RDA 5981AM/Broadlink BL3335-P - Generic/nobrand 15W RGBW B22 Bulb - basic teardown

Altirix 2346 176

#31 21698772 24 Sep 2025 07:21

divadiow divadiow

Level 36

Helpful post? (0)

Post #31
21698772 24 Sep 2025 07:21

insmod wrote:
What about earlier, AP only version?

ah, nothing for quite a few resets, but actually just had this:

Code: Text
Log in, to see the code

no difference if flashed to 0x1000 or 0x18001000 (if that can even be expected to make a difference to flash tool)

insmod wrote:
It probably is, if you have a backup. It has ROM bootloader.

will erase BL3335-P so at least HLK is OK if it kills it
ADVERTISEMENT
#32 21698781 24 Sep 2025 07:33

insmod insmod

Level 28

Helpful post? (+1)

Post #32
21698781 24 Sep 2025 07:33

https://github.com/NonPIayerCharacter/OpenBK7...actions/runs/17967349164/artifacts/4090176570
Using gcc 6 results in 9kb lighter binary than gcc 10.
#33 21698784 24 Sep 2025 07:52

divadiow divadiow

Level 36

Helpful post? (0)

Post #33
21698784 24 Sep 2025 07:52

divadiow wrote:
will erase BL3335-P so at least HLK is OK if it kills it

maybe not

insmod wrote:
https://github.com/NonPIayerCharacter/OpenBK7...actions/runs/17967349164/artifacts/4090176570

Code: Text
Log in, to see the code

not seeing BL text now

Added after 3 [minutes]:

divadiow wrote:
not seeing BL text now

oh, duh.

IO21 high = BL text (+sometimes OBK app text if not silenced for some reason), floating = OBK app text, no BL

Added after 7 [minutes]:

for the record BL3335-P needs IO21 high for RDA Flash Tool to catch at all. IO21 doesn't have to be kept high. Sewing needle job on pin.

HLK-M50 does not need IO21 high to flash - will flash with it high or floating.
ADVERTISEMENT
#34 21698791 24 Sep 2025 07:52

insmod insmod

Level 28

Helpful post? (0)

Post #34
21698791 24 Sep 2025 07:52

https://github.com/NonPIayerCharacter/OpenBK7...actions/runs/17967648119/artifacts/4090268843
ADVERTISEMENT
#35 21698799 24 Sep 2025 08:00

divadiow divadiow

Level 36

Helpful post? (0)

Post #35
21698799 24 Sep 2025 08:00

>>21698791

Code: Text
Log in, to see the code

erase from 0x1000 now performed every flash too
#36 21698809 24 Sep 2025 08:09

insmod insmod

Level 28

Helpful post? (0)

Post #36
21698809 24 Sep 2025 08:09

>>21698799
Erase is not necessary, but i need backup with AT firmware that has booted at least once.
https://github.com/NonPIayerCharacter/OpenBK7...actions/runs/17967936684/artifacts/4090356794
#37 21698822 24 Sep 2025 08:22

divadiow divadiow

Level 36

Helpful post? (0)

Post #37
21698822 24 Sep 2025 08:22

insmod wrote:
https://github.com/NonPIayerCharacter/OpenBK7...actions/runs/17967936684/artifacts/4090356794

Code: Text
Log in, to see the code

Added after 1 [minutes]:

insmod wrote:
but i need backup with AT firmware that has booted at least once

2s. see if I can get it to join wifi. office day, so have to leave shortly
#38 21698831 24 Sep 2025 08:30

insmod insmod

Level 28

Helpful post? (0)

Post #38
21698831 24 Sep 2025 08:30

Without hals
https://github.com/NonPIayerCharacter/OpenBK7...actions/runs/17968365668/artifacts/4090483675
#39 21698834 24 Sep 2025 08:47

divadiow divadiow

Level 36
Helpful post? (0)

Post #39
21698834 24 Sep 2025 08:47

insmod wrote:
Without hals
https://github.com/NonPIayerCharacter/OpenBK7...actions/runs/17968365668/artifacts/4090483675

Code: Text
Log in, to see the code

Added after 11 [minutes]:

hmm. run out of time working out the AT commands to set credentials.

here's uartwifi.bin dump after 1 boot. no AT commands tried. needs trimming

Attachments:

uartwifi_1bootonly.bin Download (2 MB)
#40 21698853 24 Sep 2025 09:10

insmod insmod

Level 28

Helpful post? (0)

Post #40
21698853 24 Sep 2025 09:10

>>21698834
Nothing was saved, so i don't know...
https://github.com/NonPIayerCharacter/OpenBK7...actions/runs/17971248839/artifacts/4091431129
#41 21699408 24 Sep 2025 20:36

divadiow divadiow

Level 36
Helpful post? (0)

Post #41
21699408 24 Sep 2025 20:36

https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/17971248839

Code: Text
Log in, to see the code

back later for AT wifi

Added after 2 [hours] 42 [minutes]:

