This is a teardown of the LSC Connect Smart Wall Dimmer (3207304). It is based on the AXY2S module/ESWIN ECR6600 which isn't supported by OpenBK. This chip seems to have a SDK available with some flashing/backup tools on GitHub: Tools can be found here: seems it is called RDTool. The chip...

>>21406429 Backup is taken via UART0, and WG236P standard firmware outputs log to UART0 too. Tuya backup included in this thread outputs log to UART1.

Since i ported RTL8720D, and i did say that i would port ECR6600 next: I started port, and managed to boot compiled binary. SDK version is reported as ECR6600F_v2.1.0b02p03t01, Release version 1.0.0 So it is newer than one used in ECR6600-TS2D_TuyaOS-3.5.7 (ECR6600F_v2.0.0B06P02), but older that skylab one.

OTA is implemented, but using classic mode (via http server and url) is preferable. While ota via post code looks simple, i had a lot of trouble of not making it crash. Even now, it crashes after binary is uploaded, but at least it works. If ota failed, reboot will be needed to try again. Tried implementing ADC, but values shown are always ~3.3v, whether i pull it up or down. So i disabled it in code, but left VBAT measurements (introduced pseudo pin for that). Modified lwip config, that fixed tcp disconnects. Tried playing with power save, hoping that it would improve signal reception. But, for me it did nothing. In HAL_PrintNetworkInfo aligning to left doesn't work. It always align to right. Otherwise, looks stable in short time i tested it. But ping watchdog is mandatory, since i often got inaccessibility without wifi disconnect when signal is lower than -70dbm. GPIO and PWM works, so i assume irq will work too. Added after 39 [minutes]:Decided to play around with test driver. All passed, save TestParseIP. If without define in str_to_ip, setting static ip crashed. If defined, test error is still there but result is this: TestIPtoStr still passes. Strangely, if started self-test from gui i see [00:03:38.627]Info:CMD:[7/19] Finished test of TestSprintfForFloat! And then instant reboot, without crash. When starting from cli, everything is ok. Once, when starting in gui it passed until there: Debug:CMD:cmd [TestStrncpy] Info:CMD:[9/19] Result OK! Since static ip is not implemented, not a priority.

yes. wifi seems bad. module is ~60cm away from my Intel Wi-Fi 6 AX200 160MHz - 69/29 (Mbps) maybe something in here needs tweaking. Added after 15 [minutes]:OBK boot inc. wifi join 2.4ghz Code: TextLog in, to see the code Added after 15 [minutes]: I'm trying to reconcile the ADCs with the WG236 datasheet. TX2/IO13 changed in previous pic why are there seemingly two UART2_TXD - GPIO0 and GPIO13?

very interesting. I look forward to seeing a firmware backup if you can make one. The tool looks similar in its options to UTP for TR6260

>>21378733 I was successful in getting a backup, I added it to the post along with instructions on how I did it. I don't know what to do with it, maybe open it in Ghidra somehow?Anyway, now I can try to start development and test things. I will keep you up to date.

Did you happen to capture the boot log for posting too? Added after 11 [hours] 7 [minutes]: I believe this is because TuyaOS3 has changed the way config is stored. It needs working out and a new config extractor made I guess. A few OS3 firmwares are about, including all Tuya LNs so far Added after 22 [minutes]:The LSC ECR6600 dump being Code: TextLog in, to see the code

thanks for posting. I've had a device or two recently that will output at 115200 for then 921600 or 2000000 for the app. not like that is it?

>>21392144 No, I don't think so. I have tried every baud rate in RDTool. There was one that kept printing fff (don't remember which). But the app log is still only on the second UART.

😭 Skylab sent me WG236-U (ECR6600U (USB)) by mistake. refunded/ordered again.

[AXY2S] [ECR6600] Teardown LSC Connect Smart Wall Dimmer (3207304)

jasperro 9309 73

Report a violation of the law

Reply | New topic

Helpful post

#1 21377851 05 Jan 2025 10:44

jasperro jasperro

Level 5

Posts: 17

Help: 2

Rate: 8
Topic author

Helpful post
Post #1
21377851 05 Jan 2025 10:44

This is a teardown of the LSC Connect Smart Wall Dimmer (3207304). It is based on the AXY2S module/ESWIN ECR6600 which isn't supported by OpenBK.

This chip seems to have a SDK available with some flashing/backup tools on GitHub: https://github.com/NonPIayerCharacter/ecr6600. Tools can be found here: https://github.com/NonPIayerCharacter/ecr6600/raw/refs/heads/master/dbg_tools/Burn_Tools.tar, seems it is called RDTool. The chip might be similar to the TR6260, see >>21358543 by @insmod.

Update: port in progress at https://github.com/jasperro/OpenBK7231T_App and https://github.com/jasperro/OpenECR6600

I don't have a full datasheet (except a small product brief from ESWIN) for the chip so it's all guesswork. I couldn't find it anywhere.
On this page: https://www.dusuniot.com/product-specification/dsm-036-wi-fi6-and-ble-dual-cloud-module/ it seems there is a pinout of a module (DSM-036) using ECR6600 and here is the module info (AXY2S): https://developer.tuya.com/en/docs/iot/AXY2S.

Update: reading flash has succeeded by using RDTool with the STUB provided in the repository. Firmware backup is attached here:
lscdimmerb..kup.bin (2 MB)You must be logged in to download this attachment.

To take a backup of the device, follow two quite easy steps.
The terms upload and download are switched around. Upload is actually download to the PC, download is actually upload to MCU.

First, desolder the AXY2S module from the dimmer and connect TX->RX, RX->TX, and GND -> GND with UART. Do solder a wire to VBat on the module, but do not connect this to 3v3 yet.

First download and extract the Burn Tools mentioned above and the STUB bin from the repository at https://raw.githubusercontent.com/NonPIayerCh...00/common/common_bin/ECR6600F_stub_V1.3.1.bin
Then, open the RDTool.exe in the extracted Burn Tools folder.

Open the develop tab and fill in the settings shown:

When all data is correct, click the start button. Quicky connect your VBat wire to 3v3. It should say "Begin to download STUB" in the content/log.

Then, go to the flash tab and fill in all data as shown here, put the path where you want to save your backup in by selecting save path. Then click start. content/log should now say data uploaded 10%, 20%, ... until "READ Flash Success!"

The resulting backup should be 2048KB.

From now, I will be trying to get development for this device working, e.g. make a OpenECR6600 repository and try to get OpenBeken running. I will post updates here.

Taking the device apart is very easy. The front can be taken off by pulling the dial out and turning the nut. Taking the back casing off is done by pushing the clips in.

AI: What specific goals or issues are you encountering with the teardown or flashing process of the LSC Connect Smart Wall Dimmer?
Chip is AXY2S/ECR6600 which is unsupported by OpenBK. I want to possibly add support to OpenBK.
AI: Have you had any previous experience with similar devices or processes that might be relevant to this project?
Yes, I made a WS2811 Driver for OpenBK on LN882H here: https://www.elektroda.com/rtvforum/topic4083817.html. I'm familiar with the code.

