Eswin ECR6600 flashing guide, datasheet, pinout, 100% local setup, Home Assistant

p.kaczmarek2 5508 102

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

#91 21594708 01 Jul 2025 13:41

DeDaMrAz DeDaMrAz

Level 20

Post #91

21594708 01 Jul 2025 13:41

ECR6600 test

SendGet http://example.com/ myFile.html

Info:CMD: CMD_SendGET received with args http://example.com/ myFile.html
Info:HTTP_CLIENT:HTTPClient_Async_SendGet for http://example.com/, sizeof(httprequest_t) == 160!
Info:CMD:[WebApp Cmd 'SendGet http://example.com/ myFile.html' Result] OK
Info:HTTP_CLIENT:Parse url http://example.com/
Info:HTTP_CLIENT:host: 'example.com', port: 80
Info:HTTP_CLIENT:HAL_TCP_Establish: created socket 2

Error:HTTP_CLIENT:success to establish tcp, fd=2
Info:HTTP_CLIENT:httpclient_recv 255 bytes has been read
Info:HTTP_CLIENT:httpclient_recv 236 bytes has been read
Info:HTTP_CLIENT:httpclient_recv 255 bytes has been read
Info:HTTP_CLIENT:httpclient_recv 255 bytes has been read
Info:HTTP_CLIENT:httpclient_recv 255 bytes has been read
Info:HTTP_CLIENT:httpclient_recv 255 bytes has been read
Info:HTTP_CLIENT:httpclient_recv 7 bytes has been read
Info:MAIN:Time 225, idle 0/s, free 188384, MQTT 0(14), bWifi 1, secondsWithNoPing 158, socks 2/20

If you like my work, support me at: https://paypal.me/openshwprojects

ADVERTISEMENT
#92 21594735 01 Jul 2025 14:12

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #92
21594735 01 Jul 2025 14:12

I will try to clear this up, I also think that hal_machw_time could be moved to HAL:
- by default, it would use:
Code: C / C++
Log in, to see the code

On ECR:
Code: C / C++
Log in, to see the code

On Beken, hal_machw_time

To be honest, I am not even sure how big precision do we need for that timer for HTTP, maybe we could get away with using g_timeMs globally, without HAL call

I'll try to make those changes today and try to test as far as I can, I'll ask you for a review later

Added after 1 [minutes]:

This whole HTTP Client looks more or less suspicious. This:
Code: C / C++
Log in, to see the code

is used as it returns time offset, but in reality, it returns either 0 or 1

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#93 21615836 24 Jul 2025 15:38

walligatorw walligatorw

Level 3
Helpful post? (0)

Post #93
21615836 24 Jul 2025 15:38

Hi guys!
I bought several switches MCL-Y10-L-03W in this store:
https://aliexpress.ru/item/1005008813709294.h...2.1426903569.1753361948-1554502598.1753361948
(not an advertisement)
Want to cut them off from the Tuyas cloud and make them local in Home Assistant.
Found this topic with your work and firmware. Thank you for your great work!
I disassembled one switch and saw the AXYU board.
Flashed one switch as written in the instructions. Everything went well.
Now I need to configure the pins, but I have no experience in how to do this. But I have a great desire!
I don’t know how to determine all the pins. Maybe you can help me?
I am attaching photos and the dump file with the factory firmware.

Attachments:

Tuya_MCL-Y10-L-03W_Backup_ECR6600.bin Download (2 MB)
#94 21615922 24 Jul 2025 17:11

insmod insmod

Level 26

Helpful post? (0)

Post #94
21615922 24 Jul 2025 17:11

>>21615836
Well, you've already determined button pins.
All that remains are relay pins.
Put everything back together, connect it to mains and experiment in GPIO Doctor (Web app -> GPIO Finder).
Check unconfigured pins by setting output high/low, and when relay clicks - you will know what pin it is.
#95 21615944 24 Jul 2025 17:41

walligatorw walligatorw

Level 3

Helpful post? (0)

Post #95
21615944 24 Jul 2025 17:41

>>21615922
Thank you! I'll try it now.
But I still need the pins of the six LEDs.
In the factory logic, they glow white when off and glow blue when on. On each switch.
I do it ...
ADVERTISEMENT
#96 21615947 24 Jul 2025 17:44

insmod insmod

Level 26

Helpful post? (0)

Post #96
21615947 24 Jul 2025 17:44

>>21615944
Leds are usually on the same pin as relays.
At least it was that way on almost all switches i've seen (except moes zigbee no-neutral no-capacitor switch).
But if not, they can be found the same way.
#97 21615948 24 Jul 2025 17:49

walligatorw walligatorw

Level 3

Helpful post? (0)

Post #97
21615948 24 Jul 2025 17:49

Now, with all zero pins, all blue LEDs are lit. That is, the relays are in the on states.
#98 21616010 24 Jul 2025 19:05

divadiow divadiow

Level 35

Helpful post? (0)

Post #98
21616010 24 Jul 2025 19:05

device boot log on IO13 from fw dump (on test device)
Code: Text
Log in, to see the code
#99 21616102 24 Jul 2025 20:15

walligatorw walligatorw

Level 3

Helpful post? (0)

Post #99
21616102 24 Jul 2025 20:15

Thank you, insmod!
Thank you, divadiow!
I found these pins and they work!

