[AXY2S] [ECR6600] Teardown LSC Connect Smart Wall Dimmer (3207304)

Question

This is a teardown of the LSC Connect Smart Wall Dimmer (3207304). It is based on the AXY2S module/ESWIN ECR6600 which isn't supported by OpenBK. This chip seems to have a SDK available with some flashing/backup tools on GitHub: Tools can be found here: seems it is called RDTool. The chip...

insmod · Accepted Answer

>>21406429 Backup is taken via UART0, and WG236P standard firmware outputs log to UART0 too. Tuya backup included in this thread outputs log to UART1.

insmod · Accepted Answer

Since i ported RTL8720D, and i did say that i would port ECR6600 next:
I started port, and managed to boot compiled binary.
SDK version is reported as ECR6600F_v2.1.0b02p03t01, Release version 1.0.0
So it is newer than one used in ECR6600-TS2D_TuyaOS-3.5.7 (ECR6600F_v2.0.0B06P02), but older that skylab one.

insmod · Accepted Answer

OTA is implemented, but using classic mode (via http server and url) is preferable. While ota via post code looks simple, i had a lot of trouble of not making it crash. Even now, it crashes after binary is uploaded, but at least it works. If ota failed, reboot will be needed to try again.
Tried implementing ADC, but values shown are always ~3.3v, whether i pull it up or down. So i disabled it in code, but left VBAT measurements (introduced pseudo pin for that).

Modified lwip config, that fixed tcp disconnects.
Tried playing with power save, hoping that it would improve signal reception. But, for me it did nothing.
In HAL_PrintNetworkInfo aligning to left doesn't work. It always align to right.

Otherwise, looks stable in short time i tested it. But ping watchdog is mandatory, since i often got inaccessibility without wifi disconnect when signal is lower than -70dbm.
GPIO and PWM works, so i assume irq will work too.

Added after 39 [minutes]:

Decided to play around with test driver.
All passed, save TestParseIP.
If without define in str_to_ip, setting static ip crashed. If defined, test error is still there but result is this:

TestIPtoStr still passes.
Strangely, if started self-test from gui i see [00:03:38.627]Info:CMD:[7/19] Finished test of TestSprintfForFloat!
And then instant reboot, without crash. When starting from cli, everything is ok.
Once, when starting in gui it passed until there:
Debug:CMD:cmd [TestStrncpy]
Info:CMD:[9/19] Result OK!

Since static ip is not implemented, not a priority.

divadiow · Accepted Answer

yes. wifi seems bad. module is ~60cm away from my Intel Wi-Fi 6 AX200 160MHz - 69/29 (Mbps)

maybe something in here needs tweaking.

Added after 15 [minutes]:

OBK boot inc. wifi join 2.4ghz

Log in, to see the code

Added after 15 [minutes]:

insmod wrote:
Btw, you adapter mapping is a little wrong: IO13 is TX2, and ADC1 is IO15, ADC0 is IO14, at least in code.

I'm trying to reconcile the ADCs with the WG236 datasheet. TX2/IO13 changed in previous pic

why are there seemingly two UART2_TXD - GPIO0 and GPIO13?

divadiow · Answer

very interesting. I look forward to seeing a firmware backup if you can make one. The tool looks similar in its options to UTP for TR6260

jasperro · Answer

>>21378733 I was successful in getting a backup, I added it to the post along with instructions on how I did it. I don't know what to do with it, maybe open it in Ghidra somehow?