ADVERTISEMENT
#2 21378733 05 Jan 2025 18:09

divadiow divadiow

Level 38

Posts: 4878

Help: 427

Rate: 868
Helpful post? (0)

Post #2
21378733 05 Jan 2025 18:09

very interesting. I look forward to seeing a firmware backup if you can make one. The tool looks similar in its options to UTP for TR6260
ADVERTISEMENT
#3 21389694 12 Jan 2025 17:14

jasperro jasperro

Level 5

Posts: 17

Help: 2

Rate: 8
Topic author Helpful post? (+1)

Post #3
21389694 12 Jan 2025 17:14

>>21378733 I was successful in getting a backup, I added it to the post along with instructions on how I did it. I don't know what to do with it, maybe open it in Ghidra somehow?

Anyway, now I can try to start development and test things. I will keep you up to date.

#4 21389718 12 Jan 2025 17:27

insmod insmod

Level 31

Posts: 1356

Help: 161

Rate: 426

Post #4

21389718 12 Jan 2025 17:27

I ordered a wg236, an ecr6600 module myself.
But, i will try to port it only after amebad.
Looking at the backup, while there is ota_status partition, it looks like there is no separate partition for ota. The main app (cpu) partition is 0x1CA000 in length.
Maybe ota is like how it is done for esp8266 in non-os sdk? New app is written at the end of the partition, and bootloader then writes it at the start?
Config extractor finds the tuya magic, but can't extract anything

Tuya config extractor - magic is at 1921024 
WARNING - strange nextblock header E376778
WARNING - bad nextblock CRC
WARNING - strange nextblock header B3C05C39
WARNING - bad nextblock CRC
WARNING - strange nextblock header C9BF4B93
WARNING - bad nextblock CRC
WARNING - strange nextblock header 98945117
WARNING - bad nextblock CRC
WARNING - strange nextblock header 854B761D
WARNING - bad nextblock CRC
WARNING - strange nextblock header F9DCFD9F
WARNING - bad nextblock CRC
WARNING - strange nextblock header EE6A0E96
WARNING - bad nextblock CRC
WARNING - strange nextblock header A6A74BBF
WARNING - bad nextblock CRC
WARNING - strange nextblock header 3CE845C
WARNING - bad nextblock CRC
WARNING - strange nextblock header 3CE845C
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header C7430FB
WARNING - bad nextblock CRC
WARNING - strange nextblock header AE015031
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header 398DC828
WARNING - bad nextblock CRC
WARNING - strange nextblock header AF84FFBC
WARNING - bad nextblock CRC
WARNING - strange nextblock header E342E90A
WARNING - bad nextblock CRC
WARNING - strange nextblock header DF51E4BD
WARNING - bad nextblock CRC
WARNING - strange nextblock header DF51E4BD
WARNING - bad nextblock CRC
WARNING - strange nextblock header DF51E4BD
WARNING - bad nextblock CRC
WARNING - strange nextblock header E342E90A
WARNING - bad nextblock CRC
WARNING - strange nextblock header DF51E4BD
WARNING - bad nextblock CRC
WARNING - strange nextblock header DF51E4BD
WARNING - bad nextblock CRC
WARNING - strange nextblock header DF51E4BD
WARNING - bad nextblock CRC
WARNING - strange nextblock header E342E90A
WARNING - bad nextblock CRC
Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
Failed to extract Tuya keys - no json start found

LTCT can't too

E: RuntimeError: Couldn't unpack storage data - see program logs
E: |-- File "ltchiptool\gui\work\base.py", line 24, in run
E: |-- File "ltctplugin\upk2esphome\work.py", line 32, in run_impl
E: |-- File "ltctplugin\upk2esphome\work.py", line 107, in run_file
E: |-- File "ltctplugin\upk2esphome\work.py", line 124, in run_data
E: Caused by ValueError: Validation failed at 'block magic'; while unpacking 'DataBlock._magic'; while unpacking 'KVStorage.data_blocks'
E: |-- File "ltctplugin\upk2esphome\work.py", line 122, in run_data
E: |-- File "bk7231tools\analysis\kvstorage.py", line 270, in decrypt_and_unpack
E: |-- File "datastruct\main.py", line 455, in unpack
E: |-- File "datastruct\main.py", line 446, in unpack
E: |-- File "datastruct\main.py", line 327, in _read_field
E: |-- File "datastruct\main.py", line 284, in _read_field
E: |-- File "datastruct\main.py", line 261, in _read_value
E: |-- File "datastruct\main.py", line 455, in unpack
E: |-- File "datastruct\main.py", line 446, in unpack
E: |-- File "datastruct\main.py", line 302, in _read_field
E: |-- File "datastruct\utils\context.py", line 13, in evaluate
E: |-- File "datastruct\fields\helper.py", line 147, in _validate

#5 21389968 13 Jan 2025 07:59

divadiow divadiow

Level 38

Posts: 4878

Help: 427

Rate: 868
Helpful post? (0)

Post #5
21389968 13 Jan 2025 07:59

Did you happen to capture the boot log for posting too?

Added after 11 [hours] 7 [minutes]:

insmod wrote:
Config extractor finds the tuya magic, but can't extract anything

I believe this is because TuyaOS3 has changed the way config is stored. It needs working out and a new config extractor made I guess. A few OS3 firmwares are about, including all Tuya LNs so far

Added after 22 [minutes]:

The LSC ECR6600 dump being

Code: Text
Log in, to see the code
ADVERTISEMENT

#6 21391389 13 Jan 2025 19:49

jasperro jasperro

Level 5

Posts: 17

Help: 2

Rate: 8

Post #6

21391389 13 Jan 2025 19:49

>>21389968 The boot log from UART0 (TX/RX) is very weird. It shows this:


ty heap base: 1f000 size: 196352
U��
U��
U��

repeating into infinity.
UART1 (L_TX/L_RX) shows this:


[00:00:00.004]tuya APP main()!!! reason:0
[00:00:00.006]SDK version ECR6600F_V2.0.0B06P02, Release version 1.0.0
[00:00:00.030]mac in amt
[00:00:00.049]psm event handle!
[00:00:00.051]psm lib build time: Dec 19 2023-22:43:01
[00:00:00.056]start TUYA application
[00:00:00.069]tuya_wpa_supp_evt_init:1665 wpa supplicant init event cb
[00:00:00.077][01-01 00:00:00 TUYA D][tal_thread.c:202] Thread:tuya_auth Exec Start. Set to Running Stat
[00:00:00.087][01-01 00:00:00 TUYA I][tal_thread.c:183] thread_create name:tuya_auth,stackDepth:4608,totalstackDepth:4608,priority:5
[00:00:00.103][01-01 00:00:00 TUYA I][mqc_app.c:325] mqc app init ...
[00:00:00.111][01-01 00:00:00 TUYA D][tal_thread.c:202] Thread:sys_timer Exec Start. Set to Running Stat
[00:00:00.119][01-01 00:00:00 TUYA I][tal_thread.c:183] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:8704,priority:5
[00:00:00.133][01-01 00:00:00 TUYA I][tal_thread.c:183] thread_create name:wq_system,stackDepth:5120,totalstackDepth:13824,priority:3
[00:00:00.144][01-01 00:00:00 TUYA I][tal_thread.c:183] thread_create name:wq_highpri,stackDepth:4096,totalstackDepth:17920,priority:4
[00:00:00.155][01-01 00:00:00 TUYA D][mqc_app.c:134] mq_pro:5 cnt:1
[00:00:00.160][01-01 00:00:00 TUYA D][mqc_app.c:134] mq_pro:31 cnt:2
[00:00:00.166][01-01 00:00:00 TUYA D][tal_thread.c:202] Thread:wq_highpri Exec Start. Set to Running Stat
[00:00:00.176][01-01 00:00:00 TUYA D][tuya_svc_online_log.c:223] svc online log init success
[00:00:00.187][01-01 00:00:00 TUYA D][log_seq.c:895] read m:0 f:0 l:0
[00:00:00.192][01-01 00:00:00 TUYA D][tuya_device.c:79] < TuyaOS V:3.3.105 BS:40.00_PT:2.3_LAN:3.5_CAD:1.0.5_CD:1.0.0 >
< BUILD AT:2024_01_10_08_49_07 BY ci_manage FOR tuyaos-iot AT eswin_ecr6600 >
IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 LITTLE_END:1 TLS_MODE:2 OPERATING_SYSTEM:98 RELIABLE_TRANSFER:RELIABLE_TRANSFER >

[00:00:00.219][01-01 00:00:00 TUYA D][tuya_device.c:80] ecr6600_common_singlefire_dimmer_user_config_ty:0.0.20
[00:00:00.229]###tkl_cpu_sleep_mode_set 1 0
[00:00:00.232]enable light sleep 
[00:00:00.235]###tkl_cpu_sleep_mode_set 1 0
[00:00:00.240]enable light sleep 
[00:00:00.243]enter pin_dev_init(), pin:22 
[00:00:00.246]gpio_num: 22 set GPIO func OK!
[00:00:00.251]pin_dev_init(),gpio_num : 22 init_status:1; 
[00:00:00.257]pin_dev_init()[22], gpio_num:0; 
[00:00:00.259]pin_dev_init()[22], pull_type:0; 
[00:00:00.265]enter pin_dev_init(), pin:25 
[00:00:00.268]gpio_num: 25 set GPIO func OK!
[00:00:00.273]pin_dev_init(),gpio_num : 25 init_status:1; 
[00:00:00.279]pin_dev_init()[25], gpio_num:1; 
[00:00:00.281][01-01 00:00:00 TUYA N][app_single_fire.c:287] >>>>> app_single_fire_init >>>>>
[00:00:00.290]psm_set_lowpower, is_lowpower is 1
[00:00:00.295]###tkl_cpu_sleep_mode_set 0 0
[00:00:00.298]disable light sleep 
[00:00:00.318]psm_set_normal, is_lowpower is 0
[00:00:00.322]###tkl_cpu_sleep_mode_set 1 0
[00:00:00.324]enable light sleep 
[00:00:00.327][01-01 00:00:00 TUYA N][tuya_wifi_single_fire.c:421] tuya_wifi_sf_set_enable:1
[00:00:00.335][01-01 00:00:00 TUYA N][tuya_key.c:340] for single fire, set key sleep time:0 ms
[00:00:00.344]gpio_num: 24 set GPIO func OK!
[00:00:00.349]tuya_wpas_sf_set_charge_cfg: voltage_feedback_en 1 charge_max_time 30000 discharge_max_time 12000 fast_connect_timeout 3
[00:00:00.364][01-01 00:00:00 TUYA N][simple_flash.c:447] key_addr: 0x1d5000   block_sz 4096
[00:00:00.373][01-01 00:00:00 TUYA N][simple_flash.c:533] get key:
[00:00:00.378]0x30 0x9d 0xab 0x65 0x6d 0x8d 0xbf 0xe4 0xb9 0x3f 0x35 0x4b 0xc9 0xe0 0xd4 0xe8 
[00:00:00.432][01-01 00:00:00 TUYA N][tuya_iot_com_api.c:318] uni_random_init...
[00:00:00.492][01-01 00:00:00 TUYA N][tuya_tls.c:359] tuya_tls_rand_init ok!
[00:00:00.504]UART INIT 
[00:00:00.506]psm_schedule_idle_cb,this is dbg info,first goto idle
[00:00:00.510]psm_schedule_idle_cb,this is dbg info,first goto idle
[00:00:00.515]psm_schedule_idle_cb,this is dbg info,first goto idle
[00:00:00.521]psm_schedule_idle_cb,this is dbg info,first goto idle
[00:00:00.529]psm_schedule_idle_cb,this is dbg info,first goto idle
[00:00:01.017]UART DEINIT 
[00:00:01.027][01-01 00:00:00 TUYA N][tuya_main.c:304] mf_init succ
[00:00:01.066][01-01 00:00:00 TUYA N][tuya_device.c:109] nc_tp = 1
[00:00:01.076]UART INIT 
[00:00:01.579]UART DEINIT 
[00:00:01.587]UART INIT 
[00:00:02.094]UART DEINIT
... UART INIT/DEINIT into infinity...

Seems the encryption key is

0x30 0x9d 0xab 0x65 0x6d 0x8d 0xbf 0xe4 0xb9 0x3f 0x35 0x4b 0xc9 0xe0 0xd4 0xe8

i guess?

#7 21392144 14 Jan 2025 10:58

divadiow divadiow

Level 38

Posts: 4878

Help: 427

Rate: 868
Helpful post? (0)

Post #7
21392144 14 Jan 2025 10:58

jasperro wrote:
The boot log from UART0 (TX/RX) is very weird

thanks for posting.

I've had a device or two recently that will output at 115200 for then 921600 or 2000000 for the app. not like that is it?
ADVERTISEMENT
#8 21392597 14 Jan 2025 16:07

jasperro jasperro

Level 5

Posts: 17

Help: 2

Rate: 8
Topic author Helpful post? (0)

Post #8
21392597 14 Jan 2025 16:07

>>21392144 No, I don't think so. I have tried every baud rate in RDTool. There was one that kept printing fff (don't remember which). But the app log is still only on the second UART.
#9 21402739 21 Jan 2025 09:37

divadiow divadiow

Level 38

Posts: 4878

Help: 427

Rate: 868
Helpful post? (0)

Post #9
21402739 21 Jan 2025 09:37

insmod wrote:
I ordered a wg236, an ecr6600 module myself.

😭 Skylab sent me WG236-U (ECR6600U (USB)) by mistake. refunded/ordered again.

Attachments:

SkyLab_WG236-U_V1.04_规格书_SL-23080345.pdf (388.22 KB) You must be logged in to download this attachment.

