logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

BK7252 datasheet, pinout, SDKs, flash map, application schematic, flash tool for read and write

p.kaczmarek2 2514 23
ADVERTISEMENT
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Słuchaj:
  • Close-up of the Beken BK7252UQN68 integrated circuit mounted on a green PCB.
    BK7252 is a Wi-Fi and Bluetooth Low Energy (LE) combo 32-bit chip designed for audio and video applications. It can be found in both Tuya (video doorbell) and non-Tuya (A9 spy camera) products. It supports up to 6 channels of PWM, and handles audio with a 2-channel DAC and 1-channel ADC. It also supports camera input via an 8-bit DVP interface and can compress video with a built-in JPEG engine. The integrated QSPI interface supports both Flash and RAM extension at the same time.
    Excerpt from BK7252 datasheet showing chip features and QFN68 pinout diagram.
    BK7252 comes in two packages - QFN68 and QFN48 (BK7252UQN48, 12 pins on side, 6x6mm).
    QFN68 8x8 pinout:
    Pinout diagram of BK7252 chip in QFN68 8x8 mm package with labeled pin numbers and functions.
    I haven't managed to find reference to the BK7252UQN48 pinout yet. If anyone knows of it, please post.

    BK7252 comparison with similar chips from Beken family:
    Comparison table of XW-Chip Technology Wi-Fi/BLE chips: BL2028N, BK7231U, BK7252, BK7256.
    BK7252 features more RAM and Flash than BL2028 (BK7231N?), it also has audio/video processing features.

    BK7252 datasheet
    English BK7252 datasheet - see also attachments for PDF version.
    Cover page of the BK7252 data sheet showing product name and Beken Corporation contact details. Table of contents page from the BK7252 Wi-Fi Audio/Video SoC documentation (v1.0), by Beken Corporation. Table of contents from the BK7252 datasheet showing sections on device characteristics, package, and order information. Revision history table for Wi-Fi Audio/Video SoC documentation.
    BK7252 datasheet page with introduction and main technical features of the chip. A documentation page for Beken BK7252 SoC showing key Wi-Fi Audio/Video features and a functional block diagram. Pinout diagram of the BK7252 QFN68 package, showing all pin names and numbers. Partial table describing BK7252 68-pin Wi-Fi Audio/Video SoC pinout with functions and pin types.
    A table segment listing BK7252 microcontroller pin numbers 26–40 with their signal names and functions. A table excerpt from the BK7252 datasheet showing pin functions and descriptions for pins 41–62. Section of the BK7252 datasheet showing a pinout table and descriptions of Wi-Fi/Bluetooth and system clocks. Table summarizing clock sources and peripherals for the BK7252 Wi-Fi Audio/Video SoC by Beken.
    Excerpt from the BK7252 Data Sheet showing power and reset modes of the chip. Documentation page describing UART, SPI, and SDIO peripherals for the BK7252 chip. A page from the BK7252 datasheet describing I2C, USB, ADC, PWM, and timer peripherals. Table of BK7252 GPIO functions with peripheral and analog mode descriptions.
    Pin mapping and peripheral function table for the BK7252 chip from the Beken datasheet. Table of pins and signals of Wi-Fi Audio/Video SoC by Beken. BK7252 data sheet page with a table of pin functions and a section on FLASH download procedure. Technical documentation page describing audio/video SoC Wi-Fi interfaces, including CMOS, IrDA, I2S, and audio peripherals.
    A page from the BK7252 chip datasheet, showing details on sampling, equalizer, QSPI interface, and security functions. A technical documentation page for a Wi-Fi Audio/Video SoC with parameter tables and temperature sensor information. Excerpt from BK7252 datasheet showing current consumption and WLAN receiver/transmitter characteristics tables. Table with audio parameters of the Beken Wi-Fi Audio/Video SoC, including transmitter power, DAC output amplitude, and SNR.
    Technical drawings of a QFN68 IC package with dimension table and ordering information.


    BK7252 development board and application schematic
    This is a schematic of Wi-Fi and Bluetooth Low Energy Combo Core Board by Tuya, showing the sample BK7252 application:
    Block diagram with microcontroller and several peripheral modules, labeled with section names.
    Source: https://developer.tuya.com/en/docs/iot/combo-core-board-bk7252?id=Kbpymhrki9qhe

    BK7252 known devices
    BK7252 was so far found by us in two devices, one is branded by Tuya (and device has Tuya keys encryption), and second runs unecrypted binary (YsxLite app?). See following topics:
    - Tuya Doorbell Camera (English, Polish)
    - A9 mini spy camera (without teardown topic currently, but mentioned here, known PCB versions: A9_B / V1.3_220516, JC_V9_V3B / 20230809DF, BMY_A9_V3A / 20230627DF).
    2BD5K-A9 ...photos.pdf Download (1.09 MB)
    Boot log of A9 camera:
    Code: text Expand Select all Copy to clipboard
    

 \ | /
- RT -     Thread Operating System
 / | \     3.1.0 build May 14 2022
 2006 - 2018 Copyright by rt-thread team

OSK Rev: R-3.0.22
SDK Rev: 3.0.33

[FUNC]rwnxl_init

IP Rev: W4-3.0.33-P0

[bk]tx_txdesc_flush

[FUNC]calibration_main



rfcali_mode:0



tssi:b-125, g-115

xtal_cali:25

[FUNC]ps_init

[FUNC]func_init_extended OVER!!!



start_type:0

lwIP-2.0.2 initialized!
igmp_mac_filter add 224.0.0.1 01:00:5E:00:00:01
igmp_mac_filter add 224.0.0.1 01:00:5E:00:00:01
beken wlan hw init

drv_pm_init
[I/FAL] RT-Thread Flash Abstraction Layer (V0.4.0) initialize success.
msh />cmd 1:3 

cmd 1:3 

cmd 1:3 

SD File System initialzation failed!
[I/FAL] The FAL MTD NOR device (filesystem) created successfully
LFS Filesystem initialized! filesystem ==> /flash0
bk_misc_check_start_type=0,gDcOrBattery=1
cVersion=1_1_2_36
cVersion=1_1_2_36
00000000: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000010: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000020: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000030: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000040: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000050: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000060: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000070: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00000000: 7B 22 4D 41 43 5F 41 44 44 52 22 3A 22 63 30 30  {"MAC_ADDR":"c00
00000010: 31 30 32 30 30 30 30 31 31 22 2C 22 50 52 4F 44  102000011","PROD
00000020: 55 43 54 5F 4B 45 59 22 3A 22 42 41 54 31 38 30  UCT_KEY":"BAT180
00000030: 38 32 33 49 4F 5A 52 43 22 2C 22 50 52 4F 44 55  823IOZRC","PRODU
00000040: 43 54 5F 53 45 43 52 45 54 22 3A 22 38 39 79 65  CT_SECRET":"89ye
00000050: 79 69 75 72 79 69 65 75 72 79 75 65 69 75 72 22  yiuryieuryueiur"
00000060: 2C 22 44 45 56 49 43 45 5F 4E 41 4D 45 22 3A 22  ,"DEVICE_NAME":"
00000070: 4E 55 47 5A 4C 41 22 2C 22 44 45 56 49 43 45 5F  NUGZLA","DEVICE_
sysmode=0,t=998
sending broadcast_deauth failed vif_entry == NULL

