE peripheral] GAP stack ready
[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:338] tuya_bt_handle_io_msg(), msg_type:0

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:239] app_handle_gap_msg: subtype 1

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:72] app_handle_dev_state_evt: init state 1, adv state 1, cause 0x0

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:338] tuya_bt_handle_io_msg(), msg_type:0

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:239] app_handle_gap_msg: subtype 1

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:72] app_handle_dev_state_evt: init state 1, adv state 2, cause 0x0

[01-01 18:12:15 TUYA Debug][tuya_hal_bt.c:91] GAP adv start

[01-01 18:12:15 TUYA Notice][tuya_ble_api.c:337] ble sdk re_inited
[01-01 18:12:15 TUYA Notice][tuya_bt_sdk.c:130] ty bt sdk init success finish
[01-01 18:12:15 TUYA Notice][tuya_main.c:396] Base firmware: rtl8720cf_tls_common_iot_config:2.1.6 compiled at Date:Jul 29 2020 Time:16:17:40
[01-01 18:12:15 TUYA Notice][tuya_main.c:397] reset reset reason num 0
[01-01 18:12:15 TUYA Debug][tuya_device.c:19] < TUYA IOT SDK V:1.0.12 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.2_CD:1.0.0 >
< BUILD AT:2020_07_28_19_56_28 BY embed FOR ty_iot_wf_bt_sdk_rtos AT rtl8720cf_ameba >
IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 SHUTDOWN_MODE:0 LITTLE_END:1 TLS_MODE:2 ENABLE_LOCAL_LINKAGE:0 ENABLE_CLOUD_OPERATION:0 ENABLE_SUBDEVICE:0 ENABLE_ENGINEER_TO_NORMAL:0 OPERATING_SYSTEM:2 ENABLE_SYS_RPC:0 TY_SECURITY_CHIP:0 RELIABLE_TRANSFER:RELIABLE_TRANSFER ENABLE_LAN_ENCRYPTION:1 ENABLE_LAN_LINKAGE:0 ENABLE_LAN_LINKAGE_MASTER:0 >

[01-01 18:12:15 TUYA Debug][tuya_device.c:20] rtl8720cf_tls_common_iot_config:2.1.6
[01-01 18:12:15 TUYA Notice][simple_flash.c:430] key_addr: 0x1d8000   block_sz 4096
[01-01 18:12:15 TUYA Notice][simple_flash.c:498] get key:
0x52 0x32 0x7c 0x62 0xcc 0x45 0x99 0xbc 0x1f 0x80 0x21 0xa7 0xfa 0x6 0xbe 0x6c 
[01-01 18:12:15 TUYA Notice][tuya_main.c:447] have actived over 15 min, not enter mf_init
[01-01 18:12:15 TUYA Notice][tuya_uart_common_api.c:118] ty_uart_common_main_components_version:1.0.5,memrory left:67400...
[01-01 18:12:15 TUYA Notice][uart_common.c:238] pConfig = {low_sw:close,wifi_bdrate:115200,wifi_cofig_ver:1.0.0,crc:13,}---config len:62
[01-01 18:12:15 TUYA Notice][flash_config.c:192] ty_uart_public_iot_table_read_component_version:1.0.0
[01-01 18:12:15 TUYA Notice][flash_config.c:160] key:wifi_cofig_ver,value:1.0.0,len:5
[01-01 18:12:15 TUYA Notice][flash_config.c:157] key:wifi_bdrate,value:115200,len:3
[01-01 18:12:15 TUYA Notice][flash_config.c:167] key:low_sw,value:0,len:1
[01-01 18:12:15 TUYA Err][flash_config.c:129] json key 'flow_sw' not exist!
[01-01 18:12:15 TUYA Err][flash_config.c:129] json key 'ir_sw' not exist!
[01-01 18:12:15 TUYA Err][flash_config.c:129] json key 'ir_tx' not exist!
[01-01 18:12:15 TUYA Err][flash_config.c:129] json key 'ir_rx' not exist!
[01-01 18:12:15 TUYA Notice][uart_common.c:122] get_config_flow_sw err.
[01-01 18:12:15 TUYA Notice][uart_common.c:138] get_config_ir_sw err.
[01-01 18:12:15 TUYA Notice][uart_common.c:170] uart badrate:115200
[01-01 18:12:16 TUYA Notice][uart_common.c:171] flow_open:0
[01-01 18:12:16 TUYA Notice][uart_common.c:172] lowpower_open:0
[01-01 18:12:16 TUYA Notice][uart_common.c:173] ir_open:0
[01-01 18:12:16 TUYA Notice][uart_common.c:174] ir_tx:2
[01-01 18:12:16 TUYA Notice][uart_common.c:175] ir_rx:3
[01-01 18:12:16 TUYA Notice][tuya_uart.c:134] 0   115200

