logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

RDA 5981AM/Broadlink BL3335-P - Generic/nobrand 15W RGBW B22 Bulb - basic teardown

Altirix 6666 200
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #181 21726910
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    >>21726903
    It's not that, it's just that there's no command in rom for baud change. Or if there is, i couldn't find it.
  • ADVERTISEMENT
  • #182 21726995
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    what's checksum 1 vs checksum 2 and is erase of any use (assuming things I'm seeing are valid)?

    Added after 20 [minutes]:

    flasher source
    Attachments:
    • flashtest_src_20200922展讯WIFI下载源码.7z (2.4 MB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #183 21727017
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    >>21726995
    If erase is not used, then obk config write fails.
    I don't know why it isn't required for fw.
    checksum 1 - crc32, checksum 2 - sha1
    >>21726995
    Good, i'll adjust my code tomorrow.

    I think after this i'll have to try to convert flasher from threads to tasks + cancellation tokens.
    Crashes when stopping current operation are too annoying.
  • #184 21727068
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    insmod wrote:
    Crashes when stopping current operation are too annoying.

    this. yes

    insmod wrote:
    Good, i'll adjust my code tomorrow.


    cool. many more things. a few bootloaders and AT firmwares. lots of repeats, some not so relevant. all from Gitee from "RDA5981" search.

    Maybe I should have cloned to GH instead.

    MQLinks from MQ-12F fame have an RDA5981 module - M0R1. https://blog.csdn.net/mqlinks/article/details/106709888
    Attachments:
    • x-c1x-sdk-ali-master.zip (195.67 MB) You must be logged in to download this attachment.
    • x-c1x-alios-things-sdk-master.zip (79.87 MB) You must be logged in to download this attachment.
    • RDA5981-master.zip (153.85 MB) You must be logged in to download this attachment.
    • RDA5981_Develop-master.zip (13.15 MB) You must be logged in to download this attachment.
    • MYLINKS_FIRMWARE_DOC-master.zip (214.77 KB) You must be logged in to download this attachment.
    • LP270-COMBO-master.zip (278.58 MB) You must be logged in to download this attachment.
    • lase-light_-sdk-master.zip (190.95 MB) You must be logged in to download this attachment.
    • flash-test_-rda5981-a-master.zip (207.73 MB) You must be logged in to download this attachment.
    • Ai-Thinker-Open-TG7100C_SDK-release-v1.6.6-10.zip (186.57 MB) You must be logged in to download this attachment.
  • #185 21727072
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    newer MbedOS SDK clues
    Spoiler:
    # M0R1 Series Wi-Fi Module MQTT Transparent Transmission Version Notes

    ## 1. Wi-Fi Firmware Download

    **MQTT Version Firmware Download Address: [Click to View](http://mqlinks.tpddns.cn:1888/DirectoryLister/?dir=WIFI\M0R1_RDA5981\firmware\mqtt)**

    **Multi-Function Version Firmware Download Address: [Click to View](http://mqlinks.tpddns.cn:1888/DirectoryLister/?dir=WIFI\M0R1_RDA5981\firmware\at_uart)**

    ## 2. Version Notes
    ### Release Date: October 18, 2021 Version Number: Mbedos515_V21_0430.011
    1. Optimized the connection speed of the Alibaba Cloud IoT Suite
    2. Now supports querying Alibaba Cloud configurations
    3. Added the ability to save configurations to factory defaults

    ### Release Date: September 21, 2021 Version Number: Mbedos515_V21_0430.010
    1. Added AP network configuration interface functionality
    2. Optimized AIRKISS network configuration speed

    ### Release Date: August 1, 2021 Version Number: Mbedos515_V21_0430.009
    1. Optimized MQTT packet stability

    ### Release Date: July 17, 2021 Version Number: Mbedos515_V21_0430.008
    1. Resolved issues with receiving large amounts of data from the serial port over the network

    ### Release Date: March 15, 2021 Version Number: Mbedos515_V21_0430.007
    1. Supports AP network configuration
    2. Adds slow serial port commands to ensure the integrity of MQTT packets
    3. Starting with version 007, there are two versions: one that remains the same as before, and one that includes GPIO port reset configuration and access to airkiss network configuration