sysmode=1,t=1001
cmd 1:3 

cmd 1:3 

cmd 1:3 

SD Card initialzation failed!-->ret=-1:0
video_transfer_main entry

video transfer send type:3, open type:1

2----open I2C2

chNmb=8,sensor=0,gUsedCam=abc09

camera_intfer_init=0:abc09,a5a50003-a5a50005

cmd 1:3 

cmd 1:3 

read frame time out

cmd 1:3 

SD Card initialzation failed!-->ret=-1:0
Soft_AP_start

[saap]MM_RESET_REQ

[bk]tx_txdesc_flush

[saap]ME_CONFIG_REQ

[saap]ME_CHAN_CONFIG_REQ

[saap]MM_START_REQ

[csa]csa_in_progress[0:0]-clear

mm_add_if_req_handler:0

hapd_intf_add_vif,type:3, s:0, id:0

apm start with vif:0

------beacon_int_set:100 TU

set_active param 0
[msg]APM_STOP_CFM
update_ongoing_1_bcn_update

vif_idx:0, ch_idx:0, bcmc_idx:2

mm_set_vif_state_req_handler

update_ongoing_1_bcn_update

uap_ip_start



configuring interface uap (with Static IP)
using static ip...
please use rtthread dncp start server
[DHCP] dhcpd_start: ap

[DHCP] ip_start: [192.168.1.100]

[DHCP] ip_end: [192.168.1.254]

[DHCP] dhcp_server_start(): starting new DHCP server
[DHCP] dhcp_server_start(): starting DHCP server
def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed

start watch dog
rt_hw_wdg_start time=10000 threshold=500
closesocket: invalid s=0
closesocket: invalid s=0
[E/NTP]: ERROR no such host
cur_time is 0.
gParam.bFlagServerHello==0
read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

read frame time out

    Boot log of doorbell:
    Code: text Expand Select all Copy to clipboard
    
BK7251_1.0.1_f
REG:cpsr        spsr        r13         r14
SVC:0x000000D3              0xAC608462  0x53906404
IRQ:0x000000D2  0x00000010  0x63791D40  0x0D8DA088  
FIR:0x000000D1  0x00000010  0x44BBDADF  0xEC79B028  
SYS:0x000000DF              0xFEBFFFFF  0x2B08CCB0  
ST:0x8EB59285
J 0x10100
   j
[MEM DBG] heap init-------size:127816 addr:0x420cb8---------
[MEM DBG] heap init-------size:229376 addr:0x908000---------
[1970-1-1 18:13:20.536  user_flash.c user_flash_yield_cfg_read(331) Error]  [1970-1-1 18:13:20.536  tuya_ipc_dp_handler.c IPC_APP_get_yield_test_mode(1115) Debug]  [Flash]id:0xb4016
[Flash]init over
QSPi_init
QSPi_init1
sctrl_sta_ps_init
SDK Rev: 3.0.29
[STL]0 - 0
[RST]0 ~ 0
OSK Rev: F-3.0.20
cset:0 0 0 0
goto user main!!!!!!!!!!!!!!!!!!!!
hal_aes_init done
[01-01 18:12:15 TUYA I][mqc_app.c:350] mqc app init ...
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:300 cnt:1
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:302 cnt:2
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:304 cnt:3
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:307 cnt:4
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:308 cnt:5
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:312 cnt:6
[01-01 18:12:15 TUYA D][tuya_ipc_mqtt_subscribe.c:294] iot_register_extra_mqt_cb done
[01-01 18:12:15 TUYA I][uni_thread.c:220] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:5
[01-01 18:12:15 TUYA I][uni_thread.c:220] thread_create name:cmmod,stackDepth:4096,totalstackDepth:8192,priority:4
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:5 cnt:7
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:31 cnt:8
[01-01 18:12:15 TUYA D][uni_thread.c:247] Thread:sys_timer Exec Start. Set to Running Stat
[01-01 18:12:15 TUYA D][svc_online_log.c:295] svc online log init success
[01-01 18:12:15 TUYA D][log_seq.c:892] read m:0 f:0 l:0
[01-01 18:12:15 TUYA I][uni_thread.c:220] thread_create name:wk_th-0,stackDepth:5120,totalstackDepth:13312,priority:3
[01-01 18:12:15 TUYA E][tuya_ws_db.c:326] kvs_read fails gw_bi -23
[01-01 18:12:15 TUYA D][ws_db_gw.c:159] gw base read finish:-18
[01-01 18:12:15 TUYA D][tuya_bt_sdk.c:92] ty bt cmmod regist ok:1
[01-01 18:12:15 TUYA D][tuya_ble_api.c:315] upd adv para, send conn_req beacon.
dev id key: 16
d4 1d 8c d9 8f 00 b2 04 e9 80 09 98 ec f8 42 7e 
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_port_init
ble start no ble name
[01-01 18:12:15 TUYA N][tuya_ble_api.c:650] ble sdk re_inited
[01-01 18:12:15 TUYA D][tuya_ble_active.c:520] bt active init
[01-01 18:12:15 TUYA N][tuya_bt_sdk.c:141] ty bt sdk init success finish
[1970-1-1 18:12:15.154  tuya_device.c pre_device_init(159) Debug] < TUYA IOT SDK V:0.0.1 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.4_CD:1.0.0 >
< BUILD AT:2023_02_14_15_15_07 BY ci_manage FOR ty_...
[1970-1-1 18:12:15.172  tuya_device.c pre_device_init(160) Debug] SC028_WB30_ALK:2.2.4
[1970-1-1 18:12:15.180  tuya_device.c pre_device_init(161) Notice] firmware compiled at [Jul 20 2023 14:41:22]
[PLATFORM DEBUG]bk_rst:0 tuya_rst:0
[1970-1-1 18:12:15.194  tuya_device.c pre_device_init(162) Notice] system reset reason:[0]
[FUNC]rwnxl_init
[01-01 18:12:15 TUYA D]IP Rev: W4-3.0.29-P0
[uni_thread.c:247] Thread[bk]tx_txdesc_flush
:cmmod Exec Start. Set totx_txdesc_init: i=0, j= Running Stat
0, ct=1
tx_txdesc_init: i=1, j=0, ct=1
tx_txdesc_init: i=2, j=0, ct=64
tx_txdesc_init: i=3, j=0, ct=4
tx_txdesc_init: i=4, j=0, ct=1
[FUNC]intc_init
[FUNC]calibration_main
user define rfcali mode:1 

rfcali_mode:1, 0
flash txpwr table:0x0
txpwr tabe in flash is unused
Load default txpwr for b:0x10e32f
Load default txpwr for g:0x10e33d
fit n20 table with dist:2
Load default txpwr for n40:0x10d1ee
Load default txpwr for ble:0x10e34b
lpf_i & q in flash is:128, 128
found flash XTAL:16
xtal in flash is:16
xtal_cali:16
rwnx_tpc_pa_map_init
[FUNC]sdio_intf_init
[FUNC]ps_init
[FUNC]func_init_extended OVER!!!

