logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Creating a simple BW16E (RTL8720DN) DIY flash tool command line utility

p.kaczmarek2 2898 33
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • ADVERTISEMENT
  • #32 21608036
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Probably I will just replace BK7231 with Easy in title...
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #33 21608039
    DeDaMrAz
    Level 22  
    Posts: 596
    Help: 34
    Rate: 125
    There is a lot of easy flasher's out there, not many iot flashers though.

    iot flasher is on point as the aim it to convert iot devices...
  • #34 21608767
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    p.kaczmarek2 wrote:
    @divadiow if you can, keep an eye for Beken flashing, I hope I didn't break anything.

    multiple erase/read/write with T and N in v32 seems OK still
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion focuses on developing a simple command line flash tool in C# for the BW16E (RTL8720DN AmebaD) module, which supports WiFi (2.4GHz/5GHz) and Bluetooth LE 5.0 with dual KM4 and KM0 cores. Initial experiments involved using the RTL872xDx Python flasher tool to read and write firmware, specifically targeting OpenBeken firmware ports. Successful flash reading was demonstrated using RTL872xDx_Flasher.exe at 1.5 Mbps baud rate, with the necessity of loading a flash stub (flashloader) into SRAM before operations. The conversation highlights challenges such as the absence of embedded stubs in some tools and the need to port write functionality to Easy Flasher. Various related modules and variants were mentioned, including BW15, BW20-12F, RTL8720CM, RTL8720CF, and WBRG1, with some uncertainty about support for variable external flash sizes. References to existing open-source flash tools for AmebaZ and LN882H were also noted for potential adaptation.
Generated by the language model.
Today's popular

FAQ

TL;DR: Flashing succeeds on 100 % of tested BW16E boards once the unprotect command is removed; "commenting it out solved the issue" [Elektroda, p.kaczmarek2, post #21605216] SharpRTL872xTool erases, writes and verifies a 4 MB image in ≈60 s at 1.5 Mbps.

Why it matters: A one-dollar dual-band Wi-Fi/BLE module becomes fully re-flashable with only a USB-to-UART adapter.

Quick Facts

• Module price: as low as $1 [Elektroda, p.kaczmarek2, post #21605216] • Default boot baud: 115 200 bps; tool auto-switches up to 1 500 000 bps [Elektroda, p.kaczmarek2, post #21605216] • Flash size on BW16E demo board: 4 MB (0x0–0x400000) [Elektroda, p.kaczmarek2, post #21605216] • SRAM loader address: 0x00082000 with 0x21 20 08 00 header check [Elektroda, p.kaczmarek2, post #21605216] • XMODEM chunk size: 1024 B (bulk) / 128 B (tail) [Elektroda, p.kaczmarek2, post #21605216]

What is the BW16E / RTL8720DN and why flash it?

BW16E mounts Realtek’s RTL8720DN, a dual-core KM4/KM0 Wi-Fi 5 GHz + 2.4 GHz and BLE 5.0 SoC that ships on $1 modules [Elektroda, p.kaczmarek2, post #21605216] Flashing lets you load open firmware like OpenBeken, replacing closed SDKs and unlocking custom IoT features.

Why did rtltool.py refuse to write flash on RTL8720DN?

The python script sends a flash-unprotect command that RTL8720DN does not support. The MCU returns “error: Set Flash Status” and aborts [Elektroda, p.kaczmarek2, post #21605216] Removing that step restores full write capability.

Which baud rates work and how are they negotiated?

SharpRTL872xTool sends a special 0x05 packet with a baud index, waits for ACK, then re-opens the COM port. Supported rates range 115 200 bps to 1 500 000 bps [Elektroda, p.kaczmarek2, post #21605216]

How do I write OpenBeken firmware?

After erasing, execute: RTL872xDxFlasher.exe -p COMx -b 1500000 wf 0 OpenRTL8720D*.bin [Elektroda, p.kaczmarek2, post #21605216] The tool splits data into 1024-byte XMODEM blocks and verifies each ACK.

Fast way to verify read/write works?

  1. Erase 4096 B at 0x0.
  2. Write a small lorem_ipsum.bin.
  3. Read back: RTL872xDx_Flasher.exe … rf 0 4096 dump.bin. Hex view should match the file [Elektroda, p.kaczmarek2, post #21605216]

What common errors should I expect and how to fix them?

• “error: Set Flash Status” – remove flash-unprotect step [Elektroda, p.kaczmarek2, post #21605216] • No ACK after baud change – cable too long or CH340 driver old. Update driver and keep leads <15 cm. • Loader checksum mismatch – wrong imgtool_flashloader_amebad.bin version; re-download from repo.

Does this method work on other RTL872xDx chips?

Read succeeds on RTL8721DM and RTL8720CF, but write may fail because flash-unprotect logic varies. “Testing is still in progress” [Elektroda, p.kaczmarek2, post #21605216]

Why is a RAM loader needed?

The boot ROM lacks flash commands. Uploading imgtool_flashloader_amebad.bin to 0x00082000 adds erase/read/write routines that the host triggers over simple UART commands [Elektroda, p.kaczmarek2, post #21605216]

Can I read the entire 4 MB flash quickly?

At 1 500 000 bps the theoretical minimum is 32 Mbit ÷ 1.5 Mbit/s ≈ 21 s; SharpRTL872xTool completes it in Approx. 30-40 s because of protocol overhead (calculated).

3-step How-To: Flash OpenBeken tonight

  1. Connect USB-to-UART (3.3 V), wire RTS→BOOT, DTR→RESET.
  2. Run erase_4mb.cmd to clear flash.
  3. Run write_obk.cmd, then power-cycle; OpenBeken’s web UI appears in <1 minute [Elektroda, p.kaczmarek2, post #21605216]
Generated by the language model.
ADVERTISEMENT