Anyway, now I can try to start development and test things. I will keep you up to date.

insmod · Answer

I ordered a wg236, an ecr6600 module myself.
But, i will try to port it only after amebad.
Looking at the backup, while there is ota_status partition, it looks like there is no separate partition for ota. The main app (cpu) partition is 0x1CA000 in length.
Maybe ota is like how it is done for esp8266 in non-os sdk? New app is written at the end of the partition, and bootloader then writes it at the start?
Config extractor finds the tuya magic, but can't extract anything

Tuya config extractor - magic is at 1921024 
WARNING - strange nextblock header E376778
WARNING - bad nextblock CRC
WARNING - strange nextblock header B3C05C39
WARNING - bad nextblock CRC
WARNING - strange nextblock header C9BF4B93
WARNING - bad nextblock CRC
WARNING - strange nextblock header 98945117
WARNING - bad nextblock CRC
WARNING - strange nextblock header 854B761D
WARNING - bad nextblock CRC
WARNING - strange nextblock header F9DCFD9F
WARNING - bad nextblock CRC
WARNING - strange nextblock header EE6A0E96
WARNING - bad nextblock CRC
WARNING - strange nextblock header A6A74BBF
WARNING - bad nextblock CRC
WARNING - strange nextblock header 3CE845C
WARNING - bad nextblock CRC
WARNING - strange nextblock header 3CE845C
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header C7430FB
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header AF84FFBC
WARNING - bad nextblock CRC
WARNING - strange nextblock header E342E90A
WARNING - bad nextblock CRC
WARNING - strange nextblock header DF51E4BD
WARNING - bad nextblock CRC
WARNING - strange nextblock header DF51E4BD
WARNING - bad nextblock CRC
WARNING - strange nextblock header DF51E4BD
WARNING - bad nextblock CRC
WARNING - strange nextblock header E342E90A
WARNING - bad nextblock CRC
WARNING - strange nextblock header DF51E4BD
WARNING - bad nextblock CRC
WARNING - strange nextblock header DF51E4BD
WARNING - bad nextblock CRC
WARNING - strange nextblock header DF51E4BD
WARNING - bad nextblock CRC
WARNING - strange nextblock header E342E90A
WARNING - bad nextblock CRC
Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
Failed to extract Tuya keys - no json start found

LTCT can't too

E: RuntimeError: Couldn't unpack storage data - see program logs
E: |-- File "ltchiptool\gui\work\base.py", line 24, in run
E: |-- File "ltctplugin\upk2esphome\work.py", line 32, in run_impl
E: |-- File "ltctplugin\upk2esphome\work.py", line 107, in run_file
E: |-- File "ltctplugin\upk2esphome\work.py", line 124, in run_data
E: Caused by ValueError: Validation failed at 'block magic'; while unpacking 'DataBlock._magic'; while unpacking 'KVStorage.data_blocks'
E: |-- File "ltctplugin\upk2esphome\work.py", line 122, in run_data
E: |-- File "bk7231tools\analysis\kvstorage.py", line 270, in decrypt_and_unpack
E: |-- File "datastruct\main.py", line 455, in unpack
E: |-- File "datastruct\main.py", line 446, in unpack
E: |-- File "datastruct\main.py", line 327, in _read_field
E: |-- File "datastruct\main.py", line 284, in _read_field
E: |-- File "datastruct\main.py", line 261, in _read_value
E: |-- File "datastruct\main.py", line 455, in unpack
E: |-- File "datastruct\main.py", line 446, in unpack
E: |-- File "datastruct\main.py", line 302, in _read_field
E: |-- File "datastruct\utils\context.py", line 13, in evaluate
E: |-- File "datastruct\fields\helper.py", line 147, in _validate

divadiow · Answer

Did you happen to capture the boot log for posting too?

Added after 11 [hours] 7 [minutes]:

insmod wrote:
Config extractor finds the tuya magic, but can't extract anything

I believe this is because TuyaOS3 has changed the way config is stored. It needs working out and a new config extractor made I guess. A few OS3 firmwares are about, including all Tuya LNs so far

Added after 22 [minutes]:

The LSC ECR6600 dump being

Log in, to see the code

jasperro · Answer

>>21389968 The boot log from UART0 (TX/RX) is very weird. It shows this:


ty heap base: 1f000 size: 196352
U��
U��
U��

repeating into infinity.
UART1 (L_TX/L_RX) shows this:


