Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

p.kaczmarek2 3867 110

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

#31 21713492 07 Oct 2025 20:38

DeDaMrAz DeDaMrAz

Level 21

Helpful post? (0)

Post #31
21713492 07 Oct 2025 20:38

p.kaczmarek2 wrote:
I think we need to capture traffic for TWX817

That's JTAG or SWD, sure we can do that but you'll still need a dedicated HW for communication.

If you like my work, support me at: https://paypal.me/openshwprojects
ADVERTISEMENT
#32 21713603 07 Oct 2025 22:29

divadiow divadiow

Level 36

Helpful post? (+1)

Post #32
21713603 07 Oct 2025 22:29

W800 bits: https://www.elektroda.com/rtvforum/topic4120455.html#21542722
#33 21714040 08 Oct 2025 14:20

insmod insmod

Level 29

Helpful post? (0)

Post #33
21714040 08 Oct 2025 14:20

New fix uploaded - backup saving on RTLZ/RTLD and RTLZ2 when using "Backup and flash new". LN was fixed earlier.
ADVERTISEMENT
#34 21714071 08 Oct 2025 15:06

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #34
21714071 08 Oct 2025 15:06

Nice progress. Btw, I think some of the common backup saving, etc, could be moved in future to the shared base class.

Is it merge ready? Or maybe I will try it on Ubuntu VM, if it could work...

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#35 21714087 08 Oct 2025 15:36

divadiow divadiow

Level 36

Helpful post? (0)

Post #35
21714087 08 Oct 2025 15:36

cool.
Are any of these a concern/experiened by others? https://www.elektroda.com/rtvforum/topic4097185-90.html#21712724
#36 21714143 08 Oct 2025 17:00

insmod insmod

Level 29

Helpful post? (+1)

Post #36
21714143 08 Oct 2025 17:00

>>21714087
Fixed Z2 error.

Updated BL602:
Flash size detection.
Backups can now be restored.
Loader converted to base64 string.
Full flash erase and partial erase. (it prints "Command timed out!" on erase, but that's because erase doesn't return "OK", but something else).
Can write dts and partitions, but not boot and firmware (because no header generation).

Merge ready, i believe. BK, RTLD and RTLZ2 works with mono (6.12, not 6.14) on a real pc. RTLB doesn't because bauds higher than 921600 aren't working for me, and RTLB rom default baud rate is 1500000.
#37 21714176 08 Oct 2025 17:53

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #37
21714176 08 Oct 2025 17:53

I just got another BK7252 camera and tried to read flash with UART custom read, it seems that we need to add doUnprotect, or, more precisely, get flash ID call for non-N devices. Currently FLASH_SIZE is only set there, so it's not present on BK7231T and BK7252. Futhermore, for full read, the value is hardcoded.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#38 21714178 08 Oct 2025 17:56

insmod insmod

Level 29

Helpful post? (0)

Post #38
21714178 08 Oct 2025 17:56

>>21714176
It won't work, i've tried.
Even just flash id without unprotect
#39 21714186 08 Oct 2025 18:04

divadiow divadiow

Level 36

Helpful post? (0)

Post #39
21714186 08 Oct 2025 18:04

anything in these of assistance or not really?

#40 21714187 08 Oct 2025 18:12

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Post #40

21714187 08 Oct 2025 18:12

Oh no, but still, thanks, at least you saved me some effort. So we need... a field for flash size, I guess?

I tried that via UART on Doorbell:

I allowed custom read to get past max size.