    ### Release Date: March 15, 2021 Version Number: Mbedos515_V21_0430.006
    1. Improves connection stability across MQTT platforms
    2. Improves MQTT communication responsiveness

    ### Release Date: February 23, 2021 Version Number: Mbedos515_V21_0430.005
    1. Updates the SDK package to Mbedos515_V21_0430

    ### Release Date: January 15, 2021 Version: Mbedos515_V20_0712.004
    1. Fixed an issue where only setting the three Alibaba Cloud elements failed to connect to the server.
    2. Added two super commands for users to configure parameters for the Alibaba Cloud IoT Suite and MQTT server.

    ### Release Date: January 9, 2021
    Version: Mbedos515_V20_0712.003
    1. Added the AT+MRD command to set the "Retained" attribute of the MQTT publish function: AT+MRD=on turns on the "Retained" attribute.

    ### Release Date: January 3, 2021 Version Number: Mbedos515_V20_0712.002
    Starting in 2021, the SDK version for version M0R1 will be updated to Mbedos515_V20_0712. Major updates compared to previous versions include:
    1. Fixed a memory leak during the scan process;
    2. Fixed an issue where some phones failed to connect to hotspots;
    3. Fixed an issue where link loss could not be detected in sniffer mode;
    4. Fixed an issue causing out-of-bounds exceptions;
    5. Fixed an issue with beacon hopping in STA+AP mode;
    6. Fixed an issue with deduplication timers;

    Version 002 adds the following:
    1. Fixed the pinout feature in the previous version M0E1.
    2. When configured in APSTA mode, AP connections will work even if STA connections are unavailable.

    ### Release Date: December 22, 2020 Version Number: Mbedos515_V1.3.7.001
    1. MQTT transparent transmission version released


    Added after 12 [minutes]:

    Cloudspeaker device. USB fw update

    http://info.mqlinks.com:1888/dokuwiki/doku.ph...=search&id=mq-12fusermanual&q=rda5981
    Two QR code stands for payment on a restaurant table.
    CloudSpeaker V7.2 PCB with wires connected via pin header
  • ADVERTISEMENT
  • Helpful post
    #186 21727217
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    Release is 'broken' - there is no UART binary.
    https://github.com/openshwprojects/OpenBK7231T_App/pull/1840
    And since there is no 'release' yet, i've decided to switch bootloader to ali one.
    It allows for better OTA image compression. 15kb is saved in my case (gcc 10).

    Added after 14 [minutes]:

    Comparison:

    Old:
    Code: text Expand Select all Copy to clipboard
    1839_merge_a0818b4b69d3
input_file: sdk/OpenRDA5981/.build/OpenBeken.bin
lzma_file: sdk/OpenRDA5981/.build/OpenBeken.bin.lzma
   size: 308741
   version: 1839_merge_a0818b4b69d3
   crc32_lzma: b3aba129

    New:
    Code: text Expand Select all Copy to clipboard
    1840_merge_7310c557b9c5
input_file: sdk/OpenRDA5981/.build/OpenBeken.bin
lzma_file: sdk/OpenRDA5981/.build/OpenBeken.bin.lzma
   size: 293299
   version: 1717805796
   crc32_lzma: bfe5866c

    15442 bytes lighter.
  • #187 21727673
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    yummy
    BK7231 Easy UART Flasher interface with firmware write operation completed
    OpenRDA5981 control panel with active WiFi and MQTT connection

    Added after 13 [minutes]:

    insmod wrote:
    And since there is no 'release' yet, i've decided to switch bootloader to ali one


    Code: Text
    Log in, to see the code


    tbh I thought the bl wasn't changeable (without SPI or whatever, like BK-T)

    OTA list stops at OpenRDA5981_1.18.203.img and OTA attempt causes
    Code: Text
    Log in, to see the code


    requiring re-flash. I see naming has changed a little. and of course file size makes sense now
    https://github.com/openshwprojects/OpenBK7231...ownload/1.18.205/OpenRDA5981_1.18.205_ota.img

    Code: Text
    Log in, to see the code


    Added after 14 [minutes]:

    https://github.com/OpenBekenIOT/webapp/pull/232
  • #188 21727683
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    Updated flasher, now supports only obk config write.
    Also implemented full erase.