[00:00:00.004]tuya APP main()!!! reason:0
[00:00:00.006]SDK version ECR6600F_V2.0.0B06P02, Release version 1.0.0
[00:00:00.030]mac in amt
[00:00:00.049]psm event handle!
[00:00:00.051]psm lib build time: Dec 19 2023-22:43:01
[00:00:00.056]start TUYA application
[00:00:00.069]tuya_wpa_supp_evt_init:1665 wpa supplicant init event cb
[00:00:00.077][01-01 00:00:00 TUYA D][tal_thread.c:202] Thread:tuya_auth Exec Start. Set to Running Stat
[00:00:00.087][01-01 00:00:00 TUYA I][tal_thread.c:183] thread_create name:tuya_auth,stackDepth:4608,totalstackDepth:4608,priority:5
[00:00:00.103][01-01 00:00:00 TUYA I][mqc_app.c:325] mqc app init ...
[00:00:00.111][01-01 00:00:00 TUYA D][tal_thread.c:202] Thread:sys_timer Exec Start. Set to Running Stat
[00:00:00.119][01-01 00:00:00 TUYA I][tal_thread.c:183] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:8704,priority:5
[00:00:00.133][01-01 00:00:00 TUYA I][tal_thread.c:183] thread_create name:wq_system,stackDepth:5120,totalstackDepth:13824,priority:3
[00:00:00.144][01-01 00:00:00 TUYA I][tal_thread.c:183] thread_create name:wq_highpri,stackDepth:4096,totalstackDepth:17920,priority:4
[00:00:00.155][01-01 00:00:00 TUYA D][mqc_app.c:134] mq_pro:5 cnt:1
[00:00:00.160][01-01 00:00:00 TUYA D][mqc_app.c:134] mq_pro:31 cnt:2
[00:00:00.166][01-01 00:00:00 TUYA D][tal_thread.c:202] Thread:wq_highpri Exec Start. Set to Running Stat
[00:00:00.176][01-01 00:00:00 TUYA D][tuya_svc_online_log.c:223] svc online log init success
[00:00:00.187][01-01 00:00:00 TUYA D][log_seq.c:895] read m:0 f:0 l:0
[00:00:00.192][01-01 00:00:00 TUYA D][tuya_device.c:79] < TuyaOS V:3.3.105 BS:40.00_PT:2.3_LAN:3.5_CAD:1.0.5_CD:1.0.0 >
< BUILD AT:2024_01_10_08_49_07 BY ci_manage FOR tuyaos-iot AT eswin_ecr6600 >
IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 LITTLE_END:1 TLS_MODE:2 OPERATING_SYSTEM:98 RELIABLE_TRANSFER:RELIABLE_TRANSFER >

