Flashing OpenBeken on BK7238 Module (WB43-M5 V1.1) with Surplife App

Question

I have some light bulbs with BK7238 Module (PCB Marking WB43-M5 V1.1) - Surplife app. I bought the same bulb from the same seller and they used to have BL602 modules. Now they are shipping it with this chip, same app, same box. I managed to dump the flash and rom, how can I flash OpenBeken? You...

divadiow · Accepted Answer

Interesting. I saw your post over there and was planning to look over that firmware backup in the morning.

BK7238 development is still a work in progress but there are OpenBK7238 firmwares that could be flashed

https://www.elektroda.com/rtvforum/topic4092465-60.html#21361724

Added after 7 [hours] 28 [minutes]:

so yes, your device is a Zengge/SurpLife RGBCCT - BulbD46D - with BP5758D

Here is boot log 115200/2000000

Log in, to see the code

Added after 7 [minutes]:

maybe this new device should be its own new thread @p.kaczmarek2 for BK7238 testing/progress?

divadiow · Accepted Answer

Easy Flasher can be used to read/write firmware from BK7238 - To burn the latest BK7238 firmware, place OpenBK7238_QIO__beken_sdk_f866976df64b.bin from the attached zip into the EasyFlasher firmwares subdir and rename to OpenBK7231N_QIO__beken_sdk_f866976df64b.bin Be sure to reveal advanced options and to choose skip key check or flash with BKFIL Yes - the NiceMCU board with XH-WBS3 module

Jinaria · Answer

Thanks,

- I'm not sure how to flash the experimental firmware, I dumped the flash and ROM using ltchiptool but it cannot write to the flash.
- How did you get the boot log? Did you flash it to a development board?
- I'll add PCB and module photos later this evening.

divadiow · Answer

please be aware that not everything may work yet and that flashing is at your own risk

Jinaria · Answer

Thank you for the step by step guide, I managed to flash the firmware successfully but for some reason the AP does not show up. I noticed that the factory firmware dump is 2MB but the experimental firmware size is only 1224KB. Added after 24 [minutes]:Cannot edit the first post, here are some photos of the smart bulb:

divadiow · Answer

are you able to see if there is any log UART log out from TX to see if it's booting at all? I'm not sure we know much about this module. Does it have labels on the reverse of the module? Added after 2 [minutes]:if you're able to, please post clear head-on front and rear pictures of the module

Jinaria · Answer

Here is a boot log, seems to be in some kind of boot loop : Code: text Expand Select all Copy to clipboardBK7238_1.0.14 REG:cpsr        spsr        r13         r14 SVC:0x400000D3              0x0042F810  0x00010008 IRQ:0x400000D2  0x00000010  0x0042FC10  0x48C01942 FIR:0x400000D1  0x00000010  0x00430000  0x30602F40 SYS:0x400000DF              0x0042B820  0x00000158 ST:0x00010000  Fal(V0.4.0)success                             RT-Thread OTA package(V0.2.8-beken-1133282d-20    220604) initialize success. go os_addr(0x10000).......... BK7238_1.0.14 REG:cpsr        spsr        r13         r14 SVC:0x400000D3              0x0042F810  0x00010008 IRQ:0x400000D2  0x00000010  0x0042FC10  0x48C01942 FIR:0x400000D1  0x00000010  0x00430000  0x30602F40 SYS:0x400000DF              0x0042B820  0x00000158 ST:0x00010000  Fal(V0.4.0)success                             RT-Thread OTA package(V0.2.8-beken-1133282d-20    220604) initialize success. The module has RX/TX/CEN/V3.3/GND on the back.

divadiow · Answer

interesting. I'll just flash it myself. I can't remember if there was something about the QIO file. We might have to slice it up and flash from a certain address or do OTA

divadiow · Answer

so yes, flashing the QIO from 0x0 (I used BKFIL) does not result in any output for me - not even bootloader.

I've flashed your original firmware in its entirety

then flashed OpenBK7238__beken_sdk_f866976df64b.rbl.bin (from zip file above - add .bin to the end) from 0x132000

if you can open the COM port quick enough you'll see the tail-end of the OTA

then the AP broadcasts

taggbricka · Answer

I just bought (accidentally) a few of these XH-WB3S modules. I was not aware they were BK7238 based.

However I have reprogrammed one with BK723flasher like so:

After this the module seems to be idle after power up, draws only 4mA.
I am wondering if some of the port pins need to be at 3.3V or 0V at startup for the module to boot correctly.

insmod · Answer

>>21438048 Try this firmware, it's the latest version available. EDIT: deleted, this version fails to boot.

p.kaczmarek2 · Answer

I've seen your PR is ready to merge @insmod, is it working well now? I didn't manage to check it myself yet, first XR806 took my time and now real life stuff.

insmod · Answer

>>21438169 Probably not, i just tried to flash QIO - and it failed to boot. Shows bootloader log, delays a few seconds, repeatedly. Flashing rbl works.

p.kaczmarek2 · Answer

Interesting, but it worked before, right? So maybe checking last commits can give us some insights? I can also try to get my NiceMCU and test tomorrow morning and report back

taggbricka · Answer

Flashed the (renamed) OpenBK7231N_QIO_1527_merge_2fec4f7723d8.bin to a new BK7238. I don't think it started afterwards.Including the flasher log and the backup image from the brand new device if it might be of any interest.

insmod · Answer

Fixed boot, caused by encrypting the binary with standard tuya keys, instead of no encryption.

insmod · Answer

@p.kaczmarek2 now it can probably be merged, boots ok.
Everything bar SPIDMA should work.
For some reason, flasher fails to read config, encryption problems or something else?