Code: Text
Log in, to see the code

translated AT readme
Code: Text
Log in, to see the code

Attachments:

uartwifi_1bootonly_saveandconnecttowifi.bin Download (2 MB)
#42 21699859 25 Sep 2025 03:26

insmod insmod

Level 28

Helpful post? (0)

Post #42
21699859 25 Sep 2025 03:26

Continuing grasping at straws
https://github.com/NonPIayerCharacter/OpenBK7...actions/runs/17994074956/artifacts/4099684750
#43 21699872 25 Sep 2025 06:05

divadiow divadiow

Level 36

Helpful post? (0)

Post #43
21699872 25 Sep 2025 06:05

insmod wrote:
Continuing grasping at straws

ooh

Code: Text
Log in, to see the code
#44 21699876 25 Sep 2025 06:11

insmod insmod

Level 28

Helpful post? (0)

Post #44
21699876 25 Sep 2025 06:11

>>21699872
https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/17996644497
#45 21699878 25 Sep 2025 06:18

divadiow divadiow

Level 36

Helpful post? (0)

Post #45
21699878 25 Sep 2025 06:18

Code: Text
Log in, to see the code
#46 21699880 25 Sep 2025 06:22

insmod insmod

Level 28

Helpful post? (0)

Post #46
21699880 25 Sep 2025 06:22

https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/17996818801
#47 21699881 25 Sep 2025 06:26

divadiow divadiow

Level 36

Helpful post? (0)

Post #47
21699881 25 Sep 2025 06:26

Code: Text
Log in, to see the code
#48 21699885 25 Sep 2025 06:31

insmod insmod

Level 28

Helpful post? (0)

Post #48
21699885 25 Sep 2025 06:31

https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/17996955540
ADVERTISEMENT
#49 21699889 25 Sep 2025 06:42

divadiow divadiow

Level 36

Helpful post? (0)

Post #49
21699889 25 Sep 2025 06:42

omg
Code: Text
Log in, to see the code

here is save wifi creds and reboot. stays in AP mode

Code: Text
Log in, to see the code

gui is available for a few seconds before dying
#50 21699895 25 Sep 2025 06:59

insmod insmod

Level 28

Helpful post? (0)

Post #50
21699895 25 Sep 2025 06:59

https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/17997365111
Did you check if pins/pwm/tuyamcu works?
#51 21699897 25 Sep 2025 07:13

divadiow divadiow

Level 36

Helpful post? (0)

Post #51
21699897 25 Sep 2025 07:13

insmod wrote:
Did you check if pins/pwm/tuyamcu works?

negative can't get to gui long enough to do much.

works= driver starts, pins save and can be toggled without crashing or actual works with LEDs, TMDA simulator etc?

insmod wrote:
https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/17997365111

Code: Text
Log in, to see the code

despite free mem gui still dies.

Code: Text
Log in, to see the code

Added after 4 [minutes]:

uart log stops, uart LED flashing on ESP adaptor. will try uart switch
#52 21699899 25 Sep 2025 07:17

insmod insmod

Level 28

Helpful post? (0)

Post #52
21699899 25 Sep 2025 07:17

https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/17997637549

Added after 1 [minutes]:

I see config save is working. Does it connect to wifi?
#53 21699903 25 Sep 2025 07:22

divadiow divadiow

Level 36

Helpful post? (0)

Post #53
21699903 25 Sep 2025 07:22

insmod wrote:
https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/17997637549

Added after 1 [minutes]:

I see config save is working. Does it connect to wifi?

I'm afraid no. 2 tries. comes up as AP

Code: Text
Log in, to see the code
#54 21699912 25 Sep 2025 07:34

insmod insmod

Level 28

Helpful post? (0)

Post #54
21699912 25 Sep 2025 07:34

https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/17997936471
#55 21699916 25 Sep 2025 07:42

divadiow divadiow

Level 36

Helpful post? (0)

Post #55
21699916 25 Sep 2025 07:42

no sta still. or startup commands save

Spoiler:

RDA Boot ROM for RDA5991H r550
Build Time: 15:50:19 - May 10 2017
RDA Microelectronics Copyright(C) 2004-2017

