logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[Youtube] WBR2/WBR3 - RTL8720CF flashing step by step guide/tutorial - how to solder and flash

p.kaczmarek2 5463 22

TL;DR

  • Shows how to flash WBR2 and WBR3 modules built around the RTL8720CF/W701-VA2-CG chip.
  • Uses a step-by-step soldering guide with a few extra wires, similar to flashing ESP modules.
  • Covers WBR1, WBR2, WBR3, WBR2L, WBR3L, and WBRU modules, with English and Polish text guides.
  • Lets you replace firmware, free devices from the cloud, and pair them with Home Assistant.
  • A 2026 update says BK7231GUIFlashTool now supports the read/write process, while the wiring stays the same.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • WBR3 module from the RTL8720CF series with text about the flashing process.
    RTL8720CF/W701-VA2-CG can be easily flashed just like ESP modules - you just need to connect few more wires. Here's a step by step video showing firmware change process for WBR3 and WBR2 modules, which are using mentioned Realtek chip. This way you can free your devices from the cloud and pair them with Home Assistant.

    This guide is applicable to the following modules with the core chip of RTL8720CF or similar, so: WBR1, WBR2, WBR3, WBR2L, WBR3L, WBRU etc.

    See full guide:



    After finishing the guide, you can do the configuration futher like on our other videos on the playlist:
    https://www.youtube.com/watch?v=pkcspey25V4&a...LzbXEc2ebpH0I8m_Cfbqv1MTlQuBKYvlx&index=2

    If you want to see the same guide in text format, please see:
    - English Guide
    - Polish Guide

    Thank you for watching! Let us know how the flashing process went. You can also visit our teardowns list here: https://openbekeniot.github.io/webapp/devicesList.html , if you have a device that's not listed yet, please consider submitting it. See you!



    Update 2026
    As of 2026, this platform read/write is also supported by our flash tool:
    https://github.com/openshwprojects/BK7231GUIFlashTool
    The connection (soldering, wires), is the same, but you can use our tool instead of the legacy one.
    Please check it out and use it instead of legacy tools, let us know how it works for you!

    Cool? Ranking DIY
    Helpful post? Buy me a coffee.
    About Author
    p.kaczmarek2
    Moderator Smart Home  
    Offline 
    p.kaczmarek2 wrote 14400 posts with rating 12330, helped 650 times. Been with us since 2014 year.
  • ADVERTISEMENT
  • #2 21427090
    divadiow
    Level 38  
    Posts: 4845
    Help: 421
    Rate: 853
    a user on this forum kindly sent me some WBR3 modules for testing. The location of those pads on the rear is a pain, as already stated.

    I think I will turn the CR3L Bluetooth Gateway chassis into a WBR3-type dev board. Similar to your NodeMCU hack here https://www.elektroda.com/rtvforum/topic4097185.html#21375394 and other NodeMCU/NiceMCU conversions

    https://www.elektroda.com/rtvforum/topic3973321.html
    https://www.elektroda.com/rtvforum/topic4095663.html

    With the CR3L removed, and unlikely to return, for testing in other adaptors I think a series of jumper headers could easily be routed to the case for easy-access testing of all available GPIOs on this module. Any ugly routing of pads on the rear of the module will be hidden inside.

    Disassembled Smart Gateway with WBR3 modules on a blue mat.
  • #3 21427247
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14400
    Help: 650
    Rate: 12330
    Will you route out the pad on the module back? I did it, just to be on the safe side - it may be needed if I brick the OTA.

    Electronic module placed on a breadboard with connected wires.
    Electronic module on a breadboard with soldered wires.
    Electronic module placed on a breadboard.
    Helpful post? Buy me a coffee.
  • #4 21427250
    divadiow
    Level 38  
    Posts: 4845
    Help: 421
    Rate: 853
    yes. initial idea is that all should be routed to the outside case for every eventuality
  • #5 21427264
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14400
    Help: 650
    Rate: 12330
    So you have two options:
    1. do just like me, route out a wire
    2. is this just a twosided board and copper ground pour is on both sides onder WBR3 place? If so, maybe you could... well, carefully cut the board under it to expose the required pad? Still ,it may not be the best idea
    Helpful post? Buy me a coffee.
  • #6 21427272
    divadiow
    Level 38  
    Posts: 4845
    Help: 421
    Rate: 853
    Quote:
    So you have two options:
    1. do just like me, route out a wire