start_type:0
Initializing TCP/IP stack
tcp_port:57202
bk_wlan_app_init finished
rf_thread_init ok
[01-01 18:12:15 TUYA D][tuya_ws_db.c:450] init fs. Path: null 
[01-01 18:12:15 TUYA D][kv_storge.c:46] *****************kvs_init. 
[01-01 18:12:15 TUYA N][simple_flash.c:407] key_addr: 0x397000   block_sz 4096
[01-01 18:12:15 TUYA N][simple_flash.c:496] get key:
0x89 0x33 0xfa 0xd1 0x58 0xfb 0x7f 0x3b 0xe7 0x24 0x97 0xd2 0x15 0xb2 0x6f 0xbd 
[01-01 18:12:16 TUYA D][mf_core.c:38] mf_core_init success
[01-01 18:12:16 TUYA I][uni_thread.c:220] thread_create name:mf_test,stackDepth:5120,totalstackDepth:18432,priority:4
[01-01 18:12:16 TUYA D][uni_thread.c:243] enter Thread:mf_test func call
[01-01 18:12:16 TUYA D][tuya_uart.c:53] buffer size 4160
[01-01 18:12:16 TUYA D][uni_thread.c:247] Thread:mf_test Exec Start. Set to Running Stat
[01-01 18ble name:BK7231BT-01, 4:12:16 TUYA D][uni_thred:a9:19:e2:9d:b2
EM_BLad.c:247] Thread:wk_th-E_END:0xef6
-----rw_mai0 Exec Start. Set to Run task init----
nning Stat
BLE Rev: B4-3.0.29-P0
-----rw_main  start----
gapm_cmp_evt_handler operation = 0x1, status = 0x0 
gapm_cmp_evt_handler operation = 0x3, status = 0x0 
[PLATFORM NOTICE]STACK INIT OK
ble create new db
ble_env->start_hdl = 0xa
prf_task_id:120, state:1
[PLATFORM NOTICE]CREATE DB SUCCESS
[01-01 18:12:16 TUYA D][tuya_ble_api.c:543] rev ble event 3
[PLATFORM NOTICE]!!!!!!!!!!tuya_before_netcfg_cb
appm start advertising
gapm_cmp_evt_handler operation = 0x1b, status = 0x0 
[01-01 18:12:16 TUYA D][mf_test.c:355] mf thread delete
[01-01 18:12:16 TUYA D][uni_thread.c:307] Del Thrd:mf_test
[01-01 18:12:16 TUYA N][tuya_main.c:301] mf_init succ
[01-01 18:12:16 TUYA D][tuya_uart.c:53] buffer size 8
[1970-1-1 18:12:16.610  tuya_device.c app_init(197) Debug] app_init

[01-01 18:12:16 TUYA D][tuya_main.c:307] gwcm_mode 0
[01-01 18:12:16 TUYA D][tuya_main.c:323] device_init in
[1970-1-1 18:12:16.628  user_flash.c user_flash_yield_cfg_read(335) Debug] uf open OK
[1970-1-1 18:12:16.634  user_flash.c user_flash_yield_cfg_read(337) Debug] uf file yield_param read data 4!
[1970-1-1 18:12:16.646  tuya_ipc_dp_handler.c IPC_APP_get_yield_test_mode(1115) Debug] get ***** yield_test_mode:1 

[1970-1-1 18:12:16.658  user_flash.c user_flash_yield_cfg_read(335) Debug] uf open OK
[1970-1-1 18:12:16.666  user_flash.c user_flash_yield_cfg_read(337) Debug] uf file yield_param read data 4!
[1970-1-1 18:12:16.676  tuya_ipc_dp_handler.c IPC_APP_get_yield_test_mode(1115) Debug] get ***** yield_test_mode:1 

[1970-1-1 18:12:16.686  tuya_device.c device_init(578) Debug] < TUYA IOT SDK V:0.0.1 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.4_CD:1.0.0 >
< BUILD AT:2023_02_14_15_15_07 BY ci_manage FOR ty_...
[1970-1-1 18:12:16.704  tuya_device.c device_init(579) Debug] SC028_WB30_ALK:2.2.4
[1970-1-1 18:12:16.712  tuya_device.c device_init(580) Notice] firmware compiled at [Jul 20 2023 14:41:22]
[PLATFORM DEBUG]bk_rst:0 tuya_rst:0
[1970-1-1 18:12:16.726  tuya_device.c device_init(581) Notice] system reset reason:[0]
[1970-1-1 18:12:16.734  tuya_device.c device_init(582) Notice] 
  
   
 ***********device_init*******1****

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [6] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [4] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [3] init success

[01-01 18:12:16 TUYA N][tuya_drv_adc.c:536] adc init =0x9008cc,0x900800,0x900828. chn=4,5

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [13] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [5] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [25] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [28] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [7] init success

[01-01 18:12:16 TUYA N][machine.c:198] ns4150 driver_register success

[01-01 18:12:16 TUYA N][machine.c:129] ns4150 device_register success

[01-01 18:12:16 TUYA N][machine.c:79] match ns4150 success 

[01-01 18:12:16 TUYA N][snd_chip.c:48] snd chip register:ns4150 

[01-01 18:12:16 TUYA N][machine.c:50] snd_dev new name:ty_snd 

[01-01 18:12:16 TUYA N][machine.c:345] snd_dev_register 

[01-01 18:12:16 TUYA N][tuya_audio_api.c:60] tuya_audio_system_default_init success :ty_snd 

bk_dac_init[PLATFORM NOTICE]bk7252 audio adc init
[01-01 18:12:16 TUYA N][tuya_drv_adc.c:536] adc init =0x9008ac,0x900800,0x900828. chn=2,0