"pins": {
"0": "Btn;1",
"2": "Btn;2",
"14": "Rel;1",
"15": "Rel_n;1",
"16": "LED_n;2",
"17": "Btn;3",
"20": "LED_n;3",
"21": "LED_n;1",
"22": "Rel;2",
"23": "Rel_n;2",
"24": "Rel;3",
"25": "Rel_n;3"
},

I haven't figured out the purpose of pin 3 and pin 4 yet.
And also, when relay 1 is triggered, the switch restarts.

I dig further...
#100 21633438 12 Aug 2025 22:03

divadiow divadiow

Level 35

Helpful post? (0)

Post #100
21633438 12 Aug 2025 22:03

does this spelling mismatch of RST_TYPE in http_fns.c mean it'll default to "ERROR" if type is "UNKNOWN" on ECR6600?

Code: Text
Log in, to see the code

https://github.com/openshwprojects/OpenBK7231...411729a28dc0ac/src/httpserver/http_fns.c#L971
#101 21633440 12 Aug 2025 22:06

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (+1)

Post #101
21633440 12 Aug 2025 22:06

Yes, this enumeration comes from ECR SDK, you can probably find it by searching for "RST_TYPE_UNKOWN" there.

Added after 24 [seconds]:

Btw thx for reminding me, we need to move reset reason to HAL

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#102 21633446 12 Aug 2025 22:11

divadiow divadiow

Level 35

Helpful post? (0)

Post #102
21633446 12 Aug 2025 22:11

doh. I was searching all your repos only forgetting @insmod has some submodules

https://github.com/search?q=owner%3ANonPIayerCharacter+RST_TYPE_UNKOWN&type=code
ADVERTISEMENT
#103 21636152 16 Aug 2025 07:41

divadiow divadiow

Level 35

Helpful post? (0)

Post #103
21636152 16 Aug 2025 07:41

REST ECR6600 OTA is successful but

Code: Text
Log in, to see the code
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

Topic summary

The discussion focuses on the Eswin ECR6600 WiFi+Bluetooth SoC module used in IoT devices, particularly smart plugs with integrated BL0937 energy metering chips. Key topics include detailed pinout configurations, firmware flashing procedures via UART, and local firmware development to enable cloud-free operation with Home Assistant using Tasmota/esphome-like firmware ports. Users report initial issues with the BL0937 driver not functioning due to its exclusion from firmware builds, which was later resolved by including the driver and verifying correct pin assignments. Attempts to extract and decrypt Tuya configuration keys from original firmware backups reveal challenges due to changed secondary keys and CRC errors, complicating full firmware analysis and key extraction. The community explores using Tuya Wind IDE on Linux for SDK access, and reverse engineering efforts with Ghidra face difficulties due to the ECR6600’s NDS32 architecture and base address uncertainties. Firmware disassembly and key extraction are ongoing, with partial success in identifying key material and decrypting some blocks. Additional tests confirm the ECR6600 supports WiFi 6 (2.4 GHz only) and HTTP GET/POST commands for local network control, including file downloads via HTTP client functionality. Integration efforts include porting missing HAL functions like hal_machw_time and lwip_close_force for timing and socket management. Various ECR6600-based devices, including plugs ordered from AliExpress (e.g., TNCE 16A power monitors and E103-W11 modules), are tested for firmware backup, flashing, and local control capabilities. The discussion also covers SDK build issues, firmware memory mapping, and the need for improved tooling and documentation to fully support ECR6600 development and integration with open-source platforms.
Summary generated by the language model.

Home page
/
Forum
/
Smart Home
/
Smart Home IoT
/
Smart Home Guides
/
Eswin ECR6600 flashing guide, datasheet, pinout, 100% local setup, Home Assistant

FAQ

TL;DR: You can fully back-up and re-flash any ESWIN ECR6600 module with only VCC, GND, TX0 (IO6) and RX0 (IO5); no “GPIO0” strap is required. Use RDTool, load the 16 kB stub at 0x10000, then dump up to 4 MB of flash in ≈90 s. The chip’s 2.4 GHz radio delivers +17 dBm and even speaks Wi-Fi 6/802.11ax [Elektroda, p.kaczmarek2, post #21479963]

