logo elektroda
logo elektroda
X
logo elektroda

Backup & Restore of Xradiotech/Allwinner XR806/XR809 Flash in Windows: Guide & Demonstration

divadiow 2871 2
ADVERTISEMENT
📢 Listen (AI):
  • Here I will demonstrate how the internal flash of the Xradiotech/Allwinner XR806 (and XR809 - see note at bottom) can be read to file in Windows. Although there is not yet an OpenXR806 cloud-free alternative firmware to use on devices that have the XR806 at heart, flash firmware backups are useful in development and research and for general backup purposes.

    One Tuya module seen in the wild based on XR806 is the WXU (T103C-HL). Also available as WXU-IPEX - datasheets attached.

    To date on Elektroda XR806 has been spotted in:
    Avatto TRV16-WIFI radiator valve
    Avatto SWT60 Smart Watering Timer
    Allwinner development board

    Also: QOTO QT-08W Solar Power Smart Water Valve

    XR806 uses 5mm x 5mm QFN40 package and 4mm x 4mm QFN32 packages for different feature lists.

    Pin layout diagram of the XR806 chip by Xradiotech Pin diagram for XR806 BM2I Diagram of XRADIO XR806 chip with pin labels.


    Table showing GPIO multiplexing for XR806Bxxx.




    To get into UART download mode PB02 needs to be pulled to ground at power-on.

    on the WXU PB02 is the 3rd pad up from the bottom on the right-hand side of the module as you look at the top

    Schematic of an integrated circuit with GPIO and UART connections.

    or from the bottom:
    Diagram of electronic circuit pins with labels.

    and again from the top with WXU shown mounted on PCB from TRV16, which I will also use to demonstrate flash backup
    Electronic module with pin labels.

    Soldering can be performed direct to WXU contacts or, in the case of this WXU on PCB from TRV16, I have chosen to solder to the breakout pads instead for all but PB02.

    Electronic module with markings and QR code Printed circuit board with labels and connectors.

    Electronic module with wires on a blue mat. Green PCB with attached colored wires against a keyboard background.

    USB-TTL RX -> XR806 TX
    USB-TTL TX -> XR806 RX
    3.3V -> XR806 VBAT
    USB-TTL GND -> PSU GND -> XR806 GND

    Flash writing and reading is performed in the PhoenixMC program, available from https://github.com/openshwprojects/FlashTools/tree/main/XRadioTech-AllWinner

    Main text areas are in Chinese, so here are some translations to aid navigation

    PhoenixMC software interface for firmware updates.
    Graphical user interface for a flash memory operation application. Screenshot of software settings window for firmware programming.

    Connect XR806 as above and power on. Set appropriate baud on the main page (this may need to be lower if your wires are too long or you're using pogo pins), open the Debug menu. It should communicate with the XR806 and unlock the text fields. Change the length box text to 200000 and click Read.

    Animated read image
    Flash operation application window with various options and settings.

    Flash backup will be saved to file called flash_A_0x0_L_0x200000.bin in the PhoenixMC root folder
    Properties window of the binary file flash_A_0x0_L_0x200000.bin in Windows.

    In this mode you can also read the flash ID. eg:
    Dialog window with a warning from the phoenixMC program, showing BROM version and flash ID.

    which looks to be Winbond W25Q16JV or W25Q16DV in my case.

    To restore a backup simply rename your backup file extension from .bin to .img (or change the filtering in the open dialog box to *.*) and flash back with the blue Update button. eg:

    Screenshot of PhoenixMC software showing binary file details.




    This process is identical for the XR809 except for the need to ground both PB02 and PB03. Original XR809-specific guide: https://www.elektroda.com/rtvforum/topic3806769.html




    Your backup may contain your wifi credentials so backup should be done prior to pairing device with cloud platforms or pair/unpair with test AP. Please share your backup files for analysis and archive in the collection https://github.com/openshwprojects/FlashDumps/tree/main/IoT

    Alternatively, PM me the file and I'll happily flash/pair to test AP/unpair and take new backup.

    Cool? Ranking DIY
    About Author
    divadiow
    Level 34  
    Offline 
    divadiow wrote 2844 posts with rating 494, helped 256 times. Live in city Bristol. Been with us since 2023 year.
  • ADVERTISEMENT
  • Helpful post
    #2 21540487
    p.kaczmarek2
    Moderator Smart Home
    With our recent research and development, it seems increasingly likely that it's also possible to flash XR chips without grounding extra pins, as long as the firmware is built with command line enabled (at least "reboot" and "upgrade" commands must be handled. We need to test it in OpenXR. What do you think?

    Related discussion: https://www.elektroda.com/rtvforum/topic4074636-150.html#21534886
    Helpful post? Buy me a coffee.
  • #3 21540572
    divadiow
    Level 34  
    we need more real XR806 backups to test. The TRV XR806 one we have does not appear to support it but it is trying to do TuyaMCU comms on the flashing UART, so maybe theyre getting in the way. If you use Tuya MCU Debug Assistant with fake pid so the app finishes booting, then close com port and try PhoenixMC again it still doesn't go into download mode. But yeh, need more backups.

    The AWOL dev board dump does work.
    Screenshot of a flash programming software window with settings, bin file name, and Open comm OK! message highlighted.

    Added after 9 [minutes]:

    divadiow wrote:
    but it is trying to do TuyaMCU comms on the flashing UART, so maybe theyre getting in the way

    or maybe it accepts command on other UART (RX1/TX1), where log out is, but then how do you switch to flashing the other uart when it's in download mode? two usb-ttls and you choose both in PhoenixMC at the same time and expect one to fail? hmm. I could try that I guess
📢 Listen (AI):
ADVERTISEMENT