logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[AXY2S] [ECR6600] Teardown LSC Connect Smart Wall Dimmer (3207304)

jasperro 9309 73
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #31 21471135
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    insmod wrote:
    Do you plan on changing MAC address? Since it is stored on flash in nv_amt partition, it can be easily changed.

    no plans, but could do I suppose. I have changed it within OBK and it worked.

    insmod wrote:
    Also, did you order WG236 from reseller or official store?

    the same Skylab Ali store you posted a link for a while ago. 5 modules/1 lot.

    insmod wrote:
    Did you try to request SDK from them?

    yes. I am waiting for sales to talk to dev team to supply me with the SDK. Obviously hoping it's a later version. I pestered them earlier today because it seems to be taking a while :/

    insmod wrote:
    -85dbm, and main page is accessible. A miracle, i always have problems if rssi is lower than -80. As far as i understood, both TR6260 and ECR6600 tx power is more or less alright, but reception is worse.


    yeh what's the deal with this. I had to move WG236 right next to aerial to get this to work. 20cm further away and the GUI would struggle to load :(
  • ADVERTISEMENT
  • #32 21471943
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    >>21471135
    Since you've changed it within OBK, then it is changed in nv_amt.

    Your module performance seems to be worse than mine, because i can get it to connect and load gui through 2 walls and ~7m to AP, though only if i'm holding it perpendicular to it. My AP is AX3600 with 23dBm tx power, ch13 20mhz with 25-30 neighbouring aps.
    But even if i'm not holding it, it can sometimes connect, even if there's no gui.
  • ADVERTISEMENT
  • #34 21473272
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    >>21473263 Yay, a newer SDK! Can you upload it somewhere else? I got an ERR_ADDRESS_INVALID.

    Added after 2 [minutes]:

    Never mind, i managed to download using phone and mobile network.
  • #35 21473277
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    insmod wrote:
    Never mind, i managed to download using phone and mobile network.

    ah ok. just uploading to GH. glad you got it.
  • #36 21473279
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    For now, just applying it on top of current sdk throws errors, now i'm trying to fix it.

    Added after 31 [minutes]:

    Compiled it, but unfortunately inaccessibility issue remains. But there was no connection slowing down at -86dbm rssi.

    Added after 34 [minutes]:

    However, it seems it manages to 'reconnect'. I placed it parallel to AP, gui stopped being accessible. Then placed it perpendicular and it managed to start being accessible. But perhaps that was a one time thing, i'm not sure.

    Added after 16 [minutes]:

    Pull request opened.
    It seems resulting binary is a lot bigger now, previously is 688kb, not it's 756kb.
  • #37 21473425
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    Boo. Doesn't sound like newer SDK is a great leap forward... Yet
  • #38 21473474
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    It seems i just undefined CONFIG_ECR6600_DBGTRIM like in skylab, and that increased the size.
    After i redefined it, size dropped to 696kb.
    But even with it, there is a lot of free space, since updates are not A/B, but compressed ones.
  • #39 21474230
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    went on a hunt last night for ECR6600 treasure. Not sure I've found anything but there are a ton of resources here http://ftp.hi-flying.com:9000/

    including some ECR6600 stuff which is where I started http://ftp.hi-flying.com:9000/%E7%94%9F%E4%BA%A7/%E7%94%9F%E4%BA%A7%E5%B7%A5%E5%85%B7/
    Directory index with Chinese file names for download.

    eg ECR6600 WLAN Facility executables
    Screenshot of a folder with a list of files and folders in Windows.

    other resources in there for BL602, RDA5981. looks old though

    Added after 2 [minutes]:

    don't really know what to do with a lot of the stuff
    Screenshot of WLAN Facility software displaying test statistics and device status.
  • #40 21474686
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    >>21474230 Another variant of SDK is here: http://ftp.hi-flying.com:9000/HF-LPT62X0/SDK/HF-LPT62X0_SDK_2MB_4MB_V1.03.04_20240821.rar
    Unfortunately, it is not a full sdk, all of the code is in static libs.
    SDK version, according to the docs is v2.1.23.2. From libversion.a: ECR6600F_v2.1.23.3_hanfeng V2.0.0 10:39:42 May 25 2024
    Fortunately, i was able to add libs to our sdk with minimal changes required.
  • ADVERTISEMENT
  • #41 21474737
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    cool.