Quick Facts

• SoC: Andes D10 @160 MHz, 512 kB SRAM, on-chip 2 / 4 MB QSPI flash [Elektroda, p.kaczmarek2, post #21479963]
• RF: 2.4 GHz 802.11 b/g/n/ax, +17 dBm Tx, BLE 5.0 +10 dBm [Elektroda, p.kaczmarek2, post #21479963]
• Pkg / modules: QFN40 5×5 mm (-40 D), QFN32 4×4 mm (-TSx), used in AXY2S, WG236, E103-W11 [Elektroda, p.kaczmarek2, post #21479963]
• Flash/UART pins: TX0 = IO6, RX0 = IO5, BOOT-log = IO13, Reset = CEN [Elektroda, p.kaczmarek2, post #21479963]
• Flash tool: RDTool v1.0.21, stub = ECR6600F_stub_V1.3.1.bin, begin 0x10000 [Elektroda, p.kaczmarek2, post #21479963]

What exactly is the ESWIN ECR6600?

ECR6600 is a 2.4 GHz Wi-Fi 6 and BLE 5.0 combo SoC built around an Andes-D10 core at 160 MHz. It integrates PA/LNA, 512 kB SRAM, hardware AES-256, TRNG and either 2 MB or 4 MB QSPI flash [Elektroda, p.kaczmarek2, post #21479963]

Which ready-made modules carry the ECR6600?

Confirmed modules include Tuya AXY2S/AXYU (CB2S-style), SkyLab WG236 (ESP-12 footprint), CDI-WX56600A and Ebyte E103-W11. All expose TX0 (IO6) and RX0 (IO5) on edge pads [Elektroda, p.kaczmarek2, post #21479963]

How do I enter the UART flashing mode?

Connect 3.3 V, GND, IO6→USB-TTL RX, IO5→USB-TTL TX and optionally RST. Start RDTool, click Start, then pulse RST (or power-cycle). No special boot-strap pin is needed; timing is within ~1 s after reset [Elektroda, p.kaczmarek2, post #21479963]

How can I back-up the factory firmware?

In RDTool choose Develop Tool → Single File. Load the 16 kB stub (ECR6600F_stub_V1.3.1.bin) at start-up address 0x10000, then switch to Flash tab and read 0x400000 bytes (4 MB) or 0x200000 for 2 MB parts [Elektroda, p.kaczmarek2, post #21479963]

How do I restore a full dump if something goes wrong?

Use the same Single File tab: select your backup BIN, set Begin Addr 0x0, tick “is download”, click Start, then reset the board. RDTool sends stub and image automatically [Elektroda, divadiow, post #21480971]

How do I flash OpenECR/OpenBK firmware?

Pick the latest all-in-one UART binary from the GitHub releases page, go to Develop Tool → All-in-One, click Start and reset the module. On reboot it opens an AP for web configuration just like Tasmota [Elektroda, p.kaczmarek2, post #21479963]

What pin mapping is needed for BL0937 energy plugs?

Typical EU smart plug uses IO14→CF, IO15→SEL, IO20→CF1, IO25→Relay and IO24→Button [Elektroda, spectrality, post #21481109] With the fixed driver build the meter reports Voltage, Current and Power correctly [Elektroda, insmod, post #21481313]

Does the chip really support Wi-Fi 6?

Yes. The radio claims 802.11ax HE20 single-stream support (“DCM, MCS7”) at +17 dBm, but only on 2.4 GHz; 5 GHz is not available [Elektroda, p.kaczmarek2, post #21479963]

Can I use HTTPS requests from scripts?

Not yet. The current HTTPClient in OpenBK for ECR6600 only handles plain HTTP. For secure endpoints use MQTT/TLS from an external bridge [Elektroda, p.kaczmarek2, post #21594735]

Will repeated SendGet events leak sockets or RAM?

No. A stress test toggling another device every second showed stable free heap (~188 kB) and only two open sockets after each cycle [Elektroda, DeDaMrAz, post #21594690]

How big is the flash and how do I check?

Run a 4 MB read first; RDTool prints “FLASH is not enough!” if the part is 2 MB. The size is also listed in the module datasheet, e.g., WG236 is 4 MB [SkyLab WG236 datasheet].

Can I still extract Tuya JSON config?

Not reliably. The usual BK7231 key set fails because ECR6600 uses a different secondary key; current tools stop after the first block [Elektroda, p.kaczmarek2, post #21481736]

Where can I download the official TuyaOS SDK?

Tuya Wind IDE lists it as “eswin_ecr6600_wifi-ble-tuyastack”; direct URL examples: …/pruduct/eswin_ecr6600_1.0.23.zip [Elektroda, divadiow, post #21481466]

Does the ECR6600 allow 5-GHz Wi-Fi?

No. Only 2.4 GHz is implemented. For dual-band 802.11ax consider ESP32-C5, the sole low-cost 2.4 / 5 GHz IoT SoC as of 2025 [Espressif Datasheet ESP32-C5, 2024].