Enter Mcu Mode
count_left=5
count_left=4
count_left=3
count_left=2
count_left=1
Ready to boot...
Partition addr:4010901c
Find newest partition index:0, total:1, buf_addr:0x00100000, size:0x00000138
Partition[0] info
flag:00000001, version:rda5991h
p_address:00001000, r_address:00001000, psize_in_bytes:0x0007e000, dsize_in_byte j $----------------maclib task
OpenRDA5981, version _gcc6
Entering initLog()...
Commands registered!
initLog() done!
Warning: Sector header check failed. Format this sector (0x140fc000).
Debug:CMD:Adding command loglevel
Debug:CMD:Adding command logfeature
Debug:CMD:Adding command logtype
Debug:CMD:Adding commEasyFlash V4.1.0 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
and logdelay
Info:MAIN:Main_Init_Before_Delay
Debug:CFG:ReadFlashVars: will read 64 bytes
Debug:CFG:ReadFlashVars: really loaded 64 bytes
Debug:CFG:SaveFlashVars: saved 64 bytes
Debug:CFG:CFG_CalcChecksum: header size 4, total size 3584, rem size 3580
Warn:CFG:CFMain_Init_Before_Delay done
Main_Init_Delay
Main_Init_Delay done
ues
Debug:CMD:Adding command setButtonTimes
Debug:CMD:Adding command setButtonHoldRepeat
Debug:CMD:Adding command setStartupD:Adding command led_nextColor
Debug:CMD:Adding command led_lerpSpeed
Debug:CMD:Adding command HSBColor
Debug:CMD:Adding command HSBColor1
Debug:CMD:Adding command HSBColor2
Debug:CMD:Adding command HSBColor3
Debug:CMD:Adding command led_finishFullLerp
Debug:CMD:Adding command led_gammaCtrl
Debug:CMD:Adding command CTRange
Debug:CMD:Adding command DimmerDelta
Debug:CMD:Adding command led_saveInterval
Debug:CMD:Adding command SPC
Debug:CMD:Adding command SetChannel
Debug:CMD:Adding command SetFlash
Debug:CMD:Adding command SetChannelFloat
Debug:CMD:Adding command ToggleChannel
Debug:CMD:Adding command AddChannel
Debug:CMD:Adding command ClampChannel
Debug:CMD:Adding command SetPinRole
Debug:CMD:Adding command SetPinChannel
Debug:CMD:Adding command GetChannel
Debug:CMD:Adding command GetReadings
Debug:CMD:Adding command ShortName
Debug:CMD:Adding command FriendlyName
Debug:CMD:Adding command PinDeepSleep
Debug:CMD:Adding command FullBootTime
Debug:CMD:Adding command SetChannelLabel
Debug:CMD:Adding command MapRanges
Debug:CMD:Adding command Map
Debug:CMD:Adding command SetChannelVisible
Debug:CMD:Adding command SetChannelPrivate
Debug:CMD:Adding command Ch
Debug:CMD:Adding command AddEventHandler
Debug:CMD:Adding command AddChangeHandler
Debug:CMD:Adding command listEventHandlers
Debug:CMD:Adding command clearAllHandlers
Debug:CMD:Adding command alias
Debug:CMD:Adding command echo
Debug:CMD:Adding command restart
Debug:CMD:Adding command reboot
Debug:CMD:Adding command clearConfig
Debug:CMD:Adding command clearIO
Debug:CMD:Adding command clearAll
Debug:CMD:Adding command DeepSleep
Debug:CMD:Adding command PowerSave
Debug:CMD:Adding command if
Debug:CMD:Adding command ota_http
Debug:CMD:Adding command scheduleHADiscovery
Debug:CMD:Adding command flags
Debug:CMD:Adding command SetFlag
Debug:CMD:Adding command ClearNoPingTime
Debug:CMD:Adding command SetStartValue
Debug:CMD:Adding command OpenAP
Debug:CMD:Adding command DSEdge
Debug:CMD:Adding command SafeMode
Debug:CMD:Adding command StartupCommand
Debug:CMD:Adding command Choice
Debug:CMD:Adding command PWMFrequency
Debug:CMD:Adding command IndexRefreshInterval
Debug:CMD:Adding command startScript
Debug:CMD:Adding command stopScript
Debug:CMD:Adding command stopAllScripts
Debug:CMD:Adding command listScripts
Debug:CMD:Adding command goto
Debug:CMD:Adding command delay_s
Debug:CMD:Adding command delay_ms
Debug:CMD:Adding command return
Debug:CMD:Adding command resetSVM
Debug:CMD:Adding command waitFor
Debug:CMD:cmd [exec early.bat]
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Debug:MAIN:Started http tcp server
Info:MQTT:MQTT_RegisterCallback called for bT rda5981F3FF0000/ subT rda5981F3FF0000/+/set
Info:MQTT:MQTT_RegisterCallback called for bT obks/ subT obks/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/rda5981F3FF0000/ subT cmnd/rda5981F3FF0000/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obks/ subT cmnd/obks/+
Info:MQTT:MQTT_RegisterCallback called for bT rda5981F3FF0000/ subT rda5981F3FF0000/+/get
Info:MQTT:MQTT_RegisterCallback called for bT homeassistant/ subT homeassistant/+
Debug:CMD:Adding command publish
Debug:CMD:Adding command publishInt
Debug:CMD:Adding command publishFloat
Debug:CMD:Adding command publishAll
Debug:CMD:Adding command publishChannel
Debug:CMD:Adding command publishChannels
Debug:CMD:Adding command publishBenchmark
Debug:CMD:Adding command mqtt_broadcastInterval
Debug:CMD:Adding command mqtt_broadcastItemsPerSec
Debug:CMD:Adding command TasTeleInterval
Debug:CMD:Adding command publishDriver
Info:CMD:CMD_StartScript: started @startup at the beginning
Debug:CMD:cmd [startScript autoexec.bat]
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
ExtraDebug:HTTP:Socket bound on 0.0.0.0:80
Info:HTTP:TCP server listening
Info:MAIN:Time 1, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 2, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 3, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 4, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
set_network_ap,enter

