RDA 5981AM/Broadlink BL3335-P - Generic/nobrand 15W RGBW B22 Bulb - basic teardown

Altirix 3879 200

Report a violation of the law

Reply | New topic

#151 21703891 29 Sep 2025 08:21

insmod insmod

Level 29

Helpful post? (0)

Post #151
21703891 29 Sep 2025 08:21

Pull request - https://github.com/openshwprojects/OpenBK7231T_App/pull/1813
Disable tuyamcu and dht.
Kept aht2x and enabled wrapping printf functions for float printf.
Need another ota test.
@p.kaczmarek2
I changed how "Prepare CI Environment" step is handled in workflow.
If it builds a non-release version, then that step is skipped, saving about 30 sec.
But i can't check if it would work for next release.
ADVERTISEMENT
#152 21703893 29 Sep 2025 08:24

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #152
21703893 29 Sep 2025 08:24

I can merge it now and we will try on release version.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#153 21703897 29 Sep 2025 08:28

insmod insmod

Level 29

Helpful post? (0)

Post #153
21703897 29 Sep 2025 08:28

Okay. Though i don't know if nanoprintf breaks RDA or not. Might release non-working RDA build.
ADVERTISEMENT
#154 21703911 29 Sep 2025 08:48

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #154
21703911 29 Sep 2025 08:48

We'll know once @divadiow tests. If there is a problem, I can remove this release, so we don't have polluted release history.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#155 21703915 29 Sep 2025 08:58

insmod insmod

Level 29

Helpful post? (0)

Post #155
21703915 29 Sep 2025 08:58

It didn't work i see, version wasn't overridden to release one.
Fix is not working yet (#1815)
#156 21703917 29 Sep 2025 09:01

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #156
21703917 29 Sep 2025 09:01

Ah ok, i can accept futher one. I'm available today whole day.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#157 21703922 29 Sep 2025 09:05

divadiow divadiow

Level 36

Helpful post? (0)

Post #157
21703922 29 Sep 2025 09:05

insmod wrote:
Need another ota test.

main_6083ddfca5f3
Code: Text
Log in, to see the code
#158 21703929 29 Sep 2025 09:11

insmod insmod

Level 29

Helpful post? (0)

Post #158
21703929 29 Sep 2025 09:11

@p.kaczmarek2
https://github.com/openshwprojects/OpenBK7231T_App/pull/1816
>>21703922
Does AHT2X print anything now?
#159 21703933 29 Sep 2025 09:13

divadiow divadiow

Level 36

Helpful post? (0)

Post #159
21703933 29 Sep 2025 09:13

insmod wrote:
Does AHT2X print anything now?
ADVERTISEMENT
#160 21703942 29 Sep 2025 09:32

insmod insmod

Level 29

Helpful post? (0)

Post #160
21703942 29 Sep 2025 09:32

Why is there 4 incomplete boots though?

Added after 16 [minutes]:

Ota fix? https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/18089380421
#161 21703961 29 Sep 2025 09:41

divadiow divadiow

Level 36

Helpful post? (0)

Post #161
21703961 29 Sep 2025 09:41

insmod wrote:
Why is there 4 incomplete boots though?

unsure of my exact steps, but every reboot adds +1 incomplete reboot until safe mode. then it'll always go into safe mode again on reboot even if you exit safe mode first.

this is after running aht2x driver (ad-hoc - not in startup command), I'll wipe and see if incomplete count changes with no driver ever being run

Added after 4 [minutes]:

first boot after flash

Code: Text
Log in, to see the code

second
Code: Text
Log in, to see the code

etc

Added after 2 [minutes]:

so actually, nothing to do with driver running
#162 21703978 29 Sep 2025 09:44

insmod insmod

Level 29

Helpful post? (0)

Post #162
21703978 29 Sep 2025 09:44

>>21703961
Fix for flash vars https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/18089628603
#163 21703983 29 Sep 2025 09:49

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #163
21703983 29 Sep 2025 09:49

Looks like "boot is ok" event is not written?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#164 21703989 29 Sep 2025 10:04

divadiow divadiow

Level 36

Helpful post? (0)

Post #164
21703989 29 Sep 2025 10:04

insmod wrote:
Fix for flash vars https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/18089628603

first boot

second and all after = incomplete boots: 1

OTA with same build =
Code: Text
Log in, to see the code

Added after 9 [minutes]:

a small side-effect of changing build file extension to .img is that the RDA tool only allows *.bin so requires manual *.* reveal first. just a point of note
#165 21703996 29 Sep 2025 10:05

insmod insmod

Level 29

Helpful post? (0)

Post #165
21703996 29 Sep 2025 10:05

>>21703989
I'll change it back then in next commit
https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/18090104614
#166 21704024 29 Sep 2025 10:32

divadiow divadiow

Level 36

Helpful post? (0)