Starting read!
Read parms: start 0x11000 (sector 17), len 0x411000 (69632 sectors)
Now is: środa, 8 października 2025 17:48:17.
Flasher mode: BK7252
Going to open port: COM3.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus failed, will try again - 0/100!
Getting bus success!
Going to set baud rate setting (460800)!
Going to start reading at offset 0x11000...
Reading 0x11000... Ok! Reading 0x12000... Ok! Reading 0x13000... Ok! Reading 0x14000... Ok! Reading 0x15000... Ok! Reading 0x16000... Ok! Reading 0x17000... Ok! Reading 0x18000... Ok! Reading 0x19000... Ok! Reading 0x1A000... Ok! Reading 0x1B000... Ok! Reading 0x1C000... Ok! Reading 0x1D000... Ok! Reading 0x1E000... Ok! Reading 0x1F000... Ok! Reading 0x20000... Ok! Reading 0x21000... Ok! Reading 0x22000... Ok! Reading 0x23000... Ok! Reading 0x24000... Ok! Reading 0x25000... Ok! Reading 0x26000... Ok! Reading 0x27000... Ok! Reading 0x28000... Ok! Reading 0x29000... Ok! Reading 0x2A000... Ok! Reading 0x2B000... Ok! Reading 0x2C000... Ok! Reading 0x2D000... Ok! Reading 0x2E000... Ok! Reading 0x2F000... Ok! Reading 0x30000... Ok! Reading 0x31000... Ok! Reading 0x32000... Ok! Reading 0x33000... Ok! Reading 0x34000... Ok! Reading 0x35000... Ok! Reading 0x36000... Ok! Reading 0x37000... Ok! Reading 0x38000... Ok! Reading 0x39000... Ok! Reading 0x3A000... Ok! Reading 0x3B000... Ok! Reading 0x3C000... Ok! Reading 0x3D000... Ok! Reading 0x3E000... Ok! Reading 0x3F000... Ok! Reading 0x40000... Ok! Reading 0x41000... Ok! Reading 0x42000... Ok! Reading 0x43000... Ok! Reading 0x44000... Ok! Reading 0x45000... Ok! Reading 0x46000... Ok! Reading 0x47000... Ok! Reading 0x48000... Ok! Reading 0x49000... Ok! Reading 0x4A000... Ok! Reading 0x4B000... Ok! Reading 0x4C000... Ok! Reading 0x4D000... Ok! Reading 0x4E000... Ok! Reading 0x4F000... Ok! Reading 0x50000... Ok! Reading 0x51000... Ok! Reading 0x52000... Ok! Reading 0x53000... Ok! Reading 0x54000... Ok! Reading 0x55000... Ok! Reading 0x56000... Ok! Reading 0x57000... Ok! Reading 0x58000... Ok! Reading 0x59000... Ok! Reading 0x5A000... Ok! Reading 0x5B000... Ok! Reading 0x5C000... Ok! Reading 0x5D000... Ok! Reading 0x5E000... Ok! Reading 0x5F000... Ok! Reading 0x60000... Ok! Reading 0x61000... Ok! Reading 0x62000... Ok! Reading 0x63000... Ok! Reading 0x64000... Ok! Reading 0x65000... Ok! Reading 0x66000... Ok! Reading 0x67000... Ok! Reading 0x68000... Ok! Reading 0x69000... Ok! Reading 0x6A000... Ok! Reading 0x6B000... Ok! Reading 0x6C000... Ok! Reading 0x6D000... Ok! Reading 0x6E000... Ok! Reading 0x6F000... Ok! Reading 0x70000... Ok! Reading 0x71000... Ok! Reading 0x72000... Ok! Reading 0x73000... Ok! Reading 0x74000... Ok! Reading 0x75000... Ok! Reading 0x76000... Ok! Reading 0x77000... Ok! Reading 0x78000... Ok! Reading 0x79000... Ok! Reading 0x7A000... Ok! Reading 0x7B000... Ok! Reading 0x7C000... Ok! Reading 0x7D000... Ok! Reading 0x7E000... Ok! Reading 0x7F000... Ok! Reading 0x80000... Ok! Reading 0x81000... Ok! Reading 0x82000... Ok! Reading 0x83000... Ok! Reading 0x84000... Ok! Reading 0x85000... Ok! Reading 0x86000... Ok! Reading 0x87000... Ok! Reading 0x88000... Ok! Reading 0x89000... Ok! Reading 0x8A000... Ok! Reading 0x8B000... Ok! Reading 0x8C000... Ok! Reading 0x8D000... Ok! Reading 0x8E000... Ok! Reading 0x8F000... Ok! Reading 0x90000... Ok! Reading 0x91000... Ok! Reading 0x92000... Ok! Reading 0x93000... Ok! Reading 0x94000... Ok! Reading 0x95000... Ok! Reading 0x96000... Ok! Reading 0x97000... Ok! Reading 0x98000... Ok! Reading 0x99000... Ok! Reading 0x9A000... Ok! Reading 0x9B000... Ok! Reading 0x9C000... Ok! Reading 0x9D000... Ok! Reading 0x9E000... Ok! Reading 0x9F000... Ok! Reading 0xA0000... Ok! Reading 0xA1000... Ok! Reading 0xA2000... Ok! Reading 0xA3000... Ok! Reading 0xA4000... Ok! Reading 0xA5000... Ok! Reading 0xA6000... Ok! Reading 0xA7000... Ok! Reading 0xA8000... Ok! Reading 0xA9000... Ok! Reading 0xAA000... Ok! Reading 0xAB000... Ok! Reading 0xAC000... Ok! Reading 0xAD000... Ok! Reading 0xAE000... Ok! Reading 0xAF000... Ok! Reading 0xB0000... Ok! Reading 0xB1000... Ok! Reading 0xB2000... Ok! Reading 0xB3000... Ok! Reading 0xB4000... Ok! Reading 0xB5000... Ok! Reading 0xB6000... Ok! Reading 0xB7000... Ok! Reading 0xB8000... Ok! Reading 0xB9000... Ok! Reading 0xBA000... Ok! Reading 0xBB000... Ok! Reading 0xBC000... Ok! Reading 0xBD000... Ok! Reading 0xBE000... Ok! Reading 0xBF000... Ok! Reading 0xC0000... Ok! Reading 0xC1000... Ok! Reading 0xC2000... Ok! Reading 0xC3000... Ok! Reading 0xC4000... Ok! Reading 0xC5000... Ok! Reading 0xC6000... Ok! Reading 0xC7000... Ok! Reading 0xC8000... Ok! Reading 0xC9000... Ok! Reading 0xCA000... Ok! Reading 0xCB000... Ok! Reading 0xCC000... Ok! Reading 0xCD000... Ok! Reading 0xCE000... Ok! Reading 0xCF000... Ok! Reading 0xD0000... Ok! Reading 0xD1000... Ok! Reading 0xD2000... Ok! Reading 0xD3000... Ok! Reading 0xD4000... Ok! Reading 0xD5000... Ok! Reading 0xD6000... Ok! Reading 0xD7000... Ok! Reading 0xD8000... Ok! Reading 0xD9000... Ok! Reading 0xDA000... Ok! Reading 0xDB000... Ok! Reading 0xDC000... Ok! Reading 0xDD000... Ok! Reading 0xDE000... Ok! Reading 0xDF000... Ok! Reading 0xE0000... Ok! Reading 0xE1000... Ok! Reading 0xE2000... Ok! Reading 0xE3000... Ok! Reading 0xE4000... Ok! Reading 0xE5000... Ok! Reading 0xE6000... Ok! Reading 0xE7000... Ok! Reading 0xE8000... Ok! Reading 0xE9000... Ok! Reading 0xEA000... Ok! Reading 0xEB000... Ok! Reading 0xEC000... Ok! Reading 0xED000... Ok! Reading 0xEE000... Ok! Reading 0xEF000... Ok! Reading 0xF0000... Ok! Reading 0xF1000... Ok! Reading 0xF2000... Ok! Reading 0xF3000... Ok! Reading 0xF4000... Ok! Reading 0xF5000... Ok! Reading 0xF6000... Ok! Reading 0xF7000... Ok! Reading 0xF8000... Ok! Reading 0xF9000... Ok! Reading 0xFA000... Ok! Reading 0xFB000... Ok! Reading 0xFC000... Ok! Reading 0xFD000... Ok! Reading 0xFE000... Ok! Reading 0xFF000... Ok! Reading 0x100000... Ok! Reading 0x101000... Ok! Reading 0x102000... Ok! Reading 0x103000... Ok! Reading 0x104000... Ok! Reading 0x105000... Ok! Reading 0x106000... Ok! Reading 0x107000... Ok! Reading 0x108000... Ok! Reading 0x109000... Ok! Reading 0x10A000... Ok! Reading 0x10B000... Ok! Reading 0x10C000... Ok! Reading 0x10D000... Ok! Reading 0x10E000... Ok! Reading 0x10F000... Ok! Reading 0x110000... Ok! Reading 0x111000... Ok! Reading 0x112000... Ok! Reading 0x113000... Ok! Reading 0x114000... Ok! Reading 0x115000... Ok! Reading 0x116000... Ok! Reading 0x117000... Ok! Reading 0x118000... Ok! Reading 