#10 21403198 21 Jan 2025 14:29

insmod insmod

Level 31

Posts: 1356

Help: 161

Rate: 426

Post #10

21403198 21 Jan 2025 14:29

Mine arrived

But. i'm taking a short break from iot, and trying to build a custom rom for my android phone.
Boot log:

[00:00:00.000]SDK version ECR6600F_v2.1.22, Release version 1.0.0
[00:00:00.021]EasyFlash V4.0.0 is initialize success.
[00:00:00.024]mac in amt
[00:00:00.037]NV PsmPOREnable not configured!
[00:00:00.038]NV PsmFlag not configured!
[00:00:00.044]NV PsmDeepSleepTime not configured!
[00:00:00.046]PSM init success
[00:00:00.049]psm event handle!
[00:00:00.052]rtc calculate start!
[00:00:00.055]health_monitor not ready
[00:00:00.060]flash auto set country read null, set 0
[00:00:00.066]device config complete
[00:00:00.070]BE2:0x7f00c
[00:00:00.070]BE3:0x7f00f
[00:00:00.072]BE4:0xf
[00:00:00.076]device config complete
[00:00:00.079]ps_set_mode: cfm_cnt 0
[00:00:00.082]set key failed, status 0x2
[00:00:00.083]set key failed, status 0x2
[00:00:00.089]set key failed, status 0x2
[00:00:00.092]set key failed, status 0x2
[00:00:00.095]set key failed, status 0x2
[00:00:00.100]set key failed, status 0x2
[00:00:00.103]wpa state: wl0 DISCON->INACT.
[00:00:00.106]wpa state: wl0 INACT->DISCON.
[00:00:00.112]set key failed, status 0x2
[00:00:00.114]set key failed, status 0x2
[00:00:00.117]set key failed, status 0x2
[00:00:00.120]set key failed, status 0x2
[00:00:00.125]set key failed, status 0x2
[00:00:00.128]set key failed, status 0x2
[00:00:00.130]wpa state: wl1 DISCON->INACT.
[00:00:00.136]wpa state: wl1 INACT->DISCON.
[00:00:00.178]init STAIP 
[00:00:00.179]init APIP 
[00:00:00.182]init DNS SERVER 
[00:00:00.185]at dhcps nv err
[00:00:00.187]at dhcpc nv err! 
[00:00:00.190]init DHCP_EN:1,1 
[00:00:00.193]at softap autostart... 
[00:00:00.195]load ap info nv fail
[00:00:00.198]Can not find local_ssid or local_password or local_channel in dnv.
[00:00:00.206]local ota: ssid:local_ota_test  password:12345678  channel:7
[00:00:00.212]--wifi_ctrl_iface--vif[0]:flush_bss 0

[00:00:00.217]--scan freq=2442 scan_ssid="local_ota_test"
[00:00:00.220]--w[00:00:00.223]
[0]:scan freq=2442 scan_ssid="local_ota_test"[00:00:00.223]


[00:00:00.232]OK
[00:00:00.232]
[00:00:00.235]wpa state: wl0 DISCON->SCAN.
[00:00:00.238]fhost scan cmd
[00:00:00.240]msg_id: MM_ADD_IF_REQ, dest_id: 32, src_id: 45, state: 0
[00:00:00.246]m_add_if_req_handler 0
[00:00:00.249]add vif 0, type 0, status 0
[00:00:00.251]45 scan start
[00:00:00.254]scan set channel 2442
[00:00:00.260]scan tx probe req, ssid cnt 1, len 14
[00:00:00.263]fhost scan cmd resp 0
[00:00:00.361]scan next 1
[00:00:00.362]scan finish
[00:00:00.365]fhost scan cfm: 0, cnt 0 rx_mgt:0 beacon:0 proberesp:0
[00:00:00.370]msg_id: MM_REMOVE_IF_REQ, dest_id: 32, src_id: 45, state: 0
[00:00:00.376]del vif 0
[00:00:00.378]wpa state: wl0 SCAN->INACT.
[00:00:00.381]ap num is 0
[00:00:00.384]--wifi_ctrl_iface--vif[0]:flush_bss 0

[00:00:00.389]--sca[00:00:00.391]OK
n freq=2442 scan_ssid="local_ota[00:00:00.392]
_test"
[00:00:00.397]--wifi_ctrl_iface--vif[0]:scan freq=2442 scan_ssid="local_ota_test"

[00:00:00.403]OK
[00:00:00.406]
[00:00:00.407]wpa state: wl0 INACT->SCAN.
[00:00:00.411]fhost scan cmd
[00:00:00.414]msg_id: MM_ADD_IF_REQ, dest_id: 32, src_id: 45, state: 0
[00:00:00.419]m_add_if_req_handler 0
[00:00:00.422]add vif 1, type 0, status 0
[00:00:00.425]45 scan start
[00:00:00.428]scan set channel 2442
[00:00:00.430]scan tx probe req, ssid cnt 1, len 14
[00:00:00.436]fhost scan cmd resp 0
[00:00:00.535]scan next 1
[00:00:00.536]scan finish
[00:00:00.539]fhost scan cfm: 0, cnt 0 rx_mgt:0 beacon:0 proberesp:0
[00:00:00.544]msg_id: MM_REMOVE_IF_REQ, dest_id: 32, src_id: 45, state: 0
[00:00:00.550]del vif 1
[00:00:00.553]wpa state: wl0 SCAN->INACT.
[00:00:00.555]ap num is 0
[00:00:00.558]enter normal mode 
[00:00:00.561]local ota scan fail.
[00:00:00.564]load wifi nv fail:1.

#11 21403203 21 Jan 2025 14:32

divadiow divadiow

Level 38

Posts: 4878

Help: 427

Rate: 868
Helpful post? (0)

Post #11
21403203 21 Jan 2025 14:32

insmod wrote:
i'm taking a short break from iot

:o :o
#12 21403233 21 Jan 2025 14:46

insmod insmod

Level 31

Posts: 1356

Help: 161

Rate: 426
Helpful post? (0)

Post #12
21403233 21 Jan 2025 14:46

Managed to take a backup, but with startup address "0x0" it immediately booted to system.
But, if startup address was 0x10000, it didn't boot and was operable until next reboot. And since stub is loaded into ram and not flash, after reset it continued to work as before.

Attachments:

wg236.bin (2 MB) You must be logged in to download this attachment.
#13 21406429 23 Jan 2025 16:36

luteac luteac

Level 1

Posts: 1
Helpful post? (0)

Post #13
21406429 23 Jan 2025 16:36

>>21403233

Which interface did you use to connect to the device? The UART0 or the LOG (L_TX, L_RX) one?
#14 21406439 23 Jan 2025 16:43

jasperro jasperro

Level 5

Posts: 17

Help: 2

Rate: 8
Topic author Helpful post? (0)

Post #14
21406439 23 Jan 2025 16:43

>>21406429
The normal TX/RX (UART0).
Helpful post

#15 21406440 23 Jan 2025 16:43

insmod insmod

Level 31

Posts: 1356

Help: 161

Rate: 426
Helpful post? (+2)

Helpful post
Post #15
21406440 23 Jan 2025 16:43

>>21406429 Backup is taken via UART0, and WG236P standard firmware outputs log to UART0 too. Tuya backup included in this thread outputs log to UART1.
#16 21417478 30 Jan 2025 19:42

divadiow divadiow

Level 38

Posts: 4878

Help: 427

Rate: 868
Helpful post? (0)

Post #16
21417478 30 Jan 2025 19:42

did you get past this with the LSC fw @insmod ?