Post #166
21704024 29 Sep 2025 10:32

insmod wrote:
https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/18090104614

failed
#167 21704028 29 Sep 2025 10:37

insmod insmod

Level 29

Helpful post? (+1)

Post #167
21704028 29 Sep 2025 10:37

https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/18090879999

Added after 3 [minutes]:

https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/18090969780
#168 21704049 29 Sep 2025 10:50

divadiow divadiow

Level 36

Helpful post? (0)

Post #168
21704049 29 Sep 2025 10:50

insmod wrote:
https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/18090969780

Code: Text
Log in, to see the code
#169 21704058 29 Sep 2025 11:03

insmod insmod

Level 29

Helpful post? (0)

Post #169
21704058 29 Sep 2025 11:03

I'm giving up on OTA. There is no actual example of using it. Plus function docs says write address and buffer length must always be aligned to 1k.
And what does rda5981_write_partition_end do? Just check crc? If so, then how does update is applied then?
https://github.com/openshwprojects/OpenBK7231T_App/pull/1817
#170 21704070 29 Sep 2025 11:15

divadiow divadiow

Level 36

Helpful post? (0)

Post #170
21704070 29 Sep 2025 11:15

yep. fair enough.

guessing no clues in anyone else's work? https://github.com/search?q=rda5981_write_partition_end&type=code

no matter though.
#171 21704083 29 Sep 2025 11:35

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #171
21704083 29 Sep 2025 11:35

There is such sample:
Code: C / C++
Log in, to see the code

Added after 47 [seconds]:

Also in AliOS:
https://github.com/brucetsao/AliOS-Things/blo...3b1/platform/mcu/rda5981x/hal/ota_port.c#L100

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#172 21704085 29 Sep 2025 11:41

insmod insmod

Level 29

Helpful post? (0)

Post #172
21704085 29 Sep 2025 11:41

>>21704070
It actually does, but there are still limits that i explained earlier.
Flash write length, for example, must be aligned to 256 bytes
https://github.com/ARMmbed/mbed-os/blob/d723b...GET_RDA/TARGET_UNO_91H/src/wland_flash.c#L142
SDK was actually not needed.
Almost everything is there in mbed-os main repo.

Added after 4 [minutes]:

I won't do it though, at least without having rda module on hand
@p.kaczmarek2
These need to be merged
https://github.com/openshwprojects/OpenBK7231T_App/pull/1814
https://github.com/openshwprojects/OpenBK7231T_App/pull/1817
#173 21720663 15 Oct 2025 00:01

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (+1)

Post #173
21720663 15 Oct 2025 00:01

Discussion about BG Electrical 822/HC-01 RDA5981A BL3335-P Module Double UK Smart Socket moved to:
https://www.elektroda.com/rtvforum/topic4148862.html

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#174 21720715 15 Oct 2025 06:35

divadiow divadiow

Level 36

Helpful post? (0)

Post #174
21720715 15 Oct 2025 06:35

thank you. now we need @Altirix to come back to have a go with backup and flash of the B22 bulb. Though if bulb is PWM I wonder if that'll be an issue

Added after 1 [minutes]:

insmod wrote:
With config, sta and pins/pwm/uart

though pwm support seems to have been added

Added after 1 [minutes]:

divadiow wrote:
PWM seems to be OK. Dimmer works, colour picker works, warm/cold slider. LED dr in web app works.

oh. and I did check it

#175 21726119 20 Oct 2025 18:20

insmod insmod

Level 29

Post #175

21726119 20 Oct 2025 18:20

Got bootloader to work, and if OTA image is written manually - then upgrade occurs.
The only thing left is to fix ota code in OBK, but that might be rather hard. rda5981_write_partition must be aligned to 1K.

bootloader starts...
crc:0xa0fa6b33
firmware image valid
crc:0xc78cc364
upgrade image valid
current firmware is valid(ver:dev_20251020_165123)
upgrade is valid(ver:667916694)
firmware size 297598, after lzma decode 480008
crc:0x27cf9996
firmware crc 0x27cf9996(667916694), after lzma decode 0x27cf9996(667916694)
upgrade complete
update firmware information complete
erase image, addr: 0x18095000
boot from 0x18004000
boot user partition:0x18004000, pc:0x18018b59

----------------maclib task 
OpenRDA5981, version dev_20251020_165123
Entering initLog()...
Commands registered!