    likely this, but maybe with thin enamelled wire

    Quote:
    2. is this just a twosided board and copper ground pour is on both sides onder WBR3 place? If so, maybe you could... well, carefully cut the board under it to expose the required pad? Still ,it may not be the best idea


    hadn't thought of this, but it looks like most of both sides are covered by a ground plane so that would need careful avoidance/isolation from the soldered pads.
  • ADVERTISEMENT
  • #7 21427346
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14400
    Help: 650
    Rate: 12330
    The PCB edges would be needed to be sanded with sand paper.

    Btw, I still have those 3 from the reader:
    Close-up of a PCB prototype with electronic components on a breadboard.
    I will probably swap them for ESP soon. One of my switches is still TYWE3S-based, but soon it will run on Realtek. We just first need to make sure that it runs stable enough for wall placement.

    Do you have HA instance running?
    Helpful post? Buy me a coffee.
  • #8 21428230
    divadiow
    Level 38  
    Posts: 4845
    Help: 421
    Rate: 853
    some progress
    Blue printed circuit board with connected wires on a blue work mat. Circuit board with attached wires on a blue mat. Circuit board with WBR3 module on a blue background.Close-up of a blue PCB with an electronic module and connected wires.

    Added after 8 [hours] 42 [minutes]:

    p.kaczmarek2 wrote:
    Do you have HA instance running?

    yes. not prod setup, just testing


    Screenshot of Home Assistant interface showing various devices and their status.
  • #9 21430141
    divadiow
    Level 38  
    Posts: 4845
    Help: 421
    Rate: 853
    Image of a circuit board with red wires connected to pins labeled as TX0 PA14, 3.3V, RX2 PA15, RX0 PA13, GND, A1, TX2 PA16, GND, A0, 3.3V. PCB board with WBR3 module and USB-C connector with labeled components.

    White electronic device with two LEDs on top, one red and one blue, and a button on the side. Plastic enclosure of a device with pin labels on the side. View of the Smart Gateway TYBL1 device from the bottom, with port labels and power indication. Electronic module with port and model labels on a white casing. White electronic module RTL8720CF WBR3 with connected USB-C cable on a blue background. White plastic DIY project case with visible cutouts for ports and connectors. Printed circuit board with connected red wires in a white case. Empty plastic enclosure on a blue surface with a tool on the right. Circuit board with red and blue LEDs, button, and wired connections.

    and now A0 and A13 can be pulled high with ease
    Electronic device with wires connected to a USB adapter.

    and flashed to OpenRTL

    PA3 - red LED
    PA2 - blue LED
    PA11 - button

    OpenRTL control panel with active mode

    nice 5v USB-C, easy flashing, spare GPIOs, labelled, multiple grounds and 3v3, spare headers for expansion :)
  • ADVERTISEMENT
  • #10 21430151
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14400
    Help: 650
    Rate: 12330
    Very nice idea. Remember to add more grounds and VDD pins in advance.

    Also, we really need to check if it 's possible to print pin names on paper, it would help a lot if we could label this connector.
    Helpful post? Buy me a coffee.
  • #11 21430457
    divadiow
    Level 38  
    Posts: 4845
    Help: 421
    Rate: 853
    p.kaczmarek2 wrote:
    Very nice idea. Remember to add more grounds and VDD pins in advance.

    oh. I thought 3 GND and 2 3V3 would do for now. Plenty of space if more needed though

    Added after 45 [seconds]:

    p.kaczmarek2 wrote:
    it would help a lot if we could label this connector.