[00:00:00.219][01-01 00:00:00 TUYA D][tuya_device.c:80] ecr6600_common_singlefire_dimmer_user_config_ty:0.0.20
[00:00:00.229]###tkl_cpu_sleep_mode_set 1 0
[00:00:00.232]enable light sleep 
[00:00:00.235]###tkl_cpu_sleep_mode_set 1 0
[00:00:00.240]enable light sleep 
[00:00:00.243]enter pin_dev_init(), pin:22 
[00:00:00.246]gpio_num: 22 set GPIO func OK!
[00:00:00.251]pin_dev_init(),gpio_num : 22 init_status:1; 
[00:00:00.257]pin_dev_init()[22], gpio_num:0; 
[00:00:00.259]pin_dev_init()[22], pull_type:0; 
[00:00:00.265]enter pin_dev_init(), pin:25 
[00:00:00.268]gpio_num: 25 set GPIO func OK!
[00:00:00.273]pin_dev_init(),gpio_num : 25 init_status:1; 
[00:00:00.279]pin_dev_init()[25], gpio_num:1; 
[00:00:00.281][01-01 00:00:00 TUYA N][app_single_fire.c:287] >>>>> app_single_fire_init >>>>>
[00:00:00.290]psm_set_lowpower, is_lowpower is 1
[00:00:00.295]###tkl_cpu_sleep_mode_set 0 0
[00:00:00.298]disable light sleep 
[00:00:00.318]psm_set_normal, is_lowpower is 0
[00:00:00.322]###tkl_cpu_sleep_mode_set 1 0
[00:00:00.324]enable light sleep 
[00:00:00.327][01-01 00:00:00 TUYA N][tuya_wifi_single_fire.c:421] tuya_wifi_sf_set_enable:1
[00:00:00.335][01-01 00:00:00 TUYA N][tuya_key.c:340] for single fire, set key sleep time:0 ms
[00:00:00.344]gpio_num: 24 set GPIO func OK!
[00:00:00.349]tuya_wpas_sf_set_charge_cfg: voltage_feedback_en 1 charge_max_time 30000 discharge_max_time 12000 fast_connect_timeout 3
[00:00:00.364][01-01 00:00:00 TUYA N][simple_flash.c:447] key_addr: 0x1d5000   block_sz 4096
[00:00:00.373][01-01 00:00:00 TUYA N][simple_flash.c:533] get key:
[00:00:00.378]0x30 0x9d 0xab 0x65 0x6d 0x8d 0xbf 0xe4 0xb9 0x3f 0x35 0x4b 0xc9 0xe0 0xd4 0xe8 
[00:00:00.432][01-01 00:00:00 TUYA N][tuya_iot_com_api.c:318] uni_random_init...
[00:00:00.492][01-01 00:00:00 TUYA N][tuya_tls.c:359] tuya_tls_rand_init ok!
[00:00:00.504]UART INIT 
[00:00:00.506]psm_schedule_idle_cb,this is dbg info,first goto idle
[00:00:00.510]psm_schedule_idle_cb,this is dbg info,first goto idle
[00:00:00.515]psm_schedule_idle_cb,this is dbg info,first goto idle
[00:00:00.521]psm_schedule_idle_cb,this is dbg info,first goto idle
[00:00:00.529]psm_schedule_idle_cb,this is dbg info,first goto idle
[00:00:01.017]UART DEINIT 
[00:00:01.027][01-01 00:00:00 TUYA N][tuya_main.c:304] mf_init succ
[00:00:01.066][01-01 00:00:00 TUYA N][tuya_device.c:109] nc_tp = 1
[00:00:01.076]UART INIT 
[00:00:01.579]UART DEINIT 
[00:00:01.587]UART INIT 
[00:00:02.094]UART DEINIT
... UART INIT/DEINIT into infinity...

Seems the encryption key is

0x30 0x9d 0xab 0x65 0x6d 0x8d 0xbf 0xe4 0xb9 0x3f 0x35 0x4b 0xc9 0xe0 0xd4 0xe8

i guess?

divadiow · Answer

thanks for posting. I've had a device or two recently that will output at 115200 for then 921600 or 2000000 for the app. not like that is it?

jasperro · Answer

>>21392144 No, I don't think so. I have tried every baud rate in RDTool. There was one that kept printing fff (don't remember which). But the app log is still only on the second UART.

divadiow · Answer

😭 Skylab sent me WG236-U (ECR6600U (USB)) by mistake. refunded/ordered again.

insmod · Answer

Mine arrived

But. i'm taking a short break from iot, and trying to build a custom rom for my android phone.
Boot log:

[00:00:00.000]SDK version ECR6600F_v2.1.22, Release version 1.0.0
[00:00:00.021]EasyFlash V4.0.0 is initialize success.
[00:00:00.024]mac in amt
[00:00:00.037]NV PsmPOREnable not configured!
[00:00:00.038]NV PsmFlag not configured!
[00:00:00.044]NV PsmDeepSleepTime not configured!
[00:00:00.046]PSM init success
[00:00:00.049]psm event handle!
[00:00:00.052]rtc calculate start!
[00:00:00.055]health_monitor not ready
[00:00:00.060]flash auto set country read null, set 0
[00:00:00.066]device config complete
[00:00:00.070]BE2:0x7f00c
[00:00:00.070]BE3:0x7f00f
[00:00:00.072]BE4:0xf
[00:00:00.076]device config complete
[00:00:00.079]ps_set_mode: cfm_cnt 0
[00:00:00.082]set key failed, status 0x2
[00:00:00.083]set key failed, status 0x2
[00:00:00.089]set key failed, status 0x2
[00:00:00.092]set key failed, status 0x2
[00:00:00.095]set key failed, status 0x2
[00:00:00.100]set key failed, status 0x2
[00:00:00.103]wpa state: wl0 DISCON->INACT.
[00:00:00.106]wpa state: wl0 INACT->DISCON.
[00:00:00.112]set key failed, status 0x2
[00:00:00.114]set key failed, status 0x2
[00:00:00.117]set key failed, status 0x2
[00:00:00.120]set key failed, status 0x2
[00:00:00.125]set key failed, status 0x2
[00:00:00.128]set key failed, status 0x2
[00:00:00.130]wpa state: wl1 DISCON->INACT.
[00:00:00.136]wpa state: wl1 INACT->DISCON.
[00:00:00.178]init STAIP 
[00:00:00.179]init APIP 
[00:00:00.182]init DNS SERVER 
[00:00:00.185]at dhcps nv err
[00:00:00.187]at dhcpc nv err! 
[00:00:00.190]init DHCP_EN:1,1 
[00:00:00.193]at softap autostart... 
[00:00:00.195]load ap info nv fail
[00:00:00.198]Can not find local_ssid or local_password or local_channel in dnv.
[00:00:00.206]local ota: ssid:local_ota_test  password:12345678  channel:7
[00:00:00.212]--wifi_ctrl_iface--vif[0]:flush_bss 0

[00:00:00.217]--scan freq=2442 scan_ssid="local_ota_test"
[00:00:00.220]--w[00:00:00.223]
[0]:scan freq=2442 scan_ssid="local_ota_test"[00:00:00.223]


[00:00:00.232]OK
[00:00:00.232]
[00:00:00.235]wpa state: wl0 DISCON->SCAN.
[00:00:00.238]fhost scan cmd
[00:00:00.240]msg_id: MM_ADD_IF_REQ, dest_id: 32, src_id: 45, state: 0
[00:00:00.246]m_add_if_req_handler 0
[00:00:00.249]add vif 0, type 0, status 0
[00:00:00.251]45 scan start
[00:00:00.254]scan set channel 2442
[00:00:00.260]scan tx probe req, ssid cnt 1, len 14
[00:00:00.263]fhost scan cmd resp 0
[00:00:00.361]scan next 1
[00:00:00.362]scan finish
[00:00:00.365]fhost scan cfm: 0, cnt 0 rx_mgt:0 beacon:0 proberesp:0
[00:00:00.370]msg_id: MM_REMOVE_IF_REQ, dest_id: 32, src_id: 45, state: 0
[00:00:00.376]del vif 0
[00:00:00.378]wpa state: wl0 SCAN->INACT.
[00:00:00.381]ap num is 0
[00:00:00.384]--wifi_ctrl_iface--vif[0]:flush_bss 0

[00:00:00.389]--sca[00:00:00.391]OK
n freq=2442 scan_ssid="local_ota[00:00:00.392]
_test"
[00:00:00.397]--wifi_ctrl_iface--vif[0]:scan freq=2442 scan_ssid="local_ota_test"