Code: Text
Log in, to see the code

Added after 12 [minutes]:

jasperro wrote:
Update: port in progress at https://github.com/jasperro/OpenBK7231T_App and https://github.com/jasperro/OpenECR6600

how's the port going @jasperro?
#17 21417576 30 Jan 2025 20:18

jasperro jasperro

Level 5

Posts: 17

Help: 2

Rate: 8
Topic author Helpful post? (0)

Post #17
21417576 30 Jan 2025 20:18

>>21417478 I am getting OpenBK and the drivers from SDK to build after some trouble with the Makefiles. I can build an image just fine, but I am not sure how to get the OpenBK built object files into the final image. It just seems to include some example app.

I think it probably has something to do with Boards/ecr6600/common/mdl_size/gen_mdl_ld.sh and Boards/ecr6600/common/ld_xip.script.S, but I'm not sure how to use them. Maybe you or someone else would like to take a look?

I will upload what I have now to GitHub on jasperro/OpenECR6600 and OpenBK7231T_App#jasperroOpenECR6600 and might try to get things working again this weekend.

And on the UART INIT/DEINIT you see, I have that too so it is probably working fine.
#18 21417683 30 Jan 2025 21:53

divadiow divadiow

Level 38

Posts: 4878

Help: 427

Rate: 868
Helpful post? (0)

Post #18
21417683 30 Jan 2025 21:53

Quote:
And on the UART INIT/DEINIT you see, I have that too so it is probably working fine.

yes, silly me. Just looked at your boot log again

it's TuyaMCU. I just need to find the product key.

@jasperro did you happen to capture the boot log with the module in place? What is the MCU in your device - I don't think I see it in the pics

Quote:
Maybe you or someone else would like to take a look?

I will not be of much use with this

Added after 47 [minutes]:

>>21403198

my obligatory ESP adaptor mapping pic for the WG236
Helpful post

#19 21459310 28 Feb 2025 00:21

insmod insmod

Level 31

Posts: 1356

Help: 161

Rate: 426
Helpful post? (+2)

Helpful post
Post #19
21459310 28 Feb 2025 00:21

Since i ported RTL8720D, and i did say that i would port ECR6600 next:
I started port, and managed to boot compiled binary.
SDK version is reported as ECR6600F_v2.1.0b02p03t01, Release version 1.0.0
So it is newer than one used in ECR6600-TS2D_TuyaOS-3.5.7 (ECR6600F_v2.0.0B06P02), but older that skylab one.

#20 21459742 28 Feb 2025 21:30

insmod insmod

Level 31

Posts: 1356

Help: 161

Rate: 426

Post #20

21459742 28 Feb 2025 21:30

First boot on generic hals

[00:00:00.000]SDK version ECR6600F_v2.1.0b02p03t01, Release version 1.0.0
[00:00:00.022]EasyFlash V4.0.0 is initialize success.
[00:00:00.044]NV get PsmPOREnable failed!!
[00:00:00.046]NV get PsmFlag failed!!
[00:00:00.049]NV get PsmDeepSleepTime failed!!
[00:00:00.054]PSM init success
[00:00:00.057]psm event handle!
[00:00:00.060]rtc calculate start!
[00:00:00.063]health_monitor not ready
[00:00:00.067]mac in amt
[00:00:00.069]ps_set_mode: cfm_cnt 0
[00:00:00.072]set key failed, status 0x2
[00:00:00.073]set key failed, status 0x2
[00:00:00.079]set key failed, status 0x2
[00:00:00.082]set key failed, status 0x2
[00:00:00.087]wifi not ready!
[00:00:00.087]wifi not ready!
x2
[00:00:00.093]set key failed, status 0x2
[00:00:00.096]wpa state: wl0 DISCON->INACT.
[00:00:00.099]wpa state: wl0 INACT->DISCON.
[00:00:00.105]set key [00:00:00.107]wifi not ready!
 ready!
set key failed, status 0x2
[00:00:00.112]set key failed, status 0x2
[00:00:00.118]set key failed, status 0x2
[00:00:00.120]set key failed, status 0x2
[00:00:00.123]set key failed, statu[00:00:00.127]wifi not ready!
s 0x2
[00:00:00.131]wpa state: wl1 DISCON->INACT.
[00:00:00.134]wpa state: wl1 INACT->DISCON.
[00:00:00.147]wifi not ready!
[00:00:00.147]Entering initLog()...
[00:00:00.152]Commands registered!
[00:00:00.155]initLog() done!
[00:00:00.160]Info:MAIN:Main_Init_Before_Delay
Warn:CFG:CFG_InitAndLoad: Config crc or ident mismatch. Default config will be loaded.
Info:
Main_Init_Before_Delay done
[00:00:00.173]
Main_Init_Delay
[00:00:00.176]
Main_Init_Delay d[00:00:00.180]CFG:CFG_SetDefaultLEDCorrectionTable: setting defaults
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_BefoEDCorre_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Info:HTTP:TCP server listening
Info:MQTT:MQTT_RegisterCallback called for bT ecr660000000000/ subT ecr660000000000/+/set
Info:MQTT:MQTT_RegisterCallback called for bT obks/ subT obks/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/ecr660000000000/ subT cmnd/ecr660000000000/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obks/ subT cmnd/obks/+
Info:MQTT:MQTT_RegisterCallback called for bT ecr660000000000/ subT ecr660000000000/+/get
Info:CMD:CMD_StartScript: started @startup at the beginning
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
[00:00:01.201]Info:MAIN:Time 1, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
[00:00:02.199]Info:MAIN:Time 2, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
[00:00:03.205]Info:MAIN:Time 3, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
[00:00:04.201]Info:MAIN:Time 4, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
[00:00:05.199]Info:MAIN:Time 5, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
[00:00:06.206]Info:MAIN:Time 6, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
Info:MAIN:Boot complete time reached (5 seconds)
[00:00:07.206]Info:MAIN:Time 7, idle 0/s, free 90976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16

Need to do something about partitions, since it is the same size as in stock tr6260, meaning env size is not enough to save config.

Added after 7 [hours] 48 [minutes]:

https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/13594856085
Flash it as all-in-one, no stub needed.
No uart, no irq for bl0937.
For some reason, mqtt freezes the device. Increasing buffer size didn't help.

Info:MAIN:Time 6, idle 0/s, free 183472, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/16 
Info:MAIN:Boot complete time reached (5 seconds)
Info:MQTT:mqtt_connection_cb: Successfully connected
Info:MQTT:mqtt_subscribed to ecr66001F58A5A6/+/set
Info:MQTT:mqtt_subscribed to obks/+/set
Info:MQTT:mqtt_subscribed to cmnd/ecr66001F58A5A6/+
Info:MQTT:mqtt_subscribed to cmnd/obks/+
Info:MQTT:mqtt_subscribed to ecr66001F58A5A6/+/get
[00:00:18.263]Info:MQTT:Publishing val ecr66001F58A5A6 to ecr66001F58A5A6/host retain=0
Info:MAIN:Time 7, idle 0/s, free 182624, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 3/16 
[00:00:19.180]Info:MQTT:Publishing val OpenECR6600 _ecr6600_ae5dd87cfc22 Feb 28 2025 19:12:14 to ecr66001F58A5A6/build retain=0
Info:MAIN:Time 8, idle 0/s, free 183584, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/16

Also often see tcp disconnects, in chrome it reports empty response. If i remember correctly, tr6260 also had the same problem.
LFS and config uses tuya config partition.
Doing firmware backup is mandatory, since at least on wg236p mac address is stored not in efuse, but on flash. And of course rf calibration is on flash too.
Wifi is so bad for me, that i either had to hold it perpendicular to wifi, or solder external antenna (that is what i've done later). Perhaps there is tx power setting in code somewhere?