mark ip 1

ip_table.ip_range[0] = 0x1

mark ip 1

ip_table.ip_range[0] = 0x1
Info:MAIN:Time 5, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 6, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Boot complete time reached (5 seconds)
Debug:CFG:SaveFlashVars: saved 64 bytes
Info:MAIN:Time 7, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 8, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 9, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
stamac=38:7a:0e:e3:6b:7e,ip=0.0.0.0

mark ip 2

ip_table.ip_range[0] = 0x3
Info:MAIN:Time 10, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Debug:GEN:+--------------- net device info ------------+
Debug:GEN:|netif type : AP |
Debug:GEN:|netif rssi = -128 |
Debug:GEN:|netif ip = 192.168.4.1 |
Debug:GEN:|netif mask = 255.255.255.0 |
Debug:GEN:|netif gateway = 192.168.4.1 |
Debug:GEN:|netif mac : [2e] |
Debug:GEN:+--------------------------------------------+
Info:MAIN:Time 11, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 12, idle 0/s, free 53019, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 3/4
stamac=38:7a:0e:e3:6b:7e,ip=192.168.4.2
staconflag=1
option_start=msg_type,staconflag=1

mark ip 2

ip_table.ip_range[0] = 0x3
Error:HTTP:TCP Client is disconnected, fd: 3
Info:MAIN:Time 13, idle 0/s, free 57115, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 14, idle 0/s, free 36635, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 3/4
Info:MAIN:Time 15, idle 0/s, free 36635, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 3/4
Info:MAIN:Time 16, idle 0/s, free 36635, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 3/4
Info:MAIN:Time 17, idle 0/s, free 36635, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 3/4
Info:HTTP:HTTP_ProcessPacket: generating cfg_wifi_set
Debug:CFG:CFG_CalcChecksum: header size 4, total size 3584, rem size 3580
Info:MAIN:Time 18, idle 0/s, free 28443, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 3/4
Info:MAIN:Module reboot in 2...
Info:MAIN:Time 19, idle 0/s, free 28443, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 3/4
Info:MAIN:Module reboot in 1...

RDA Boot ROM for RDA5991H r550
Build Time: 15:50:19 - May 10 2017
RDA Microelectronics Copyright(C) 2004-2017

