Tuya TYBL1 Bluetooth Gateway: CR3L/RTL8720CM [W701M-VT2-CG] Flash Backup, Boot Log - Info Dump

Question 1

How do I put a Tuya TYBL1 CR3L/RTL8720CM gateway into UART download mode, and which pins need to be pulled high?

Answer

Pull A_13/RX and A_0 high to enter UART download mode on the CR3L module. The poster also noted an edge case: on their ESP adapter, only A_0 needed to be pulled high. A practical 3-step method is: 1. expose the CR3L pads, 2. pull A_0 high, and if needed also A_13/RX, 3. power the module and connect your UART tool. That is the download path, not the normal log output path. [#21413940]

Question 2

What is the CR3L module in Tuya Bluetooth gateways, and how is it related to the Realtek RTL8720CM/AmebaZ2 platform?

Answer

The CR3L is the Tuya radio module used in these gateways, and the thread ties it directly to Realtek RTL8720CM / AmebaZ2. "CR3L" is a Tuya Wi‑Fi/BLE module category that hosts the gateway firmware, exposes UART and GPIO pads, and in this thread runs builds tagged rtl8720cm_ameba. The boot log explicitly says gw_module is CR3L and the successful OBK flash used the realtek-ambz2 target. [#21413940]

Question 3

Why does a Tuya TYBL1 boot log show two firmware slots like Fw1 and Fw2, and how does the dual-image partition table work?

Answer

It shows two slots because the device stores Fw1 and Fw2 as separate bootable images. The partition table listed Boot at 0x004000, Fw1 at 0x010000, and Fw2 at 0x1BC000, with each firmware partition sized 0x1AC000 bytes. The boot log then selects one slot using validity and serial-number metadata, such as "fw2 USE, return sn 1". That layout supports rollback or staged updates without overwriting the only image. [#21423978]

Question 4

Which tools work best for backing up and restoring Tuya TYBL1 firmware: CH341 with NeoProgrammer, ltchiptool, or AmebaZ2 PG Tool?

Answer

All three worked, but each served a different role. CH341 with NeoProgrammer gave a confirmed raw SPI dump, ltchiptool worked for UART-based dumping and flashing when the adapter cooperated, and AmebaZ2 PG Tool successfully restored the saved images. The strongest recovery evidence is that all 3 dumps booted and paired when flashed back using AmebaZ2 PG Tool. Use CH341 for safest archival backup, then use UART tools for faster iteration. [#21413940]

Question 5

What steps are involved in dumping the SPI flash from a Tuya Bluetooth gateway and verifying that the backup is valid?

Answer

The thread used a simple hardware-first workflow. 1. Connect a CH341 Black programmer to the flash, detected as BY25Q32 [3.3V] 32 Mbits, 4 Mbytes. 2. Read the full main memory in NeoProgrammer and record the CRC32, which was 0xE63F24B4. 3. Reflash the saved image with AmebaZ2 PG Tool and confirm the unit still boots and pairs. That final restore test is the strongest validation. [#21413940]

Question 6

Why would ltchiptool give I/O errors with one CH340 adapter but work with another when dumping a CR3L gateway?

Answer

Because the UART adapter itself was the failure point in at least one test. One poster said it took too much time to dump with ltchiptool because they got only I/O errors, then switching from one CH340 adapter to another made it work immediately. That points to adapter quality, wiring tolerance, or USB-UART stability rather than a CR3L limitation. If ltchiptool fails repeatedly, swap the adapter before changing firmware settings. [#21440797]

Question 7

How can I flash OpenBeken (OBK) onto a Tuya CR3L Bluetooth gateway, and what command line was used successfully in the thread?

Answer

Flash it over UART as a Realtek AmebaZ2 target. The exact command reported as successful was: ltchiptool flash write -f realtek-ambz2 ~/Downloads/OpenRTL87X0C_1.18.41.bin. "OBK" is open-source device firmware that replaces stock Tuya firmware, adds local control features, and in this thread was tested on RTL87x0C/RTL8720CM gateways. The poster showed it installed on an NH-BLE-WIFI-GW V1.0.8 board after changing CH340 adapters. [#21440797]

Question 8

What does OBK mean in the context of Tuya gateway hacking, and how much free heap was reported on RTL8720CM after flashing it?

Answer

OBK means OpenBeken, the alternative firmware being tested on these Tuya gateways. After flashing it on a CR3L-based RTL8720CM device, one status line reported free 4297224 bytes of heap. That is unusually high headroom for embedded experiments and is why the poster said "A LOT of free heap available with OBK." The same post said the port appeared to work out of the box without extra SRAM mapping changes. [#21439662]

Question 9

Why does the pin configuration page show only "error" on RTL87x0C builds, and what changed between OBK 1.18.31 and later versions?

