RDA 5981AM/Broadlink BL3335-P - Generic/nobrand 15W RGBW B22 Bulb - basic teardown

I'm posting as there seems to be a very limited amount of info on this device and chip being used, A Broadlink BL3335-P, (carrier PCB says BR3335, the actual module has no part number)



Anyway I was curious as to what the actual controller was so as you can see I peeled the can off. this presents the RDA 5981AM.



Unfortunately I'm not exactly sure where the bulb was from, I've had it for a while and only recently took a look inside. It's most likely one off AliExpress and I'm pretty sure they switched to another controller now as I've ordered twice from the same store a few years later. There is no branding on the side of the bulb.

Others seem to have got the same or similar boards such as https://diy.viktak.com/2020/05/broadlink-smart-bulb-conversion-to-open-source.html and were able to make a custom board for an esp as there's no project that supports the controller, likely due to it being obscure.

If anyone wants to try and support this controller in OpenBeken or any others and would like to get anything off the device that would be useful in supporting you, feel free to message

Very interesting, I haven't seen that one yet. I could give it a go, but for now, I'm doing porting for XR806, so it would have to wait a bit in the queue.

Anyway, were you able to find a datasheet for this module or chip?

Did you attempt to take a boot log of this device? It could tell us which SDK was used.

If there is no documentation for used WiFi module, then maybe we can desolder it with hot air just to check the GPIO markings on the back.

p.kaczmarek2 wrote:

Very interesting, I haven't seen that one yet. I could give it a go, but for now, I'm doing porting for XR806, so it would have to wait a bit in the queue.

No worries, in no rush myself, was trying to find info on what I had to start moving them away from their proprietary firmware. and noticed it seemed to be unknown to those who work on these open projects.

p.kaczmarek2 wrote:

Anyway, were you able to find a datasheet for this module or chip?

Yes, seems the blog post states they were unable to find documentation (however they supposedly had a Broadlink BL3336T-P) there does seem to be documentation for the Broadlink BL3335-P and RDA 5981AM it's using.

https://fccid.io/2ACDZ-BL3335-P/User-Manual/User-Manual-3825022.html

https://github.com/RDA5981/RDA5981/blob/master/Datasheet/RDA5981AM DataSheet V1.5.pdf

p.kaczmarek2 wrote:

Did you attempt to take a boot log of this device? It could tell us which SDK was used.

I have not, how would you recommend getting a boot log from one of these?

Edit: could probs use an arduino as a usb to serial and connect to the rx and tx then power the board with 3.3v. and that should spit out a boot log?

If someone is interested in trying to port, a module with this chip is available at aliexpress, (HLK-M50).
I don't see a point though, the sdks i've seen are very old, last version publicly available is at least 8 years old (RDA5981_SDK_MbedOS515_V1.3.5).
On csdn there are mentions of RDA5981_SDK_MbedOS515_V1.3.6 and RDA5981_SDK_MbedOS515_V2.0, but you cannot download them (china only site).
And not to mention there is no freertos in any of those sdk.

insmod wrote:

last version publicly available is at least 8 years old (RDA5981_SDK_MbedOS515_V1.3.5).

these I guess? https://github.com/Edragon/RDA-RDA5981/tree/master

I think I've nailed the correct starting address (includes BL) and length for 1mb flash on HLK-M50







useful: https://github.com/ljalves/hfeasy

without modification RDA Dump tool loads with these addresses set by Hi-Flying. These addresses result in a 2044kb file dump, which clearly shows HLK-M50 flash content repeated.



Tool and dump will also land in FlashDumps and FlashTools GH

and I've not seen any boot log output on either UART at any baud, no AP either. Only a small power spike at start to suggest it's doing anything