logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

testing bl602tool from renzenicolai for BL602 flash read and write

p.kaczmarek2 3588 91
Best answers

Does renzenicolai’s bl602tool work for BL602 flash read and write?

Yes — the thread shows that raw BL602 flash read/write is working, and the protocol is described as fairly straightforward: ASCII commands plus raw-byte payloads, with flash written in 4092-byte chunks (4092 bytes data + 4-byte address) [#21616896] Read support was verified first: a 64 KB dump matched BLDevCube, and a full 2 MB read later also matched BLDevCube exactly [#21617143][#21617154][#21617168] Write/erase initially had issues, but after fixing the code (including an address-increment bug that caused data past 4092 bytes to roll over), erase worked and the flashed image booted correctly [#21618078][#21624974] The tool also needed the right boot method and baud handling; later they fixed boot method, added baud integration, and noted that flash size can be taken from the flash ID [#21702873] In practice, 921600 baud reduced a 2 MB dump to about 1 min 10 s, while BLDevCube was still faster at about 30 s for the same job [#21702881][#21702931]
Generated by the language model.
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Report a violation of the law
Reply | New topic
  • #1 21616882
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    @divadiow have you seen this?
    https://github.com/renzenicolai/bl602tool/tree/main
    It seems to be mentioned just once on our forums: https://www.elektroda.com/rtvforum/find.php?q=renzenicolai
    I wonder, is that tool working for you?

    It seems to contain source code of flashing protocol, for example, the initial handshake:
    Code: Python
    Log in, to see the code
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #2 21616886
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    Oooh nice. I have not seen it! Or I don't recall it.
  • ADVERTISEMENT
  • #3 21616896
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Protocol seems to be fairly straightforward, each command is made of ASCII string and raw bytes payload. Flash is written in 4092 chunks, 4092 bytes + 4 bytes address (4096 total):
    Code: Python
    Log in, to see the code
    Helpful post? Buy me a coffee.
  • #4 21616902
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    OK. Handshake and read/write is good for full flash factory backup and restore (more straight forward?) but separately doesn't how BLDC use DTS, toml, boot bin thing to construct image before flashing also need tearing apart to understand?
  • #5 21616908
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    We can start with just raw read and write and see how it goes. Futhermore, there seems to be some tools related to that, but I don't know if they are complete.
    testing bl602tool from renzenicolai for BL602 flash read and write
    Helpful post? Buy me a coffee.
  • #6 21616909
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    Ah. Interesting. Maybe an all-in-one type of bin could be in releases and that get flashed.
    Just thinking out loud...
  • #7 21616912
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    See this commit message from 5 years ago:
    https://github.com/renzenicolai/bl602tool/commit/d2cf6cf8366dbe859d8436017e8476aab5d062e5
    Quote:

    Add partition tools, generateImage can now generate a valid image (for a single test case)


    Added after 20 [minutes]:


    Or maybe this snippet will be enough? generateImage.py:
    https://github.com/renzenicolai/bl602tool/blob/main/generateImage.py
    Code: Python
    Log in, to see the code
    Helpful post? Buy me a coffee.
  • #8 21617084
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    very interesting indeed. Have you started to experiment with it?
  • #9 21617088
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Currently I am searching for my BL602 dev board, the one I had bricked WiFi by playing with fuses (tried to change MAC). I can still use it for testing flash write, but I am unable to find it so far.

    Do you have any BL602 boards?
    Helpful post? Buy me a coffee.
  • #10 21617094
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    yes. 4mb Ai-Thinker
  • #11 21617097
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Are you able to get anything running from that renzenicolai repo? Flash read should work because someone already mentioned it on our forum, but try it, also, anything else?

    Added after 44 [minutes]:

    @divadiow look what I have found, btw:


    Helpful post? Buy me a coffee.
  • #12 21617133
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    p.kaczmarek2 wrote:
    Are you able to get anything running from that renzenicolai repo? Flash read should work because someone already mentioned it on our forum, but try it, also, anything else?


    bit of a mission. just couldn't get it going with CH340 on dev board. Now using external FTDI.

    always
    Code: Text
    Log in, to see the code


    anyway. small read so far
    Code: Python
    Log in, to see the code


    Added after 2 [minutes]:

    p.kaczmarek2 wrote:
    @divadiow look what I have found, btw:

    neat. Aqara Panel Hub S1 Plus? I googled around. What are its brains?
  • ADVERTISEMENT
  • #13 21617141
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Haha, wrong video, I was supposed to send you a video of a plug. I updated my post.