    A note about ali bootloader - it doesn't allow same version upgrade. (uart and ota versions are different, so 1.18.205 uart will upgrade to 1.18.205 ota).
  • ADVERTISEMENT
  • #190 21727699
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    >>21727691
    Fixed
  • #191 21728390
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    erase all. no crash but not getting past:

    Flashing tool interface for RDA5981 chip using COM46 port
  • #192 21728395
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    >>21728390
    Buttons are enabled, meaning it succeeded.
  • #193 21728399
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    damn. fallen for that again. thanks

    Added after 7 [minutes]:

    is erase one of those soft-erase kinda functions where only a few bytes are removed so it's seen to be marked as erased? I took backup after erase and I see data from 0x1000 still
  • #194 21728432
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    >>21728399
    Fixed
  • #195 21728560
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    >>21728432

    yes. blank now. appreciate the additional logging

    BK7231 Easy UART Flasher interface with COM46 port open and flash log visible
  • #196 21730163
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    RDA5981 seen in USB borescope device - https://reverseengineering.stackexchange.com/...mera-ypc99-how-to-stream-on-linux/27180#27180

    source: Tasmota Discord https://discord.com/channels/479389167382691863/790917300210368562/975139694285299782

    hurricos — 5/14/22, 9:57 PM
    Quote:
    A long shot, but: I'm trying to identify the MCU used in the "YPC99" USB boroscope USBcam-to-WiFi module.

    The device provides 11n WiFi and supports acting as a USB 2.0 host. It is made to find a USB Camera device and associate with it, then provide an RTSP stream.
  • #198 21739138
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12315
    Yes!! Great progress, just keep platforms md updated
    Helpful post? Buy me a coffee.
  • #199 21742205
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    p.kaczmarek2 wrote:
    Yes!! Great progress, just keep platforms md updated

    I have some changes in main ready (if acceptable), but wanted to include BK7231N submodule commit update, if change to submodule is acceptable

    https://github.com/openshwprojects/OpenBK7231N/pull/25

    https://github.com/openshwprojects/OpenBK7231...compare/main...divadiow:OpenBK7231T_App:Monly
  • #200 21742263
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12315
    Ready to merge and tested?
    Helpful post? Buy me a coffee.
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion revolves around the Broadlink BL3335-P smart bulb, which utilizes the RDA 5981AM chip. The original poster seeks information on the device and its components after peeling off the can to reveal the chip. They mention the bulb likely originated from AliExpress and express interest in moving away from proprietary firmware. Other participants inquire about the availability of a datasheet and suggest methods for obtaining a boot log, including using an Arduino for serial communication. They also note the existence of a similar module available on AliExpress (HLK-M50) and discuss the outdated nature of the available SDKs for the RDA5981AM chip.
Generated by the language model.
Today's popular

FAQ

TL;DR: 2 MB Tuya RDA5981 modules exist; “GPIO2 is used as log tx.” This FAQ distills BL3335‑P/RDA5981 teardown notes, SDK status, and dump tips. For modders migrating generic 15W RGBW bulbs off proprietary stacks. [Elektroda, insmod, post #21634746]

Why it matters: It shows how to identify the module, grab a boot log, and safely dump firmware when documentation is scarce.

Quick Facts

What chip is inside the Broadlink BL3335‑P smart bulb module?

A teardown shows the RF can covers an RDA5981AM Wi‑Fi SoC. The carrier PCB is marked BR3335, and the assembled module is sold as BL3335‑P. Photos in the thread reveal the die marking after peeling the shield. This identification aligns the bulb with the RDA5981 software ecosystem rather than ESP‑class parts. [Elektroda, Altirix, post #21434019]

Where can I find documentation for BL3335‑P and RDA5981AM?

Start with the FCC user manual for Broadlink BL3335‑P and the RDA5981AM datasheet. Both links are collected in the thread for quick access. The docs help with pinout, regulatory details, and SoC capabilities, which are essential for logging and firmware work. [Elektroda, Altirix, post #21434407]

Is there open-source firmware support for RDA5981 (OpenBeken/Tasmota/ESPHome)?