[00:00:00.403]OK
[00:00:00.406]
[00:00:00.407]wpa state: wl0 INACT->SCAN.
[00:00:00.411]fhost scan cmd
[00:00:00.414]msg_id: MM_ADD_IF_REQ, dest_id: 32, src_id: 45, state: 0
[00:00:00.419]m_add_if_req_handler 0
[00:00:00.422]add vif 1, type 0, status 0
[00:00:00.425]45 scan start
[00:00:00.428]scan set channel 2442
[00:00:00.430]scan tx probe req, ssid cnt 1, len 14
[00:00:00.436]fhost scan cmd resp 0
[00:00:00.535]scan next 1
[00:00:00.536]scan finish
[00:00:00.539]fhost scan cfm: 0, cnt 0 rx_mgt:0 beacon:0 proberesp:0
[00:00:00.544]msg_id: MM_REMOVE_IF_REQ, dest_id: 32, src_id: 45, state: 0
[00:00:00.550]del vif 1
[00:00:00.553]wpa state: wl0 SCAN->INACT.
[00:00:00.555]ap num is 0
[00:00:00.558]enter normal mode 
[00:00:00.561]local ota scan fail.
[00:00:00.564]load wifi nv fail:1.

divadiow · Answer

:o :o

insmod · Answer

Managed to take a backup, but with startup address "0x0" it immediately booted to system.
But, if startup address was 0x10000, it didn't boot and was operable until next reboot. And since stub is loaded into ram and not flash, after reset it continued to work as before.

luteac · Answer

>>21403233 Which interface did you use to connect to the device? The UART0 or the LOG (L_TX, L_RX) one?

jasperro · Answer

>>21406429 The normal TX/RX (UART0).

divadiow · Answer

did you get past this with the LSC fw @insmod ? Code: TextLog in, to see the code Added after 12 [minutes]: how's the port going @jasperro?

jasperro · Answer

>>21417478 I am getting OpenBK and the drivers from SDK to build after some trouble with the Makefiles. I can build an image just fine, but I am not sure how to get the OpenBK built object files into the final image. It just seems to include some example app.

I think it probably has something to do with Boards/ecr6600/common/mdl_size/gen_mdl_ld.sh and Boards/ecr6600/common/ld_xip.script.S, but I'm not sure how to use them. Maybe you or someone else would like to take a look?

I will upload what I have now to GitHub on jasperro/OpenECR6600 and OpenBK7231T_App#jasperroOpenECR6600 and might try to get things working again this weekend.

And on the UART INIT/DEINIT you see, I have that too so it is probably working fine.

divadiow · Answer

yes, silly me. Just looked at your boot log again it's TuyaMCU. I just need to find the product key. @jasperro did you happen to capture the boot log with the module in place? What is the MCU in your device - I don't think I see it in the pics I will not be of much use with this Added after 47 [minutes]: >>21403198 my obligatory ESP adaptor mapping pic for the WG236