 Create Task ty_uart_task, stack 0x1002f128, len 4096
[01-01 18:12:16 TUYA Notice][uart_common.c:748] uart_task_init ok
[01-01 18:12:16 TUYA Notice][weather_sever.c:348] ty_uart_public_weather_component_version:1.0.0
[01-01 18:12:16 TUYA Notice][tuya_download_file.c:630] ty_uart_public_file_download_component_version:1.0.0
[01-01 18:12:16 TUYA Notice][tuya_download_file.c:662] file_download_init OK
[01-01 18:12:16 TUYA Notice][tuya_uart_common_api.c:186]  tuya_uart_common_init ok,memrory left:60624...
[01-01 18:12:16 TUYA Notice][process_server.c:110] send jump_pack
[01-01 18:12:18 TUYA Notice][uart_common.c:631] heart timer out clear all
[01-01 18:12:19 TUYA Notice][process_server.c:110] send jump_pack
[01-01 18:12:21 TUYA Notice][uart_common.c:631] heart timer out clear all
[01-01 18:12:22 TUYA Notice][process_server.c:110] send jump_pack
[01-01 18:12:24 TUYA Notice][uart_common.c:631] heart timer out clear all
[01-01 18:12:25 TUYA Notice][process_server.c:110] send jump_pack
[01-01 18:12:27 TUYA Notice][uart_common.c:631] heart timer out clear all
[01-01 18:12:28 TUYA Notice][process_server.c:110] send jump_pack
[01-01 18:12:30 TUYA Notice][uart_common.c:631] heart timer out clear all
[01-01 18:12:31 TUYA Notice][process_server.c:110] send jump_pack

Source: https://www.elektroda.com/rtvforum/topic4093142-60.html#21361625
Yes, I know it says Rtl8710c, rtl8720c is just 8710 with bluetooth.

For this guide, you will need to have some basic soldering skills and a USB to UART converter, like the CH340 one. It should have 3.3V voltage levels. So far, I've been using successfully this one for years:

I am also often using external 3.3V LDO (like AMS1117-3.3V) as a better power supply. 3.3V directly from USB to UART may not work. The 3.3V pin on shown USB to UART converter is only used to select voltage levels.

W701-VA2-CG modules
Let's consider most popular W701-VA2-CG modules.
WBR3 is a common Tuya module based on W701-VA2-CG. It has somewhat similar footprint to popular TYWE3S (ESP12) modules, so it also matches more or less with CB3S and WB3S.

Diagram of the WBR3 module with pin labeling and top and bottom views.

Pin number	Symbol	I/O type	Function
1	NC	/	The pin is pulled up to be compatible with other modules
2	A_7	I/O	GPIOA_7, hardware PWM, IC Pin 21
3	EN	I/O	Enabling pin, which works at the high level and is pulled up and controlled by a user externally
4	A_11	I/O	GPIOA_11, hardware PWM, IC Pin 25
5	A_2	I/O	GPIOA_2, hardware PWM, IC Pin 18
6	A_3	I/O	GPIOA_3, hardware PWM, IC Pin 19
7	A_4	I/O	GPIOA_4, hardware PWM, IC Pin 20
8	VCC	P	Power supply pin (3.3V)
9	GND	P	Power supply reference ground
10	A_12	I/O	GPIOA_12, hardware PWM, IC Pin 26
11	A_16	I/O	GPIOA_16, UART_Log_TXD, which is used for displaying the module internal information and can be configured as a common GPIO
12	A_17	I/O	GPIOA_17, hardware PWM, IC Pin 38
13	A_18	I/O	GPIOA_18, hardware PWM, IC Pin 39
14	A_19	I/O	GPIOA_19, hardware PWM, IC Pin 40
15	RXD	I/O	GPIOA_13, UART0_RXD, which is used as a user-side serial interface pin
16	TXD	I/O	GPIOA_14, UART0_TXD, which is used as a user-side serial interface pin

There is also A_15 (UART_Log_RXD) available on the back of the module.
WBR3 Modul...atform.pdf Download (619.05 kB)

WBR2 is a common Tuya module based on W701-VA2-CG. It has somewhat similar footprint to popular TYWE2S (ESP8266) modules, so it also matches more or less with CB2S and WB2S.