Added after 1 [hours] 25 [minutes]:

Semi-working OTA - https://github.com/openshwprojects/OpenBK7231T_App/pull/1839
I get firmware image invalid after upgrade, even though it's working fine

bootloader starts...
crc:0x3304f1f5
firmware image invalid
crc:0x657dbae8
upgrade image valid
bootloader starts...
crc:0x6affa22c
firmware image invalid
crc:0x657dbae8
upgrade image valid
firmware size 289910, after lzma decode 468160
crc:0x60353d1f
firmware crc 0x72f(1839_merge_655d0fc32777), after lzma decode 0x60353d1f(1614101791)
upgrade flash operation failed in copy upgrade firmware
boot from 0x18004000
boot user partition:0x18004000, pc:0x18018bc9

----------------maclib task 
OpenRDA5981, version 1839_merge_655d0fc32777
Entering initLog()...
Commands registered!

Added after 33 [minutes]:

Now with easyflash and littlefs

#176 21726237 20 Oct 2025 18:49

divadiow divadiow

Level 36

Helpful post? (0)

Post #176
21726237 20 Oct 2025 18:49

hey great! nice

you got yourself an RDA5981 I guess
#177 21726252 20 Oct 2025 18:55

insmod insmod

Level 29

Helpful post? (0)

Post #177
21726252 20 Oct 2025 18:55

>>21726237
BL3335-P from SP4L-US plug.
It can't be easily disassembled, like UK or EU version. No screws. Destroyed it in the process.
#178 21726511 20 Oct 2025 22:17

divadiow divadiow

Level 36

Helpful post? (0)

Post #178
21726511 20 Oct 2025 22:17

all for a good cause.

need IO21 high for log? for flashing too or just power-on and rx/tx?
#179 21726631 21 Oct 2025 12:58

insmod insmod

Level 29
Helpful post? (0)

Post #179
21726631 21 Oct 2025 12:58

>>21726511
No need for IO21 at all

Added after 5 [hours] 12 [minutes]:

Since OTA is merged, here's the flasher
https://github.com/openshwprojects/BK7231GUIFlashTool/pull/76

Read works fine, occasional errors are there, but retry works fine. Hash checks every sector.
Write is hacked, commands like "flash 1" "flash 5 2 4096 0 1" "flash 3" are sent without confirmation if they've worked, unlike original flasher.
But it works for me just fine.
Can't write only OBK config. If firmware is not flashed after, it will stop booting. So i disabled it, and "Automatically configure OBK on flash write" will write config before firmware flash.

Read is like on RTL_Z2 (dump bytes)
Code: text Expand Select all Copy to clipboard
md.b 180F4000 4096 180F-4000: 1F 3F FF FF 45 46 34 30 FF FF FF FF FF FF FF FF .?яяEF40яяяяяяяя ...

I did find an interesting alternative read command in ROM dump - "uploadb". But it's broken, adds some garbage at specific offsets. Plus it's not immediate.

No baud change, only 921600. Second argument of "loadx"/"loady" commands allows baud change, but i wasn't able to get it to work.
#180 21726903 21 Oct 2025 13:18

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #180
21726903 21 Oct 2025 13:18

Nice! IF you have issues with baud change, check UI code calls. I remember they caused issues for me in BL602. It turned out that addLog with Invoke is very, very slow. It halts thread and SerialPort does not react in time.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Reply | New topic

Report a violation of the law

Topic summary

The discussion revolves around the Broadlink BL3335-P smart bulb, which utilizes the RDA 5981AM chip. The original poster seeks information on the device and its components after peeling off the can to reveal the chip. They mention the bulb likely originated from AliExpress and express interest in moving away from proprietary firmware. Other participants inquire about the availability of a datasheet and suggest methods for obtaining a boot log, including using an Arduino for serial communication. They also note the existence of a similar module available on AliExpress (HLK-M50) and discuss the outdated nature of the available SDKs for the RDA5981AM chip.
Summary generated by the language model.

FAQ

TL;DR: 2 MB Tuya RDA5981 modules exist; “GPIO2 is used as log tx.” This FAQ distills BL3335‑P/RDA5981 teardown notes, SDK status, and dump tips. For modders migrating generic 15W RGBW bulbs off proprietary stacks. [Elektroda, insmod, post #21634746]

Why it matters: It shows how to identify the module, grab a boot log, and safely dump firmware when documentation is scarce.

Quick Facts

- SoC/module ID: Broadlink BL3335‑P uses RDA5981AM, confirmed by teardown and linked docs. [Elektroda, Altirix, post #21434407]
- Flash sizes seen: Tuya WRD2L/WRD3S modules are 2 MB and rare/pricey. [Elektroda, insmod, post #21634746]
- HLK‑M50 often maps as 1 MB; wrong dump bases can create a repeated 2044 KB image. [Elektroda, divadiow, post #21479530]
- SDK status: Public RDA5981 SDKs are old (Mbed OS 5.1.5 v1.3.5); no FreeRTOS noted. [Elektroda, insmod, post #21434414]
- Tuya modules: GPIO2 is designated as the UART log TX. [Tuya WRD3L Datasheet]

What chip is inside the Broadlink BL3335‑P smart bulb module?