insmod · Answer

First boot on generic hals

[00:00:00.000]SDK version ECR6600F_v2.1.0b02p03t01, Release version 1.0.0
[00:00:00.022]EasyFlash V4.0.0 is initialize success.
[00:00:00.044]NV get PsmPOREnable failed!!
[00:00:00.046]NV get PsmFlag failed!!
[00:00:00.049]NV get PsmDeepSleepTime failed!!
[00:00:00.054]PSM init success
[00:00:00.057]psm event handle!
[00:00:00.060]rtc calculate start!
[00:00:00.063]health_monitor not ready
[00:00:00.067]mac in amt
[00:00:00.069]ps_set_mode: cfm_cnt 0
[00:00:00.072]set key failed, status 0x2
[00:00:00.073]set key failed, status 0x2
[00:00:00.079]set key failed, status 0x2
[00:00:00.082]set key failed, status 0x2
[00:00:00.087]wifi not ready!
[00:00:00.087]wifi not ready!
x2
[00:00:00.093]set key failed, status 0x2
[00:00:00.096]wpa state: wl0 DISCON->INACT.
[00:00:00.099]wpa state: wl0 INACT->DISCON.
[00:00:00.105]set key [00:00:00.107]wifi not ready!
 ready!
set key failed, status 0x2
[00:00:00.112]set key failed, status 0x2
[00:00:00.118]set key failed, status 0x2
[00:00:00.120]set key failed, status 0x2
[00:00:00.123]set key failed, statu[00:00:00.127]wifi not ready!
s 0x2
[00:00:00.131]wpa state: wl1 DISCON->INACT.
[00:00:00.134]wpa state: wl1 INACT->DISCON.
[00:00:00.147]wifi not ready!
[00:00:00.147]Entering initLog()...
[00:00:00.152]Commands registered!
[00:00:00.155]initLog() done!
[00:00:00.160]Info:MAIN:Main_Init_Before_Delay
Warn:CFG:CFG_InitAndLoad: Config crc or ident mismatch. Default config will be loaded.
Info:
Main_Init_Before_Delay done
[00:00:00.173]
Main_Init_Delay
[00:00:00.176]
Main_Init_Delay d[00:00:00.180]CFG:CFG_SetDefaultLEDCorrectionTable: setting defaults
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_BefoEDCorre_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Info:HTTP:TCP server listening
Info:MQTT:MQTT_RegisterCallback called for bT ecr660000000000/ subT ecr660000000000/+/set
Info:MQTT:MQTT_RegisterCallback called for bT obks/ subT obks/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/ecr660000000000/ subT cmnd/ecr660000000000/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obks/ subT cmnd/obks/+
Info:MQTT:MQTT_RegisterCallback called for bT ecr660000000000/ subT ecr660000000000/+/get
Info:CMD:CMD_StartScript: started @startup at the beginning
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
[00:00:01.201]Info:MAIN:Time 1, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
[00:00:02.199]Info:MAIN:Time 2, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
[00:00:03.205]Info:MAIN:Time 3, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
[00:00:04.201]Info:MAIN:Time 4, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
[00:00:05.199]Info:MAIN:Time 5, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
[00:00:06.206]Info:MAIN:Time 6, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
Info:MAIN:Boot complete time reached (5 seconds)
[00:00:07.206]Info:MAIN:Time 7, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16

Need to do something about partitions, since it is the same size as in stock tr6260, meaning env size is not enough to save config.

Added after 7 [hours] 48 [minutes]:

https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/13594856085
Flash it as all-in-one, no stub needed.
No uart, no irq for bl0937.
For some reason, mqtt freezes the device. Increasing buffer size didn't help.

Info:MAIN:Time 6, idle 0/s, free 183472, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/16 
Info:MAIN:Boot complete time reached (5 seconds)
Info:MQTT:mqtt_connection_cb: Successfully connected
Info:MQTT:mqtt_subscribed to ecr66001F58A5A6/+/set
Info:MQTT:mqtt_subscribed to obks/+/set
Info:MQTT:mqtt_subscribed to cmnd/ecr66001F58A5A6/+
Info:MQTT:mqtt_subscribed to cmnd/obks/+
Info:MQTT:mqtt_subscribed to ecr66001F58A5A6/+/get
[00:00:18.263]Info:MQTT:Publishing val ecr66001F58A5A6 to ecr66001F58A5A6/host retain=0
Info:MAIN:Time 7, idle 0/s, free 182624, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 3/16 
[00:00:19.180]Info:MQTT:Publishing val OpenECR6600 _ecr6600_ae5dd87cfc22 Feb 28 2025 19:12:14 to ecr66001F58A5A6/build retain=0
Info:MAIN:Time 8, idle 0/s, free 183584, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/16

Also often see tcp disconnects, in chrome it reports empty response. If i remember correctly, tr6260 also had the same problem.
LFS and config uses tuya config partition.
Doing firmware backup is mandatory, since at least on wg236p mac address is stored not in efuse, but on flash. And of course rf calibration is on flash too.
Wifi is so bad for me, that i either had to hold it perpendicular to wifi, or solder external antenna (that is what i've done later). Perhaps there is tx power setting in code somewhere?

Added after 1 [hours] 4 [minutes]:

I can see in mqtt explorer that it manages to publish build.
Tried increasing mqtt task stack size and delay, didn't work.