Added after 1 [hours] 4 [minutes]:

I can see in mqtt explorer that it manages to publish build.
Tried increasing mqtt task stack size and delay, didn't work.

Added after 4 [minutes]:

Looked a little closer at the code and noticed, than next after build is mac publish. Turned out that HAL_GetMACStr was done incorrectly, so it's fixed now.

#21 21461296 01 Mar 2025 13:42

insmod insmod

Level 31

Posts: 1356

Help: 161

Rate: 426
Helpful post? (0)

Post #21
21461296 01 Mar 2025 13:42

Uart and bl0937 irq are implemented. Irq is not tested, but uart works with tuyamcu simulator.
Standard uart pins are RX0-P5 TX0-P6. Alternate uart uses uart1 with default pins: P1-RX, P2-TX.
@divadiow can you test it all? Especially your signal reception, mine was a lot worse compared to beken, esp, etc. Even with soldered antenna, it is only at the same level as them.
Btw, you adapter mapping is a little wrong: IO13 is TX2, and ADC1 is IO15, ADC0 is IO14, at least in code.

https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/13604783135
#22 21461300 01 Mar 2025 13:45

divadiow divadiow

Level 38

Posts: 4878

Help: 427

Rate: 868
Helpful post? (0)

Post #22
21461300 01 Mar 2025 13:45

Ah crap, cheers for letting me know. Will fix.

Yes to testing but am out for the next day or two :/
Helpful post

#23 21462089 02 Mar 2025 02:38

insmod insmod

Level 31

Posts: 1356

Help: 161

Rate: 426
Helpful post? (+4)

Helpful post
Post #23
21462089 02 Mar 2025 02:38

OTA is implemented, but using classic mode (via http server and url) is preferable. While ota via post code looks simple, i had a lot of trouble of not making it crash. Even now, it crashes after binary is uploaded, but at least it works. If ota failed, reboot will be needed to try again.
Tried implementing ADC, but values shown are always ~3.3v, whether i pull it up or down. So i disabled it in code, but left VBAT measurements (introduced pseudo pin for that).

Modified lwip config, that fixed tcp disconnects.
Tried playing with power save, hoping that it would improve signal reception. But, for me it did nothing.
In HAL_PrintNetworkInfo aligning to left doesn't work. It always align to right.

Otherwise, looks stable in short time i tested it. But ping watchdog is mandatory, since i often got inaccessibility without wifi disconnect when signal is lower than -70dbm.
GPIO and PWM works, so i assume irq will work too.

Added after 39 [minutes]:

Decided to play around with test driver.
All passed, save TestParseIP.
If without define in str_to_ip, setting static ip crashed. If defined, test error is still there but result is this:

TestIPtoStr still passes.
Strangely, if started self-test from gui i see [00:03:38.627]Info:CMD:[7/19] Finished test of TestSprintfForFloat!
And then instant reboot, without crash. When starting from cli, everything is ok.
Once, when starting in gui it passed until there:
Debug:CMD:cmd [TestStrncpy]
Info:CMD:[9/19] Result OK!

Since static ip is not implemented, not a priority.
Helpful post

#24 21462915 02 Mar 2025 18:13

divadiow divadiow

Level 38

Posts: 4878

Help: 427

Rate: 868
Helpful post? (+2)

Helpful post
Post #24
21462915 02 Mar 2025 18:13

yes. wifi seems bad. module is ~60cm away from my Intel Wi-Fi 6 AX200 160MHz - 69/29 (Mbps)

maybe something in here needs tweaking.

Added after 15 [minutes]:

OBK boot inc. wifi join 2.4ghz
Code: Text
Log in, to see the code

Added after 15 [minutes]:

insmod wrote:
Btw, you adapter mapping is a little wrong: IO13 is TX2, and ADC1 is IO15, ADC0 is IO14, at least in code.

I'm trying to reconcile the ADCs with the WG236 datasheet. TX2/IO13 changed in previous pic

why are there seemingly two UART2_TXD - GPIO0 and GPIO13?
#25 21462954 02 Mar 2025 18:47

insmod insmod

Level 31

Posts: 1356

Help: 161

Rate: 426
Helpful post? (0)

Post #25
21462954 02 Mar 2025 18:47

>>21462915 The only uart port without extra pins is UART1 (and even it has 2 variants for rts/cts). All uart/adc/pwm variants, from what i understood looking at the code is here https://github.com/openshwprojects/OpenBK7231...e303682c7c/src/hal/ecr6600/hal_pins_ecr6600.c

Added after 27 [minutes]:

Damn, i looked at the tool and noticed that partitions can be easily edited in it. And i struggled to do it manually via hex editor, with recalculating crc32 separately...
#26 21463019 02 Mar 2025 18:47

divadiow divadiow

Level 38

Posts: 4878

Help: 427

Rate: 868
Helpful post? (0)

Post #26
21463019 02 Mar 2025 18:47

insmod wrote:
>>21462915 The only uart port without extra pins is UART1 (and even it has 2 variants for rts/cts). All uart/adc/pwm variants, from what i understood looking at the code is here https://github.com/openshwprojects/OpenBK7231...e303682c7c/src/hal/ecr6600/hal_pins_ecr6600.c

OK. odd. Using LED I have confirmed IO14 and IO15 on the module map correctly as in pic with P14/P15 in OBK.
#27 21463032 03 Mar 2025 01:11

insmod insmod

Level 31

Posts: 1356

Help: 161

Rate: 426
Helpful post? (+1)

Post #27
21463032 03 Mar 2025 01:11

>>21463019 Then skylab labelled them incorrectly, because IO15 should be ADC1 and IO14 ADC0

Added after 6 [hours] 18 [minutes]:

Implemented static ip, and mac changing.
Also discovered a 'magic' way to improve wifi a little. Disabled undocumented amt_cal_info_obtain() in main, that allowed connecting even if rssi is lower than -90 (mine connected at -91, previously was not connecting if lower than -80). Though it still was inaccessible and mqtt failed to connect.

Updated partitions, needs uart flash, not ota.

Still need to actually test it on real device, because some may have encryption, and that would make any non-standard firmware unbootable.
#28 21463587 03 Mar 2025 11:46

divadiow divadiow

Level 38

Posts: 4878

Help: 427

Rate: 868
Helpful post? (0)

Post #28
21463587 03 Mar 2025 11:46

changed mac OK. though it did seem to stop using one from module initially (I did erase whole flash just before new build though, which may explain this if old mac was in flash?)