    They supply some firmware for that module which was build using that SDK ver

    Code: Text
    Log in, to see the code


    http://www.hi-flying.com/download-item-hf-lpt62x0-firmware

    OTAd from OpenECR6600 to LPT6200_1.03.04_UPGRADE_4M_20240813.bin and then it just outputs this on boot. Not sure what this fw does.
    Code: Text
    Log in, to see the code


    I had already made contact with HF asking for full SDK access.
  • ADVERTISEMENT
  • #42 21474739
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    >>21474737 You ota'd to 4mb firmware. We only have 2mb.
    Try attached one.
    We don't really need full sdk, considering almost nothing was really updated in open source parts (according to includes).
    Most of the updates were probably in proprietary code, which comes in static libs (e.g. 802.11 code, psm etc).
    Attachments:
    • LPT6200_standalone_Compress_ota_packeg.bin (487.38 KB) You must be logged in to download this attachment.
  • #43 21474743
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    ha. of course. had they were 4mb in my head. same result for that file
  • #44 21474745
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    Perhaps log outputs to different port? It should boot at least, even if it shouldn't work normally because of some missing partitions.
  • #45 21474750
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    did try other TXs. well, IO6, IO22, IO13, IO0 and IO2 @115200
    also tried this as AIO to same result
    Screenshot of RDTool V1.0.21 showing firmware downloading and flashing process.

    Added after 2 [minutes]:

    I'm hunting for my spare ipex connector aerials - not seeing anything broadcast from it with the HF firmware I don't think. Though you'd expect their calib to be OK anyway surely?

    Added after 28 [minutes]:

    insmod wrote:
    Fortunately, i was able to add libs to our sdk with minimal changes required.

    were you able to determine any changes/differences of particular interest?
  • #46 21474785
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    >>21474750 Except for libs, almost nothing.
    Check sdk repo last commit for imported changes.
    Libs are most important though, almost a year newer than v2.1.22 (ECR6600F_v2.1.22 V2.0.0 18:31:40 Jun 1 2023).
  • #47 21474786
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    insmod wrote:
    Libs are most important though

    oh cool.

    Added after 11 [minutes]:

    I wonder if our PCB antennas are connected. It looks it's all there - I think. Could try tracing I guess. The datasheet seems to suggest it's one or the other though
    Table showing module numbers and antenna connector types.
  • #48 21474804
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    >>21474786 I soldered an ipex to one module, and i did have to remove resistor and connecting ipex side with a blob before it worked.
  • #49 21474808
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    >>21474786
    but then the label on my modules say WG236A.
    I have this pic from @DeDaMrAz which I think are his ECR6600s. They don't look to have ipex connectors, so I wonder if his experiences with wifi signal are the same
    Skylab electronic modules with printed QR codes on a dark background.

    Added after 1 [minutes]:

    and this looks like a "P"
    Electronic module with Skylab branding and markings.

    Added after 1 [minutes]:

    maybe I could trouble him for a better hi-res pic

    Added after 1 [minutes]:

    >>21474804

    oh nice. feel free to share a pic if you're happy to. I don't have any aerials that match the connector size it seems
  • #50 21474812
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    >>21474808 I didn't either, i soldered IPEX instead of intended MHF4. So i had to solder only one side, and when i removed the antenna, all of it except central part ripped off as well.
  • #51 21474814
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    oh I get you. OK.

    Added after 8 [hours] 43 [minutes]:

    Playing. some notes:

    erase flash
    flash OpenECR6600 AIO to 0x0
    boot
    readback to 2mb file
    generic mac seen at:
    Screenshot showing a section of hex memory analysis with a selected address.

    set mac manually in OBK. mac then seen at 1FE308

    Table snippet with entries 0x001F E000 and NV AMT (8KB) and RF values.

    copy Tuya ECR6600 dump from 1FE000-1FFFFF and transplant into 2mb OBK dump.
    picked up Tuya mac but wifi no better
    View of the OpenECR6600 user interface with configuration options.
  • #52 21477678
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14440
    Help: 650
    Rate: 12410
    I've reviewed and merged PRs, but I'm not sure it's it yet ready to be added to releases? TR6260 still has no OTA because of OTA tool/bootloader mismatch, and there is still some wifi instability? Or which issues are pending for those two platforms?
    Helpful post? Buy me a coffee.
  • #53 21477692
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    >>21477678 Wifi instability can mostly be countered by ping watchdog, especially on TR.
    But overall, both of those platforms have wonky wifi, and on ecr6600 i had to gui access, mqtt failed to connect but ping watchdog didn't trigger.
    I would've just marked them as use-at-your-own-risk.
    Btw, new partition file for TR is here: https://github.com/NonPIayerCharacter/OpenTR6260/blob/master/new_partition_0x6000.bin
  • #54 21477727
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    insmod wrote:
    both of those platforms have wonky wifi,