[01-01 18:12:16 TUYA N][tuya_audio_api.c:242] snd dev open

[01-01 18:12:16 TUYA N][tuya_audio_api.c:181] tuya_audio_format set 16 1 8000

[01-01 18:12:16 TUYA I][uni_thread.c:220] thread_create name:ty_ao,stackDepth:2048,totalstackDepth:20480,priority:1
[1970-1-1 18:12:16.886  tuya_audio.c ty_audio_play_beep(517) Debug] 
--$1---- ty_audio_play_beep D 

offset:3576832,this:3576832,read_len:320,remain_len:15972offset:3577152,this:3577152,read_len:320,remain_len:15652offset:3577472,this:3577472,read_len:320,remain_len:15332offset:3577792,this:3577792,read_len:320,remain_len:15012offset:3578112,this:3578112,read_len:320,remain_len:14692offset:3578432,this:3578432,read_len:320,remain_len:14372offset:3578752,this:3578752,read_len:320,remain_len:14052offset:3579072,this:3579072,read_len:320,remain_len:13732[01-01 18:12:16 TUYA D][uni_thread.c:125] del list not empty...deleting
[01-01 18:12:16 TUYA D][uni_thread.c:128] Thread:mf_test is still running..
[01-01 18:12:16 TUYA D][uni_thread.c:247] Thread:ty_ao Exec Start. Set to Running Stat
offset:3579392,this:3579392,read_len:320,remain_len:13412offset:3579712,this:3579712,read_len:320,remain_len:13092offset:3580032,this:3580032,read_len:320,remain_len:12772offset:3580352,this:3580352,read_len:320,remain_len:12452offset:3580672,this:3580672,read_len:320,remain_len:12132[01-01 18:12:17 TUYA D][uni_thread.c:265] Thread:mf_test Exec Finish. Set to Del Stat
[01-01 18:12:17 TUYA D][uni_thread.c:125] del list not empty...deleting
[01-01 18:12:17 TUYA D][uni_thread.c:132] Final Free Thread:mf_test, is_self:1
[01-01 18:12:17 TUYA D][uni_thread.c:138] delay to delete thread self
[01-01 18:12:17 TUYA D][uni_thread.c:149] finally delete thread self
offset:3580992,this:3580992,read_len:320,remain_len:11812offset:3581312,this:3581312,read_len:320,remain_len:11492offset:3581632,this:3581632,read_len:320,remain_len:11172offset:3581952,this:3581952,read_len:320,remain_len:10852offset:3582272,this:3582272,read_len:320,remain_len:10532offset:3582592,this:3582592,read_len:320,remain_len:10212offset:3582912,this:3582912,read_len:320,remain_len:9892offset:3583232,this:3583232,read_len:320,remain_len:9572offset:3583552,this:3583552,read_len:320,remain_len:9252offset:3583872,this:3583872,read_len:320,remain_len:8932offset:3584192,this:3584192,read_len:320,remain_len:8612offset:3584512,this:3584512,read_len:320,remain_len:8292offset:3584832,this:3584832,read_len:320,remain_len:7972offset:3585152,this:3585152,read_len:320,remain_len:7652offset:3585472,this:3585472,read_len:320,remain_len:7332offset:3585792,this:3585792,read_len:320,remain_len:7012offset:3586112,this:3586112,read_len:320,remain_len:6692offset:3586432,this:3586432,read_len:320,remain_len:6372offset:3586752,this:3586752,read_len:320,remain_len:6052offset:3587072,this:3587072,read_len:320,remain_len:5732offset:3587392,this:3587392,read_len:320,remain_len:5412offset:3587712,this:3587712,read_len:320,remain_len:5092offset:3588032,this:3588032,read_len:320,remain_len:4772offset:3588352,this:3588352,read_len:320,remain_len:4452offset:3588672,this:3588672,read_len:320,remain_len:4132offset:3588992,this:3588992,read_len:320,remain_len:3812offset:3589312,this:3589312,read_len:320,remain_len:3492offset:3589632,this:3589632,read_len:320,remain_len:3172offset:3589952,this:3589952,read_len:320,remain_len:2852offset:3590272,this:3590272,read_len:320,remain_len:2532offset:3590592,this:3590592,read_len:320,remain_len:2212offset:3590912,this:3590912,read_len:320,remain_len:1892offset:3591232,this:3591232,read_len:320,remain_len:1572offset:3591552,this:3591552,read_len:320,remain_len:1252offset:3591872,this:3591872,read_len:320,remain_len:932offset:3592192,this:3592192,read_len:320,remain_len:612offset:3592512,this:3592512,read_len:292,remain_len:292fatfs: disk_initialize vol 0
===sd card open:0===
Not 4 line mode. skip config SD_D2(P18)
cmd 1:3 
sdcard cmd 8 timeout,cmdresp_int_reg:0x84
cmd8 noresp, voltage mismatch or Ver1.X SD or not SD
sdcard cmd 37 timeout,cmdresp_int_reg:0x84
send cmd55 err:3
send cmd55&cmd41 err, quite loop
Not 4 line mode. skip config SD_D2(P18)
cmd 1:3 
sdcard cmd 8 timeout,cmdresp_int_reg:0x84
cmd8 noresp, voltage mismatch or Ver1.X SD or not SD
sdcard cmd 37 timeout,cmdresp_int_reg:0x84
send cmd55 err:3
send cmd55&cmd41 err, quite loop
Not 4 line mode. skip config SD_D2(P18)
cmd 1:3 
sdcard cmd 8 timeout,cmdresp_int_reg:0x84
cmd8 noresp, voltage mismatch or Ver1.X SD or not SD
sdcard cmd 37 timeout,cmdresp_int_reg:0x84
send cmd55 err:3
send cmd55&cmd41 err, quite loop
sdcard_open err
[1970-1-1 18:12:19.492  tuya_sdcard.c sd_mount(108) Error] -----mount fatfs fail-----

[1970-1-1 18:12:19.498  bk_sd_fac.c bk_sd_fac_connect(112) Debug] no sdcard

[1970-1-1 18:12:19.506  bk_sd_fac.c bk_sd_fac_init(734) Debug] bk_sd_fac_connect fail , bk sd fac out -1

[1970-1-1 18:12:19.516  tuya_power.c tuya_power_init(265) Debug] tuya_power_init
[01-01 18:12:19 TUYA N][tuya_peripheral.c:223] ty_gpio pin [2] init success

[01-01 18:12:19 TUYA N][tuya_drv_adc.c:536] adc init =0x9008bc,0x900800,0x900828. chn=3,4

[1970-1-1 18:12:19.540  tuya_power_save.c ty_power_save_init(139) Debug] set deepsleep timer timeout 185!
[01-01 18:12:19 TUYA I][uni_thread.c:220] thread_create name:ty_ps,stackDepth:2560,totalstackDepth:23040,priority:4
[1970-1-1 18:12:19.560  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x8] success