    which connector?
  • #12 21430463
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14400
    Help: 650
    Rate: 12330
    This one obviously:
    Close-up of a circuit board with an electronic module and red wires.
    I need to do the same for my dev board: https://www.elektroda.com/rtvforum/topic4062695.html
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #13 21430469
    divadiow
    Level 38  
    Posts: 4845
    Help: 421
    Rate: 853
    I have labelled it!
    Close-up of an electronic connector with labeled pins.
    Close-up of a label with pin markings on a white electronic device casing.
  • #14 21430484
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14400
    Help: 650
    Rate: 12330
    Ah right, sorry, I didn't see. It seems that we need to use "big thumb" image option more often.
    Helpful post? Buy me a coffee.
  • #15 21811291
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14400
    Help: 650
    Rate: 12330
    Update 2026
    As of 2026, this platform read/write is also supported by our flash tool:
    https://github.com/openshwprojects/BK7231GUIFlashTool
    The connection (soldering, wires), is the same, but you can use our tool instead of the legacy one.
    Please check it out and use it instead of legacy tools, let us know how it works for you!
    Helpful post? Buy me a coffee.
  • #16 21811926
    tomik67
    Level 12  
    Posts: 111
    Rate: 11
    Board Language: polish
    Today I flashed four pieces of MTG276-WF-RL presence sensors with the WBR3 modules mentioned in this thread...:

    Link

    It was possible to read the modules, it only worked at a speed of 1500000, it was not always without errors, the last module despite repeated attempts always showed some errors.
    Writing was possible at two speeds: 921600 and 2000000.
    The read logs of one of the modules and its contents are attached.
    A write of the OBK config failed.
    There is no detailed config because MTG276-WF-RL is an MCU device, the module is only used for communication.

    PS. I have never tried so I prefer to ask:
    Is it possible to run Flash on macOS and if so how ?
    Attachments:
    • Reading_log_RTL87X0C.txt (14.65 KB) You must be logged in to download this attachment.
    • readResult_RTL87X0C_275-WF-RL_2_2026-17-1-14-50-04.bin (2 MB) You must be logged in to download this attachment.
  • #17 21863617
    divadiow
    Level 38  
    Posts: 4845
    Help: 421
    Rate: 853
    >>21811926

    I didn't notice this post from back in January. Here's the boot log from your firmware dump.

    Code: Text
    Log in, to see the code


    tomik67 wrote:
    it was not always without errors, the last module despite repeated attempts always showed some errors.


    You should find the latest Easy Flasher more resilient.
  • #18 21863652
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14400
    Help: 650
    Rate: 12330
    This has macOS build but no RTL support:
    https://github.com/openshwprojects/EasyGUIFlashTool
    No RTL support... yet?
    Helpful post? Buy me a coffee.
  • #19 21863783
    tomik67
    Level 12  
    Posts: 111
    Rate: 11
    Board Language: polish
    divadiow wrote:
    Is your device MTG236-WF or MTG276-WF?

    Model MTG236-WF is the flush-mounted version and MTG276-WF-RL is the surface-mounted version, pcb slightly different but dpID the same.
  • #20 21865586
    divadiow
    Level 38  
    Posts: 4845
    Help: 421
    Rate: 853
    p.kaczmarek2 wrote:
    No RTL support... yet?


    could give it a go I guess, unless you were thinking or doing it. or anyone else was

    Added after 47 [seconds]:

    Almost got XR806 support in EF1 to a good point I believe
  • #21 21865598
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14400
    Help: 650
    Rate: 12330
    Sure, please give it a go. Maybe @DeDaMrAz can help testing
    Helpful post? Buy me a coffee.
  • #22 21866282
    divadiow
    Level 38  
    Posts: 4845
    Help: 421
    Rate: 853
    hmm. fiddly. read is oddly flakier than write, just like EF1 is/was. write and full chip erase OKish. capped baud though.

    Screenshot of EasyGUI Flash Tool with progress bar and flashing operation log
  • #23 21866952
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14400
    Help: 650
    Rate: 12330
    Sure, let's have it. Can you open a PR? Do you test only in web browser or also on Windows? I noticed that serial backends are a bit different between platforms.
    Helpful post? Buy me a coffee.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion revolves around flashing the RTL8720CF chip used in WBR2 and WBR3 modules, similar to ESP modules. Users share experiences and techniques for modifying the modules, including routing wires for easier access to GPIOs and ensuring stable operation for integration with Home Assistant. Various methods for exposing pads on the module for flashing are debated, including careful PCB modifications. Users also discuss the importance of labeling connections and ensuring adequate power and ground connections for development purposes.
Generated by the language model.
Today's popular