0x119000... Ok! Reading 0x11A000... Ok! Reading 0x11B000... Ok! Reading 0x11C000... Ok! Reading 0x11D000... Ok! Reading 0x11E000... Ok! Reading 0x11F000... Ok! Reading 0x120000... Ok! Reading 0x121000... Ok! Reading 0x122000... Ok! Reading 0x123000... Ok! Reading 0x124000... Ok! Reading 0x125000... Ok! Reading 0x126000... Ok! Reading 0x127000... Ok! Reading 0x128000... Ok! Reading 0x129000... Ok! Reading 0x12A000... Ok! Reading 0x12B000... Ok! Reading 0x12C000... Ok! Reading 0x12D000... Ok! Reading 0x12E000... Ok! Reading 0x12F000... Ok! Reading 0x130000... Ok! Reading 0x131000... Ok! Reading 0x132000... Ok! Reading 0x133000... Ok! Reading 0x134000... Ok! Reading 0x135000... Ok! Reading 0x136000... Ok! Reading 0x137000... Ok! Reading 0x138000... Ok! Reading 0x139000... Ok! Reading 0x13A000... Ok! Reading 0x13B000... Ok! Reading 0x13C000... Ok! Reading 0x13D000... Ok! Reading 0x13E000... Ok! Reading 0x13F000... Ok! Reading 0x140000... Ok! Reading 0x141000... Ok! Reading 0x142000... Ok! Reading 0x143000... Ok! Reading 0x144000... Ok! Reading 0x145000... Ok! Reading 0x146000... Ok! Reading 0x147000... Ok! Reading 0x148000... Ok! Reading 0x149000... Ok! Reading 0x14A000... Ok! Reading 0x14B000... Ok! Reading 0x14C000... Ok! Reading 0x14D000... Ok! Reading 0x14E000... Ok! Reading 0x14F000... Ok! Reading 0x150000... Ok! Reading 0x151000... Ok! Reading 0x152000... Ok! Reading 0x153000... Ok! Reading 0x154000... Ok! Reading 0x155000... Ok! Reading 0x156000... Ok! Reading 0x157000... Ok! Reading 0x158000... Ok! Reading 0x159000... Ok! Reading 0x15A000... Ok! Reading 0x15B000... Ok! Reading 0x15C000... Ok! Reading 0x15D000... Ok! Reading 0x15E000... Ok! Reading 0x15F000... Ok! Reading 0x160000... Ok! Reading 0x161000... Ok! Reading 0x162000... Ok! Reading 0x163000... Ok! Reading 0x164000... Ok! Reading 0x165000... Ok! Reading 0x166000... Ok! Reading 0x167000... Ok! Reading 0x168000... Ok! Reading 0x169000... Ok! Reading 0x16A000... Ok! Reading 0x16B000... Ok! Reading 0x16C000... Ok! Reading 0x16D000... Ok! Reading 0x16E000... Ok! Reading 0x16F000... Ok! Reading 0x170000... Ok! Reading 0x171000... Ok! Reading 0x172000... Ok! Reading 0x173000... Ok! Reading 0x174000... Ok! Reading 0x175000... Ok! Reading 0x176000... Ok! Reading 0x177000... Ok! Reading 0x178000... Ok! Reading 0x179000... Ok! Reading 0x17A000... Ok! Reading 0x17B000... Ok! Reading 0x17C000... Ok! Reading 0x17D000... Ok! Reading 0x17E000... Ok! Reading 0x17F000... Ok! Reading 0x180000... Ok! Reading 0x181000... Ok! Reading 0x182000... Ok! Reading 0x183000... Ok! Reading 0x184000... Ok! Reading 0x185000... Ok! Reading 0x186000... Ok! Reading 0x187000... Ok! Reading 0x188000... Ok! Reading 0x189000... Ok! Reading 0x18A000... Ok! Reading 0x18B000... Ok! Reading 0x18C000... Ok! Reading 0x18D000... Ok! Reading 0x18E000... Ok! Reading 0x18F000... Ok! Reading 0x190000... Ok! Reading 0x191000... Ok! Reading 0x192000... Ok! Reading 0x193000... Ok! Reading 0x194000... Ok! Reading 0x195000... Ok! Reading 0x196000... Ok! Reading 0x197000... Ok! Reading 0x198000... Ok! Reading 0x199000... Ok! Reading 0x19A000... Ok! Reading 0x19B000... Ok! Reading 0x19C000... Ok! Reading 0x19D000... Ok! Reading 0x19E000... Ok! Reading 0x19F000... Ok! Reading 0x1A0000... Ok! Reading 0x1A1000... Ok! Reading 0x1A2000... Ok! Reading 0x1A3000... Ok! Reading 0x1A4000... Ok! Reading 0x1A5000... Ok! Reading 0x1A6000... Ok! Reading 0x1A7000... Ok! Reading 0x1A8000... Ok! Reading 0x1A9000... Ok! Reading 0x1AA000... Ok! Reading 0x1AB000... Ok! Reading 0x1AC000... Ok! Reading 0x1AD000... Ok! Reading 0x1AE000... Ok! Reading 0x1AF000... Ok! Reading 0x1B0000... Ok! Reading 0x1B1000... Ok! Reading 0x1B2000... Ok! Reading 0x1B3000... Ok! Reading 0x1B4000... Ok! Reading 0x1B5000... Ok! Reading 0x1B6000... Ok! Reading 0x1B7000... Ok! Reading 0x1B8000... Ok! Reading 0x1B9000... Ok! Reading 0x1BA000... Ok! Reading 0x1BB000... Ok! Reading 0x1BC000... Ok! Reading 0x1BD000... Ok! Reading 0x1BE000... Ok! Reading 0x1BF000... Ok! Reading 0x1C0000... Ok! Reading 0x1C1000... Ok! Reading 0x1C2000... Ok! Reading 0x1C3000... Ok! Reading 0x1C4000... Ok! Reading 0x1C5000... Ok! Reading 0x1C6000... Ok! Reading 0x1C7000... Ok! Reading 0x1C8000... Ok! Reading 0x1C9000... Ok! Reading 0x1CA000... Ok! Reading 0x1CB000... Ok! Reading 0x1CC000... Ok! Reading 0x1CD000... Ok! Reading 0x1CE000... Ok! Reading 0x1CF000... Ok! Reading 0x1D0000... Ok! Reading 0x1D1000... Ok! Reading 0x1D2000... Ok! Reading 0x1D3000... Ok! Reading 0x1D4000... Ok! Reading 0x1D5000... Ok! Reading 0x1D6000... Ok! Reading 0x1D7000... Ok! Reading 0x1D8000... Ok! Reading 0x1D9000... Ok! Reading 0x1DA000... Ok! Reading 0x1DB000... Ok! Reading 0x1DC000... Ok! Reading 0x1DD000... Ok! Reading 0x1DE000... Ok! Reading 0x1DF000... Ok! Reading 0x1E0000... Ok! Reading 0x1E1000... Ok! Reading 0x1E2000... Ok! Reading 0x1E3000... Ok! Reading 0x1E4000... Ok! Reading 0x1E5000... Ok! Reading 0x1E6000... Ok! Reading 0x1E7000... Ok! Reading 0x1E8000... Ok! Reading 0x1E9000... Ok! Reading 0x1EA000... Ok! Reading 0x1EB000... Ok! Reading 0x1EC000... Ok! Reading 0x1ED000... Ok! Reading 0x1EE000... Ok! Reading 0x1EF000... Ok! Reading 0x1F0000... Ok! Reading 0x1F1000... Ok! Reading 0x1F2000... Ok! Reading 0x1F3000... Ok! Reading 0x1F4000... Ok! Reading 0x1F5000... Ok! Reading 0x1F6000... Ok! Reading 0x1F7000... Ok! Reading 0x1F8000... Ok! Reading 0x1F9000... Ok! Reading 0x1FA000... Ok! Reading 0x1FB000... Ok! Reading 0x1FC000... Ok! Reading 0x1FD000... Ok! Reading 0x1FE000... Ok! Reading 0x1FF000... Ok! Reading 0x200000... Ok! Reading 0x201000... Ok! Reading 0x202000... Ok! Reading 0x203000... Ok! Reading 0x204000... Ok! Reading 0x205000... Ok! Reading 0x206000... Ok! Reading 0x207000... Ok! Reading 0x208000... Ok! Reading 0x209000... Ok! Reading 0x20A000... Ok! Reading 0x20B000... Ok! Reading 0x20C000... Ok! Reading 0x20D000... Ok! Reading 0x20E000... Ok! Reading 0x20F000... Ok! Reading 0x210000... Ok! Reading 0x211000... Ok! Reading 0x212000... Ok! Reading 0x213000... Ok! Reading 0x214000... Ok! Reading 0x215000... Ok! Reading 0x216000... Ok! Reading 0x217000... Ok! Reading 0x218000... Ok! Reading 0x219000... Ok! Reading 0x21A000... Ok! Reading 0x21B000... Ok! Reading 0x21C000... Ok! Reading 0x21D000... Ok! Reading 0x21E000... Ok! Reading 0x21F000... Ok! Reading 0x220000... Ok! Reading 0x221000... Ok! Reading 0x222000... Ok! Reading 0x223000... Ok! Reading 0x224000... Ok! Reading 0x225000... Ok! Reading 