[1970-1-1 18:12:19.568  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x600] success

[1970-1-1 18:12:19.578  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x80] success

[1970-1-1 18:12:19.588  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x2] success

[1970-1-1 18:12:19.596  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x600] success

[1970-1-1 18:12:19.606  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0xc3600] success

[1970-1-1 18:12:19.614  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x2c800] success

[1970-1-1 18:12:19.624  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x10000] success

[01-01 18:12:19 TUYA I][uni_thread.c:220] thread_create name:wk_th-0,stackDepth:1536,totalstackDepth:24576,priority:4
[1970-1-1 18:12:19.644  tuya_lite_doorbell.c ty_user_doorbell_task_proc_start(358) Debug] __begin

[01-01 18:12:19 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[1970-1-1 18:12:19.660  user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default!
[1970-1-1 18:12:19.672  tuya_led_ctrl.c led_light_mode_set(214) Info] change led status => [8]

[01-01 18:12:19 TUYA I][uni_thread.c:220] thread_create name:blue_led_light_ctrl,stackDepth:1024,totalstackDepth:25600,priority:1
[01-01 18:12:19 TUYA D][ipc_key.c:116] min_timer_period :10
[01-01 18:12:19 TUYA D][ipc_key.c:116] min_timer_period :10
[01-01 18:12:19 TUYA D][key_proc.c:62]  key_proc_init done !!!

[1970-1-1 18:12:19.708  tuya_alarm.c tuya_notifify_alarm_init(303) Debug] tuya_notifify_alarm_init
[PLATFORM DEBUG]bk_rst:0 tuya_rst:0
rw_ieee80211_set_country code:
code: CN
channel: 1 - 13
mode: MANUAL
bk_wlan cca closed
[1970-1-1 18:12:19.740  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4436]

[PLATFORM DEBUG]tuya_os_adapt_watchdog_init_start
[PLATFORM DEBUG]tuya_os_adapt_watchdog_init_start OK
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[01-01 18:12:19 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[1970-1-1 18:12:19.758  user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default!
[PLATFORM DEBUG]ssid:SmartLife-9DB2 key:  channnel: 6
[saap]MM_RESET_REQ
[bk]tx_txdesc_flush
tx_txdesc_init: i=0, j=0, ct=1
tx_txdesc_init: i=1, j=0, ct=1
tx_txdesc_init: i=2, j=0, ct=64
tx_txdesc_init: i=3, j=0, ct=4
tx_txdesc_init: i=4, j=0, ct=1
[saap]M[1970-1-1 18:12:19.946  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4222]

[1970-1-1 18:12:20.092  tuya_ipc_camera.c tuya_ipc_camera_init(358) Debug] video test set format
[1970-1-1 18:12:20.112  tuya_ipc_camera.c tuya_ipc_camera_init(366) Debug] video test set buff
[1970-1-1 18:12:20.116  tuya_ipc_camera.c tuya_ipc_camera_init(428) Debug] video test start stream
E_CONFIG_REQ
[saap]ME_CHAN_CONFIG_REQ
[saap]MM_START_REQ
[csa]csa_in_progress[0:0]-clear
mm_add_if_req_handler:0
hapd_intf_add_vif,type:3, s:0, id:0
apm start with vif:0
------beacon_int_set:100 TU
set_active param 0
[msg]APM_STOP_CFM
update_ongoing_1_bcn_update
mm_set_vif_state_req_handler
vif_idx:0, ch_idx:[1970-1-1 18:12:20.148  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4464]

0, bcmc_idx:2
update_ongoing_1_bcn_update
enter low level!
mac 4c:a9:19:e2:9d:b3
leave low level!
[net]addvif_idx:0
uap_ip_start

configuring interface uap (with[1970-1-1 18:12:20.172  tuya_power_save.c ty_power_save_deal_wake_soure(161) Notice] 
--#3---sctrl_get_deep_sleep_wake_soure [0], gpio [-1]
[1970-1-1 18:12:20.184  tuya_power_save.c ty_power_save_deal_wake_soure(175) Debug] get_gw_active not is ACTIVATED
[1970-1-1 18:12:20.196  tuya_device.c device_init(656) Info] 
--#1---TUYA_APP_Init_Stream_Storage

Init tuya_ipc_ss_init[01-01 18:12:20 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[1970-1-1 18:12:20.214  user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default!
[1970-1-1 18:12:20.226  tuya_ipc_dp_handler.c IPC_APP_get_sd_record_onoff(478) Debug] curr sd_record_on_off:1 

[01-01 18:12:20 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[1970-1-1 18:12:20.242  user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default!
[1970-1-1 18:12:20.254  tuya_ipc_dp_handler.c IPC_APP_get_sd_record_mode(512) Debug] curr sd_record_mode:0 

[01-01 18:12:20 TUYA E][tuya_ipc_stream_storage.c:1780] the ss mgr not inited, but msg buffered: set mode 1
[1970-1-1 18:12:20.274  tuya_device.c __wait_online(550) Notice] wait online ...
 Static IP)def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed
dev id key: 16
6d 65 25 f2 34 fb 69 34 74 0e 9e fc 3d 01 87 49 
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_reset_adv
gapm_cmp_evt_handler operation = 0x10, status = 0x0 
[1970-1-1 18:12:20.306  tuya_sdcard.c tuya_ipc_sd_status_upload(177) Debug] report sd status : [5]
[01-01 18:12:20 TUYA E][tuya_ipc_stream_storage.c:1782] storage not inited
[1970-1-1 18:12:20.348  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4353]

[1970-1-1 18:12:20.378  tuya_ld.c get_ld_stat_cb(99) Debug] LD state :[TY_LD_STATE_LIGHT]

fetch msg success. event type = [0x80]
[1970-1-1 18:12:20.378  tuya_event.c __event_night_state_callback(158) Debug] process night event 0

[1970-1-1 18:12:20.388  tuya_peripheral.c ty_peripheral_ctrl_irled(306) Debug] tuya_gpio_write success! pin=[6] val=[0], ret=[0]

[1970-1-1 18:12:20.402  tuya_peripheral.c ty_peripheral_ircut_set(531) Debug] ty_peripheral_ircut_set [TY_PERIPHERAL_SW_ON]

[1970-1-1 18:12:20.560  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4218]

[1970-1-1 18:12:20.718  tuya_stream_proc.c tuya_stream_ctrl_night(606) Debug] bai-------------------------------------------tian
[1970-1-1 18:12:20.720  tuya_stream_proc.c tuya_stream_ctrl_night(854) Debug] 0328-----baitian--------------