    You'd think these WG236 modules would be fine, but have we any feedback on wifi performance from users with releases flashed to real devices? Maybe @jannie_doedel @miegapele @Jamiwi are willing to report on that.
  • #56 21488355
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    :/
    also. have you ever got the efuse read to work? I've tried with and without stubs of various versions
    Interface of a firmware upgrade tool with a list of settings and errors.
  • #57 21488364
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    >>21488355
    You need AT to read those
    Checked menuconfig, but found nothing worthwhile.
  • #58 21488380
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    Ah interesting cheers.
    Would be interesting to see what's read out with the AT firmware flashed to a real Tuya device, assuming that would work. What aes key, if any... Etc
  • #59 21522920
    Maximilian0017
    Level 7  
    Posts: 12
    Help: 1
    Rate: 1
    Hi,

    Is there any news on this project?
    Can we do anything to help?
  • #60 21522927
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    Maximilian0017 wrote:
    Is there any news on this project?


    about ECR6600 open-source firmware alternative support? Yes: https://www.elektroda.com/rtvforum/topic4111822.html

    or do you mean about the separate efforts to extract config data from ECR6600 Tuya dumps?
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion centers on the teardown and firmware development efforts for the LSC Connect Smart Wall Dimmer (model 3207304), which uses the AXY2S module based on the ESWIN ECR6600 chip. The ECR6600 is not currently supported by OpenBK firmware, but an SDK and flashing/backup tools (RDTool) are available on GitHub. The chip is similar to the TR6260, and ongoing porting efforts are documented in repositories such as jasperro/OpenECR6600 and OpenBK7231T_App. Users successfully extracted firmware backups via UART0 and analyzed boot logs, revealing TuyaOS V3 firmware with some changes in configuration storage compared to earlier versions. Challenges include unstable Wi-Fi reception, OTA update issues due to bootloader and OTA tool version mismatches, and limited documentation with only partial datasheets available. Various SDK versions have been obtained, including newer releases (v2.1.22 and v2.1.23.3), but integration and stability improvements remain in progress. Hardware variations include WG236 and WG236A modules, some with IPEX antenna connectors requiring modification for proper signal reception. Wi-Fi performance varies, with some users reporting poor reception and others achieving stable connections through walls and distance. Tools and code for UART, GPIO, PWM, ADC, and IRQ support are being developed and tested. The community is working on improving OTA functionality, MAC address modification, and partition management. Additional resources and SDKs have been shared from sources like SkyLab and Hi-Flying. Overall, the project is in active development with partial success in firmware porting and hardware support, but Wi-Fi stability and OTA remain key issues to resolve.
Generated by the language model.
Today's popular

FAQ

TL;DR: For modders backing up or porting the LSC Connect Smart Wall Dimmer 3207304, the working path is clear: read a 2048KB flash dump over UART0, because “READ Flash Success!” is confirmed with RDTool plus the ECR6600 stub. This FAQ helps anyone handling the AXY2S/ECR6600 platform, TuyaOS 3 storage changes, and early OpenECR6600 support. [#21377851]

Why it matters: This thread turns a previously unsupported Tuya dimmer into a documented ECR6600 case study for backup, reverse-engineering, and early open-firmware migration.

Option What it does well Main limitation Practical status
Stock Tuya firmware Boots reliably and exposes Tuya app logs Closed platform, config extraction fails Best baseline
RDTool + ECR6600 stub Reads full flash backup to PC Wording is confusing; timing matters on VBat Confirmed working
OpenECR6600 / OpenBK Custom firmware, UART, OTA, TuyaMCU support Wi-Fi and sleep behavior varied by module/SDK Usable, still maturing
WG236A test modules Good for bench testing and SDK work Reported weak receive performance on some units Mixed results

Key insight: The hardest blocker was not dumping flash. It was platform maturity: TuyaOS 3 storage changed, UART logs split across ports, and ECR6600 Wi‑Fi and sleep behavior depended heavily on module, partitions, and SDK version.