Pin number	Symbol	IO type	Function
1	3V3	/	Power supply pin (3.3V)
2	A19	I/O	GPIOA_19, hardware PWM, IC Pin40
3	GND	P	Power supply reference ground
4	A18	I/O	GPIOA_18, hardware PWM, IC Pin39
5	A13	I/O	GPIOA_13, UART0_RXD, which is used as a user-side serial interface pin
6	A17	I/O	GPIOA_17, hardware PWM, IC Pin38
7	A14	I/O	GPIOA_14, UART0_TXD, which is used as a user-side serial interface pin
8	A20	I/O	GPIOA_20, common GPIO, IC Pin1
9	A12	I/O	GPIOA_12, hardware PWM, IC Pin26
10	EN	I/O	Enabling pin, which works at the high level and is pulled up and controlled by a user externally
11	A11	I/O	GPIOA_11, hardware PWM, IC Pin25

There is also A_15 (UART_Log_RXD) and A_16 (UART_Log_TXD) available on the back of the module.
WBR2 Modul...atform.pdf Download (581.57 kB)

WBRU is a common Tuya module based on W701-VA2-CG. It has somewhat similar footprint to CBU, with both UART ports available on sides.

WBRU electronic module with CE and RoHS markings.

Diagram of WBRU module with top and bottom view

Pin number	Symbol	II/O type	Function
1	PA8	I/O	GPIOA_8, common GPIO, which can be reused as SPI_SCK and corresponds to Pin 22 of the IC
2	PA9	I/O	GPIOA_9, common GPIO, which can be reused as SPI_MOSI and corresponds to Pin 23 of the IC
3	PA2	I/O	GPIOA_2, hardware PWM, correspond to Pin 18 of the IC
4	PA3	I/O	GPIOA_3, hardware PWM, correspond to Pin 19 of the IC
5	PA4	I/O	GPIOA_4, hardware PWM, correspond to Pin 20 of the IC
6	L_RX	I/O	GPIOA_15, UART_Log_RXD (used to receive the external logs of the module), which can be configured as a common GPIO
7	L_TX	I/O	GPIOA_16, UART_Log_TXD (used to send the internal logs of the module), which can be configured as a common GPIO
8	PA11	I/O	GPIOA_11, hardware PWM, correspond to Pin 25 of the IC
9	PA12	I/O	GPIOA_12, hardware PWM, correspond to Pin 26 of the IC
10	PA17	I/O	GPIOA_17, hardware PWM, correspond to Pin 38 of the IC
11	PA18	I/O	GPIOA_18, hardware PWM, correspond to Pin 39 of the IC
12	PA19	I/O	GPIOA_19, hardware PWM, correspond to Pin 40 of the IC
13	GND	P	Power supply reference ground
14	VCC	P	Power supply pin (3.3V)
15	TX	I/O	GPIOA_14, UART0_TXD (user serial interface)
16	RX	I/O	GPIOA_13, UART0_RXD (user serial interface)
17	PA20	I/O	GPIOA_20, common GPIO, correspond to Pin 1 of the IC
18	EN	I/O	Enabling pin, active at the high level. The module has been pulled to the high level and the user can control the pin externally
19	PA0	I/O	GPIOA_0, not recommend to pull it to the high level. If it is pulled to a high level, it will enter the test mode. Correspond to Pin 15 of the IC
20	PA10	I/O	GPIOA_10, common GPIO, which can be reused as SPI_MISO and corresponds to Pin 24 of the IC
21	PA7	I/O	GPIOA_7, common GPIO, which can be reused as SPI_CS and corresponds to Pin 21 of the IC

WBRU Modul...atform.pdf Download (963.69 kB)

NOTE: A_15 (UART_Log_RXD) and A_16 (UART_Log_TXD) are used as debug log output and as flashing port. A_13 (UART0_RXD) and A_0 must be pulled high to enable bootloader.

Flashing guide
Those WBR3/WBR2 modules are strange, in case of WBR3 you need to access pin from under module. You can desolder it with hot air.
You need to connect:
- GND and 3.3V to a good 3.3V power supply
- A_16 to USB to UART RX
- A_15 to USB to UART TX (it's on module back)
- RXD and A0 to 3.3V (to enable bootloader mode)
To reset module, connect EN to ground (it's like RESET, CEN pin)
This is how it looks like for WBR3:

Close-up of Tuya W701-VA2-CG module with soldered wires.

And for WBR2:
- GND and 3.3V to a good 3.3V power supply
- LOG_TX to USB to UART RX
- LOG_RX to USB to UART TX (it's on module back)
- A13 (RXD) and A0 to 3.3V (to enable bootloader mode)

Tuya module with soldered wires for flashing

Tuya WBR2 module with connected wires for flashing.

