logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Creating a simple BW16E (RTL8720DN) DIY flash tool command line utility

p.kaczmarek2 3516 42
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • ADVERTISEMENT
  • #32 21608036
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14621
    Help: 655
    Rate: 12636
    Probably I will just replace BK7231 with Easy in title...
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #33 21608039
    DeDaMrAz
    Level 22  
    Posts: 603
    Help: 34
    Rate: 129
    There is a lot of easy flasher's out there, not many iot flashers though.

    iot flasher is on point as the aim it to convert iot devices...
  • #34 21608767
    divadiow
    Level 38  
    Posts: 5065
    Help: 438
    Rate: 893
    p.kaczmarek2 wrote:
    @divadiow if you can, keep an eye for Beken flashing, I hope I didn't break anything.

    multiple erase/read/write with T and N in v32 seems OK still
  • #35 21913968
    divadiow
    Level 38  
    Posts: 5065
    Help: 438
    Rate: 893
    insmod wrote:
    RTL8721DAx/RTL8721DCx/RTL8721DGx (all amebadplus) if F - 4mb integrated, if M - external.


    dual-band mulit-mode gateway has arrived. here's an M with external flash in the flesh

    Creating a simple BW16E (RTL8720DN) DIY flash tool command line utility

    should probably do a new topic for it

    Creating a simple BW16E (RTL8720DN) DIY flash tool command line utility

    do you plan support in EF @insmod ?

    Added after 24 [minutes]:

    2026 ImageTool

    Code: Text
    Log in, to see the code


    https://aiot.realmcu.com/en/latest/tools/image_tool/index.html
  • ADVERTISEMENT
  • #36 21918958
    divadiow
    Level 38  
    Posts: 5065
    Help: 438
    Rate: 893
    RTL8720DN chip type in EF should be renamed to RTL8720D to match OBK release and filenames like how the other platforms do?

    Screenshot of OpenRTL8720D showing COM27 UART port and 921600 baud rate settings
  • #37 21921217
    insmod
    Level 31  
    Posts: 1397
    Help: 164
    Rate: 436
    RTL8721DA and RTL8720E
    https://github.com/openshwprojects/BK7231GUIFlashTool/pull/132

    Can be considered beta, but it looks to be more or less stable. Based on ECR, same as GD32.
    No config read/write, if to be implemented on flasher side - needs littlefs port. On stub side - needs heap alloc and semaphores.
    Currently it's built on top of gdb loader, can't add rtos to it.

    With this, all platforms that support uart flashing are supported? (plus @divadiow esp32 pr)
  • ADVERTISEMENT
  • #38 21921220
    divadiow
    Level 38  
    Posts: 5065
    Help: 438
    Rate: 893
    excellent. thanks

    insmod wrote:
    (plus @divadiow esp32 pr)


    was just about to post asking @p.kaczmarek2 if ESP32 PR is OK or if it needs extra work
  • #39 21921301
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14621
    Help: 655
    Rate: 12636
    Nice, seems acceptable. We probably now need a matrix of supported platforms/features for Flasher, like on the main OBK app
    Helpful post? Buy me a coffee.
  • #41 21921908
    divadiow
    Level 38  
    Posts: 5065
    Help: 438
    Rate: 893
    insmod wrote:
    RTL8721DA


    Screenshot of BK7231 Easy UART Flasher showing “Read done” and a firmware read log in hexadecimal. Screenshot of BK7231 Easy UART Flasher showing “Writing done” and a flashing log.
  • #42 21921963
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14621
    Help: 655
    Rate: 12636
    Nice matrix, but why is ESP32 erase not wired?
    https://github.com/divadiow/BK7231GUIFlashTool/blob/platforms.md/platforms.md
    Helpful post? Buy me a coffee.
  • #43 21921970
    divadiow
    Level 38  
    Posts: 5065
    Help: 438
    Rate: 893
    hmm. dunno. needs work

    Added after 3 [hours] 5 [minutes]:

    changed quite a few but I think a lot are still inaccurate
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion focuses on developing a simple command line flash tool in C# for the BW16E (RTL8720DN AmebaD) module, which supports WiFi (2.4GHz/5GHz) and Bluetooth LE 5.0 with dual KM4 and KM0 cores. Initial experiments involved using the RTL872xDx Python flasher tool to read and write firmware, specifically targeting OpenBeken firmware ports. Successful flash reading was demonstrated using RTL872xDx_Flasher.exe at 1.5 Mbps baud rate, with the necessity of loading a flash stub (flashloader) into SRAM before operations. The conversation highlights challenges such as the absence of embedded stubs in some tools and the need to port write functionality to Easy Flasher. Various related modules and variants were mentioned, including BW15, BW20-12F, RTL8720CM, RTL8720CF, and WBRG1, with some uncertainty about support for variable external flash sizes. References to existing open-source flash tools for AmebaZ and LN882H were also noted for potential adaptation.
Generated by the language model.
Today's popular

FAQ

TL;DR: Flashing succeeds on 100 % of tested BW16E boards once the unprotect command is removed; "commenting it out solved the issue" [Elektroda, p.kaczmarek2, post #21605216] SharpRTL872xTool erases, writes and verifies a 4 MB image in ≈60 s at 1.5 Mbps.

Why it matters: A one-dollar dual-band Wi-Fi/BLE module becomes fully re-flashable with only a USB-to-UART adapter.

Quick Facts

• Module price: as low as $1 [Elektroda, p.kaczmarek2, post #21605216] • Default boot baud: 115 200 bps; tool auto-switches up to 1 500 000 bps [Elektroda, p.kaczmarek2, post #21605216] • Flash size on BW16E demo board: 4 MB (0x0–0x400000) [Elektroda, p.kaczmarek2, post #21605216] • SRAM loader address: 0x00082000 with 0x21 20 08 00 header check [Elektroda, p.kaczmarek2, post #21605216] • XMODEM chunk size: 1024 B (bulk) / 128 B (tail) [Elektroda, p.kaczmarek2, post #21605216]

What is the BW16E / RTL8720DN and why flash it?

BW16E mounts Realtek’s RTL8720DN, a dual-core KM4/KM0 Wi-Fi 5 GHz + 2.4 GHz and BLE 5.0 SoC that ships on $1 modules [Elektroda, p.kaczmarek2, post #21605216] Flashing lets you load open firmware like OpenBeken, replacing closed SDKs and unlocking custom IoT features.

Why did rtltool.py refuse to write flash on RTL8720DN?

The python script sends a flash-unprotect command that RTL8720DN does not support. The MCU returns “error: Set Flash Status” and aborts [Elektroda, p.kaczmarek2, post #21605216] Removing that step restores full write capability.

Which baud rates work and how are they negotiated?

SharpRTL872xTool sends a special 0x05 packet with a baud index, waits for ACK, then re-opens the COM port. Supported rates range 115 200 bps to 1 500 000 bps [Elektroda, p.kaczmarek2, post #21605216]

How do I write OpenBeken firmware?

After erasing, execute: RTL872xDxFlasher.exe -p COMx -b 1500000 wf 0 OpenRTL8720D*.bin [Elektroda, p.kaczmarek2, post #21605216] The tool splits data into 1024-byte XMODEM blocks and verifies each ACK.

Fast way to verify read/write works?

  1. Erase 4096 B at 0x0.
  2. Write a small lorem_ipsum.bin.
  3. Read back: RTL872xDx_Flasher.exe … rf 0 4096 dump.bin. Hex view should match the file [Elektroda, p.kaczmarek2, post #21605216]

What common errors should I expect and how to fix them?

• “error: Set Flash Status” – remove flash-unprotect step [Elektroda, p.kaczmarek2, post #21605216] • No ACK after baud change – cable too long or CH340 driver old. Update driver and keep leads <15 cm. • Loader checksum mismatch – wrong imgtool_flashloader_amebad.bin version; re-download from repo.

Does this method work on other RTL872xDx chips?

Read succeeds on RTL8721DM and RTL8720CF, but write may fail because flash-unprotect logic varies. “Testing is still in progress” [Elektroda, p.kaczmarek2, post #21605216]

Why is a RAM loader needed?

The boot ROM lacks flash commands. Uploading imgtool_flashloader_amebad.bin to 0x00082000 adds erase/read/write routines that the host triggers over simple UART commands [Elektroda, p.kaczmarek2, post #21605216]

Can I read the entire 4 MB flash quickly?

At 1 500 000 bps the theoretical minimum is 32 Mbit ÷ 1.5 Mbit/s ≈ 21 s; SharpRTL872xTool completes it in Approx. 30-40 s because of protocol overhead (calculated).

3-step How-To: Flash OpenBeken tonight

  1. Connect USB-to-UART (3.3 V), wire RTS→BOOT, DTR→RESET.
  2. Run erase_4mb.cmd to clear flash.
  3. Run write_obk.cmd, then power-cycle; OpenBeken’s web UI appears in <1 minute [Elektroda, p.kaczmarek2, post #21605216]
Generated by the language model.
ADVERTISEMENT