Quick Facts

  • The confirmed backup size for the LSC dimmer is 2048KB, read after desoldering the AXY2S module and using RDTool with the ECR6600 stub. [#21377851]
  • On the original Tuya dimmer firmware, UART0 handled flashing access while the readable Tuya application log appeared on UART1 (L_TX/L_RX). [#21406440]
  • One captured stock boot string reported TuyaOS V:3.3.105 built on 2024-01-10 08:49:07 for eswin_ecr6600. [#21389968]
  • Early OpenECR6600 testing showed default serial mappings of RX0=P5, TX0=P6 and alternate UART1 on P1/P2. [#21461296]
  • Power-save testing on a newer ECR6600 build dropped current from about 0.12A to roughly 0.02–0.03A with powersave 1 or powersave 2. [#21622863]

How do I back up the flash on an LSC Connect Smart Wall Dimmer 3207304 with an AXY2S/ECR6600 module using RDTool and the ECR6600 stub?

Use UART0 and the ECR6600 stub to read a full 2048KB dump. 1. Desolder the AXY2S module and wire TX->RX, RX->TX, GND->GND, plus a loose VBat lead. 2. In RDTool, load the stub in the Develop tab, press Start, then quickly connect VBat to 3.3V when the log says it begins downloading the stub. 3. In the Flash tab, choose a save path and start the read. RDTool then counts up 10%, 20%, and ends with “READ Flash Success!”. [#21377851]

What is the AXY2S module, and how is it related to the ESWIN ECR6600 chip in Tuya-based smart devices?

The AXY2S module is the radio module used on this dimmer, and it is built around the ESWIN ECR6600 chip. "AXY2S is a Wi‑Fi/BLE module that integrates the ECR6600 SoC, exposing the chip through a packaged module used by Tuya devices." In this thread, the LSC Connect Smart Wall Dimmer 3207304 uses an AXY2S/ECR6600 combination, which is why OpenBK support had to be ported to ECR6600 rather than a better-known Beken part. [#21377851]

Why does the LSC Connect Smart Wall Dimmer output the Tuya app boot log on UART1 (L_TX/L_RX) instead of UART0?

Because this device routes the Tuya application log to UART1, while UART0 stays available for flashing and lower-level access. The captured boot log showed full Tuya app output on L_TX/L_RX, including the SDK banner and product string, while UART0 only printed ty heap base: 1f000 size: 196352 followed by repeated garbage characters. That split is device-specific: a standard WG236P firmware later showed logs on UART0, but the Tuya dimmer dump did not. [#21391389]

What does the repeating UART INIT and UART DEINIT log mean on the ECR6600-based LSC dimmer, and is it normal?

It appears normal for this stock Tuya firmware. The dimmer repeatedly printed UART INIT and UART DEINIT on the app-log UART after boot, and later testing confirmed other users saw the same behavior on the LSC firmware. One developer explicitly said that if you see the same INIT/DEINIT loop, “it is probably working fine.” So treat it as expected firmware behavior, not proof of a bad flash or dead module. [#21417576]

Which UART interface should I use to flash or back up an ECR6600 device: UART0 or the LOG port on L_TX/L_RX?

Use UART0 for flashing and backup. The thread confirms the working backup connection was the normal TX/RX port, not the LOG pads. Later follow-up made it explicit: backup is taken via UART0, while log output may appear on UART0 or UART1 depending on the firmware. On the LSC Tuya dump, flashing used UART0 and the readable boot log appeared on UART1. [#21406440]

Why can’t Tuya config extractor or LTChipTool unpack the config from an ECR6600 TuyaOS 3 firmware dump?

Because the dump uses a newer TuyaOS 3 storage layout that the existing extractors do not understand. The thread showed both tools finding Tuya markers but failing validation: the config extractor reported bad CRCs and “no json start found,” while LTChipTool failed at block magic. One contributor summarized the reason directly: “TuyaOS3 has changed the way config is stored.” That means the failure is a format mismatch, not proof that the dump is corrupt. [#21389968]

What is RDTool for ECR6600, and how are its upload and download options labeled compared with what they actually do?

RDTool is the vendor-style flashing and readback utility used with ECR6600 chips, but its labels are reversed. In this tool, upload actually means reading data from the device to the PC, and download means writing data from the PC to the MCU. That matters when you back up flash, because the correct operation is the one labeled as an upload even though you are saving a file locally. The thread calls this out as a specific trap. [#21377851]

How do OpenECR6600 and OpenBK compare with stock Tuya firmware on ECR6600 devices for flashing, OTA, and device support?