0x226000... Ok! Reading 0x227000... Ok! Reading 0x228000... Ok! Reading 0x229000... Ok! Reading 0x22A000... Ok! Reading 0x22B000... Ok! Reading 0x22C000... Ok! Reading 0x22D000... Ok! Reading 0x22E000... Ok! Reading 0x22F000... Ok! Reading 0x230000... Ok! Reading 0x231000... Ok! Reading 0x232000... Ok! Reading 0x233000... Ok! Reading 0x234000... Ok! Reading 0x235000... Ok! Reading 0x236000... Ok! Reading 0x237000... Ok! Reading 0x238000... Ok! Reading 0x239000... Ok! Reading 0x23A000... Ok! Reading 0x23B000... Ok! Reading 0x23C000... Ok! Reading 0x23D000... Ok! Reading 0x23E000... Ok! Reading 0x23F000... Ok! Reading 0x240000... Ok! Reading 0x241000... Ok! Reading 0x242000... Ok! Reading 0x243000... Ok! Reading 0x244000... Ok! Reading 0x245000... Ok! Reading 0x246000... Ok! Reading 0x247000... Ok! Reading 0x248000... Ok! Reading 0x249000... Ok! Reading 0x24A000... Ok! Reading 0x24B000... Ok! Reading 0x24C000... Ok! Reading 0x24D000... Ok! Reading 0x24E000... Ok! Reading 0x24F000... Ok! Reading 0x250000... Ok! Reading 0x251000... Ok! Reading 0x252000... Ok! Reading 0x253000... Ok! Reading 0x254000... Ok! Reading 0x255000... Ok! Reading 0x256000... Ok! Reading 0x257000... Ok! Reading 0x258000... Ok! Reading 0x259000... Ok! Reading 0x25A000... Ok! Reading 0x25B000... Ok! Reading 0x25C000... Ok! Reading 0x25D000... Ok! Reading 0x25E000... Ok! Reading 0x25F000... Ok! Reading 0x260000... Ok! Reading 0x261000... Ok! Reading 0x262000... Ok! Reading 0x263000... Ok! Reading 0x264000... Ok! Reading 0x265000... Ok! Reading 0x266000... Ok! Reading 0x267000... Ok! Reading 0x268000... Ok! Reading 0x269000... Ok! Reading 0x26A000... Ok! Reading 0x26B000... Ok! Reading 0x26C000... Ok! Reading 0x26D000... Ok! Reading 0x26E000... Ok! Reading 0x26F000... Ok! Reading 0x270000... Ok! Reading 0x271000... Ok! Reading 0x272000... Ok! Reading 0x273000... Ok! Reading 0x274000... Ok! Reading 0x275000... Ok! Reading 0x276000... Ok! Reading 0x277000... Ok! Reading 0x278000... Ok! Reading 0x279000... Ok! Reading 0x27A000... Ok! Reading 0x27B000... Ok! Reading 0x27C000... Ok! Reading 0x27D000... Ok! Reading 0x27E000... Ok! Reading 0x27F000... Ok! Reading 0x280000... Ok! Reading 0x281000... Ok! Reading 0x282000... Ok! Reading 0x283000... Ok! Reading 0x284000... Ok! Reading 0x285000... Ok! Reading 0x286000... Ok! Reading 0x287000... Ok! Reading 0x288000... Ok! Reading 0x289000... Ok! Reading 0x28A000... Ok! Reading 0x28B000... Ok! Reading 0x28C000... Ok! Reading 0x28D000... Ok! Reading 0x28E000... Ok! Reading 0x28F000... Ok! Reading 0x290000... Ok! Reading 0x291000... Ok! Reading 0x292000... Ok! Reading 0x293000... Ok! Reading 0x294000... Ok! Reading 0x295000... Ok! Reading 0x296000... Ok! Reading 0x297000... Ok! Reading 0x298000... Ok! Reading 0x299000... Ok! Reading 0x29A000... Ok! Reading 0x29B000... Ok! Reading 0x29C000... Ok! Reading 0x29D000... Ok! Reading 0x29E000... Ok! Reading 0x29F000... Ok! Reading 0x2A0000... Ok! Reading 0x2A1000... Ok! Reading 0x2A2000... Ok! Reading 0x2A3000... Ok! Reading 0x2A4000... Ok! Reading 0x2A5000... Ok! Reading 0x2A6000... Ok! Reading 0x2A7000... Ok! Reading 0x2A8000... Ok! Reading 0x2A9000... Ok! Reading 0x2AA000... Ok! Reading 0x2AB000... Ok! Reading 0x2AC000... Ok! Reading 0x2AD000... Ok! Reading 0x2AE000... Ok! Reading 0x2AF000... Ok! Reading 0x2B0000... Ok! Reading 0x2B1000... Ok! Reading 0x2B2000... Ok! Reading 0x2B3000... Ok! Reading 0x2B4000... Ok! Reading 0x2B5000... Ok! Reading 0x2B6000... Ok! Reading 0x2B7000... Ok! Reading 0x2B8000... Ok! Reading 0x2B9000... Ok! Reading 0x2BA000... Ok! Reading 0x2BB000... Ok! Reading 0x2BC000... Ok! Reading 0x2BD000... Ok! Reading 0x2BE000... Ok! Reading 0x2BF000... Ok! Reading 0x2C0000... Ok! Reading 0x2C1000... Ok! Reading 0x2C2000... Ok! Reading 0x2C3000... Ok! Reading 0x2C4000... Ok! Reading 0x2C5000... Ok! Reading 0x2C6000... Ok! Reading 0x2C7000... Ok! Reading 0x2C8000... Ok! Reading 0x2C9000... Ok! Reading 0x2CA000... Ok! Reading 0x2CB000... Ok! Reading 0x2CC000... Ok! Reading 0x2CD000... Ok! Reading 0x2CE000... Ok! Reading 0x2CF000... Ok! Reading 0x2D0000... Ok! Reading 0x2D1000... Ok! Reading 0x2D2000... Ok! Reading 0x2D3000... Ok! Reading 0x2D4000... Ok! Reading 0x2D5000... Ok! Reading 0x2D6000... Ok! Reading 0x2D7000... Ok! Reading 0x2D8000... Ok! Reading 0x2D9000... Ok! Reading 0x2DA000... Ok! Reading 0x2DB000... Ok! Reading 0x2DC000... Ok! Reading 0x2DD000... Ok! Reading 0x2DE000... Ok! Reading 0x2DF000... Ok! Reading 0x2E0000... Ok! Reading 0x2E1000... Ok! Reading 0x2E2000... Ok! Reading 0x2E3000... Ok! Reading 0x2E4000... Ok! Reading 0x2E5000... Ok! Reading 0x2E6000... Ok! Reading 0x2E7000... Ok! Reading 0x2E8000... Ok! Reading 0x2E9000... Ok! Reading 0x2EA000... Ok! Reading 0x2EB000... Ok! Reading 0x2EC000... Ok! Reading 0x2ED000... Ok! Reading 0x2EE000... Ok! Reading 0x2EF000... Ok! Reading 0x2F0000... Ok! Reading 0x2F1000... Ok! Reading 0x2F2000... Ok! Reading 0x2F3000... Ok! Reading 0x2F4000... Ok! Reading 0x2F5000... Ok! Reading 0x2F6000... Ok! Reading 0x2F7000... Ok! Reading 0x2F8000... Ok! Reading 0x2F9000... Ok! Reading 0x2FA000... Ok! Reading 0x2FB000... Ok! Reading 0x2FC000... Ok! Reading 0x2FD000... Ok! Reading 0x2FE000... Ok! Reading 0x2FF000... Ok! Reading 0x300000... Ok! Reading 0x301000... Ok! Reading 0x302000... Ok! Reading 0x303000... Ok! Reading 0x304000... Ok! Reading 0x305000... Ok! Reading 0x306000... Ok! Reading 0x307000... Ok! Reading 0x308000... Ok! Reading 0x309000... Ok! Reading 0x30A000... Ok! Reading 0x30B000... Ok! Reading 0x30C000... Ok! Reading 0x30D000... Ok! Reading 0x30E000... Ok! Reading 0x30F000... Ok! Reading 0x310000... Ok! Reading 0x311000... Ok! Reading 0x312000... Ok! Reading 0x313000... Ok! Reading 0x314000... Ok! Reading 0x315000... Ok! Reading 0x316000... Ok! Reading 0x317000... Ok! Reading 0x318000... Ok! Reading 0x319000... Ok! Reading 0x31A000... Ok! Reading 0x31B000... Ok! Reading 0x31C000... Ok! Reading 0x31D000... Ok! Reading 0x31E000... Ok! Reading 0x31F000... Ok! Reading 0x320000... Ok! Reading 0x321000... Ok! Reading 0x322000... Ok! Reading 0x323000... Ok! Reading 0x324000... Ok! Reading 0x325000... Ok! Reading 0x326000... Ok! Reading 0x327000... Ok! Reading 0x328000... Ok! Reading 0x329000... Ok! Reading 0x32A000... Ok! Reading 0x32B000... Ok! Reading 0x32C000... Ok! Reading 0x32D000... Ok! Reading 0x32E000... Ok! Reading 0x32F000... Ok! Reading 0x330000... Ok! Reading 0x331000... Ok! Reading 0x332000... Ok! Reading 0x333000... Ok! Reading 