Enter Mcu Mode
count_left=5
count_left=4
count_left=3
count_left=2
count_left=1
Ready to boot...
Partition addr:4010901c
Find newest partition index:0, total:1, buf_addr:0x00100000, size:0x00000138
Partition[0] info
flag:00000001, version:rda5991h
p_address:00001000, r_address:00001000, psize_in_bytes:0x0007e000, dsize_in_byte j (----------------maclib task
OpenRDA5981, version _gcc6
Entering initLog()...
Commands registered!
initLog() done!
Warning: Sector header check failed. Format this sector (0x140fc000).
Warning: Sector header check failed. Format this sector (0x140fd000).
Debug:CMD:Adding command loglevel
Debug:CMD:Adding command logfeature
Debug:CMD:Adding command logtype
Debug:CMD:Adding commEasyFlash V4.1.0 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
and logdelay
Info:MAIN:Main_Init_Before_Delay
Debug:CFG:ReadFlashVars: will read 64 bytes
Debug:CFG:ReadFlashVars: really lom: header size 4, total size 3584, rem size 3580
Debug:CMD:Adding command startDriver
Debug:CMD:Adding command stopDriver
DeMain_Init_Before_Delay done
Main_Init_Delay
Main_Init_Delay done
D:Adding command led_nextColor
Debug:CMD:Adding command led_lerpSpeed
Debug:CMD:Adding command HSBColor
Debug:CMD:Adding command HSBColor1
Debug:CMD:Adding command HSBColor2
Debug:CMD:Adding command HSBColor3
Debug:CMD:Adding command led_finishFullLerp
Debug:CMD:Adding command led_gammaCtrl
Debug:CMD:Adding command CTRange
Debug:CMD:Adding command DimmerDelta
Debug:CMD:Adding command led_saveInterval
Debug:CMD:Adding command SPC
Debug:CMD:Adding command SetChannel
Debug:CMD:Adding command SetFlash
Debug:CMD:Adding command SetChannelFloat
Debug:CMD:Adding command ToggleChannel
Debug:CMD:Adding command AddChannel
Debug:CMD:Adding command ClampChannel
Debug:CMD:Adding command SetPinRole
Debug:CMD:Adding command SetPinChannel
Debug:CMD:Adding command GetChannel
Debug:CMD:Adding command GetReadings
Debug:CMD:Adding command ShortName
Debug:CMD:Adding command FriendlyName
Debug:CMD:Adding command PinDeepSleep
Debug:CMD:Adding command FullBootTime
Debug:CMD:Adding command SetChannelLabel
Debug:CMD:Adding command MapRanges
Debug:CMD:Adding command Map
Debug:CMD:Adding command SetChannelVisible
Debug:CMD:Adding command SetChannelPrivate
Debug:CMD:Adding command Ch
Debug:CMD:Adding command AddEventHandler
Debug:CMD:Adding command AddChangeHandler
Debug:CMD:Adding command listEventHandlers
Debug:CMD:Adding command clearAllHandlers
Debug:CMD:Adding command alias
Debug:CMD:Adding command echo
Debug:CMD:Adding command restart
Debug:CMD:Adding command reboot
Debug:CMD:Adding command clearConfig
Debug:CMD:Adding command clearIO
Debug:CMD:Adding command clearAll
Debug:CMD:Adding command DeepSleep
Debug:CMD:Adding command PowerSave
Debug:CMD:Adding command if
Debug:CMD:Adding command ota_http
Debug:CMD:Adding command scheduleHADiscovery
Debug:CMD:Adding command flags
Debug:CMD:Adding command SetFlag
Debug:CMD:Adding command ClearNoPingTime
Debug:CMD:Adding command SetStartValue
Debug:CMD:Adding command OpenAP
Debug:CMD:Adding command DSEdge
Debug:CMD:Adding command SafeMode
Debug:CMD:Adding command StartupCommand
Debug:CMD:Adding command Choice
Debug:CMD:Adding command PWMFrequency
Debug:CMD:Adding command IndexRefreshInterval
Debug:CMD:Adding command startScript
Debug:CMD:Adding command stopScript
Debug:CMD:Adding command stopAllScripts
Debug:CMD:Adding command listScripts
Debug:CMD:Adding command goto
Debug:CMD:Adding command delay_s
Debug:CMD:Adding command delay_ms
Debug:CMD:Adding command return
Debug:CMD:Adding command resetSVM
Debug:CMD:Adding command waitFor
Debug:CMD:cmd [exec early.bat]
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Debug:MAIN:Started http tcp server
Info:MQTT:MQTT_RegisterCallback called for bT rda5981F3FF0000/ subT rda5981F3FF0000/+/set
Info:MQTT:MQTT_RegisterCallback called for bT obks/ subT obks/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/rda5981F3FF0000/ subT cmnd/rda5981F3FF0000/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obks/ subT cmnd/obks/+
Info:MQTT:MQTT_RegisterCallback called for bT rda5981F3FF0000/ subT rda5981F3FF0000/+/get
Info:MQTT:MQTT_RegisterCallback called for bT homeassistant/ subT homeassistant/+
Debug:CMD:Adding command publish
Debug:CMD:Adding command publishInt
Debug:CMD:Adding command publishFloat
Debug:CMD:Adding command publishAll
Debug:CMD:Adding command publishChannel
Debug:CMD:Adding command publishChannels
Debug:CMD:Adding command publishBenchmark
Debug:CMD:Adding command mqtt_broadcastInterval
Debug:CMD:Adding command mqtt_broadcastItemsPerSec
Debug:CMD:Adding command TasTeleInterval
ExtraDebug:HTTP:Socket bound on 0.0.0.0:80
Debug:CMD:Adding command publishDriver
Info:HTTP:TCP server listening
Info:CMD:CMD_StartScript: started @startup at the beginning
Debug:CMD:cmd [startScript autoexec.bat]
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
Info:MAIN:Time 1, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 2, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 3, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 4, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
set_network_ap,enter

mark ip 1

ip_table.ip_range[0] = 0x1

mark ip 1

ip_table.ip_range[0] = 0x1
Info:MAIN:Time 5, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 6, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Boot complete time reached (5 seconds)
Debug:CFG:SaveFlashVars: saved 64 bytes
Info:MAIN:Time 7, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 8, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 9, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 10, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Debug:GEN:+--------------- net device info ------------+
Debug:GEN:|netif type : AP |
Debug:GEN:|netif rssi = -128 |
Debug:GEN:|netif ip = 192.168.4.1 |
Debug:GEN:|netif mask = 255.255.255.0 |
Debug:GEN:|netif gateway = 192.168.4.1 |
Debug:GEN:|netif mac : [2e] |
Debug:GEN:+--------------------------------------------+
Info:MAIN:Time 11, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 12, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4

Added after 2 [minutes]:

does it save but then get wiped again?