Here is my setup, as you can see I am using TC1264 (similar to AMS1117-3.3V) LDO for power supply:

Breadboard with connected wires and a module.

Get our binaries here:
https://github.com/openshwprojects/OpenBK7231T_App
Now, if you run any UART to USB converter, you should be able to see this message after doing reboot (shorting EN to ground for a moment):

RealTerm program showing UART connection settings.

Now you can use AmebaZ2 PG Tool 1.2.47:

User interface of the AmebaZ2 PG Tool 1.2.47 for programming.

Set Flash Pin as in Docs:

Flash options for Tuya modules with flash pin selection

Start flashing:

User interface of the AmebaZ2 PG Tool 1.2.47 during flashing.

Remember that you need to disconnect booting pins from 3.3V (all except 3.3V pin itself) and reboot in order for new firmware to start.

To sum up - flashing infographics, WBR3:

Guide for connecting and flashing WBR3 (W701-VA2-CG/RTL8720CF) module for Home Assistant integration.

WBR2:

Tuya flashing docs:
Flash Firm...tation.pdf Download (2.47 MB)

Binaries and flash Tool download
Get binaries from our repository:
https://github.com/openshwprojects/OpenBK7231T_App
Navigate to Releases tab:
https://github.com/openshwprojects/OpenBK7231T_App/releases
Binaries are marked as RTL87X0C, OpenRTL87X0C, they should run on RTL8710C/RTL8720C:

Screenshot of a table with flash files for various devices, with highlighted entries for RTL87X0C.

Flash tool is available here:
AmebaZII_P...1.2.47.zip Download (99.8 kB)
Flash tool mirror is here:
https://github.com/openshwprojects/FlashTools/tree/main/Realtek

First configuration
So now you have flashed your device and disconnected pulled up signals from 3.3V. Of course, the main 3.3V pin still should be connected, because your device needs power. Short EN to ground to reboot. Then first thing to check is the UART log output. It should print OBK log correctly:

Screenshot from RealTerm showing boot log of an IoT module.

OBK access point should appear:

Wi-Fi network connection window for OpenRTL87X0C

Connect to this AP and go to 192.168.4.1:

Go to config, WiFi:

OpenRTL87X0C configuration interface with Configure WiFi & Web highlighted

Configure your WiFi SSID/password there.
Device will reboot and connect to your network. You can use your router DHCP clients list to discover new device IP.

What to do next?
With OBK you can do many things, including HASS Discovery:

Use SSDP Discovery:

Use Tasmota Device Groups:

Add DHT11:

Create custom online builds and drivers:
How to create a custom driver for OpenBeken with online builds (no toolchain required)
OpenBeken online building system - compiling firmware for all platforms (BK7231, BL602, W800, etc)
OBK repository:
https://github.com/openshwprojects/OpenBK7231T_App
OBK docs:
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/README.md
Our devices list:
https://openbekeniot.github.io/webapp/devicesList.html

Interesting development board
There is also BW15 module available along with development board. It features RTL8720CF. More info coming soon.
bw15_datas...eet_en.pdf Download (829.32 kB)

Summary
Ameba ZII is now flashable with OBK. WBR3/WBR2/etc modules requires few more wires to flash, but it's still doable. WBR3 may be a bit more problematic, because flashing pads are on the back of the module, but you can always desolder whole module with hot air. Even a cheap hot air station like 858 should work good. Soon we will also release a video showing whole process step for step, but that's all for now. Good luck with flashing your devices!

Special thanks for @insmod and @divadiow for RTL porting and testing!

PS: I also attach some futher RTL8720-related dasheets... there are more RTL types that we hope to support soon as well.

Attachments:

Cool? Ranking DIY

Helpful post? Buy me a coffee.

About Author

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Offline

p.kaczmarek2 wrote 11875 posts with rating 9951, helped 568 times. Been with us since 2014 year.

ADVERTISEMENT
Helpful post

#2 21375270 03 Jan 2025 18:01

DeDaMrAz DeDaMrAz

Level 19

Helpful post? (+3)

Helpful post
Post #2
21375270 03 Jan 2025 18:01

Here is a quick preview of the flashing jig for WBR3 modules that is being in the works now.

I am planning of using these pins for it that can be found here - https://www.aliexpress.com/item/4001036082221....order_list.order_list_main.11.71c91802RZ11DZ

Once completed all files will be available here to download.