A teardown shows the RF can covers an RDA5981AM Wi‑Fi SoC. The carrier PCB is marked BR3335, and the assembled module is sold as BL3335‑P. Photos in the thread reveal the die marking after peeling the shield. This identification aligns the bulb with the RDA5981 software ecosystem rather than ESP‑class parts. [Elektroda, Altirix, post #21434019]

Where can I find documentation for BL3335‑P and RDA5981AM?

Start with the FCC user manual for Broadlink BL3335‑P and the RDA5981AM datasheet. Both links are collected in the thread for quick access. The docs help with pinout, regulatory details, and SoC capabilities, which are essential for logging and firmware work. [Elektroda, Altirix, post #21434407]

Is there open-source firmware support for RDA5981 (OpenBeken/Tasmota/ESPHome)?

Active, mainstream support is not available. Builders have replaced the module with an ESP‑based board in similar bulbs due to the lack of open stacks targeting RDA5981. The thread opener invites contributors to attempt a port if interested. [Elektroda, Altirix, post #21434019]

How do I capture a boot log from an RDA5981 bulb or module?

Use a 3.3 V USB‑to‑serial (an Arduino in pass‑through mode works) and connect to RX/TX. Power the board at 3.3 V from a stable source. Open a terminal and reset the device to catch the early boot prints. [Elektroda, Altirix, post #21434407]

Which pin outputs logs on Tuya RDA5981 modules like WRD2L/WRD3S?

Tuya’s datasheet specifies GPIO2 as the log UART transmitter. Route your USB‑to‑serial RX to GPIO2 and common ground, then try standard baud rates. If silent, logs may be disabled in that build. [Tuya WRD3L Datasheet]

What RDA5981 SDKs exist, and are they viable today?

Public SDKs are dated Mbed OS 5.1.5 branches, and FreeRTOS isn’t provided. As one contributor puts it, “the sdks i’ve seen are very old.” Expect missing modern tooling and limited RTOS choices without vendor updates. [Elektroda, insmod, post #21434414]

How can I dump HLK‑M50 (RDA5981) firmware without duplication artifacts?

Use correct start address and 1 MB length to include the bootloader. The RDA Dump tool’s default vendor settings produce a 2044 KB file with repeated content on HLK‑M50. Adjust offsets to avoid mirrored dumps. [Elektroda, divadiow, post #21479530]

Why do I see no boot log or AP on an HLK‑M50 module?

One tester observed no UART output at any baud and no AP, only a brief power spike. That behavior suggests the image disables logs and soft‑AP or the device waits for external triggers. Verify power integrity and logging pins. [Elektroda, divadiow, post #21479538]

Are Tuya RDA5981 modules still available, and which models exist?

Yes, but they’re rare and expensive. Identified 2 MB variants include WRD2L, TYWRD2S, and TYWRD3S. The same source also lists other interesting Wi‑Fi/BLE modules stocked by the seller, but not RDA5981 alternatives at similar cost. [Elektroda, insmod, post #21634746]

Any useful tools or repos for working with RDA5981 images?

Check hfeasy for utilities and the RDA Dump tool used with Hi‑Flying modules. The thread includes sample dumps, boot strings, and notes on correcting dump bases to avoid duplicated images. [Elektroda, divadiow, post #21479530]

Can desoldering the module help identify GPIOs and signals?

Yes. If documentation is thin, remove the can or the module and inspect the underside for silkscreened GPIO labels. This is a practical way to map UART and control lines before wiring. [Elektroda, p.kaczmarek2, post #21434400]

Is anyone porting OpenBeken to RDA5981 right now?

A maintainer expressed interest but is prioritizing XR806 porting first. That places any RDA5981 work in a queue without a public timeline. Community test hardware and logs would help when development starts. [Elektroda, p.kaczmarek2, post #21434400]

What’s inside the generic 15W RGBW B22 bulb using BL3335‑P?

It’s an unbranded bulb, likely from AliExpress, carrying a Broadlink BL3335‑P module with an RDA5981AM under the RF can. Prior art shows people replacing the control board with ESP boards due to software support gaps. [Elektroda, Altirix, post #21434019]

Do boot strings reveal anything about the firmware base?

Captured strings include “airkiss‑2.0.0‑25360 (Dec 17 2015) ... ARM Cortex‑M3” and a build timestamp from December 2017. Those indicate legacy Broadlink stacks and toolchains, aligning with the older SDK landscape. [Elektroda, divadiow, post #21479530]

Where can I browse an RDA5981 SDK repository snapshot?

A GitHub mirror collects RDA5981 SDK material, including Mbed OS 5.1.5 based trees. It’s a starting point for analysis, though not a modern upstream. [Elektroda, divadiow, post #21434436]