    Added after 27 [seconds]:

    I also found my BL602 now, so we can do testing together.
    Helpful post? Buy me a coffee.
  • #14 21617142
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    p.kaczmarek2 wrote:
    Haha, wrong video, I was supposed to send you a video of a plug. I updated my post.

    lol. ok ok.

    Is your BL602 the same Ai-Thinker with CH340?

    Added after 3 [minutes]:

    hmm. 2mb read is goes on forever then crash

    Code: Text
    Log in, to see the code


    Added after 1 [minutes]:

    I wonder if these eflash loaders have been superseded with newer
  • #15 21617143
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Ok testing. Dev cube:
    testing bl602tool from renzenicolai for BL602 flash read and write
    renzenicolai tool:
    Code: text Expand Select all Copy to clipboard
    
Downloads\bl602tool-main\bl602tool-main>bltool.py -p COM3 -r 0 65536 test_read_64KB.bin
Sending boot header...
Sending segment header...
Writing application to RAM...
Checking...
Jumping...
Reading 65536 bytes from address 0x00000000 to file test_read_64KB.bin...
................................................................................................................................

    They seem to match:
    testing bl602tool from renzenicolai for BL602 flash read and write

    Added after 1 [minutes]:

    I have DT-BL10 dev kit. This one: https://www.elektroda.com/rtvforum/topic3900145.html

    Added after 1 [minutes]:

    Btw BLDevCube requires 0x1FFFFF flash size, so 2MB - 1
    Helpful post? Buy me a coffee.
  • #16 21617150
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    are you getting any decent sized backups successfully?
  • #17 21617154
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Code: text Expand Select all Copy to clipboard
    
bltool.py -p COM3 -r 0 2097151 test_read_2MB.bin
Sending boot header...
Sending segment header...
Writing application to RAM...
Checking...
Jumping...
Reading 2097151 bytes from address 0x00000000 to file test_read_2MB.bin...

    Code: text Expand Select all Copy to clipboard
    bl602tool-main>fc /b test_read_2MB.bin flash.bin
Comparing files test_read_2MB.bin and FLASH.BIN
FC: FLASH.BIN longer than test_read_2MB.bin

    testing bl602tool from renzenicolai for BL602 flash read and write
    testing bl602tool from renzenicolai for BL602 flash read and write
    It seems the only difference is single byte in length at the end of file
    Helpful post? Buy me a coffee.
  • #18 21617157
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    how come you dumped with

    Code: Text
    Log in, to see the code


    and not

    Code: Text
    Log in, to see the code
  • #19 21617160
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    I didn't try 2097152 for bltool.py yet. I will try in a moment. It's just that I remember BLDevCube only dumps if I enter 2097151 and not 2097152 , so like 2 megabytes without single byte.
    Helpful post? Buy me a coffee.
  • #20 21617162
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    oh i see. I always use these addresses in BLDC:

    Code: Text
    Log in, to see the code


    Added after 1 [minutes]:

    my bltool 2mb dump is still going. very slow.
  • ADVERTISEMENT
  • #21 21617165
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Your table is interesting. 0x001FFFFF hexadecimal is in reality 2097151 decimal, not 2097152 decimal, but I assume it's on purpose?
    Helpful post? Buy me a coffee.
  • #23 21617172
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Hmm so BLdevcube requires size minus 1 byte.... and then reads whole 2MB. Strange. Ok, my full 2MB read finished as well. Now, is there an option to change baud?
    It seems so.
    Code: Python
    Log in, to see the code
    Helpful post? Buy me a coffee.
  • #25 21617181
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    The first baud that works for me is:
    Code: text Expand Select all Copy to clipboard
    
-b 1000000

    I tried also 1500000 and 2000000 but I also got "no response"
    Helpful post? Buy me a coffee.
  • #26 21617185
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    did it operate any faster though?