If you like my work, support me at: https://paypal.me/openshwprojects
#3 21375394 03 Jan 2025 19:07

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #3
21375394 03 Jan 2025 19:07

Very interesting idea, I wonder how reliable it will be.

I've recently started working on a simple NodeMCU to WBR3 hack, and it seems to turned out well. I've managed to solder WBR3 with a two wires for flashing below it:

Now, flashing it via UART does not work currently, but we have OTA, and maybe I could just lift CH340 traces and connect them to correct UART port?

I hope to receive more WBR3 modules soon from a reader, so it might be worth to try it.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

#4 21375443 03 Jan 2025 20:28

divadiow divadiow

Level 34

Post #4

21375443 03 Jan 2025 20:28

WBR3 is an interesting module. BW15 and vanilla RTL8720CFs (the one I have anyway) only require PA0 to be pulled to 3.3V.

I am lead to believe that WBR3s have, as seen in your boot log

whereas

is seen in non-Tuya RTL8720CF modules. It'd be good to see this confirmed (or debunked) in future captures of boot logs from other devices/WBR3s

With PA0 high and PA13 low for me on BW15 this is the output. Some other boot mode.

Added after 56 [minutes]:

I lifted the table from here and added Modules/Other Names column because I was losing track of what was what. It's a work in progress. Perhaps DM me for anything wrong/missing and I'll fix.

RTL P/N

Series

Protocol

CPU

Mhz

SRAM

UART

SPI

I2S

ADC/DAC

Modules/Other Names

RTL8710BN

Ameba Z

RTL8195A

WiFi

ARM M4

125M

258KB

Y/N

W302/T103_V1.0, T112_V1.1, WR1, WR1-IPEX, WR2, WR2, WR2E, WR3, WR3E, WR4, WR5E

RTL8710BX

Ameba Z

RTL8195A

WiFi

ARM M4

62.5M

256KB

Y/N

WR3L, WR3LE, BW12, BW14, T102_V1.1

RTL8710CX

Ameba Z2

WiFi

ARM M4

100M

256KB

N/N

RTL8710CM

Ameba Z2

WiFi

ARM M4

100M

256K+4M

N/N

RTL8720CN

Ameba Z2

WiFi+BLE4.2

ARM M4

100M

256KB

Ble4.2

N/N

RTL8720CF

Ameba Z2

RTL8710C

WiFi+BLE4.2

ARM M4

100M

256KB

Ble4.2

N/N

W701-VA2-CG, WBR2, WBR3, WBRU, W701H, BW15

RTL8720CM

Ameba Z2

WiFi+BLE4.2

ARM M4

100M

256KB

Ble4.2

N/N

RTL8720CS

Ameba CS

WiFi+BLE5 Mesh

M0+M4

200M

512KB

Ble5.0 mesh

Y/Y

RTL8721CSM

Ameba CS

WiFi+BLE5 Mesh

M0+M4

200M

512K+4M

Ble5.0 mesh

Y/Y

RTL8722CSM

Ameba CS

WiFi+BLE5 Mesh

M0+M4

200M

512K+4M

Ble5.0 mesh

Y/Y

RTL8720DN

Ameba D

2.4G+5G+BLE5

M0+M4

200M

512K

Ble5.0 mesh

Y/Y

W701D, BW16

RTL8721DM

Ameba D

2.4G+5G+BLE5

M0+M4

200M

512K+4M

Ble5.0 mesh

Y/Y

RTL8722DM

Ameba D

2.4G+5G+BLE5

M0+M4

200M

512K+4M

Ble5.0 mesh

Y/Y

#5 21375602 03 Jan 2025 20:42

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #5
21375602 03 Jan 2025 20:42

Thank you for sharing, that's a very informative table.

Btw Do you have any flashdumps of RTL that are not (yet) there?
https://github.com/openshwprojects/FlashDumps
Maybe we should merge our collections.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#6 21375622 03 Jan 2025 20:54

divadiow divadiow

Level 34

Helpful post? (0)

Post #6
21375622 03 Jan 2025 20:54

Only the Tapo P100 and BW15 AT factory flash. I can make PR to add? new folder for CF?