Added after 38 [minutes]:

insmod wrote:
Still need to actually test it on real device, because some may have encryption, and that would make any non-standard firmware unbootable.

yes. We only have two real device firmware so far and they both boot on WG236.

I may be getting an EU plug with ECR6600 today but it might be the same firmware we already have

Added after 3 [hours] 13 [minutes]:

divadiow wrote:
I may be getting an EU plug with ECR6600 today

I give up. Stupid T34 again
#29 21470619 07 Mar 2025 22:57

divadiow divadiow

Level 38

Posts: 4878

Help: 427

Rate: 868
Helpful post? (0)

Post #29
21470619 07 Mar 2025 22:57

OTA 1553_merge_36861d4df64d -> 1.18.57 ✅

from TX0/IO6:
Code: Text
Log in, to see the code
#30 21470659 08 Mar 2025 00:10

insmod insmod

Level 31

Posts: 1356

Help: 161

Rate: 426
Helpful post? (0)

Post #30
21470659 08 Mar 2025 00:10

I also tried implementing OTA for TR6260, and it works! ...almost... No, it doesn't.
I managed to generate OTA diff image with ota_tool from ECR6600 (and it recognizes TR6260), but bootloader complained that version 3 is not supported.
After i manually patched OTA image to version 1, bootloader started to report this:
Code: text Expand Select all Copy to clipboard
patch checking ... patch check pass update begin ... OTA Update Done

But system is not updated.
It seems we need an older version of said tool, or a newer bootloader. I tried 3 different bootloaders (they differ a little, HLK-M20, ELM327 and standard nocrc), but none succeeded. Or an older bootloader to use A/B slots, the one where partitions are stored at 0x4000. Or a newer sdk perhaps.

>>21470619
Do you plan on changing MAC address? Since it is stored on flash in nv_amt partition, it can be easily changed.
Also, did you order WG236 from reseller or official store? Did you try to request SDK from them?
-85dbm, and main page is accessible. A miracle, i always have problems if rssi is lower than -80. As far as i understood, both TR6260 and ECR6600 tx power is more or less alright, but reception is worse.
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Reply | New topic

Report a violation of the law

Topic summary

✨ The discussion centers on the teardown and firmware development efforts for the LSC Connect Smart Wall Dimmer (model 3207304), which uses the AXY2S module based on the ESWIN ECR6600 chip. The ECR6600 is not currently supported by OpenBK firmware, but an SDK and flashing/backup tools (RDTool) are available on GitHub. The chip is similar to the TR6260, and ongoing porting efforts are documented in repositories such as jasperro/OpenECR6600 and OpenBK7231T_App. Users successfully extracted firmware backups via UART0 and analyzed boot logs, revealing TuyaOS V3 firmware with some changes in configuration storage compared to earlier versions. Challenges include unstable Wi-Fi reception, OTA update issues due to bootloader and OTA tool version mismatches, and limited documentation with only partial datasheets available. Various SDK versions have been obtained, including newer releases (v2.1.22 and v2.1.23.3), but integration and stability improvements remain in progress. Hardware variations include WG236 and WG236A modules, some with IPEX antenna connectors requiring modification for proper signal reception. Wi-Fi performance varies, with some users reporting poor reception and others achieving stable connections through walls and distance. Tools and code for UART, GPIO, PWM, ADC, and IRQ support are being developed and tested. The community is working on improving OTA functionality, MAC address modification, and partition management. Additional resources and SDKs have been shared from sources like SkyLab and Hi-Flying. Overall, the project is in active development with partial success in firmware porting and hardware support, but Wi-Fi stability and OTA remain key issues to resolve.
Generated by the language model.

Home page
/
Forum
/
Smart Home
/
Smart Home IoT
/
[AXY2S] [ECR6600] Teardown LSC Connect Smart Wall Dimmer (3207304)

FAQ

TL;DR: For modders backing up or porting the LSC Connect Smart Wall Dimmer 3207304, the working path is clear: read a 2048KB flash dump over UART0, because “READ Flash Success!” is confirmed with RDTool plus the ECR6600 stub. This FAQ helps anyone handling the AXY2S/ECR6600 platform, TuyaOS 3 storage changes, and early OpenECR6600 support. [#21377851]

Why it matters: This thread turns a previously unsupported Tuya dimmer into a documented ECR6600 case study for backup, reverse-engineering, and early open-firmware migration.

Option	What it does well	Main limitation	Practical status
Stock Tuya firmware	Boots reliably and exposes Tuya app logs	Closed platform, config extraction fails	Best baseline
RDTool + ECR6600 stub	Reads full flash backup to PC	Wording is confusing; timing matters on VBat	Confirmed working
OpenECR6600 / OpenBK	Custom firmware, UART, OTA, TuyaMCU support	Wi-Fi and sleep behavior varied by module/SDK	Usable, still maturing
WG236A test modules	Good for bench testing and SDK work	Reported weak receive performance on some units	Mixed results

Key insight: The hardest blocker was not dumping flash. It was platform maturity: TuyaOS 3 storage changed, UART logs split across ports, and ECR6600 Wi‑Fi and sleep behavior depended heavily on module, partitions, and SDK version.

Quick Facts

The confirmed backup size for the LSC dimmer is 2048KB, read after desoldering the AXY2S module and using RDTool with the ECR6600 stub. [#21377851]
On the original Tuya dimmer firmware, UART0 handled flashing access while the readable Tuya application log appeared on UART1 (L_TX/L_RX). [#21406440]
One captured stock boot string reported TuyaOS V:3.3.105 built on 2024-01-10 08:49:07 for eswin_ecr6600. [#21389968]
Early OpenECR6600 testing showed default serial mappings of RX0=P5, TX0=P6 and alternate UART1 on P1/P2. [#21461296]
Power-save testing on a newer ECR6600 build dropped current from about 0.12A to roughly 0.02–0.03A with powersave 1 or powersave 2. [#21622863]

How do I back up the flash on an LSC Connect Smart Wall Dimmer 3207304 with an AXY2S/ECR6600 module using RDTool and the ECR6600 stub?

Use UART0 and the ECR6600 stub to read a full 2048KB dump. 1. Desolder the AXY2S module and wire TX->RX, RX->TX, GND->GND, plus a loose VBat lead. 2. In RDTool, load the stub in the Develop tab, press Start, then quickly connect VBat to 3.3V when the log says it begins downloading the stub. 3. In the Flash tab, choose a save path and start the read. RDTool then counts up 10%, 20%, and ends with “READ Flash Success!”. [#21377851]

What is the AXY2S module, and how is it related to the ESWIN ECR6600 chip in Tuya-based smart devices?

The AXY2S module is the radio module used on this dimmer, and it is built around the ESWIN ECR6600 chip. "AXY2S is a Wi‑Fi/BLE module that integrates the ECR6600 SoC, exposing the chip through a packaged module used by Tuya devices." In this thread, the LSC Connect Smart Wall Dimmer 3207304 uses an AXY2S/ECR6600 combination, which is why OpenBK support had to be ported to ECR6600 rather than a better-known Beken part. [#21377851]

Why does the LSC Connect Smart Wall Dimmer output the Tuya app boot log on UART1 (L_TX/L_RX) instead of UART0?