FAQ

TL;DR: Flashing WBR2/WBR3 needs more than 4 wires, and one expert notes the rear pads are "a pain" to reach. This FAQ is for Tuya modders who want a step-by-step RTL8720CF flashing path, safer pad access, and a reusable WBR3 test jig that frees devices from the cloud and works with Home Assistant. [#21427090]

Why it matters: The thread turns a fiddly Realtek module into a repeatable flashing workflow, plus a practical dev-board approach for recovery, testing, and faster firmware experiments.

Option Year mentioned RTL8720CF support in thread Best use
Legacy RTL flashing tools 2025 Yes Original WBR2/WBR3 process
BK7231GUIFlashTool 2026 Yes Preferred read/write tool for this platform
EasyGUIFlashTool macOS build 2026 No RTL support yet macOS availability, but not for RTL yet

Key insight: Keep recovery access to the hard-to-reach rear pad and to A0/A13. That single design choice makes repeated flashing, full-chip erase, and post-OTA rescue much easier on WBR3 hardware.

Quick Facts

  • The guide explicitly covers WBR1, WBR2, WBR3, WBR2L, WBR3L, and WBRU when they use the RTL8720CF or similar core chip. [#21426314]
  • Reported working flash speeds were 921600 and 2000000 baud for writing, while one user could read a module only at 1500000 baud and still saw errors. [#21811926]
  • One reusable WBR3 adapter used 5 V USB-C, 3 GND, and 2 3V3 pins, with labeled headers and spare GPIOs for repeated test access. [#21430457]
  • A flashed WBR3 was mapped as PA3 = red LED, PA2 = blue LED, and PA11 = button, confirming practical GPIO identification after OpenRTL flashing. [#21430141]

How do you flash a WBR2 or WBR3 module with the RTL8720CF step by step, including which wires and pads need to be soldered?

You flash it by soldering the required wires, then following the RTL8720CF video guide and text guide for WBR2/WBR3-class modules. 1. Solder the flashing wires, including access to the hard-to-reach rear pad and the lines needed to control boot state. 2. Pull the required control pads high as shown on the custom dev board approach. 3. Run the flash tool and then continue configuration through the linked playlist for Home Assistant setup. The author states the process is similar to ESP modules, but needs a few more wires. [#21426314]

Which Tuya modules are covered by this RTL8720CF flashing guide besides WBR2 and WBR3, such as WBR1, WBR2L, WBR3L, or WBRU?

The guide also covers WBR1, WBR2L, WBR3L, and WBRU, as long as the module uses the RTL8720CF core chip or a similar Realtek chip. That scope is stated directly in the opening post, so the procedure is not limited to only WBR2 and WBR3 boards. [#21426314]

What's the best way to access the rear pads on a WBR3 module when the pad layout is hard to reach for flashing?

The most practical method is to route the rear pad to an external header using thin wire, ideally hidden inside a donor chassis or adapter. One builder called the rear pad position “a pain,” then proposed converting a CR3L case into a WBR3 dev board so all GPIOs and hard pads stay reachable from outside. [#21427090]

Why would someone route the back pad of a WBR3 module out to an external header, and how does that help if an OTA flash gets bricked?

You route that pad out so you still have hardware recovery access if an OTA update fails. The thread explicitly says the extra back-pad wire was added “just to be on the safe side” because it may be needed after a bricked OTA, which turns a risky hidden pad into an accessible recovery point. [#21427247]

What are A0 and A13 used for during WBR3 flashing, and how do you pull them high correctly on a custom dev board?

A0 and A13 are the pads the custom WBR3 adapter exposed so they could be pulled high easily during flashing. The finished board specifically reports that “A0 and A13 can be pulled high with ease,” which means the builder designed dedicated, reachable header access instead of relying on temporary probes on tiny rear pads. [#21430141]

How can you turn a CR3L Bluetooth Gateway chassis into a WBR3 development board with USB-C power, labeled headers, and spare GPIO access?