[1970-1-1 18:12:20.758  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4477]

[1970-1-1 18:12:20.758  tuya_device.c __wifi_status_cb(425) Info] wf_nw_status_cb,wifi_status:2
[1970-1-1 18:12:20.766  tuya_led_ctrl.c led_light_mode_set(214) Info] change led status => [9]

publish event [0x80] success
[1970-1-1 18:12:20.966  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4314]

[1970-1-1 18:12:21.178  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4387]

[1970-1-1 18:12:21.302  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:21.376  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4456]

[1970-1-1 18:12:21.588  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4278]

[1970-1-1 18:12:21.796  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4463]

[1970-1-1 18:12:22.008  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4392]

[1970-1-1 18:12:22.206  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4238]

[1970-1-1 18:12:22.322  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:22.416  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4490]

[1970-1-1 18:12:22.628  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[4340]

[1970-1-1 18:12:22.628  tuya_power.c update_sys_bat(106) Debug] update_sys_bat percent: 100 percent_hold: 100 bat: 100

[1970-1-1 18:12:23.342  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:24.362  tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:25.382  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:26.402  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:26.956  tuya_audio.c __audio_output_proc(389) Debug] ao buffer empty.

[1970-1-1 18:12:27.422  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:28.442  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:29.462  tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:30.482  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:31.502  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:32.522  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:33.542  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:34.562  tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:35.582  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:36.602  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:36.956  tuya_audio.c __audio_output_proc(389) Debug] ao buffer empty.

[1970-1-1 18:12:37.622  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:38.642  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:39.662  tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:40.682  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:41.702  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:42.722  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:43.742  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:44.762  tuya_device.c __wait_online(550) Notice] wait online ...
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[1970-1-1 18:12:45.782  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:46.394  tuya_device.c __wait_online(550) Notice] wait online ...
[1970-1-1 18:12:46.708  tuya_soft_wdt.c tuya_soft_wdt_check(51) Info] type = [0] ts=31 pts=31, last=0

[1970-1-1 18:12:46.708  tuya_soft_wdt.c tuya_soft_wdt_check(51) Info] type = [1] ts=31 pts=31, last=0

[1970-1-1 18:12:46.716  tuya_soft_wdt.c tuya_soft_wdt_check(51) Info] type = [2] ts=31 pts=31, last=0

[1970-1-1 18:12:46.956  tuya_audio.c __audio_output_proc(389) Debug] ao buffer empty.

[1970-1-1 18:12:47.414  tuya_device.c __wait_online(550) Notice] wait online ...


    BK7252 flash read and write with SPI (CH341)
    Just refer to Doorbell guide by @divadiow
    Tuya Doorbell - English
    Tuya Doorbell - Polish

    BK7252 flash read and write with UART (CH340)
    BK7252 flashing is very similar to BK7231T - in fact, BK7231T mode in Easy UART Flasher may work for some BK7252s. As far as I've tested, the only issue may arise with some BK7252s in BK7231 Easy UART flasher due to the "address wrap" hack used to access the bootloader:
    Screenshot from Visual Studio showing C# source code, with the line addr + FLASH_SIZE; highlighted.
    That's why Easy UART flasher version 19 and later has a new BK7252-specific mode.
    So, get it here:
    https://github.com/openshwprojects/BK7231GUIFlashTool
    Just choose BK7252 mode:
    Screenshot of BK7231 Easy UART Flasher software with a Reading success! message displayed.
    On hardware side, it's a classic BK connection - just RX, TX, GND and power (3.3V).

    If flasher can't "Get bus", do a quick power off/on cycle. You can check out our other BK7231 tutorials to see more details:
    https://openbekeniot.github.io/webapp/devicesList.html
    https://www.youtube.com/@elektrodacom
    Alternatively, you can use old Python solution:
    https://github.com/OpenBekenIOT/hid_download_py
    Example backup flash to file command:
    Code: text Expand Select all Copy to clipboard
    
python uartprogram -l 0x1FFFFF -b 115200 -r -d COM3  mybackup.bin

    This will read 2MB flash, starting with default 0x11000 offset. Bootloader is not read there. It seems bootloader reading is possible only on some BK7252 - we don't know why yet.
    To write:
    Code: text Expand Select all Copy to clipboard
    
python uartprogram -b 115200 -w -d COM3 newflash.bin

    Then do power off/on cycle to run new firmware.
    You can also submit your BK7252 factory backup here:
    https://github.com/openshwprojects/FlashDumps

    UART method should not be used to change bootloader because it may be possible to brick BK7252 that way. Just like with BK7231T, the bootloader is in 0-0x11000 physical address section. In the event of Bootloader overwrite it is likely a restore using the SPI method will be required as device will not respond over UART anymore.

    Bootloader is using RT-Thread. See attached documents.


    BK7252 open source firmware
    OpenBeken is going to support BK7252 soon, but current build is not public. Check Releases Tab periodically for updates:
    LED lighting control panel on a device running OpenBK7252 system.

    BK7252 Tuya SDKs (as links, files are too large to attach):
    Code: text Expand Select all Copy to clipboard
    
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.10.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.11.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.14.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.16.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.17.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.18.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.21.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.22.zip
https://airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com/smart/embed/pruduct/BK7252_1.1.23.zip

    They consist of gcc-arm-none-eabi-5_4-2016q3.tar.bz2 SDK, FreeRTOSv9.0.0, Beken SDK, tools:
    - video_tool
    - tuya_packager
    - scripts
    - rtt_ota
    - rt_partition_tool
    - memory_leak
    - make
    - iperf_test
    - gnuwin32
    - crc_binary
    - beken_packager
    The attached BK72XX_SDK_User_Manual-3.0.3.pdf and BEKEN_WiFi_SDK_API_Reference-3.0.27.pdf documents are also from the Tuya SDK package.