Because this device routes the Tuya application log to UART1, while UART0 stays available for flashing and lower-level access. The captured boot log showed full Tuya app output on L_TX/L_RX, including the SDK banner and product string, while UART0 only printed ty heap base: 1f000 size: 196352 followed by repeated garbage characters. That split is device-specific: a standard WG236P firmware later showed logs on UART0, but the Tuya dimmer dump did not. [#21391389]

What does the repeating UART INIT and UART DEINIT log mean on the ECR6600-based LSC dimmer, and is it normal?

It appears normal for this stock Tuya firmware. The dimmer repeatedly printed UART INIT and UART DEINIT on the app-log UART after boot, and later testing confirmed other users saw the same behavior on the LSC firmware. One developer explicitly said that if you see the same INIT/DEINIT loop, “it is probably working fine.” So treat it as expected firmware behavior, not proof of a bad flash or dead module. [#21417576]

Which UART interface should I use to flash or back up an ECR6600 device: UART0 or the LOG port on L_TX/L_RX?

Use UART0 for flashing and backup. The thread confirms the working backup connection was the normal TX/RX port, not the LOG pads. Later follow-up made it explicit: backup is taken via UART0, while log output may appear on UART0 or UART1 depending on the firmware. On the LSC Tuya dump, flashing used UART0 and the readable boot log appeared on UART1. [#21406440]

Why can’t Tuya config extractor or LTChipTool unpack the config from an ECR6600 TuyaOS 3 firmware dump?

Because the dump uses a newer TuyaOS 3 storage layout that the existing extractors do not understand. The thread showed both tools finding Tuya markers but failing validation: the config extractor reported bad CRCs and “no json start found,” while LTChipTool failed at block magic. One contributor summarized the reason directly: “TuyaOS3 has changed the way config is stored.” That means the failure is a format mismatch, not proof that the dump is corrupt. [#21389968]

What is RDTool for ECR6600, and how are its upload and download options labeled compared with what they actually do?

RDTool is the vendor-style flashing and readback utility used with ECR6600 chips, but its labels are reversed. In this tool, upload actually means reading data from the device to the PC, and download means writing data from the PC to the MCU. That matters when you back up flash, because the correct operation is the one labeled as an upload even though you are saving a file locally. The thread calls this out as a specific trap. [#21377851]

How do OpenECR6600 and OpenBK compare with stock Tuya firmware on ECR6600 devices for flashing, OTA, and device support?

Stock Tuya firmware is the reliable baseline, while OpenECR6600 adds real custom-firmware control but still had edge cases during development. By March 2025, developers had booted compiled OpenECR6600 binaries, added UART and BL0937 IRQ support, and offered all-in-one images that did not need a stub. OTA also worked in some paths, but classic HTTP URL OTA was preferred because POST-based OTA could crash after upload. Real-device support improved later, and users reported ECR6600/BL0937 EU plugs running OpenECR6600 without obvious Wi‑Fi trouble. [#21522945]

Why is Wi-Fi reception reported as weak or inconsistent on some WG236A ECR6600 modules even when transmit power seems fine?

Because several testers saw a receive-side problem on WG236A modules, not a simple transmit-power issue. One report said the module could show about -75dBm on the router but -90dBm on the device log, with HTTP already broken. Another needed the module oriented perpendicular to the access point or placed within 20cm of the antenna to keep the GUI usable. Later tests on real devices looked better, so the issue seems concentrated on some test modules and antenna setups. [#21523878]

What GPIOs, UART pins, and ADC pins are mapped on the WG236 or WG236A ECR6600 modules when using OpenECR6600?

OpenECR6600 testing mapped the standard UART to RX0=P5 and TX0=P6, with alternate UART1 on P1 RX and P2 TX. The thread also corrected board notes: IO13 is TX2, ADC1 is IO15, and ADC0 is IO14 in code. "WG236 is an ECR6600 module that exposes GPIO, UART, ADC, and PWM functions through board pins, but several alternate functions share pads and caused mapping confusion in testing." That is why screenshots and silkscreen labels did not always match code behavior. [#21461296]

How can I change or preserve the MAC address on an ECR6600 module when flashing OpenECR6600, especially if the MAC is stored in flash instead of efuse?

Back up the original flash first, because some ECR6600 modules store the MAC in flash, not efuse. Developers noted that on at least one WG236P, the MAC lived in the nv_amt partition, and erasing flash could replace it with a generic default. OpenECR6600 later added MAC changing, and testers confirmed that changing the MAC inside OBK updated the value stored in flash. Preserving the original backup also keeps RF calibration data, which is stored there too. [#21459742]

What is the BL0937 chip in these smart dimmer and plug devices, and how is it used with OpenECR6600 or TuyaMCU setups?

BL0937 is the metering chip used for power measurement in several ECR6600 smart plugs, and OpenECR6600 added early support for its interrupt path. "BL0937 is an energy-monitoring IC that measures mains parameters and reports them to the main Wi‑Fi MCU, often through pulse or interrupt-based signaling." In this thread, developers first reported “no irq for bl0937,” then later implemented BL0937 IRQ support. Another tester identified an ECR6600 device as TuyaMCU-based, meaning the Wi‑Fi module and external controller can split duties instead of running everything on one MCU. [#21461296]

Why does ECR6600 OTA sometimes upload successfully but still fail to update, and how do bootloader or partition mismatches affect it?

OTA can complete the transfer but still fail because the bootloader, OTA image format, or partition layout does not match. A related TR6260 test showed the bootloader saying “patch check pass” and “OTA Update Done,” yet the firmware never changed. On ECR6600, developers also warned that partition sizing mattered, and newer images sometimes required UART flashing rather than OTA after partition updates. One clear failure case was trying a 4MB Hi-Flying firmware on a 2MB module, which only printed HF-LPT6200 and did not behave normally. [#21474737]

What device template or config is available for the LSC Connect Smart Wall Dimmer 3207304, including the known Tuya dpIDs like switch_led_1 and bright_value_1?

A complete OpenECR6600 device template was not published in this thread, but the Tuya datapoints were identified. In January 2026, the dimmer was matched to model ID ecx4sg with dpIDs including switch_led_1 as ability 1, bright_value_1 as ability 2, brightness_min_1 as ability 3, and countdown_1 as ability 6. The brightness range was listed as 10 to 1000. A placeholder add to the device list was also linked, showing the device was at least partially characterized. [#21809988]

How do deep sleep and power save modes behave on newer ECR6600 SDK builds, and what problems should I expect after wake-up?

Newer SDK builds improved power save, but deep sleep still behaved inconsistently after wake. One tester measured about 0.12A at powersave 0 and 0.02–0.03A at powersave 1 or powersave 2, while the device stayed responsive. Deep sleep entered correctly with commands like deepsleep 30, and the module could wake after 30s, but Wi‑Fi rejoin was erratic. In several wake cycles, the device booted, scanned, reached state 6, then disconnected repeatedly until a hard power cycle or later reboot restored normal joins. [#21622863]

Generated by the language model.