Code: Text
Log in, to see the code
#56 21699923 25 Sep 2025 07:52

insmod insmod

Level 28

Helpful post? (0)

Post #56
21699923 25 Sep 2025 07:52

>>21699916
And it seems that only first 2 sectors get wiped.
https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/17998248187
#57 21699929 25 Sep 2025 08:00

divadiow divadiow

Level 36

Helpful post? (0)

Post #57
21699929 25 Sep 2025 08:00

no change

Code: Text
Log in, to see the code

Added after 1 [minutes]:

definitely shouldn't be 0x18xxxx?
#58 21699933 25 Sep 2025 08:03

insmod insmod

Level 28

Helpful post? (0)

Post #58
21699933 25 Sep 2025 08:03

>>21699929
That's the problem, there are no docs for flash functions. And flash can be at 0x1400000 if no icache or 0x1800000 if with icache.
But is it mapped at 0x1400000 if icache is enabled (and it is enabled). Icache = xip?
https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/17998411597
#59 21699934 25 Sep 2025 08:19

divadiow divadiow

Level 36
Helpful post? (0)

Post #59
21699934 25 Sep 2025 08:19

hmm. no change

Spoiler:

RDA Boot ROM for RDA5991H r550
Build Time: 15:50:19 - May 10 2017
RDA Microelectronics Copyright(C) 2004-2017

Enter Mcu Mode
count_left=5
count_left=4
count_left=3
count_left=2
count_left=1
Ready to boot...
Partition addr:4010901c
Find newest partition index:0, total:1, buf_addr:0x00100000, size:0x00000138
Partition[0] info
flag:00000001, version:rda5991h
p_address:00001000, r_address:00001000, psize_in_bytes:0x0007e000, dsize_in_bytes i) F C $ o0 SH Ō)G ----------------maclib task
OpenRDA5981, version _gcc6
Entering initLog()...
Commands registered!
initLog() done!
Warning: Sector header check failed. Format this sector (0x180f5000).
Debug:CMD:Adding command loglevel
Debug:CMD:Adding command logfeature
Debug:CMD:Adding command logtype
Debug:CMD:Adding commEasyFlash V4.1.0 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
and logdelay
Info:MAIN:Main_Init_Before_Delay
Debug:CFG:ReadFlashVars: will read 64 bytes
Debug:CFG:ReadFlashVars: really loaded 64 bytes
Debug:CFG:SaveFlashVars: saved 64 bytes
Debug:CFG:CFG_CalcChecksum: header size 4, total size 3584, rem size 3580
Warn:CFG:CFg:CMD:Adding command listRepeatingEvents
Debug:CMD:Adding command showgpi
Debug:CMD:Adding command setChannelType
Debug:CMD:Main_Init_Before_Delay done
Main_Init_Delay
Main_Init_Delay done
D:Adding command led_nextColor
Debug:CMD:Adding command led_lerpSpeed
Debug:CMD:Adding command HSBColor
Debug:CMD:Adding command HSBColor1
Debug:CMD:Adding command HSBColor2
Debug:CMD:Adding command HSBColor3
Debug:CMD:Adding command led_finishFullLerp
Debug:CMD:Adding command led_gammaCtrl
Debug:CMD:Adding command CTRange
Debug:CMD:Adding command DimmerDelta
Debug:CMD:Adding command led_saveInterval
Debug:CMD:Adding command SPC
Debug:CMD:Adding command SetChannel
Debug:CMD:Adding command SetFlash
Debug:CMD:Adding command SetChannelFloat
Debug:CMD:Adding command ToggleChannel
Debug:CMD:Adding command AddChannel
Debug:CMD:Adding command ClampChannel
Debug:CMD:Adding command SetPinRole
Debug:CMD:Adding command SetPinChannel
Debug:CMD:Adding command GetChannel
Debug:CMD:Adding command GetReadings
Debug:CMD:Adding command ShortName
Debug:CMD:Adding command FriendlyName
Debug:CMD:Adding command PinDeepSleep
Debug:CMD:Adding command FullBootTime
Debug:CMD:Adding command SetChannelLabel
Debug:CMD:Adding command MapRanges
Debug:CMD:Adding command Map
Debug:CMD:Adding command SetChannelVisible
Debug:CMD:Adding command SetChannelPrivate
Debug:CMD:Adding command Ch
Debug:CMD:Adding command AddEventHandler
Debug:CMD:Adding command AddChangeHandler
Debug:CMD:Adding command listEventHandlers
Debug:CMD:Adding command clearAllHandlers
Debug:CMD:Adding command alias
Debug:CMD:Adding command echo
Debug:CMD:Adding command restart
Debug:CMD:Adding command reboot
Debug:CMD:Adding command clearConfig
Debug:CMD:Adding command clearIO
Debug:CMD:Adding command clearAll
Debug:CMD:Adding command DeepSleep
Debug:CMD:Adding command PowerSave
Debug:CMD:Adding command if
Debug:CMD:Adding command ota_http
Debug:CMD:Adding command scheduleHADiscovery
Debug:CMD:Adding command flags
Debug:CMD:Adding command SetFlag
Debug:CMD:Adding command ClearNoPingTime
Debug:CMD:Adding command SetStartValue
Debug:CMD:Adding command OpenAP
Debug:CMD:Adding command DSEdge
Debug:CMD:Adding command SafeMode
Debug:CMD:Adding command StartupCommand
Debug:CMD:Adding command Choice
Debug:CMD:Adding command PWMFrequency
Debug:CMD:Adding command IndexRefreshInterval
Debug:CMD:Adding command startScript
Debug:CMD:Adding command stopScript
Debug:CMD:Adding command stopAllScripts
Debug:CMD:Adding command listScripts
Debug:CMD:Adding command goto
Debug:CMD:Adding command delay_s
Debug:CMD:Adding command delay_ms
Debug:CMD:Adding command return
Debug:CMD:Adding command resetSVM
Debug:CMD:Adding command waitFor
Debug:CMD:cmd [exec early.bat]
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Debug:MAIN:Started http tcp server
Info:MQTT:MQTT_RegisterCallback called for bT rda59816EFE0000/ subT rda59816EFE0000/+/set
Info:MQTT:MQTT_RegisterCallback called for bT obks/ subT obks/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/rda59816EFE0000/ subT cmnd/rda59816EFE0000/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obks/ subT cmnd/obks/+
Info:MQTT:MQTT_RegisterCallback called for bT rda59816EFE0000/ subT rda59816EFE0000/+/get
Info:MQTT:MQTT_RegisterCallback called for bT homeassistant/ subT homeassistant/+
Debug:CMD:Adding command publish
Debug:CMD:Adding command publishInt
Debug:CMD:Adding command publishFloat
Debug:CMD:Adding command publishAll
Debug:CMD:Adding command publishChannel
Debug:CMD:Adding command publishChannels
Debug:CMD:Adding command publishBenchmark
Debug:CMD:Adding command mqtt_broadcastInterval
Debug:CMD:Adding command mqtt_broadcastItemsPerSec
Debug:CMD:Adding command TasTeleInterval
Debug:CMD:Adding command publishDriver
Info:CMD:CMD_StartScript: started @startup at the beginning
Debug:CMD:cmd [startScript autoexec.bat]
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
ExtraDebug:HTTP:Socket bound on 0.0.0.0:80
Info:HTTP:TCP server listening
Info:MAIN:Time 1, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 2, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 3, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 4, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
set_network_ap,enter