    BK7252 Flash Maps
    bk7252_flash_map_2MB.xlsx
    Spreadsheet showing memory partitioning with highlighted rows for app and other sections.
    Partition NameStart Addr (Hex)Start Addr (Dec)Physical AddrSizeSize (Hex)Start Addr (Hex)Start Addr (Dec)Logical AddrSizeSize (Hex)Remarks
    bootloader0x0000KB68KB0x000KB64KB0x10000Boot + Copy. Bootloader does not use full 64KB. RF+MAC placed before.
    app0x110006963268KB1224KB0x1320000x100006553664KB1152KB0x120000Main Program Area
    download0x14300013230081292KB748KB0xBB000Temporary download area, can reuse. 748 / 1152 (app) = ~65%
    param10x1FE00020889602040KB4KB0x1000EasyFlash
    param20x1FF00020930562044KB4KB0x1000Fast Connect

    🟨 Yellow rows (app) indicate discrepancy between physical and logical addresses
    bk7252_flash_map_4MB.xlsx
    Screenshot of an Excel sheet showing a table with memory addresses and sizes for different software partitions.
    Partition NameStartAddr_Physical_HexStartAddr_Physical_DecAddrSize_KBSize_HexStartAddr_Logical_HexStartAddr_Logical_DecLogical_KBSize_KB_LogicalSize_Hex_LogicalNotes
    bootloader0x0000000KB64KB0x0000000KB60KBBoot + Copy bootloader doesn't use full 64KB RF+MAC placed in front
    app0x110006963268KB1768KB0x1BA0000x100006553664KB1664KB0x1A0000Main application area physical address aligned to 68KB
    filesystem0x1CB00018800641836KB1156KB0x1210000x1B000017694721728KB1088KB0x110000
    download0x2EC00030638082992KB1096KB0x1120001100/1664=66%
    param10x3FE00041861124088KB4KBEasyFlash
    param20x3FF00041902084092KB4KBEasyFlash


    Related A9 camera "hack"
    It may be also possible to get A9 camera video stream without firmware change - see this guide:
    https://www.elektroda.com/rtvforum/topic4117962.html

    Summary
    This is all BK7252 information I have managed to find so far. Currently we know flashing methods (both SPI and UART) and we can compile our own firmware for it, but we're still working on OTA and video processing. Hopefully we'll be able to resolve these issues soon. Special thanks for @divadiow and @insmod for development and info.

    See attachments for more information. If you have any more info, let us know.
    Attachments:

    Cool? Ranking DIY
    Helpful post? Buy me a coffee.
    About Author
    p.kaczmarek2
    Moderator Smart Home  
    Offline 
    p.kaczmarek2 wrote 11960 posts with rating 9995, helped 572 times. Been with us since 2014 year.
  • ADVERTISEMENT
  • #2 21525965
    chemik_16
    Level 26  
    But to operate a camera/audio probably still a long way off ? ;) .
  • ADVERTISEMENT
  • #3 21525979
    p.kaczmarek2
    Moderator Smart Home  
    We haven't tried this directly yet, but there are quite a few potential examples and SDKs. One would have to see if they work with the camera module what is used on these boards. The links posted are also promising. In addition, we are working out two types of A9 cameras in parallel. The first is based on the BK7252 and the second on the XF16 (XR872).
    Two disassembled cameras with circuit boards, batteries, lenses, cables, and casings on a white background. Two round camera circuit boards for A9-type devices with visible chips and micro USB ports.
    bk7252_camera_release_20210609.zip and bk7252_camera_release_20191113.zip has the CFG_USE_CAMERA_INTF option.

    I'm adding the RT-Thread documents (you have to flip them through the translator):
    Attachments:
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #5 21526110
    insmod
    Level 24  
    I just recently updated sdk to 3.0.76, which adds bk7252n support.
    The chip is very recent, most information i see about it was made in 2025.
    Will have to see if i can build for it.

    Camera is a very long way from working, i don't even have a camera module that is supported by sdk example.
    My bk7252 camera came with gc0310 and txw817 with unknown camera.
    And neither of them are supported.
  • ADVERTISEMENT
  • #6 21526124
    p.kaczmarek2
    Moderator Smart Home  
    I still need to find my second A9 camera, which also had BK7252 but I stopped working on it in the past because I bricked the bootloader. Maybe I will be able to recover it with SPI method.

    @insmod do you have a bootlog of TXW817 ? I haven't found much info about it yet.
    Quote:

    TXW817 Series TXW817-810
    Product Description
    TXW817 is a low-power, high-performance, highly integrated 2.4GHz Wi-Fi+ small wireless multi-mode IoT SOC chip that integrates IEEE 802.11 b/g/n baseband and RF (Radio Frequency) circuits, including power amplifier PA (Power Amplifier), low noise amplifier LNA (Low Noise Amplifier), RF balun, antenna switch and power management module.

    The TXW817 Wi-Fi baseband implements Orthogonal Frequency Division Multiplexing (OFDM) technology, is backward compatible with Direct Sequence Spread Spectrum (DSSS) and Complementary Code Keying (CCK) technologies, and supports IEEE 802.11 b/g/n protocols. It supports 20MHz standard bandwidth and 5MHz/10MHz narrow bandwidth, and provides a maximum physical layer rate of 72.2Mbit/s.

    The TXW817 chip integrates a high-performance 32-bit microprocessor, built-in MJPEG (supports VGA/720P), provides DVP, LCD, USB2.0 High Speed ​​Host/Device, SDMMC Host, SDIO2.0 Slave, RMII MAC, SPI Master & Device, UART, IIC, IIS, PDM, IR Send/Recieve, PWM, GPIO, Audio and ordinary ADC/DAC and other rich peripheral interfaces, supports running programs on SPI Flash. Supports RTOS and third-party components, and provides an open and easy-to-use development and debugging environment.

    The TXW817 series includes multiple models and provides the mainstream QFN48 package. Depending on the package, the peripheral resource configuration in the device is different. Some packages support built-in PSRAM and Flash.
    Applications:
    - Wireless audio and video applications
    - MiniDV
    - IPC


    There are some docs but they require login:
    https://www.taixin-semi.com/Product?prouctSubClass=58
    Helpful post? Buy me a coffee.
  • #8 21526822
    satanistik
    Level 27  
    Would it be possible to add circuit support to the OBK via SPI?
    I am referring to the ATM90E3 three-phase power meter.
  • #9 21526885
    p.kaczmarek2
    Moderator Smart Home  
    Sure, it seems the datasheet is available, but where did you find ATM90E3 device? Or are you making a custom one? Is there a product with one of supported chips and ATM90E3 ?
    Helpful post? Buy me a coffee.
  • #10 21527221
    satanistik
    Level 27  
    Well, there is no cheap power measurement device for 3-phase systems using transformers. But there is something out there for about 1kzl, the ATM90E3 is quite cheap and available. I can design the board.
  • #11 21527527
    divadiow
    Level 34  
    with reference to the BK7252N A9 cam, SPI mode entered and dump taken with Neo. SPI entered using same method as the doorbell

    I made another import.xml for Neo so more of the flash IDs used in our devices can be detected. Attached.

    Screenshot of NeoProgrammer software showing SPI NOR flash memory TH25Q-16HB being read using a CH341 Black programmer.

    A USB programmer connected by wires to a PCB with electronics on a wooden table.

    Flash fully erased in BKFIL - dump was all FF on read-back. Wrote UART dump back to flash and cam boots and outputs boot log as normal.



    OpenBK7238 QIO from 0x0 does not boot.