Remove the CR3L module, fit a WBR3, and route the module pads to external jumper headers in the case. The finished build added 5 V USB-C power, labeled headers, spare GPIOs, multiple grounds, and 3V3 pins, creating a reusable flashing and testing adapter instead of a one-off wiring job. [#21430141]

Which GPIOs were identified in the thread for the flashed WBR3 module, and how were PA3, PA2, and PA11 mapped to LEDs and button functions?

The mapped GPIOs were PA3 for the red LED, PA2 for the blue LED, and PA11 for the button. Those assignments were reported immediately after the module was flashed to OpenRTL, so they serve as working pin confirmations for that specific WBR3-based dev-board build. [#21430141]

What is OpenRTL in the context of flashing Realtek RTL8720CF modules, and how does it relate to freeing Tuya devices from the cloud?

OpenRTL is firmware used on Realtek RTL8720CF-based modules after flashing, and the thread shows a WBR3 successfully flashed to it. "OpenRTL" is firmware that replaces stock Tuya software on supported Realtek modules, enabling local control, direct GPIO mapping, and cloud-independent operation. In this thread, it is presented as part of the path to free Tuya devices from the cloud and pair them with Home Assistant. [#21426314]

What does OTA mean when working with WBR3 or RTL8720CF devices, and why is it important to keep recovery access available?

OTA means over-the-air firmware updating, and it matters because a failed OTA can lock you out of normal recovery. "OTA" is a firmware update method that writes new software through the device itself, without opening hardware, but a failed image can leave recovery pads as the only practical rescue path. That is why the thread recommends routing out the hidden rear pad before final assembly. [#21427247]

BK7231GUIFlashTool vs the legacy RTL flashing tools: which one should you use for WBR2/WBR3 modules in 2026 and why?

Use BK7231GUIFlashTool in 2026 because the thread says this platform is supported there for read and write, with the same soldering and wire connections as before. The 2026 update explicitly recommends using that tool instead of legacy tools for RTL8720CF-class modules such as WBR2 and WBR3. [#21811291]

How can I run the Realtek flashing tools on macOS for WBR3 or RTL8720CF devices, and what are the current limitations?

You currently cannot rely on a macOS build for RTL8720CF flashing from this thread alone, because the cited macOS build has no RTL support yet. The thread names EasyGUIFlashTool as having a macOS build, but immediately adds the limitation: “No RTL support... yet?”, so WBR3/RTL use on macOS remains unfinished here. [#21863652]

Why might reading flash from a WBR3 module be flakier than writing, and which baud rates were reported to work more reliably?

Reading appears flakier than writing on this platform, and the thread reports concrete baud-rate differences. One user could read only at 1500000 baud, with intermittent errors, while writing worked at 921600 and 2000000 baud. A later test also says read was “oddly flakier than write,” though write and full-chip erase were still acceptable with capped baud. [#21866282]

What should you do when a WBR3 module shows repeated read errors or an OBK config write fails during flashing?

Try the newer Easy Flasher first, lower expectations for read stability, and separate firmware flashing from config extraction. A user reported repeated read errors and a failed OBK config write on an MTG276-WF-RL module, and the reply said the latest Easy Flasher should be more resilient for those failures. [#21863617]

How do MCU-based Tuya devices like the MTG276-WF-RL or MTG236-WF differ from fully Wi-Fi-controlled devices when extracting configs or making OpenBeken templates?

They differ because the Wi-Fi module handles communication, while the external MCU handles device logic, so detailed Wi-Fi-side templates may not exist. The thread states there is no detailed config for MTG276-WF-RL because it is an MCU device, and it adds that MTG236-WF and MTG276-WF-RL share the same dpID despite different flush and surface-mounted hardware. [#21863783]

What labeling, ground, and 3V3 header layout works best when building a reusable WBR3 test jig or development adapter for repeated flashing?

A practical layout uses clear pin labels, multiple grounds, and at least two 3V3 pins on an external header. One finished adapter had labeled headers, 3 GND, and 2 3V3, while the follow-up advice was to add more grounds and VDD pins in advance because repeated flashing and GPIO experiments benefit from extra power and reference points. [#21430457]
Generated by the language model.
ADVERTISEMENT