Active, mainstream support is not available. Builders have replaced the module with an ESP‑based board in similar bulbs due to the lack of open stacks targeting RDA5981. The thread opener invites contributors to attempt a port if interested. [Elektroda, Altirix, post #21434019]

How do I capture a boot log from an RDA5981 bulb or module?

Use a 3.3 V USB‑to‑serial (an Arduino in pass‑through mode works) and connect to RX/TX. Power the board at 3.3 V from a stable source. Open a terminal and reset the device to catch the early boot prints. [Elektroda, Altirix, post #21434407]

Which pin outputs logs on Tuya RDA5981 modules like WRD2L/WRD3S?

Tuya’s datasheet specifies GPIO2 as the log UART transmitter. Route your USB‑to‑serial RX to GPIO2 and common ground, then try standard baud rates. If silent, logs may be disabled in that build. [Tuya WRD3L Datasheet]

What RDA5981 SDKs exist, and are they viable today?

Public SDKs are dated Mbed OS 5.1.5 branches, and FreeRTOS isn’t provided. As one contributor puts it, “the sdks i’ve seen are very old.” Expect missing modern tooling and limited RTOS choices without vendor updates. [Elektroda, insmod, post #21434414]

How can I dump HLK‑M50 (RDA5981) firmware without duplication artifacts?

Use correct start address and 1 MB length to include the bootloader. The RDA Dump tool’s default vendor settings produce a 2044 KB file with repeated content on HLK‑M50. Adjust offsets to avoid mirrored dumps. [Elektroda, divadiow, post #21479530]

Why do I see no boot log or AP on an HLK‑M50 module?

One tester observed no UART output at any baud and no AP, only a brief power spike. That behavior suggests the image disables logs and soft‑AP or the device waits for external triggers. Verify power integrity and logging pins. [Elektroda, divadiow, post #21479538]

Are Tuya RDA5981 modules still available, and which models exist?

Yes, but they’re rare and expensive. Identified 2 MB variants include WRD2L, TYWRD2S, and TYWRD3S. The same source also lists other interesting Wi‑Fi/BLE modules stocked by the seller, but not RDA5981 alternatives at similar cost. [Elektroda, insmod, post #21634746]

Any useful tools or repos for working with RDA5981 images?

Check hfeasy for utilities and the RDA Dump tool used with Hi‑Flying modules. The thread includes sample dumps, boot strings, and notes on correcting dump bases to avoid duplicated images. [Elektroda, divadiow, post #21479530]

Can desoldering the module help identify GPIOs and signals?

Yes. If documentation is thin, remove the can or the module and inspect the underside for silkscreened GPIO labels. This is a practical way to map UART and control lines before wiring. [Elektroda, p.kaczmarek2, post #21434400]

Is anyone porting OpenBeken to RDA5981 right now?

A maintainer expressed interest but is prioritizing XR806 porting first. That places any RDA5981 work in a queue without a public timeline. Community test hardware and logs would help when development starts. [Elektroda, p.kaczmarek2, post #21434400]

What’s inside the generic 15W RGBW B22 bulb using BL3335‑P?

It’s an unbranded bulb, likely from AliExpress, carrying a Broadlink BL3335‑P module with an RDA5981AM under the RF can. Prior art shows people replacing the control board with ESP boards due to software support gaps. [Elektroda, Altirix, post #21434019]

Do boot strings reveal anything about the firmware base?

Captured strings include “airkiss‑2.0.0‑25360 (Dec 17 2015) ... ARM Cortex‑M3” and a build timestamp from December 2017. Those indicate legacy Broadlink stacks and toolchains, aligning with the older SDK landscape. [Elektroda, divadiow, post #21479530]

Where can I browse an RDA5981 SDK repository snapshot?

A GitHub mirror collects RDA5981 SDK material, including Mbed OS 5.1.5 based trees. It’s a starting point for analysis, though not a modern upstream. [Elektroda, divadiow, post #21434436]
Generated by the language model.
ADVERTISEMENT