0x334000... Ok! Reading 0x335000... Ok! Reading 0x336000... Ok! Reading 0x337000... Ok! Reading 0x338000... Ok! Reading 0x339000... Ok! Reading 0x33A000... Ok! Reading 0x33B000... Ok! Reading 0x33C000... Ok! Reading 0x33D000... Ok! Reading 0x33E000... Ok! Reading 0x33F000... Ok! Reading 0x340000... Ok! Reading 0x341000... Ok! Reading 0x342000... Ok! Reading 0x343000... Ok! Reading 0x344000... Ok! Reading 0x345000... Ok! Reading 0x346000... Ok! Reading 0x347000... Ok! Reading 0x348000... Ok! Reading 0x349000... Ok! Reading 0x34A000... Ok! Reading 0x34B000... Ok! Reading 0x34C000... Ok! Reading 0x34D000... Ok! Reading 0x34E000... Ok! Reading 0x34F000... Ok! Reading 0x350000... Ok! Reading 0x351000... Ok! Reading 0x352000... Ok! Reading 0x353000... Ok! Reading 0x354000... Ok! Reading 0x355000... Ok! Reading 0x356000... Ok! Reading 0x357000... Ok! Reading 0x358000... Ok! Reading 0x359000... Ok! Reading 0x35A000... Ok! Reading 0x35B000... Ok! Reading 0x35C000... Ok! Reading 0x35D000... Ok! Reading 0x35E000... Ok! Reading 0x35F000... Ok! Reading 0x360000... Ok! Reading 0x361000... Ok! Reading 0x362000... Ok! Reading 0x363000... Ok! Reading 0x364000... Ok! Reading 0x365000... Ok! Reading 0x366000... Ok! Reading 0x367000... Ok! Reading 0x368000... Ok! Reading 0x369000... Ok! Reading 0x36A000... Ok! Reading 0x36B000... Ok! Reading 0x36C000... Ok! Reading 0x36D000... Ok! Reading 0x36E000... Ok! Reading 0x36F000... Ok! Reading 0x370000... Ok! Reading 0x371000... Ok! Reading 0x372000... Ok! Reading 0x373000... Ok! Reading 0x374000... Ok! Reading 0x375000... Ok! Reading 0x376000... Ok! Reading 0x377000... Ok! Reading 0x378000... Ok! Reading 0x379000... Ok! Reading 0x37A000... Ok! Reading 0x37B000... Ok! Reading 0x37C000... Ok! Reading 0x37D000... Ok! Reading 0x37E000... Ok! Reading 0x37F000... Ok! Reading 0x380000... Ok! Reading 0x381000... Ok! Reading 0x382000... Ok! Reading 0x383000... Ok! Reading 0x384000... Ok! Reading 0x385000... Ok! Reading 0x386000... Ok! Reading 0x387000... Ok! Reading 0x388000... Ok! Reading 0x389000... Ok! Reading 0x38A000... Ok! Reading 0x38B000... Ok! Reading 0x38C000... Ok! Reading 0x38D000... Ok! Reading 0x38E000... Ok! Reading 0x38F000... Ok! Reading 0x390000... Ok! Reading 0x391000... Ok! Reading 0x392000... Ok! Reading 0x393000... Ok! Reading 0x394000... Ok! Reading 0x395000... Ok! Reading 0x396000... Ok! Reading 0x397000... Ok! Reading 0x398000... Ok! Reading 0x399000... Ok! Reading 0x39A000... Ok! Reading 0x39B000... Ok! Reading 0x39C000... Ok! Reading 0x39D000... Ok! Reading 0x39E000... Ok! Reading 0x39F000... Ok! Reading 0x3A0000... Ok! Reading 0x3A1000... Ok! Reading 0x3A2000... Ok! Reading 0x3A3000... Ok! Reading 0x3A4000... Ok! Reading 0x3A5000... Ok! Reading 0x3A6000... Ok! Reading 0x3A7000... Ok! Reading 0x3A8000... Ok! Reading 0x3A9000... Ok! Reading 0x3AA000... Ok! Reading 0x3AB000... Ok! Reading 0x3AC000... Ok! Reading 0x3AD000... Ok! Reading 0x3AE000... Ok! Reading 0x3AF000... Ok! Reading 0x3B0000... Ok! Reading 0x3B1000... Ok! Reading 0x3B2000... Ok! Reading 0x3B3000... Ok! Reading 0x3B4000... Ok! Reading 0x3B5000... Ok! Reading 0x3B6000... Ok! Reading 0x3B7000... Ok! Reading 0x3B8000... Ok! Reading 0x3B9000... Ok! Reading 0x3BA000... Ok! Reading 0x3BB000... Ok! Reading 0x3BC000... Ok! Reading 0x3BD000... Ok! Reading 0x3BE000... Ok! Reading 0x3BF000... Ok! Reading 0x3C0000... Ok! Reading 0x3C1000... Ok! Reading 0x3C2000... Ok! Reading 0x3C3000... Ok! Reading 0x3C4000... Ok! Reading 0x3C5000... Ok! Reading 0x3C6000... Ok! Reading 0x3C7000... Ok! Reading 0x3C8000... Ok! Reading 0x3C9000... Ok! Reading 0x3CA000... Ok! Reading 0x3CB000... Ok! Reading 0x3CC000... Ok! Reading 0x3CD000... Ok! Reading 0x3CE000... Ok! Reading 0x3CF000... Ok! Reading 0x3D0000... Ok! Reading 0x3D1000... Ok! Reading 0x3D2000... Ok! Reading 0x3D3000... Ok! Reading 0x3D4000... Ok! Reading 0x3D5000... Ok! Reading 0x3D6000... Ok! Reading 0x3D7000... Ok! Reading 0x3D8000... Ok! Reading 0x3D9000... Ok! Reading 0x3DA000... Ok! Reading 0x3DB000... Ok! Reading 0x3DC000... Ok! Reading 0x3DD000... Ok! Reading 0x3DE000... Ok! Reading 0x3DF000... Ok! Reading 0x3E0000... Ok! Reading 0x3E1000... Ok! Reading 0x3E2000... Ok! Reading 0x3E3000... Ok! Reading 0x3E4000... Ok! Reading 0x3E5000... Ok! Reading 0x3E6000... Ok! Reading 0x3E7000... Ok! Reading 0x3E8000... Ok! Reading 0x3E9000... Ok! Reading 0x3EA000... Ok! Reading 0x3EB000... Ok! Reading 0x3EC000... Ok! Reading 0x3ED000... Ok! Reading 0x3EE000... Ok! Reading 0x3EF000... Ok! Reading 0x3F0000... Ok! Reading 0x3F1000... Ok! Reading 0x3F2000... Ok! Reading 0x3F3000... Ok! Reading 0x3F4000... Ok! Reading 0x3F5000... Ok! Reading 0x3F6000... Ok! Reading 0x3F7000... Ok! Reading 0x3F8000... Ok! Reading 0x3F9000... Ok! Reading 0x3FA000... Ok! Reading 0x3FB000... Ok! Reading 0x3FC000... Ok! Reading 0x3FD000... Ok! Reading 0x3FE000... Ok! Reading 0x3FF000... Ok! Reading 0x400000... Ok! Reading 0x401000... Ok! Reading 0x402000... Ok! Reading 0x403000... Ok! Reading 0x404000... Ok! Reading 0x405000... Ok! Reading 0x406000... Ok! Reading 0x407000... Ok! Reading 0x408000... Ok! Reading 0x409000... Ok! Reading 0x40A000... Ok! Reading 0x40B000... Ok! Reading 0x40C000... Ok! Reading 0x40D000... Ok! Reading 0x40E000... Ok! Reading 0x40F000... Ok! Reading 0x410000... Ok! Reading 0x411000... Ok! Reading 0x412000... Ok! Reading 0x413000... Ok! Reading 0x414000... Ok! Reading 0x415000... Ok! Reading 0x416000... Ok! Reading 0x417000... Ok! Reading 0x418000... Ok! Reading 0x419000... Ok! Reading 0x41A000... Ok! Reading 0x41B000... Ok! Reading 0x41C000... Ok! Reading 0x41D000... Ok! Reading 0x41E000... Ok! Reading 0x41F000... Ok! Reading 0x420000... Ok! Reading 0x421000... Ok! 
Basic read operation finished, but now it's time to verify...
Starting CRC check for 1041 sectors, starting at offset 0x11000
CRC matches 0x9B43A2DA!
All read!
Loaded total 0x411000 bytes 
Wrote 4263936 to readResult_BK7252_UA_2025-08-10-17-50-06.bin
Backup created, now will attempt to extract OBK config.
It's not an OBK config, header is bad
OBK config not found.
Backup created, now will attempt to extract Tuya config.
Tuya config extractor - magic is at 3694592 
WARNING - strange nextblock header 3538A983
WARNING - bad nextblock CRC
WARNING - strange nextblock header 62D24236
WARNING - bad nextblock CRC
WARNING - strange nextblock header A31ED44C
WARNING - bad nextblock CRC
WARNING - strange nextblock header FEA94790
WARNING - bad nextblock CRC