mark ip 1

ip_table.ip_range[0] = 0x1

mark ip 1

ip_table.ip_range[0] = 0x1
Info:MAIN:Time 5, idle 0/s, free 73611, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 6, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Boot complete time reached (5 seconds)
Debug:CFG:SaveFlashVars: saved 64 bytes
Info:MAIN:Time 7, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 8, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 9, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 10, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Debug:GEN:+--------------- net device info ------------+
Debug:GEN:|netif type : AP |
Debug:GEN:|netif rssi = -128 |
Debug:GEN:|netif ip = 192.168.4.1 |
Debug:GEN:|netif mask = 255.255.255.0 |
Debug:GEN:|netif gateway = 192.168.4.1 |
Debug:GEN:|netif mac : [22] |
Debug:GEN:+--------------------------------------------+
Info:MAIN:Time 11, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 12, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 13, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 14, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4
Info:MAIN:Time 15, idle 0/s, free 73499, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/4

i'll scour all the docs I've downloaded to see if there's any hint at an answer to that

Added after 7 [minutes]:

maybe you've been through this, but is the answer in here?

Attachments:

RDA5991H.zip Download (5.81 KB)
#60 21699948 25 Sep 2025 08:28

divadiow divadiow

Level 36

Helpful post? (0)

Post #60
21699948 25 Sep 2025 08:28

maybe this is wrong, I can't tell. but I gave gpt a load of stuff. it said this.

Code: Text
Log in, to see the code

Added after 2 [minutes]:
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Topic summary

The discussion revolves around the Broadlink BL3335-P smart bulb, which utilizes the RDA 5981AM chip. The original poster seeks information on the device and its components after peeling off the can to reveal the chip. They mention the bulb likely originated from AliExpress and express interest in moving away from proprietary firmware. Other participants inquire about the availability of a datasheet and suggest methods for obtaining a boot log, including using an Arduino for serial communication. They also note the existence of a similar module available on AliExpress (HLK-M50) and discuss the outdated nature of the available SDKs for the RDA5981AM chip.
Summary generated by the language model.

FAQ

TL;DR: 2 MB Tuya RDA5981 modules exist; “GPIO2 is used as log tx.” This FAQ distills BL3335‑P/RDA5981 teardown notes, SDK status, and dump tips. For modders migrating generic 15W RGBW bulbs off proprietary stacks. [Elektroda, insmod, post #21634746]

Why it matters: It shows how to identify the module, grab a boot log, and safely dump firmware when documentation is scarce.

Quick Facts

- SoC/module ID: Broadlink BL3335‑P uses RDA5981AM, confirmed by teardown and linked docs. [Elektroda, Altirix, post #21434407]
- Flash sizes seen: Tuya WRD2L/WRD3S modules are 2 MB and rare/pricey. [Elektroda, insmod, post #21634746]
- HLK‑M50 often maps as 1 MB; wrong dump bases can create a repeated 2044 KB image. [Elektroda, divadiow, post #21479530]
- SDK status: Public RDA5981 SDKs are old (Mbed OS 5.1.5 v1.3.5); no FreeRTOS noted. [Elektroda, insmod, post #21434414]
- Tuya modules: GPIO2 is designated as the UART log TX. [Tuya WRD3L Datasheet]

What chip is inside the Broadlink BL3335‑P smart bulb module?