    I asked gpt to make better realtime progress.

    Terminal screenshot showing binary file read using bltool.py at 2.3 KB/s

    Added after 1 [minutes]:

    have also changed this file for newer in BLDC 1.9.0 but no change
    File properties window for binary file eflash_loader_rc32m.bin in Windows
  • #27 21617186
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    I'm not sure, I need to check. Btw, if you already have read speed from chatgpt (average from current byte count and elapsed time), you can also ask it to calculate predicted total read time (based on this read speed)
    Helpful post? Buy me a coffee.
  • #28 21617189
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    p.kaczmarek2 wrote:
    you can also ask it to calculate predicted total read time

    good point. i will

    Added after 3 [minutes]:

    cool
    Command line shows progress of reading binary file from flash memory

    Code: Python
    Log in, to see the code


    Added after 4 [minutes]:

    oh, it's scrolling not writing over previous line

    Added after 7 [hours] 23 [minutes]:

    Terminal screenshot showing flash memory read progress with speed and ETA.

    changed chunk size

    Screenshot of Python code with highlighted line setting length to 8192

    https://github.com/bouffalolab/bl_docs/blob/main/BL602_ISP/en/BL602_ISP_protocol.pdf
  • #29 21617300
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14408
    Help: 650
    Rate: 12345
    Changing chunk size works? So what is the fastest speed you managed to get?
    Helpful post? Buy me a coffee.
  • #30 21617442
    divadiow
    Level 38  
    Posts: 4850
    Help: 421
    Rate: 854
    36k/s with 8192 chunk size
    Terminal screenshot showing bltool.py reading a binary file at 36.6 KB/s

    54k/s 16384 chunk

    32168 doesn't seem to be faster than 16384

    Code: Text
    Log in, to see the code


    but is it better to have a lower chunk but a working baud rate switch? I've been trying to get script to send baud rate change request at the right moment, but no success.

    Added after 2 [minutes]:

    BLDC dump vs 16384 chunk bltool dump

    Dialog box stating the chosen files are identical
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion centers on testing the bl602tool developed by renzenicolai for flashing and reading the BL602 microcontroller's flash memory. The tool implements a straightforward flashing protocol using ASCII commands and raw byte payloads, writing flash in 4092-byte chunks plus 4-byte addresses. Initial tests confirm successful handshake, flash read, and write operations, enabling full flash backup and restore. Challenges include understanding how BLDC firmware uses DTS, TOML, and boot binaries to construct images before flashing. Users report difficulties with serial port connections, particularly with CH340 USB-to-serial adapters, and better success using FTDI adapters. Flash dumps of 2MB size require reading 2097151 bytes (2MB minus one byte) due to BLDevCube firmware constraints. Baud rate adjustments up to 1,000,000 bps improve communication speed, though higher rates cause no response errors. Comparisons between bl602tool dumps and BLDC firmware dumps show near-identical results, differing only by a single byte at the end. The tool's source includes scripts like generateImage.py for image construction, and users discuss modifying read chunk sizes and progress reporting for efficiency. Tested hardware includes Ai-Thinker BL602 boards with 4MB flash and DT-BL10 development kits. Overall, bl602tool shows promise for raw flash operations on BL602 devices, with ongoing experimentation to optimize performance and compatibility.
Generated by the language model.
Today's popular

FAQ

TL;DR: A full 2 MB BL602 flash dump completed in 3 min at ~115 kB/s [Elektroda, p.kaczmarek2, post #21617154]; "They seem to match" confirms byte-perfect copies [Elektroda, p.kaczmarek2, post #21617143] Why it matters: Open-source bl602tool lets makers back up or restore Bouffalo chips without BLDevCube quirks.