Added after 30 [seconds]:

Added after 5 [minutes]:

https://github.com/openshwprojects/FlashDumps/commit/b1ca8fa8f9bd579c55d094e290e40abb42099654

Added after 1 [minutes]:

This doorbell arrived today. It's probably like the one @divadiow has. It has routed out SPI, but I wanted to try UART. I am unable to read it directly at 0x0 offset, but it seems I managed to read it with wrap-around hack. So , now my binary starts at 0x11000 offset.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

#41 21714327 08 Oct 2025 20:18

insmod insmod

Level 29

Helpful post? (0)

Post #41
21714327 08 Oct 2025 20:18

Added VERY hacky BL602 write.
Everything from 0 to 0x10000 is just copied from dump to base64.
Then app header manipulation (app size, app hash and header crc). Again, originally copied from dump to base64.
And finally dts - once again just copied from dump to base64.

Plus i've had to add erase from 0 to 0x1A2000 (lfs addr) before writing just so that it would pass hash check.
#42 21714401 08 Oct 2025 21:10

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #42
21714401 08 Oct 2025 21:10

Base64? Ah, I see, you've embedded the header part into the flasher iself, and just append the app part? That's what I also considered. So, now it can flash binary from our Releases?

I'm just curious, why Base64 string instead of byte []

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#43 21714409 08 Oct 2025 21:16

insmod insmod

Level 29

Helpful post? (0)

Post #43
21714409 08 Oct 2025 21:16

>>21714401
It can, i've tested 188, 188_berry and 189.

Because converting to base64 is much easier. Just open a site, drop a binary and press convert.
Plus base64 is more lightweight compared to byte[]
#44 21714427 08 Oct 2025 21:35

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #44
21714427 08 Oct 2025 21:35

Hmm interesting, I assume you're referring to C# source, and not to the memory itself (binary size)? I would need to check, I'm not sure.

Ok, I tried method from the first post with my new camera and it worked with first try.

https://github.com/openshwprojects/FlashDumps/commit/45a8ecd96d50d4a370edfc7744672095ea7d4c21

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#45 21714466 08 Oct 2025 22:05

divadiow divadiow

Level 36

Helpful post? (0)

Post #45
21714466 08 Oct 2025 22:05

p.kaczmarek2 wrote:
It's probably like the one @divadiow has

looks the same. nice little dev board
#46 21714473 08 Oct 2025 22:10

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #46
21714473 08 Oct 2025 22:10

Anything specific to try on that? I am certainly going to create I2C pin-wide scanner...

