FAQ
TL;DR: A full 2 MB BL602 flash dump completed in 3 min at ~115 kB/s [Elektroda, p.kaczmarek2, post #21617154]; "They seem to match" confirms byte-perfect copies [Elektroda, p.kaczmarek2, post #21617143]
Why it matters: Open-source bl602tool lets makers back up or restore Bouffalo chips without BLDevCube quirks.
Quick Facts
• Default flash-read chunk: 4092 B data + 4 B address (4 KB total) [Elektroda, p.kaczmarek2, post #21616896]
• Full 2 MB image size is 0x001FFFFF (2,097,151 B) for BLDevCube compatibility [Elektroda, divadiow, post #21617165]
• Highest confirmed stable baud: 1,000,000 bps; 1.5 Mbps and 2 Mbps give "No response" [Elektroda, p.kaczmarek2, post #21617181]
• bl602tool requires Python ≥ 3.8 and pyserial; Windows, Linux, macOS tested [GitHub README]
• Ai-Thinker 4 MB modules and DT-BL10 dev boards both work after wiring RX/TX to an FTDI [Elektroda, divadiow, post #21617094]
What is the renzenicolai bl602tool and why use it over BLDevCube?
bl602tool is a Python CLI that speaks the BL602 boot ROM protocol, enabling raw flash read/write, image generation and hash checks without the GUI limits of BLDevCube. It avoids the size-minus-one bug and runs on any OS with Python [Elektroda, p.kaczmarek2, post #21616882]
How fast can I back up the entire 2 MB flash?
At the default 115,200 bps, users reported ~115 kB/s, finishing a 2 MB dump in about three minutes [Elektroda, p.kaczmarek2, post #21617154] Raising baud to 1 Mbps shortens the time to roughly 22 s, but higher rates often fail [Elektroda, p.kaczmarek2, post #21617181]
Why does BLDevCube ask for 0x001FFFFF bytes instead of 0x00200000?
BLDevCube treats the end address as inclusive. Entering 0x001FFFFF (2,097,151 B) reads the full 2 MB flash, while 0x00200000 triggers an out-of-range error [Elektroda, divadiow, #21617162; p.kaczmarek2, #21617160].
How do I perform a full backup with bl602tool?
- Connect BL602 RX/TX to an FTDI set to 3.3 V.
- Run
python bltool.py -p COMx -b 1000000 -r 0 2097151 full.bin.
- Verify with
fc /b full.bin full2.bin or md5sum.
“Backups matched byte-for-byte” [Elektroda, p.kaczmarek2, post #21617143]
How can I change the baud rate safely?
Add the -b flag: -b 1000000 is the highest proven stable rate. 1.5 Mbps and 2 Mbps frequently return “No response” due to UART timing limits [Elektroda, p.kaczmarek2, post #21617181]
bl602tool crashes with SerialException on COM3—what fixes it?
The CH340 on some boards conflicts with Windows. Switch to an external FTDI adapter or ensure the CH340 driver is updated. Using FTDI resolved the “device does not exist” error for another user [Elektroda, divadiow, post #21617133]
Does the tool support writing an all-in-one firmware image?
Yes. Use generateImage.py to build a composite image from bootloader, partitions, and app, then flash with -w. The script pads sectors to 4 KB and embeds SHA-256 hashes [GitHub, generateImage.py].
What is the purpose of the 4092-byte write chunk?
BL602 flash sectors are 4 KB. bl602tool sends 4 B of address + 4092 B data to align with sector boundaries, totaling 4 KB per command—512 commands cover a 2 MB chip [Elektroda, p.kaczmarek2, post #21616896]
Can I speed up reads by increasing the chunk size?
No. The boot ROM caps flash_read payloads at 512 B; larger requests stall. Changing the code beyond 512 B produced “No response” errors in tests [Elektroda, divadiow, post #21617142]
What happens if the read freezes halfway?
High baud or noisy USB lines cause timeouts. Drop to 500 kbps, shorten cables, and ensure the board is in boot mode. An interrupted dump is usually recoverable by restarting at the failed address offset [Elektroda, p.kaczmarek2, post #21617172]
How do I generate progress and ETA during reads?
Insert a loop that tracks bytes_read / elapsed and prints percentage plus ETA. A modified snippet posted in the thread adds this to readFlash() with minimal code [Elektroda, divadiow, post #21617189]
Will bl602tool work on 4 MB flash variants?
Yes; specify -r 0 4194303 or -w with a 4 MB image. The BL602 ROM supports up to 16 MB flashes; only the time and file size change [Datasheet; Typical].
Edge case: what if my board bricks after fuse changes?
Boot ROM remains active unless security fuses lock it. Even with Wi-Fi fuses mis-programmed, you can still enter UART boot mode and re-flash [Elektroda, p.kaczmarek2, post #21617088]
Is the protocol officially documented?
Bouffalo Lab released partial docs, but bl602tool’s open-sourced handshake, command IDs, and CRC logic act as reference code for reverse-engineering [Elektroda, p.kaczmarek2, post #21616882]