Added after 4 [minutes]:

Looked a little closer at the code and noticed, than next after build is mac publish. Turned out that HAL_GetMACStr was done incorrectly, so it's fixed now.

insmod · Answer

Uart and bl0937 irq are implemented. Irq is not tested, but uart works with tuyamcu simulator.
Standard uart pins are RX0-P5 TX0-P6. Alternate uart uses uart1 with default pins: P1-RX, P2-TX.
@divadiow can you test it all? Especially your signal reception, mine was a lot worse compared to beken, esp, etc. Even with soldered antenna, it is only at the same level as them.
Btw, you adapter mapping is a little wrong: IO13 is TX2, and ADC1 is IO15, ADC0 is IO14, at least in code.

https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/13604783135

divadiow · Answer

Ah crap, cheers for letting me know. Will fix. Yes to testing but am out for the next day or two :/

insmod · Answer

>>21462915 The only uart port without extra pins is UART1 (and even it has 2 variants for rts/cts). All uart/adc/pwm variants, from what i understood looking at the code is here https://github.com/openshwprojects/OpenBK7231...e303682c7c/src/hal/ecr6600/hal_pins_ecr6600.c

Added after 27 [minutes]:

Damn, i looked at the tool and noticed that partitions can be easily edited in it. And i struggled to do it manually via hex editor, with recalculating crc32 separately...

divadiow · Answer

OK. odd. Using LED I have confirmed IO14 and IO15 on the module map correctly as in pic with P14/P15 in OBK.

insmod · Answer

>>21463019 Then skylab labelled them incorrectly, because IO15 should be ADC1 and IO14 ADC0

Added after 6 [hours] 18 [minutes]:

Implemented static ip, and mac changing.
Also discovered a 'magic' way to improve wifi a little. Disabled undocumented amt_cal_info_obtain() in main, that allowed connecting even if rssi is lower than -90 (mine connected at -91, previously was not connecting if lower than -80). Though it still was inaccessible and mqtt failed to connect.

Updated partitions, needs uart flash, not ota.

Still need to actually test it on real device, because some may have encryption, and that would make any non-standard firmware unbootable.

divadiow · Answer

changed mac OK. though it did seem to stop using one from module initially (I did erase whole flash just before new build though, which may explain this if old mac was in flash?)

Added after 38 [minutes]:

insmod wrote:
Still need to actually test it on real device, because some may have encryption, and that would make any non-standard firmware unbootable.

yes. We only have two real device firmware so far and they both boot on WG236.

I may be getting an EU plug with ECR6600 today but it might be the same firmware we already have

Added after 3 [hours] 13 [minutes]:

divadiow wrote:
I may be getting an EU plug with ECR6600 today

I give up. Stupid T34 again

divadiow · Answer

OTA 1553_merge_36861d4df64d -> 1.18.57 ✅ from TX0/IO6: Code: TextLog in, to see the code

insmod · Answer

I also tried implementing OTA for TR6260, and it works! ...almost... No, it doesn't.
I managed to generate OTA diff image with ota_tool from ECR6600 (and it recognizes TR6260), but bootloader complained that version 3 is not supported.
After i manually patched OTA image to version 1, bootloader started to report this:

patch checking ...
patch check pass
update begin ...
OTA Update Done

But system is not updated.
It seems we need an older version of said tool, or a newer bootloader. I tried 3 different bootloaders (they differ a little, HLK-M20, ELM327 and standard nocrc), but none succeeded. Or an older bootloader to use A/B slots, the one where partitions are stored at 0x4000. Or a newer sdk perhaps.

>>21470619
Do you plan on changing MAC address? Since it is stored on flash in nv_amt partition, it can be easily changed.
Also, did you order WG236 from reseller or official store? Did you try to request SDK from them?
-85dbm, and main page is accessible. A miracle, i always have problems if rssi is lower than -80. As far as i understood, both TR6260 and ECR6600 tx power is more or less alright, but reception is worse.

[AXY2S] [ECR6600] Teardown LSC Connect Smart Wall Dimmer (3207304)

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Post #24

Post #25

Post #26

Post #27

Post #28

Post #29

Post #30

Topic summary