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#47 21714477 08 Oct 2025 23:37

divadiow divadiow

Level 36

Helpful post? (0)

Post #47
21714477 08 Oct 2025 23:37

hmm. dunno. I assume you've got the Tuya OBK running on it OK? There's daniel-dona and Apache02's opencam efforts I guess.
Here I used unadulterated test pad for some DS18B20 tests to get timings right https://www.elektroda.com/rtvforum/topic4127230-60.html#21620710

Added after 40 [seconds]:

p.kaczmarek2 wrote:
I am certainly going to create I2C pin-wide scanner

this could very useful, for any platform tbh

Added after 1 [minutes]:

You'll have probably noticed that the cam connector isn't the same 18-pin job seen on mini cams.

Added after 55 [minutes]:

insmod wrote:
Added VERY hacky BL602 write.

flashed OK to 4mb BL. boots and broadcasts

Added after 6 [minutes]:

erase DN and flash. boots

Added after 2 [minutes]:

that erase all text could do with changing depending on platform. erase all from 0 except for S/T/U/7252?

Added after 13 [minutes]:

1MB BL602 "backup and flash new" 1mb read seems OK but erase/write is slow with pauses with "command timed out!". It's still writing but I'm assuming it won't work, partitions catering for 2mb flash anyway?

#48 21714541 08 Oct 2025 23:44

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Post #48

21714541 08 Oct 2025 23:44

This is my camera sensor:

Close-up of FPC ribbon cable with label YXK-T1129 and electrical connector

This is my boot log:


 BK7251_1.0.1_f
REG:cpsr        spsr        r13         r14
SVC:0x000000D3              0x6F292F6C  0x0E57DB04
IRQ:0x000000D2  0x00000010  0x84024BE3  0x8B6B11C1  
FIR:0x000000D1  0x00000010  0xF9FFF3FE  0xF09A2C98  
SYS:0x000000DF              0xFFFCF7DF  0xC5262710  
ST:0xA405DC91
J 0x10100

¦’˘j
[MEM DBG] heap init-------size:127824 addr:0x420cb0---------
[MEM DBG] heap init-------size:229376 addr:0x908000---------
[0;31m[1970-1-1 18:13:20.536  user_flash.c user_flash_yield_cfg_read(331) Error] Ĺ[1;33m[1970-1-1 18:13:20.536  tuya_ipc_dp_handler.c IPC_APP_get_yield_test_mode(1115) Debug] Ĺ[Flash]id:0xb4016
[Flash]init over
QSPi_init
QSPi_init1
sctrl_sta_ps_init
SDK Rev: 3.0.29
[STL]0 - 0
[RST]0 ~ 0
OSK Rev: F-3.0.20
cset:0 0 0 0
goto user main!!!!!!!!!!!!!!!!!!!!
hal_aes_init done
[01-01 18:12:15 TUYA I][mqc_app.c:350] mqc app init ...
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:300 cnt:1
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:302 cnt:2
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:304 cnt:3
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:307 cnt:4
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:308 cnt:5
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:312 cnt:6
[01-01 18:12:15 TUYA D][tuya_ipc_mqtt_subscribe.c:294] iot_register_extra_mqt_cb done
[01-01 18:12:15 TUYA I][uni_thread.c:220] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:5
[01-01 18:12:15 TUYA I][uni_thread.c:220] thread_create name:cmmod,stackDepth:4096,totalstackDepth:8192,priority:4
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:5 cnt:7
[01-01 18:12:15 TUYA D][mqc_app.c:144] mq_pro:31 cnt:8
[01-01 18:12:15 TUYA D][uni_thread.c:247] Thread:sys_timer Exec Start. Set to Running Stat
[01-01 18:12:15 TUYA D][svc_online_log.c:295] svc online log init success
[01-01 18:12:15 TUYA D][log_seq.c:892] read m:1 f:0 l:0
[01-01 18:12:15 TUYA I][uni_thread.c:220] thread_create name:wk_th-0,stackDepth:5120,totalstackDepth:13312,priority:3
[01-01 18:12:15 TUYA E][tuya_ws_db.c:326] kvs_read fails gw_bi -23
[01-01 18:12:15 TUYA D][ws_db_gw.c:159] gw base read finish:-18
[01-01 18:12:15 TUYA D][tuya_bt_sdk.c:92] ty bt cmmod regist ok:1
[01-01 18:12:15 TUYA D][tuya_ble_api.c:315] upd adv para, send conn_req beacon.
dev id key: 16
d4 1d 8c d9 8f 00 b2 04 e9 80 09 98 ec f8 42 7e 
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_port_init
ble start no ble name
[01-01 18:12:15 TUYA N][tuya_ble_api.c:650] ble sdk re_inited
[01-01 18:12:15 TUYA D][tuya_ble_active.c:520] bt active init
[01-01 18:12:15 TUYA N][tuya_bt_sdk.c:141] ty bt sdk init success finish
[0;34m[1970-1-1 18:12:15.154  tuya_device.c pre_device_init(162) Notice] firmware compiled at [Sep 13 2024 14:31:56][0;m
[PLATFORM DEBUG]bk_rst:0 tuya_rst:0
[0;34m[1970-1-1 18:12:15.168  tuya_device.c pre_device_init(163) Notice] system reset reason:[0][0;m
[FUNC]rwnxl_init
[01-01 18:12:15 TUYA D]
IP Rev: W4-3.0.29-P0
[uni_thread.c:247] Thre[bk]tx_txdesc_flush
txad:cmmod Exec Start. Se_txdesc_init: i=0, j=0,t to Running Stat
 ct=1
tx_txdesc_init: i=1, j=0, ct=1
tx_txdesc_init: i=2, j=0, ct=64
tx_txdesc_init: i=3, j=0, ct=4
tx_txdesc_init: i=4, j=0, ct=1
[FUNC]intc_init
[FUNC]calibration_main
user define rfcali mode:1 

rfcali_mode:1, 0
flash txpwr table:0x0
txpwr tabe in flash is unused
Load default txpwr for b:0x10e387
Load default txpwr for g:0x10e395
fit n20 table with dist:2
Load default txpwr for n40:0x10d246
Load default txpwr for ble:0x10e3a3
lpf_i & q in flash is:128, 128
found flash XTAL:16
xtal in flash is:16
xtal_cali:16
rwnx_tpc_pa_map_init
[FUNC]sdio_intf_init
[FUNC]ps_init
[FUNC]func_init_extended OVER!!!