Will try to read device flash MID (for unprotect N):
Flash MID loaded: 152085
Will now search for Flash def in out database...
Flash def found! For: 152085
Flash information: mid: 152085, icName: P25Q16HBK, manufacturer: Puya, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-31-FF-FF
Entering SetProtectState(True)...
sr: 4
sr: 4004
final sr: 4004
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to read encryption key...
Encryption key read done!
Encryption key: 84f67900 84f67900 84f67900 84f67900
^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
WARNING! Non-standard encryption key!
If it's all zero, it may also mean that read is disabled.
Please report to forum https://www.elektroda.com/rtvforum/forum51.html 
Or just try using BK7231M mode 
^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
Going to start reading at offset 0x1D1000...
Reading 0x1D1000... Ok! 
Basic read operation finished, but now it's time to verify...
Data is entirely filled with 0xff, something must went wrong!
OBK config load failed.

taggbricka · Answer

Lovely, Thank you!

Added after 1 [hours] 6 [minutes]:

One device starts up and then goes to zero current consumtion after 2 seconds. (other devices consumes 35mA in operation)
Tried to reprogram it, programming succeds.

This is on the serial port:

BK7238_1.0.14
REG:cpsr spsr r13 r14
SVC:0x000000D3 0x00401C1C 0x000033A0
IRQ:0x000000D2 0x00000010 0x00401E0C 0x09BCA98D
FIR:0x000000D1 0x00000010 0x00401FFC 0x10F08789
SYS:0x000000DF 0x0040192C 0x00000158
ST:0x00000000
[I/FAL] Fal(V0.4.0)success
[I/OTA] RT-Thread OTA package(V0.2.8-beken-1133282d-20
220604) initialize success.

go os_addr(0x10000)..........

insmod · Answer

>>21438506 You either flashed an older firmware, or looking at wrong uart port. OBK sends log to UART1 by default, so try to connect your adapter to either P0 or P1 (i don't remember which).
If you reflash with bootloader overwrite, then bootloader will also log to uart1.

p.kaczmarek2 · Answer

It seems @insmod did a very good job. Works for me at first try. I just need to update the flasher. Log from programming UART: ( didnt have time to connect debug uart) LED RGB is on P6, P24, P26..

taggbricka · Answer

There is something funny with my last unit.

I reflash it with "bk7231flasherfirmwaresOpenBK7231N_QIO_1527_merge_2cd87167de38.bin"
That works OK.
I connect to the device AP 192.168.4.1
There I get a full UI.
I go to wifi setup and enter my net's local credentials and submit.
After this the UI at 192.168.4.1 is still active. I can navigate in it freely. The wifi credentials are there to see.
Then I power cycle the device, it powers up to 35mA and after 2 seconds crashes to 5mA. It is not possible to access anymore.

I have repeated this twice.

EDIT:
I will try to check debug output and see if there is something.

p.kaczmarek2 · Answer

Here my BK7238 is stable: I am updating flasher:

divadiow · Answer

YES!! (and an option to relax filename matching restrictions?)

p.kaczmarek2 · Answer

Is Custom read working or not? I don't really remember at the moment:

divadiow · Answer

I haven't got round to testing it yet Added after 11 [hours] 39 [minutes]: If this is a showstopper for SPI/PixelAnim/SM16703P then I can test using when/if required

p.kaczmarek2 · Answer

I am fixing small stuff for BK7238, I altered flash tool for it, I am fixing OTA in the Web App, etc, I will try to fix DHT11 and later maybe SPI DMA, depending on what is the problem, is the SPI DMA driver totally missing or just different? https://github.com/OpenBekenIOT/webapp/commit/39fde8263f682323bb4b8ced6b0cfe8fa3b1b006

Added after 1 [minutes]:

Screenshot of the OTA interface for the BK7238 chipset.

Added after 1 [minutes]:

ajh one more fix needed
https://github.com/OpenBekenIOT/webapp/commit/7cdc1daadd54a10a01bbac2516e3e56d96775a19

taggbricka · Answer

Here is the startup debug output on pin P0. bk7231flasherfirmwaresOpenBK7238_QIO_1527_merge_2cd87167de38.bin Flashed with today's version of bk7231flasher.

p.kaczmarek2 · Answer

Looks like a random crash? What does the reboot reason say? I'm testing BK7238 NiceMCU on latest release with MQTT and it seems ok so far:

Flashing OpenBeken on BK7238 Module (WB43-M5 V1.1) with Surplife App

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Post #24

Post #25

Post #26

Post #27

Post #28

Post #29

Post #30

Topic summary