There also a couple of my BX backups floating around.
#7 21375633 03 Jan 2025 20:58

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (+1)

Post #7
21375633 03 Jan 2025 20:58

Sure, let's centralize everything, especially that we've recently seen that those WBRs also have Tuya config partition.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#8 21375788 03 Jan 2025 22:54

divadiow divadiow

Level 34

Helpful post? (0)

Post #8
21375788 03 Jan 2025 22:54

@DeDaMrAz do you have a Tuya RTL8720CF to hand? If yes and you a moment would you mind flashing this to it? https://www.elektroda.com/rtvforum/topic4021547.html#20870137

I've flashed a couple of factory dumps to BW15 but they always get stuck booting at this point

Added after 42 [minutes]:

divadiow wrote:
It'd be good to see this confirmed (or debunked) in future captures of boot logs from other devices/WBR3s

ROM Version: v3.0 seen in Cuco module

https://www.elektroda.com/rtvforum/topic4042611.html#21005817

#9 21375861 03 Jan 2025 23:00

DeDaMrAz DeDaMrAz

Level 19

Post #9

21375861 03 Jan 2025 23:00

divadiow wrote:
@DeDaMrAz do you have a Tuya RTL8720CF to hand?

Same result, I recall that @insmod mentioned something wrong with flash tool writing (I guess reading may have the problem as well)

== Rtl8710c IoT Platform ==
Chip VID: 5, Ver: 3
ROM Version: v3.0

== Boot Loader ==
Dec  5 2019:14:02:18

fwx SELE[ffffffff]
fw SELE Bitidx 0, fw1 valid 1, sn 0, fw2 valid 1, sn 100
fw1 USE, return sn 0

Boot Loader <==

== RAM Start ==
Build @ 18:58:52, Jun 24 2021
interface 0 is initialized
interface 1 is initialized

Initializing [01-01 18:1WIFI ...2:15 TUYA Info][mqc_app.c:337] mqc app init ...
[01-01 18:12:15 TUYA Info][uni_thread.c:221] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:5
[01-01 18:12:15 TUYA Info][uni_thread.c:221] thread_create name:cmmod,stackDepth:4096,totalstackDepth:8192,priority:4
[01-01 18:12:15 TUYA Info][uni_thread.c:221] thread_create name:wk_th-0,stackDepth:5120,totalstackDepth:13312,priority:3
[01-01 18:12:15 TUYA Err][tuya_ws_db.c:324] kvs_read fails gw_bi -1
[01-01 18:12:15 TUYA Notice][tuya_ble_api.c:345] ble sdk inited
[BT NOTICE]tuya_os_adapt_param_init mode:0
[01-01 18:12:15 TUYA Notice][tuya_ble_api.c:381] ble sdk re_inited
[01-01 18:12:15 TUYA Notice][tuya_bt_sdk.c:125] ty bt sdk init success finish
[01-01 18:12:15 TUYA Notice][simple_flash.c:408] key_addr: 0x1d8000   block_sz 4096
[01-01 18:12:15 TUYA Notice][simple_flash.c:497] get key:
[01-01 18:12:15 TUYA Notice][mf_test.c:364] have actived over 15 min, not enter mf_init
[01-01 18:12:15 TUYA Notice][tuya_main.c:314] mf_init succ

WIFI initialized

init_thread(65), Available heap 0x15340

If you like my work, support me at: https://paypal.me/openshwprojects

#10 21375887 03 Jan 2025 23:18

divadiow divadiow

Level 34
Helpful post? (0)

Post #10
21375887 03 Jan 2025 23:18

this Govee H5106 Air Quality Monitor fw from device with second MCU does

Code: Text
Log in, to see the code

Attachments:

Govee_H5106_Air_Quality.bin Download (2 MB)
#11 21375898 03 Jan 2025 23:25

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #11
21375898 03 Jan 2025 23:25

Are you sure about that packet? TuyaMCU header is 0x55AA, not just 0x55. By the way, with some simple software on PC, we could simulate MCU to "talk" with that WiFi firmware.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#12 21375902 03 Jan 2025 23:29

divadiow divadiow

Level 34

Helpful post? (0)

Post #12
21375902 03 Jan 2025 23:29

I don't think it's TuyaMCU. Govee isn't Tuya based? And the tell-tale sign also that no Tuya storage area is found in fw. I think whoever made that pic and labelled it TuyaMCU is wrong.

This is boot log

Code: Text
Log in, to see the code

TuyaMCU simulator isn't acknowledging anything received by it.
#13 21375933 04 Jan 2025 00:10

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (+1)

Post #13
21375933 04 Jan 2025 00:10

Interesting, adding OBK support to this would be a great learning experience.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#14 21376466 04 Jan 2025 13:12

anthonythomas anthonythomas

Level 9

Helpful post? (0)

Post #14
21376466 04 Jan 2025 13:12

Is it right to say it isn't possible to flash the WBR3 without removing it from the board to gain access to the reverse pads?