    The two BK7238 dumps I tried did boot, but no signs of application running, just BL.

    BanlanX and Zengge dumps:

    Code: Text
    Log in, to see the code
    Attachments:
  • #12 21527530
    p.kaczmarek2
    Moderator Smart Home  
    Is OpenBK7238 QIO from 0x0 booting on NiceMCU?
    Helpful post? Buy me a coffee.
  • #13 21527537
    divadiow
    Level 34  
    got a feeling it doesn't. can try in a while

    Added after 10 [hours] 55 [minutes]:

    p.kaczmarek2 wrote:
    Is OpenBK7238 QIO from 0x0 booting on NiceMCU?


    QIO does actually boot and AP broadcasts. whole log out is from UART2 P0 instead of UART1 P11
  • #16 21535392
    divadiow
    Level 34  
    cool. I usually keep an eye on Lidl and Aldi weekly things for smart bits but hadn't noticed this show. Would you be happy to post firmware backup and uart boot log if/when captured?

    Added after 4 [minutes]:

    GalaxyCore GC0328 cam too by the looks
  • #18 21535443
    divadiow
    Level 34  
    cool. will have a look. You can also dump the entire flash, including bootloader, if you choose BK7231T mode - maybe - ref https://www.elektroda.com/rtvforum/topic4073760.html#21525243 - if not, maybe with hid_download_py https://www.elektroda.com/rtvforum/topic4073760.html#21526049

    Added after 4 [hours] 17 [minutes]:

    ah, also, I forget, it's probably a 4mb chip, so maybe use hid_download.py. your dump looks like it should carry on past the 2mb

    Extract of a memory dump in hexadecimal and text form, showing addresses, hex values, and corresponding ASCII characters.
  • #19 21550476
    Apache02
    Level 2  
    Hi. I recorded a video to demonstrate that it's possible to create an open-source firmware for these types of cameras:



    This processor has 2 UARTs and 2 I2C interfaces. The camera is controlled via I2C. One of the I2C buses shares pins with a UART, so depending on the board layout, you might have access to either one or two UARTs.
    Firmware is uploaded via UART using the bootloader. If the bootloader is missing (e.g., it's been erased), there's a direct access mode to the SPI flash memory. I’ve used this only to restore the bootloader.
    Note: SPI flash can be locked using eFuse. I’ve encountered at least one camera that did not respond over UART and wouldn't enter SPI flash access mode either.
  • #20 21550489
    p.kaczmarek2
    Moderator Smart Home  
    Good job, which SDK and camera driver did you use?
    Helpful post? Buy me a coffee.
  • #22 21551048
    p.kaczmarek2
    Moderator Smart Home  
    That's good to see, are you interested in working together on OBK port for that camera? We already managed to boot up on BK7522. With OBK, you will get lots of useful features, like ability to test and develop on windows, automatic online self tests, also online builds and Berry scripting language
    Helpful post? Buy me a coffee.
  • #23 21555562
    divadiow
    Level 34  
    seems the Taixin SDKs have quite a lots of cam things in. these contain init tables
    Screenshot of a file explorer window showing a list of C source files for various sensors.

    csi.h
    Screenshot showing a fragment of a C header file with preprocessor directives and sensor definitions.
  • #24 21557245
    divadiow
    Level 34  
    Tuya Rockchip RK3308 SDK has a load of cam drivers
    Spoiler:
    adv7181.c
    gc0307.c
    gc0307_old.c
    gc0308.c
    gc0308_old.c
    gc0308_user_series.c
    gc0309.c
    gc0309_for_td8801.c
    gc0309_old.c
    gc0312.c
    gc0328.c
    gc0329.c
    gc0329_old.c
    gc2015.c
    gc2015_old.c
    gc2035.c
    gc2035_old.c
    gc2145.c
    gc2155.c
    generic_sensor.c
    generic_sensor.h
    gt2005.c
    gt2005_old.c
    gt2005_user_series.c
    hi253.c
    hi704.c
    hm2057.c
    hm5065.c
    hm5065.h
    hm5065_old.c
    Kconfig
    Makefile
    mt9d112.c
    mt9d112.h
    mt9d113.c
    mt9d113.h
    mt9m112.c
    mt9m112.h
    mt9p111.c
    mt9p111.h
    mt9p111_old.c
    mt9t111.c
    mt9t111.h
    mv9335
    nt99160_2way.c
    nt99240_2way.c
    nt99250.c
    nt99252_3way.c
    nt99340_2way.c
    ov2640_rk.c
    ov2655.c
    ov2659.c
    ov2659_old.c
    ov3640.c
    ov3640.h
    ov3640_af_firmware.c
    ov3660.c
    ov5640.c
    ov5640.h
    ov5640_af_firmware.c
    ov5640_af_firmware_old.c
    ov5640_for_td8801.c
    ov5640_old.c
    ov5642.c
    ov5642.h
    ov5642_af_firmware.c
    ov7675.c
    ov7690.c
    ov9650.c
    rk2928_camera.c
    rk29xx
    rk29_camera.c
    rk29_camera_oneframe.c
    rk29_camera_pingpong.c
    rk30_camera_oneframe.c
    rk30_camera_pingpong.c
    rk3308.txt
    rk_camsys
    s5k5ca.c
    s5k5ca.h
    s5k6aa.c
    s5k6aa.h
    sid130B.c
    siv120b.c
    siv121d.c
    sp0838.c
    sp2518.c
    sp2518_old.c
    tp2825.c
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Słuchaj:
Report a violation of the law

Topic summary

The BK7252 is a 32-bit Wi-Fi and Bluetooth Low Energy combo chip designed for audio and video applications, featuring up to 6 PWM channels, 2-channel DAC, 1-channel ADC, an 8-bit DVP camera interface, and a built-in JPEG compression engine. It supports QSPI for simultaneous Flash and RAM extension and comes in QFN68 and QFN48 packages, with the latter's pinout still undocumented. The chip is used in Tuya-based and non-Tuya devices such as A9 spy cameras and ALDI REKA video doorbells. SDK versions including 3.0.76 have added BK7252N support, though camera module compatibility remains limited, with common sensors like GC0310 and TXW817 not yet supported. Firmware development involves UART bootloader flashing and SPI flash access for recovery, with some devices employing eFuse to lock SPI flash. Open-source firmware efforts exist, utilizing SDKs and camera drivers such as those for the hi704 sensor. Discussions include flash memory dumping, boot log analysis, and attempts to port OpenBK7238 firmware to BK7252 platforms. Additional interest was expressed in integrating SPI-based peripherals like the ATM90E3 three-phase power meter. Documentation and SDKs are partially available but sometimes require login access. The BK7252 is also found in affordable consumer devices, making it a target for firmware extraction and custom development.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT