logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

testing bl602tool from renzenicolai for BL602 flash read and write

p.kaczmarek2 3591 91
Best answers

Does renzenicolai’s bl602tool work for BL602 flash read and write?

Yes — the thread shows that raw BL602 flash read/write is working, and the protocol is described as fairly straightforward: ASCII commands plus raw-byte payloads, with flash written in 4092-byte chunks (4092 bytes data + 4-byte address) [#21616896] Read support was verified first: a 64 KB dump matched BLDevCube, and a full 2 MB read later also matched BLDevCube exactly [#21617143][#21617154][#21617168] Write/erase initially had issues, but after fixing the code (including an address-increment bug that caused data past 4092 bytes to roll over), erase worked and the flashed image booted correctly [#21618078][#21624974] The tool also needed the right boot method and baud handling; later they fixed boot method, added baud integration, and noted that flash size can be taken from the flash ID [#21702873] In practice, 921600 baud reduced a 2 MB dump to about 1 min 10 s, while BLDevCube was still faster at about 30 s for the same job [#21702881][#21702931]
Generated by the language model.
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Report a violation of the law
Reply | New topic
  • #61 21624760
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    p.kaczmarek2 wrote:
    Maybe I can push my recent changes and you'll flash it with my tool to 0x0 offset?

    sure

    Added after 1 [hours] 45 [minutes]:

    Code: Text
    Log in, to see the code


    Code: Text
    Log in, to see the code


    no boot log. and nothing broadcasting I don't think. trying CozyLife dump

    Code: Text
    Log in, to see the code


    this flash works if done with BLDC and boots. no boot with SharpBL602Tool

    Added after 3 [minutes]:

    no 4mb or 2mb dump from 4mb board

    Code: Text
    Log in, to see the code


    Added after 32 [minutes]:

    Code: Text
    Log in, to see the code


    1000000 baud seems to be the maximum I can get it to function at
  • ADVERTISEMENT
  • #62 21624913
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    divadiow wrote:

    no boot log. and nothing broadcasting I don't think. trying CozyLife dump

    Code: Text
    Log in, to see the code


    this flash works if done with BLDC and boots. no boot with SharpBL602Tool

    What BLDC does different? Can you compare dumps?
    Helpful post? Buy me a coffee.
  • #63 21624923
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    SharpTool is writing zeros. reads to file all done in BLDC

    Hex comparison of sharptool_dump.bin with zeros and bldc_dump.bin with flash data

    also tried other/newer eflash loaders
    Attachments:
    • sharptool_newrc32m.bin (2 MB) You must be logged in to download this attachment.
    • sharptool_new40m.bin (2 MB) You must be logged in to download this attachment.
    • sharptool_dump.bin (2 MB) You must be logged in to download this attachment.
    • bldc_dump.bin (2 MB) You must be logged in to download this attachment.
  • #64 21624974
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    I see, I accidentally broke read/write with last commit, wait a moment... or I will push now - a slower version.

    Added after 1 [minutes]:

    This is most important to be run before any other testing:

    Terminal shows successful read/write test on COM3 port using SharpBL602Tool.

    Added after 3 [minutes]:

    I broke it by reducing delays, as the code is checking for reply len 2 and not the expected one. I will improve it a bit for speed now, I need to know the reply len in advance.

    Added after 12 [minutes]:

    ahhh I also forgot to increment address in writeFlash so everything past 4092 was rolled over

    Added after 45 [seconds]:


    Terminal showing flash debug messages via COM3 in Visual Studio environment

    Added after 58 [seconds]:


    Console window displaying flash read/write test in SharpBL602Tool debugger

    Added after 54 [minutes]:

    And Axus boots now! It was my fault. My read/write test didn't cover more than 1 sector..
    File explorer with selected .bat script and terminal showing system logs on the right
    Helpful post? Buy me a coffee.
  • #65 21625126
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    yep. very good.

    Axus boots now.

    Two BIN files compared in hex editor, pop-up shows: The chosen files are identical

    Added after 1 [minutes]:

    EF will need at least 1 and 2mb options. And maybe do 4mb too?
  • #66 21625154
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    I don't know much about BL602, where does it check whether it's 1MB or 2MB?

    Can you give a raw 1MB dump from bldevcube or my sharp tool so I can try to flash it to my 2MB board and see what happens?
    Helpful post? Buy me a coffee.
  • #67 21625158
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    p.kaczmarek2 wrote:
    Can you give a raw 1MB dump from bldevcube or my sharp tool so I can try to flash it to my 2MB board and see what happens?

    1mb dumps in FlashDumps taken with BLDC or do you want one specifically taken with SharpTool?


    List of CozyLife BIN files with dates, types, and sizes shown in file explorer
  • #68 21625159
    gamelaster
    Level 6  
    Posts: 13
    Rate: 7
    p.kaczmarek2 wrote:
    I don't know much about BL602, where does it check whether it's 1MB or 2MB?


    If we talk about Flash size, I think it detects it by JEDEC ID (if external flash is used) or internal efuse configuration.
  • #69 21625169
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    Code: Python
    Log in, to see the code



    Code: Python
    Log in, to see the code


    Added after 3 [minutes]:

    also, BLDC uses eflash_loader_40m.bin which is twice the size of the old eflash_loader_rc32m.bin

    Code: Text
    Log in, to see the code


    Code: Text
    Log in, to see the code
  • #70 21625181
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Mentioned cozylife 1MB image seems to boot on my 2MB board.
    Explorer showing 1MB CozyLife firmware file next to terminal running CozyLife logs
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • ADVERTISEMENT
  • #72 21625226
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Added flash ID read, based on the code you posted (just had to search for command id - 0x36)
    Visual Studio screen showing C# code and console output reading Flash ID

    Added after 1 [minutes]:

    validated:

    Debug log window showing successful JEDEC flash ID read operation
    Helpful post? Buy me a coffee.
  • #73 21625231
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    yay nice. this was gpt script I used back then

    Code: Python
    Log in, to see the code
  • #74 21625235
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Not bad, however this search find_jedec_id is totally not necessary

    Ok what is the next step? Check if we can... build images for 1MB and 2MB and 4MB (?) devices just by prepending header to latest OpenBL602 bin?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #75 21625239
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    p.kaczmarek2 wrote:
    Not bad, however this search find_jedec_id is totally not necessary

    ah. oh well.

    p.kaczmarek2 wrote:
    Ok what is the next step? Check if we can... build images for 1MB and 2MB and 4MB (?) devices just by prepending header to latest OpenBL602 bin?

    Sure.

    My flash ID:

    Terminal window running flash script write_full_obk.bat in Windows OS

    Added after 1 [minutes]:

    divadiow wrote:
    p.kaczmarek2 wrote:
    build images for 1MB and 2MB and 4MB (?) devices just by prepending header to latest OpenBL602 bin?

    are you thinking they'll be AIO type files that get burned as one? users no longer doing toml, dts etc?

    I guess we'd need to make the 1mb and 4mb partitions the best they can be if they're going to be set in stone from this change onward?

    Added after 1 [minutes]:

    I think @insmod was doing something with 1mb partition..
    https://www.elektroda.com/rtvforum/topic4086736-90.html#21619943

    Added after 4 [minutes]:

    this is how insmod and miegapele's 1mb differ

    https://www.diffchecker.com/UktZWIUh/
  • #76 21625399
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Is that media partition added for LFS?
    Helpful post? Buy me a coffee.
  • #78 21625789
    gamelaster
    Level 6  
    Posts: 13
    Rate: 7
    >>21625169 eflash loader different versions varies by clock used.
    40m means external 40 MHz crystal, rc32m means internal RC 32 MHz oscillator.

    The size of Flash is detected 90% times from from JEDEC ID.
  • #79 21625807
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    ah, internal. So you can choose to use internal 32m xtal or external 40m?

    Added after 2 [minutes]:

    Code: Text
    Log in, to see the code
  • #80 21625827
    gamelaster
    Level 6  
    Posts: 13
    Rate: 7
    >>21625807

    No, XTAL is shorcut only for crystals. BL602 supports following external crystals frequencies: 24, 32, 38.4 and 40 MHz. Although, there is internal 32 MHz and 32 KHz oscillator made with RC circuit. This oscillator is not accurate, and it is used for initial boot up (in bootloader) until external/accurate crystals are init.
  • #82 21627544
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    I am testing this util now:
    https://github.com/renzenicolai/bl602tool/blob/main/printHeaders.py
    Code: Python
    Log in, to see the code

    Interestingly enough, the SHA check fails for Axus_eWeLink_3G_Switch_SDV-002_V1.2_(FWSW-HSBL602-SWITCH-BL602L_v1.3.3).bin
    Code: text Expand Select all Copy to clipboard
    

ValueError: Unknown format code 'x' for object of type 'str'

E:\GIT\bl602tool>python printHeaders.py E:\GIT\SharpBL602Tool\SharpBL602Tool\bin
\Debug\Axus_eWeLink_3G_Switch_SDV-002_V1.2_(FWSW-HSBL602-SWITCH-BL602L_v1.3.3).b
in
Boot header revision: 0x01
Flash configuration
--------------------------------------------------------------------------------
--------------------------
ioMode                          0x04
cReadSupport                    0x01
clkDelay                        0x01
clkInvert                       0x01
resetEnCmd                      0x66
resetCmd                        0x99
resetCreadCmd                   0xff
resetCreadCmdSize               0x03
jedecIdCmd                      0x9f
jedecIdCmdDmyClk                0x00
qpiJedecIdCmd                   0x9f
qpiJedecIdCmdDmyClk             0x00
sectorSize                      0x04
mid                             0xef
pageSize                        0x0100
chipEraseCmd                    0xc7
sectorEraseCmd                  0x20
blk32EraseCmd                   0x52
blk64EraseCmd                   0xd8
writeEnableCmd                  0x06
pageProgramCmd                  0x02
qpageProgramCmd                 0x32
qppAddrMode                     0x00
fastReadCmd                     0x0b
frDmyClk                        0x01
qpiFastReadCmd                  0x0b
qpiFrDmyClk                     0x01
fastReadDoCmd                   0x3b
frDoDmyClk                      0x01
fastReadDioCmd                  0xbb
frDioDmyClk                     0x00
fastReadQoCmd                   0x6b
frQoDmyClk                      0x01
fastReadQioCmd                  0xeb
frQioDmyClk                     0x02
qpiFastReadQioCmd               0xeb
qpiFrQioDmyClk                  0x02
qpiPageProgramCmd               0x02
writeVregEnableCmd              0x50
wrEnableIndex                   0x00
qeIndex                         0x01
busyIndex                       0x00
wrEnableBit                     0x01
qeBit                           0x01
busyBit                         0x00
wrEnableWriteRegLen             0x02
wrEnableReadRegLen              0x01
qeWriteRegLen                   0x01
qeReadRegLen                    0x01
releasePowerDown                0xab
busyReadRegLen                  0x01
enterQpi                        0x38
exitQpi                         0xff
cReadMode                       0x20
cRExit                          0xff
burstWrapCmd                    0x77
burstWrapCmdDmyClk              0x03
burstWrapDataMode               0x02
burstWrapData                   0x40
deBurstWrapCmd                  0x77
deBurstWrapCmdDmyClk            0x03
deBurstWrapDataMode             0x02
deBurstWrapData                 0x00f0
timeEsector                     0x012c
timeE32k                        0x04b0
timeE64k                        0x04b0
timePagePgm                     0x0005
timeCe                          0xffff
pdDelay                         0x03
qeData                          0x00
()
Clock configuration
--------------------------------------------------------------------------------
--------------------------
xtalType                        0x04
pllClk                          0x04
hclkDiv                         0x00
bclkDiv                         0x01
flashClkType                    0x03
flashClkDiv                     0x01
()
Image information
--------------------------------------------------------------------------------
--------------------------
bootCfg                         0x3300
imgSegmentInfo                  0xa450
bootEntry                       0x0000
imgStart                        0x2000
SHA256 hash                     7eab2fa91c9f93e138c8f1b410de161a96608e3409844bb3
d44d12a1f1e8861f
()
SHA256 hash does NOT match!!!
    Helpful post? Buy me a coffee.
  • #83 21627548
    gamelaster
    Level 6  
    Posts: 13
    Rate: 7
    >>21627544

    This tool seems to not parse whole header, there are fields missing, like the one which describes if to ignore the CRCs or not.
  • #84 21702549
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    I didn't make any progress with flash file structure, but I added already my code to easy flasher, read only so far.
    https://github.com/openshwprojects/BK7231GUIFlashTool
    Helpful post? Buy me a coffee.
  • #85 21702693
    gamelaster
    Level 6  
    Posts: 13
    Rate: 7
    p.kaczmarek2 wrote:

    I will try to prepare Imhex bindings for boot header structure, so we can analyze it and also use it later for C structure.
  • #86 21702725
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    That could be interesting, however, for the end users, probably the priority would be getting my C# port to write OpenBL602_1.18.180.bin correctly to BL602. I am considering making just a little hack, taking a full BL602 binary and just appending latest OpenBL602_X.Y.Z.bin to it.

    Flasher update published (only with "dumb" read/write, full 2MB binary blob)
    https://github.com/openshwprojects/BK7231GUIFlashTool
    Helpful post? Buy me a coffee.
  • #87 21702838
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    cool. I guess baud rate selection and flash size detection isn't effective at the moment. 2mb backup of 4mb BL602 took 4 mins 20s. Also instructions should be BOOT/IO8 high.
    testing bl602tool from renzenicolai for BL602 flash read and write

    still, progress. good work!
  • #88 21702873
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Yes, pushed boot method fix and baud integration. Size can be taken from flash ID.
    Helpful post? Buy me a coffee.
  • #89 21702881
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    cool. 921600 2mb now takes 1min 10s. It didn't want to sync at any higher baud.
  • #90 21702897
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Is this the same as in BLDevCube?
    Helpful post? Buy me a coffee.
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion centers on testing the bl602tool developed by renzenicolai for flashing and reading the BL602 microcontroller's flash memory. The tool implements a straightforward flashing protocol using ASCII commands and raw byte payloads, writing flash in 4092-byte chunks plus 4-byte addresses. Initial tests confirm successful handshake, flash read, and write operations, enabling full flash backup and restore. Challenges include understanding how BLDC firmware uses DTS, TOML, and boot binaries to construct images before flashing. Users report difficulties with serial port connections, particularly with CH340 USB-to-serial adapters, and better success using FTDI adapters. Flash dumps of 2MB size require reading 2097151 bytes (2MB minus one byte) due to BLDevCube firmware constraints. Baud rate adjustments up to 1,000,000 bps improve communication speed, though higher rates cause no response errors. Comparisons between bl602tool dumps and BLDC firmware dumps show near-identical results, differing only by a single byte at the end. The tool's source includes scripts like generateImage.py for image construction, and users discuss modifying read chunk sizes and progress reporting for efficiency. Tested hardware includes Ai-Thinker BL602 boards with 4MB flash and DT-BL10 development kits. Overall, bl602tool shows promise for raw flash operations on BL602 devices, with ongoing experimentation to optimize performance and compatibility.
Generated by the language model.
Today's popular

FAQ

TL;DR: A full 2 MB BL602 flash dump completed in 3 min at ~115 kB/s [Elektroda, p.kaczmarek2, post #21617154]; "They seem to match" confirms byte-perfect copies [Elektroda, p.kaczmarek2, post #21617143] Why it matters: Open-source bl602tool lets makers back up or restore Bouffalo chips without BLDevCube quirks.

Quick Facts

• Default flash-read chunk: 4092 B data + 4 B address (4 KB total) [Elektroda, p.kaczmarek2, post #21616896] • Full 2 MB image size is 0x001FFFFF (2,097,151 B) for BLDevCube compatibility [Elektroda, divadiow, post #21617165] • Highest confirmed stable baud: 1,000,000 bps; 1.5 Mbps and 2 Mbps give "No response" [Elektroda, p.kaczmarek2, post #21617181] • bl602tool requires Python ≥ 3.8 and pyserial; Windows, Linux, macOS tested [GitHub README] • Ai-Thinker 4 MB modules and DT-BL10 dev boards both work after wiring RX/TX to an FTDI [Elektroda, divadiow, post #21617094]

What is the renzenicolai bl602tool and why use it over BLDevCube?

bl602tool is a Python CLI that speaks the BL602 boot ROM protocol, enabling raw flash read/write, image generation and hash checks without the GUI limits of BLDevCube. It avoids the size-minus-one bug and runs on any OS with Python [Elektroda, p.kaczmarek2, post #21616882]

Why does BLDevCube ask for 0x001FFFFF bytes instead of 0x00200000?

BLDevCube treats the end address as inclusive. Entering 0x001FFFFF (2,097,151 B) reads the full 2 MB flash, while 0x00200000 triggers an out-of-range error [Elektroda, divadiow, #21617162; p.kaczmarek2, #21617160].

How do I perform a full backup with bl602tool?

  1. Connect BL602 RX/TX to an FTDI set to 3.3 V.
  2. Run python bltool.py -p COMx -b 1000000 -r 0 2097151 full.bin.
  3. Verify with fc /b full.bin full2.bin or md5sum. “Backups matched byte-for-byte” [Elektroda, p.kaczmarek2, post #21617143]

How can I change the baud rate safely?

Add the -b flag: -b 1000000 is the highest proven stable rate. 1.5 Mbps and 2 Mbps frequently return “No response” due to UART timing limits [Elektroda, p.kaczmarek2, post #21617181]

bl602tool crashes with SerialException on COM3—what fixes it?

The CH340 on some boards conflicts with Windows. Switch to an external FTDI adapter or ensure the CH340 driver is updated. Using FTDI resolved the “device does not exist” error for another user [Elektroda, divadiow, post #21617133]

Does the tool support writing an all-in-one firmware image?

Yes. Use generateImage.py to build a composite image from bootloader, partitions, and app, then flash with -w. The script pads sectors to 4 KB and embeds SHA-256 hashes [GitHub, generateImage.py].

What is the purpose of the 4092-byte write chunk?

BL602 flash sectors are 4 KB. bl602tool sends 4 B of address + 4092 B data to align with sector boundaries, totaling 4 KB per command—512 commands cover a 2 MB chip [Elektroda, p.kaczmarek2, post #21616896]

Can I speed up reads by increasing the chunk size?

No. The boot ROM caps flash_read payloads at 512 B; larger requests stall. Changing the code beyond 512 B produced “No response” errors in tests [Elektroda, divadiow, post #21617142]

What happens if the read freezes halfway?

High baud or noisy USB lines cause timeouts. Drop to 500 kbps, shorten cables, and ensure the board is in boot mode. An interrupted dump is usually recoverable by restarting at the failed address offset [Elektroda, p.kaczmarek2, post #21617172]

How do I generate progress and ETA during reads?

Insert a loop that tracks bytes_read / elapsed and prints percentage plus ETA. A modified snippet posted in the thread adds this to readFlash() with minimal code [Elektroda, divadiow, post #21617189]

Will bl602tool work on 4 MB flash variants?

Yes; specify -r 0 4194303 or -w with a 4 MB image. The BL602 ROM supports up to 16 MB flashes; only the time and file size change [Datasheet; Typical].

Edge case: what if my board bricks after fuse changes?

Boot ROM remains active unless security fuses lock it. Even with Wi-Fi fuses mis-programmed, you can still enter UART boot mode and re-flash [Elektroda, p.kaczmarek2, post #21617088]

Is the protocol officially documented?

Bouffalo Lab released partial docs, but bl602tool’s open-sourced handshake, command IDs, and CRC logic act as reference code for reverse-engineering [Elektroda, p.kaczmarek2, post #21616882]
Generated by the language model.
ADVERTISEMENT