Just wondering whether it is worth actually flashing and instead replacing with an ESP8266 since the module will be removed anyway
#15 21376702 04 Jan 2025 15:53

divadiow divadiow

Level 34

Helpful post? (0)

Post #15
21376702 04 Jan 2025 15:53

yes. WBR3 pads on the underside would need to be accessed

Added after 1 [minutes]:

>>21375933

true. that MCU is a Freqchip FR8016HA

https://github.com/search?q=FR8016HA&type=code

the device owner posted FR8016HA boot log too

Code: Text
Log in, to see the code
#16 21376858 04 Jan 2025 17:26

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #16
21376858 04 Jan 2025 17:26

anthonythomas wrote:
Is it right to say it isn't possible to flash the WBR3 without removing it from the board to gain access to the reverse pads?

I think you need to desolder it to gain access to the pads on the back side.
I've tried to flash via the other serial port, because I saw it mentioned here:
https://developer.tuya.com/en/docs/iot/burn-and-authorize-wbr-series-modules?id=Ka78imt8pf85p
but I couldn't get it to work, it may require already having a bootloader? Anyway, we're using method as shown in first post, it's tested and reliable.

By the way, WT50-WH-3A, WT100-WH-3A and WT200-16A-W thermostats are WBR3 based. I already have their dpIDs, but I don't have those devices on hand, because the user who borrowed them to me so I can investigate them have already installed them. Still, I will post a separate teardown soon, but for now without flashing.

I've already did some basic tests and it seems that UART is working on OpenRTL:
https://www.elektroda.com/rtvforum/topic4093142-60.html#21363681
I wonder if we could somehow test Realtek with TuyaMCU, @divadiow if I remember correctly, you had some tool that can simulate TuyaMCU while running on PC? Maybe if we connected RTL to PC via that port and run TuyaMCU driver....

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#17 21376867 04 Jan 2025 17:58

divadiow divadiow

Level 34

Helpful post? (0)

Post #17
21376867 04 Jan 2025 17:58

p.kaczmarek2 wrote:
I wonder if we could somehow test Realtek with TuyaMCU, @divadiow if I remember correctly, you had some tool that can simulate TuyaMCU while running on PC? Maybe if we connected RTL to PC via that port and run TuyaMCU driver....

Yes. I have already sought to try with some TuyaMCU/RTL firmwares but getting the backups to boot is hampering efforts.

I used pk in the Aleco dehumidifier backup though and got the dpIDs that way after pairing with BK-N firmware. But yeh, that's not MCU simulation...

Added after 16 [minutes]:

p.kaczmarek2 wrote:
you had some tool that can simulate TuyaMCU while running on PC?

https://www.elektroda.com/rtvforum/topic4085796.html

Added after 9 [minutes]:

I'm thinking of something else of course- RTL factory firmware with fake MCU.

Yes, TMDA could be used to test OpenRTL I guess
ADVERTISEMENT
#18 21376939 04 Jan 2025 18:07

GAAD GAAD

Level 17

» | Helpful post? (+1)

Post #18
21376939 04 Jan 2025 18:07

Uploaded to WBR1-IPEX

.
.

The first problem is that it does not accept changing to its own IP and disabling DHCP.
The first template from OBK theoretically works. Theoretically, because apart from the power supply I have nothing plugged in.
As for the change of IP: it displays a message that it has accepted and that you should restart but after a while refreshes the page and the changes disappear. After the restart, DHCP works.

The OTA update to the new version went through in a flash with no messages on the reboot page.
The info about the start was displayed and the page no longer refreshed as in OBK with BK7231 but the software loaded correctly.
It is still not possible to disable DHCP.
#19 21376947 04 Jan 2025 20:39

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #19
21376947 04 Jan 2025 20:39

It seems there was one more thermostat with WBR3 that I already tested:
Room thermostat HY609-WE with WiFi - manual, app, interior, TuyaMCU protocol
The dpIDs are included in the topic but I don't have this particular device anymore...

I wonder what's the deal with so many thermostats on WBR3, looks like I already listed 4 of them in this topic today, is it just by a chance, or....?

[edited incorrect info]

Added after 2 [hours] 28 [minutes]:

EDIT:
GAAD wrote:

The first problem is that it does not accept changing to its own IP and disabling DHCP.