Answer

It showed "error" because later RTL87x0C builds lost the pin-name mapping file from the build, even though pin roles could still work underneath. The tester verified that 1.18.31 worked, then narrowed the regression to .32 to .33. That means the breakage affected pin labels in the configuration page, not necessarily GPIO functionality itself. This is a classic UI-layer failure case: wrong metadata, working hardware. [#21440852]

Question 10

How was the missing pin-name issue on Realtek RTL87x0C fixed in OpenBeken, and which source file or pull request addressed it?

Answer

It was fixed by restoring the missing Realtek pin file to the build. The thread identified the root cause as hal_pins_realtek.c not included in OpenBeken.mk, and the proposed fix was submitted as pull request #1536. After that, the tester confirmed the pins could be configured and shown correctly again. The issue affected naming and page display, not the underlying GPIO table in hal_pins_rtl87x0c.c. [#21441046]

Question 11

What is UART DL mode on Tuya/Realtek modules, and how is it different from reading the normal boot log on TXLOG?

Answer

UART DL mode is the download/programming mode, while TXLOG is the normal serial debug output. In the thread, A_16_UART_TXLOG carried the Tuya boot log, including lines like == Boot Loader == and build dates. By contrast, entering UART DL mode required pulling boot pins high before power-up so tools could read or write firmware. One mode is passive observation; the other is active flashing access. [#21413940]

Question 12

Are there any Beken-based Tuya Bluetooth gateways, such as BK7231 models, and how would they compare with CR3L-based devices?

Answer

The thread did not confirm any Beken-based Tuya Bluetooth gateway. One participant asked about BK7231 models, and the reply was essentially that none had been seen yet, although "There must be some type BK7231 bluetooth gateway somewhere." So the comparison stayed hypothetical. By contrast, several actual gateways in the thread used CR3L modules on Realtek hardware, including multiple board variants and even a mislabeled Zigbee product. [#21418043]

Question 13

Tuya CR3L Bluetooth gateway vs ESP32-C3 Bluetooth Proxy with ESPHome — which is better for Home Assistant and cheaper to deploy?

Answer

For a simple Home Assistant Bluetooth proxy, the thread suggests ESP32-C3 is cheaper and easier. One poster noted that an ESP32-C3 SuperMini with ESPHome worked as a "dumb bluetooth passthrough" and said it was much cheaper than Tuya gateways. The Tuya CR3L gateway matters more if you want to study Tuya firmware, keep stock pairing behavior, or repurpose gateway hardware. For pure proxy duty, the ESP32-C3 route looked more practical. [#21471484]

Question 14

How does a Tuya Bluetooth gateway actually bridge Bluetooth devices to the cloud over Wi‑Fi, and what kinds of devices is it meant to support?

Answer

It bridges nearby Bluetooth or Bluetooth Mesh devices to Tuya services over Wi‑Fi. The clearest evidence is the boot log and later JSON, which identify a Bluetooth Mesh(SIG) wireless gateway, show BLE stack startup, and expose gateway product data such as model W-BG003 and category wg2. In practical terms, the thread treated it as the missing link between Tuya Bluetooth devices and the cloud, including Bluetooth-only bulbs and mesh subdevices. [#21790884]

Question 15

What work would be needed to add Bluetooth or BLE gateway support to OpenBeken, including support for Tuya Bluetooth-only bulbs and mesh devices?

Answer

It would take more than basic flashing because the gateway must handle BLE pairing, device management, and likely mesh functions. The thread shows interest, but also the challenge: questions were raised about supporting Bluetooth-only bulbs, adding BLE to OBK, and whether BLE would consume too much space. Stock logs already show BLE slave, BLE coexist, and MeshProvisioner paths, so matching stock behavior means implementing more than simple GPIO control. The hardware has memory headroom, but the software stack is the real work. [#21418043]

Option	What it was used for in the thread	Result	Main caveat
CH341 + NeoProgrammer	Raw SPI flash dump of BY25Q32	Successful 4 MB read, CRC32 verified	Requires clip or desolder access
ltchiptool + CH340 UART adapter	Dumping/flashing via module UART	Worked, but one CH340 gave I/O errors	Adapter quality mattered
AmebaZ2 PG Tool	Reflashing saved dumps	All 3 saved images booted and paired	Needs correct Realtek target flow