A teardown shows the RF can covers an RDA5981AM Wi‑Fi SoC. The carrier PCB is marked BR3335, and the assembled module is sold as BL3335‑P. Photos in the thread reveal the die marking after peeling the shield. This identification aligns the bulb with the RDA5981 software ecosystem rather than ESP‑class parts. [Elektroda, Altirix, post #21434019]

Where can I find documentation for BL3335‑P and RDA5981AM?

Start with the FCC user manual for Broadlink BL3335‑P and the RDA5981AM datasheet. Both links are collected in the thread for quick access. The docs help with pinout, regulatory details, and SoC capabilities, which are essential for logging and firmware work. [Elektroda, Altirix, post #21434407]

Is there open-source firmware support for RDA5981 (OpenBeken/Tasmota/ESPHome)?

Active, mainstream support is not available. Builders have replaced the module with an ESP‑based board in similar bulbs due to the lack of open stacks targeting RDA5981. The thread opener invites contributors to attempt a port if interested. [Elektroda, Altirix, post #21434019]

How do I capture a boot log from an RDA5981 bulb or module?

Use a 3.3 V USB‑to‑serial (an Arduino in pass‑through mode works) and connect to RX/TX. Power the board at 3.3 V from a stable source. Open a terminal and reset the device to catch the early boot prints. [Elektroda, Altirix, post #21434407]

Which pin outputs logs on Tuya RDA5981 modules like WRD2L/WRD3S?

Tuya’s datasheet specifies GPIO2 as the log UART transmitter. Route your USB‑to‑serial RX to GPIO2 and common ground, then try standard baud rates. If silent, logs may be disabled in that build. [Tuya WRD3L Datasheet]

What RDA5981 SDKs exist, and are they viable today?

Public SDKs are dated Mbed OS 5.1.5 branches, and FreeRTOS isn’t provided. As one contributor puts it, “the sdks i’ve seen are very old.” Expect missing modern tooling and limited RTOS choices without vendor updates. [Elektroda, insmod, post #21434414]

How can I dump HLK‑M50 (RDA5981) firmware without duplication artifacts?

Use correct start address and 1 MB length to include the bootloader. The RDA Dump tool’s default vendor settings produce a 2044 KB file with repeated content on HLK‑M50. Adjust offsets to avoid mirrored dumps. [Elektroda, divadiow, post #21479530]

Why do I see no boot log or AP on an HLK‑M50 module?

One tester observed no UART output at any baud and no AP, only a brief power spike. That behavior suggests the image disables logs and soft‑AP or the device waits for external triggers. Verify power integrity and logging pins. [Elektroda, divadiow, post #21479538]

Are Tuya RDA5981 modules still available, and which models exist?

Yes, but they’re rare and expensive. Identified 2 MB variants include WRD2L, TYWRD2S, and TYWRD3S. The same source also lists other interesting Wi‑Fi/BLE modules stocked by the seller, but not RDA5981 alternatives at similar cost. [Elektroda, insmod, post #21634746]

Any useful tools or repos for working with RDA5981 images?

Check hfeasy for utilities and the RDA Dump tool used with Hi‑Flying modules. The thread includes sample dumps, boot strings, and notes on correcting dump bases to avoid duplicated images. [Elektroda, divadiow, post #21479530]

Can desoldering the module help identify GPIOs and signals?

Yes. If documentation is thin, remove the can or the module and inspect the underside for silkscreened GPIO labels. This is a practical way to map UART and control lines before wiring. [Elektroda, p.kaczmarek2, post #21434400]

Is anyone porting OpenBeken to RDA5981 right now?

A maintainer expressed interest but is prioritizing XR806 porting first. That places any RDA5981 work in a queue without a public timeline. Community test hardware and logs would help when development starts. [Elektroda, p.kaczmarek2, post #21434400]

What’s inside the generic 15W RGBW B22 bulb using BL3335‑P?

It’s an unbranded bulb, likely from AliExpress, carrying a Broadlink BL3335‑P module with an RDA5981AM under the RF can. Prior art shows people replacing the control board with ESP boards due to software support gaps. [Elektroda, Altirix, post #21434019]

Do boot strings reveal anything about the firmware base?

Captured strings include “airkiss‑2.0.0‑25360 (Dec 17 2015) ... ARM Cortex‑M3” and a build timestamp from December 2017. Those indicate legacy Broadlink stacks and toolchains, aligning with the older SDK landscape. [Elektroda, divadiow, post #21479530]

Where can I browse an RDA5981 SDK repository snapshot?

A GitHub mirror collects RDA5981 SDK material, including Mbed OS 5.1.5 based trees. It’s a starting point for analysis, though not a modern upstream. [Elektroda, divadiow, post #21434436]