It's on our TODO list. Just not implemented yet. Do you need this feature? I might look into it, if needed, or maybe @insmod can help

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#20 21377266 04 Jan 2025 20:52

insmod insmod

Level 23

Helpful post? (0)

Post #20
21377266 04 Jan 2025 20:52

Static ip is currently not implemented, nor do i have any plans for it yet.
But it shouldn't be hard to implement, just disable LwIP_DHCP(0, DHCP_START); if static ip is set, and use netif_set_addr the same way it is used in HAL_SetupWiFiOpenAccessPoint
#21 21377306 04 Jan 2025 21:12

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #21
21377306 04 Jan 2025 21:12

I didn't test it, but here it is:
https://github.com/openshwprojects/OpenBK7231T_App/pull/1492/files
However now I'm not sure, don't we also need to STOP DHCP first, or do we assume that connect call always happen after fresh boot?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#22 21377677 05 Jan 2025 07:39

divadiow divadiow

Level 34

Helpful post? (0)

Post #22
21377677 05 Jan 2025 07:39

>>21375861

the Aleco does work. Just need the right TX/RX for MCU simulator, which I knew, but had reversed RX/TX!!
#23 21378157 05 Jan 2025 13:21

@GUTEK@ @GUTEK@

Level 31

» | Helpful post? (0)

Post #23
21378157 05 Jan 2025 13:21

Will this version of OBK for Realtek also work with this module?

.
They put them in the sockets, so far I have replaced them with ESP02 but somehow Tasmota does not suit me, I prefer OBK in action.
#24 21378249 05 Jan 2025 14:05

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

Post #24
21378249 05 Jan 2025 14:05

This module is still being worked on, it is not the RTL8720CF but the RTL8710BX. There will be a separate forum topic about the RTL8710BX.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#25 21378633 05 Jan 2025 17:26

rchristescu rchristescu

Level 7
Helpful post? (+1)

Post #25
21378633 05 Jan 2025 17:26

p.kaczmarek2 wrote:

Btw Do you have any flashdumps of RTL that are not (yet) there?
https://github.com/openshwprojects/FlashDumps

Thank you so much for this tutorial and for all the development.

Here is the original firmware from ERC2202-W:
https://www.elektroda.com/rtvforum/topic4048867.html#21046382
I understand you collect flashdumps for further development.

Attachments:

firmware_WBR2_ERC2202-W.bin Download (2 MB)
#26 21378638 05 Jan 2025 17:28

divadiow divadiow

Level 34

Helpful post? (0)

Post #26
21378638 05 Jan 2025 17:28

>>21378633

excellent. thanks for picking up my PM. I'll flash and have a look over it.
#27 21381809 07 Jan 2025 16:04

Jerther Jerther

Level 4

Helpful post? (0)

Post #27
21381809 07 Jan 2025 16:04

I have used this procedure on a Kasa HS200 smart switch with the RTL8710CF chip and I confirm it's working! The tests pads are clearly labeled on the PCB. I had to use the 5V pad to power the chip, and use the 3v3 pad to pull GPIO0 up.

Thank you so much
#28 21382174 07 Jan 2025 19:35

divadiow divadiow

Level 34

Helpful post? (0)

Post #28
21382174 07 Jan 2025 19:35

>>21381809

that's good news. feel free to post your OpenRTL template from the web GUI so it can be added to the device list (assuming you have it configured 100% working as intended)

if you have more info, pics etc, consider posting your findings into a new thread dedicated to the Kasa HS200.
#29 21384169 08 Jan 2025 22:37

GAAD GAAD

Level 17

» | Helpful post? (0)

Post #29
21384169 08 Jan 2025 22:37

What do I use to rip the contents of the module? Because I don't see an option in Ameba to read the memory write to file.
#30 21384196 08 Jan 2025 22:51

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #30
21384196 08 Jan 2025 22:51

We're still working on our own flasher, so we'll keep you updated.

I've received WBR3s today from a reader:

Added after 38 [seconds]:

Expect more testing soon. Maybe another NodeMCU hack?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Reply Cool? Ranking DIY | New topic

Notify about new articles

Report a violation of the law

Topic summary

The discussion focuses on flashing and configuring various Tuya-based modules, specifically those utilizing the RTL8720CF chip, such as WBR1, WBR2, WBR3, and W701-VA2-CG. A step-by-step guide for flashing these devices using the AmebaZ2 PG Tool is provided, allowing users to operate them without cloud dependency and integrate them with Home Assistant and Tasmota. Participants share insights on pinouts, boot logs, and the reliability of different flashing methods, including UART connections and potential modifications to access necessary pads. The conversation also touches on the calibration of devices and the collection of firmware dumps for further development.
Summary generated by the language model.

Home page
/
Forum
/
Smart Home
/
Smart Home IoT
/
Smart Home Tutorials
/
WBR2, WBR3, WBRU, W701-VA2-CG pinout, datasheet, flashing for Home Assistant