Stock Tuya firmware is the reliable baseline, while OpenECR6600 adds real custom-firmware control but still had edge cases during development. By March 2025, developers had booted compiled OpenECR6600 binaries, added UART and BL0937 IRQ support, and offered all-in-one images that did not need a stub. OTA also worked in some paths, but classic HTTP URL OTA was preferred because POST-based OTA could crash after upload. Real-device support improved later, and users reported ECR6600/BL0937 EU plugs running OpenECR6600 without obvious Wi‑Fi trouble. [#21522945]

Why is Wi-Fi reception reported as weak or inconsistent on some WG236A ECR6600 modules even when transmit power seems fine?

Because several testers saw a receive-side problem on WG236A modules, not a simple transmit-power issue. One report said the module could show about -75dBm on the router but -90dBm on the device log, with HTTP already broken. Another needed the module oriented perpendicular to the access point or placed within 20cm of the antenna to keep the GUI usable. Later tests on real devices looked better, so the issue seems concentrated on some test modules and antenna setups. [#21523878]

What GPIOs, UART pins, and ADC pins are mapped on the WG236 or WG236A ECR6600 modules when using OpenECR6600?

OpenECR6600 testing mapped the standard UART to RX0=P5 and TX0=P6, with alternate UART1 on P1 RX and P2 TX. The thread also corrected board notes: IO13 is TX2, ADC1 is IO15, and ADC0 is IO14 in code. "WG236 is an ECR6600 module that exposes GPIO, UART, ADC, and PWM functions through board pins, but several alternate functions share pads and caused mapping confusion in testing." That is why screenshots and silkscreen labels did not always match code behavior. [#21461296]

How can I change or preserve the MAC address on an ECR6600 module when flashing OpenECR6600, especially if the MAC is stored in flash instead of efuse?

Back up the original flash first, because some ECR6600 modules store the MAC in flash, not efuse. Developers noted that on at least one WG236P, the MAC lived in the nv_amt partition, and erasing flash could replace it with a generic default. OpenECR6600 later added MAC changing, and testers confirmed that changing the MAC inside OBK updated the value stored in flash. Preserving the original backup also keeps RF calibration data, which is stored there too. [#21459742]

What is the BL0937 chip in these smart dimmer and plug devices, and how is it used with OpenECR6600 or TuyaMCU setups?

BL0937 is the metering chip used for power measurement in several ECR6600 smart plugs, and OpenECR6600 added early support for its interrupt path. "BL0937 is an energy-monitoring IC that measures mains parameters and reports them to the main Wi‑Fi MCU, often through pulse or interrupt-based signaling." In this thread, developers first reported “no irq for bl0937,” then later implemented BL0937 IRQ support. Another tester identified an ECR6600 device as TuyaMCU-based, meaning the Wi‑Fi module and external controller can split duties instead of running everything on one MCU. [#21461296]

Why does ECR6600 OTA sometimes upload successfully but still fail to update, and how do bootloader or partition mismatches affect it?

OTA can complete the transfer but still fail because the bootloader, OTA image format, or partition layout does not match. A related TR6260 test showed the bootloader saying “patch check pass” and “OTA Update Done,” yet the firmware never changed. On ECR6600, developers also warned that partition sizing mattered, and newer images sometimes required UART flashing rather than OTA after partition updates. One clear failure case was trying a 4MB Hi-Flying firmware on a 2MB module, which only printed HF-LPT6200 and did not behave normally. [#21474737]

What device template or config is available for the LSC Connect Smart Wall Dimmer 3207304, including the known Tuya dpIDs like switch_led_1 and bright_value_1?

A complete OpenECR6600 device template was not published in this thread, but the Tuya datapoints were identified. In January 2026, the dimmer was matched to model ID ecx4sg with dpIDs including switch_led_1 as ability 1, bright_value_1 as ability 2, brightness_min_1 as ability 3, and countdown_1 as ability 6. The brightness range was listed as 10 to 1000. A placeholder add to the device list was also linked, showing the device was at least partially characterized. [#21809988]

How do deep sleep and power save modes behave on newer ECR6600 SDK builds, and what problems should I expect after wake-up?

Newer SDK builds improved power save, but deep sleep still behaved inconsistently after wake. One tester measured about 0.12A at powersave 0 and 0.02–0.03A at powersave 1 or powersave 2, while the device stayed responsive. Deep sleep entered correctly with commands like deepsleep 30, and the module could wake after 30s, but Wi‑Fi rejoin was erratic. In several wake cycles, the device booted, scanned, reached state 6, then disconnected repeatedly until a hard power cycle or later reboot restored normal joins. [#21622863]
Generated by the language model.
ADVERTISEMENT