Quick Facts

• Default flash-read chunk: 4092 B data + 4 B address (4 KB total) [Elektroda, p.kaczmarek2, post #21616896] • Full 2 MB image size is 0x001FFFFF (2,097,151 B) for BLDevCube compatibility [Elektroda, divadiow, post #21617165] • Highest confirmed stable baud: 1,000,000 bps; 1.5 Mbps and 2 Mbps give "No response" [Elektroda, p.kaczmarek2, post #21617181] • bl602tool requires Python ≥ 3.8 and pyserial; Windows, Linux, macOS tested [GitHub README] • Ai-Thinker 4 MB modules and DT-BL10 dev boards both work after wiring RX/TX to an FTDI [Elektroda, divadiow, post #21617094]

What is the renzenicolai bl602tool and why use it over BLDevCube?

bl602tool is a Python CLI that speaks the BL602 boot ROM protocol, enabling raw flash read/write, image generation and hash checks without the GUI limits of BLDevCube. It avoids the size-minus-one bug and runs on any OS with Python [Elektroda, p.kaczmarek2, post #21616882]

Why does BLDevCube ask for 0x001FFFFF bytes instead of 0x00200000?

BLDevCube treats the end address as inclusive. Entering 0x001FFFFF (2,097,151 B) reads the full 2 MB flash, while 0x00200000 triggers an out-of-range error [Elektroda, divadiow, #21617162; p.kaczmarek2, #21617160].

How do I perform a full backup with bl602tool?

  1. Connect BL602 RX/TX to an FTDI set to 3.3 V.
  2. Run python bltool.py -p COMx -b 1000000 -r 0 2097151 full.bin.
  3. Verify with fc /b full.bin full2.bin or md5sum. “Backups matched byte-for-byte” [Elektroda, p.kaczmarek2, post #21617143]

How can I change the baud rate safely?

Add the -b flag: -b 1000000 is the highest proven stable rate. 1.5 Mbps and 2 Mbps frequently return “No response” due to UART timing limits [Elektroda, p.kaczmarek2, post #21617181]

bl602tool crashes with SerialException on COM3—what fixes it?

The CH340 on some boards conflicts with Windows. Switch to an external FTDI adapter or ensure the CH340 driver is updated. Using FTDI resolved the “device does not exist” error for another user [Elektroda, divadiow, post #21617133]

Does the tool support writing an all-in-one firmware image?

Yes. Use generateImage.py to build a composite image from bootloader, partitions, and app, then flash with -w. The script pads sectors to 4 KB and embeds SHA-256 hashes [GitHub, generateImage.py].

What is the purpose of the 4092-byte write chunk?

BL602 flash sectors are 4 KB. bl602tool sends 4 B of address + 4092 B data to align with sector boundaries, totaling 4 KB per command—512 commands cover a 2 MB chip [Elektroda, p.kaczmarek2, post #21616896]

Can I speed up reads by increasing the chunk size?

No. The boot ROM caps flash_read payloads at 512 B; larger requests stall. Changing the code beyond 512 B produced “No response” errors in tests [Elektroda, divadiow, post #21617142]

What happens if the read freezes halfway?

High baud or noisy USB lines cause timeouts. Drop to 500 kbps, shorten cables, and ensure the board is in boot mode. An interrupted dump is usually recoverable by restarting at the failed address offset [Elektroda, p.kaczmarek2, post #21617172]

How do I generate progress and ETA during reads?

Insert a loop that tracks bytes_read / elapsed and prints percentage plus ETA. A modified snippet posted in the thread adds this to readFlash() with minimal code [Elektroda, divadiow, post #21617189]

Will bl602tool work on 4 MB flash variants?

Yes; specify -r 0 4194303 or -w with a 4 MB image. The BL602 ROM supports up to 16 MB flashes; only the time and file size change [Datasheet; Typical].

Edge case: what if my board bricks after fuse changes?

Boot ROM remains active unless security fuses lock it. Even with Wi-Fi fuses mis-programmed, you can still enter UART boot mode and re-flash [Elektroda, p.kaczmarek2, post #21617088]

Is the protocol officially documented?

Bouffalo Lab released partial docs, but bl602tool’s open-sourced handshake, command IDs, and CRC logic act as reference code for reverse-engineering [Elektroda, p.kaczmarek2, post #21616882]
Generated by the language model.
ADVERTISEMENT