start_type:0
Initializing TCP/IP stack
tcp_port:50272
bk_wlan_app_init finished
rf_thread_init ok
[01-01 18:12:15 TUYA D][tuya_ws_db.c:450] init fs. Path: null 
[01-01 18:12:15 TUYA D][kv_storge.c:46] *****************kvs_init. 
[01-01 18:12:15 TUYA N][simple_flash.c:407] key_addr: 0x397000   block_sz 4096
[01-01 18:12:15 TUYA N][simple_flash.c:496] get key:
0xc3 0x3d 0x40 0x5b 0x90 0xfa 0x59 0x81 0x20 0x31 0x54 0xd8 0x80 0xa9 0x8f 0xc 
[01-01 18:12:15 TUYA D][mf_core.c:38] mf_core_init success
[01-01 18:12:15 TUYA I][uni_thread.c:220] thread_create name:mf_test,stackDepth:5120,totalstackDepth:18432,priority:4
[01-01 18:12:16 TUYA D][uni_thread.c:243] enter Thread:mf_test func call
[01-01 18:12:16 TUYA D][tuya_uart.c:53] buffer size 4160
[01-01 18:12:16 TUYA D][uni_thread.c:247] Thread:mf_test Exec Start. Set to Running Stat
[01-01ble name:BK7231BT-01, d 18:12:16 TUYA D][uni_t9:c8:0c:bc:e2:ad
EM_BLhread.c:247] Thread:wk_E_END:0xef6
-----rw_math-0 Exec Start. Set to in task init----
Running Stat
BLE Rev: B4-3.0.29-P0
-----rw_main  start----
gapm_cmp_evt_handler operation = 0x1, status = 0x0 
gapm_cmp_evt_handler operation = 0x3, status = 0x0 
[PLATFORM NOTICE]STACK INIT OK
ble create new db
ble_env->start_hdl = 0xa
prf_task_id:120, state:1
[PLATFORM NOTICE]CREATE DB SUCCESS
[01-01 18:12:16 TUYA D][tuya_ble_api.c:543] rev ble event 3
[PLATFORM NOTICE]!!!!!!!!!!tuya_before_netcfg_cb
appm start advertising
gapm_cmp_evt_handler operation = 0x1b, status = 0x0 
[01-01 18:12:16 TUYA D][mf_test.c:355] mf thread delete
[01-01 18:12:16 TUYA D][uni_thread.c:307] Del Thrd:mf_test
[01-01 18:12:16 TUYA N][tuya_main.c:301] mf_init succ
[01-01 18:12:16 TUYA D][tuya_uart.c:53] buffer size 8
[01-01 18:12:16 TUYA D][tuya_main.c:307] gwcm_mode 0
[01-01 18:12:16 TUYA D][tuya_main.c:323] device_init in
[0;34m[1970-1-1 18:12:16.570  tuya_device.c device_init(583) Notice] firmware compiled at [Sep 13 2024 14:31:56][0;m
[PLATFORM DEBUG]bk_rst:0 tuya_rst:0
[0;34m[1970-1-1 18:12:16.578  tuya_device.c device_init(584) Notice] system reset reason:[0][0;m
[0;34m[1970-1-1 18:12:16.588  tuya_device.c device_init(585) Notice] 
  
   
 ***********device_init*******1****
[0;m
[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [6] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [4] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [3] init success

[01-01 18:12:16 TUYA N][tuya_drv_adc.c:536] adc init =0x9008cc,0x900800,0x900828. chn=4,5

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [13] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [5] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [25] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [28] init success

[01-01 18:12:16 TUYA N][tuya_peripheral.c:223] ty_gpio pin [7] init success

[01-01 18:12:16 TUYA N][machine.c:198] ns4150 driver_register success

[01-01 18:12:16 TUYA N][machine.c:129] ns4150 device_register success

[01-01 18:12:16 TUYA N][machine.c:79] match ns4150 success 

[01-01 18:12:16 TUYA N][snd_chip.c:48] snd chip register:ns4150 

[01-01 18:12:16 TUYA N][machine.c:50] snd_dev new name:ty_snd 

[01-01 18:12:16 TUYA N][machine.c:345] snd_dev_register 

[01-01 18:12:16 TUYA N][tuya_audio_api.c:60] tuya_audio_system_default_init success :ty_snd 

bk_dac_init
[PLATFORM NOTICE]bk7252 audio adc init
[01-01 18:12:16 TUYA N][tuya_drv_adc.c:536] adc init =0x9008ac,0x900800,0x900828. chn=2,0

[01-01 18:12:16 TUYA N][tuya_audio_api.c:242] snd dev open

[01-01 18:12:16 TUYA N][tuya_audio_api.c:181] tuya_audio_format set 16 1 8000

[01-01 18:12:16 TUYA I][uni_thread.c:220] thread_create name:ty_ao,stackDepth:2048,totalstackDepth:20480,priority:1
[01-01 18:12:16 TUYA D][uni_thread.c:125] del list not empty...deleting
[01-01 18:12:16 TUYA D][uni_thread.c:128] Thread:mf_test is still running..
[01-01 18:12:16 TUYA D][uni_thread.c:247] Thread:ty_ao Exec Start. Set to Running Stat
[01-01 18:12:16 TUYA D][uni_thread.c:265] Thread:mf_test Exec Finish. Set to Del Stat
[01-01 18:12:16 TUYA D][uni_thread.c:125] del list not empty...deleting
[01-01 18:12:16 TUYA D][uni_thread.c:132] Final Free Thread:mf_test, is_self:1
[01-01 18:12:16 TUYA D][uni_thread.c:138] delay to delete thread self
[01-01 18:12:16 TUYA D][uni_thread.c:149] finally delete thread self
fatfs: disk_initialize vol 0
===sd card open:0===
Not 4 line mode. skip config SD_D2(P18)
cmd 1:3 
sdcard cmd 8 timeout,cmdresp_int_reg:0x84
cmd8 noresp, voltage mismatch or Ver1.X SD or not SD
sdcard cmd 37 timeout,cmdresp_int_reg:0x84
send cmd55 err:3
send cmd55&cmd41 err, quite loop
Not 4 line mode. skip config SD_D2(P18)
cmd 1:3 
sdcard cmd 8 timeout,cmdresp_int_reg:0x84
cmd8 noresp, voltage mismatch or Ver1.X SD or not SD
sdcard cmd 37 timeout,cmdresp_int_reg:0x84
send cmd55 err:3
send cmd55&cmd41 err, quite loop
Not 4 line mode. skip config SD_D2(P18)
cmd 1:3 
sdcard cmd 8 timeout,cmdresp_int_reg:0x84
cmd8 noresp, voltage mismatch or Ver1.X SD or not SD
sdcard cmd 37 timeout,cmdresp_int_reg:0x84
send cmd55 err:3
send cmd55&cmd41 err, quite loop
sdcard_open err
[0;31m[1970-1-1 18:12:19.388  tuya_sdcard.c sd_mount(108) Error] -----mount fatfs fail-----
[0;m
[01-01 18:12:19 TUYA N][tuya_peripheral.c:223] ty_gpio pin [2] init success

[01-01 18:12:19 TUYA N][tuya_drv_adc.c:536] adc init =0x9008bc,0x900800,0x900828. chn=3,4

[01-01 18:12:19 TUYA I][uni_thread.c:220] thread_create name:ty_ps,stackDepth:2560,totalstackDepth:23040,priority:4
[0;37m[1970-1-1 18:12:19.420  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x8] success
[0;m
[0;37m[1970-1-1 18:12:19.428  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x600] success
[0;m
[0;37m[1970-1-1 18:12:19.438  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x80] success
[0;m
[0;37m[1970-1-1 18:12:19.446  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x2] success
[0;m
[0;37m[1970-1-1 18:12:19.456  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x600] success
[0;m
[0;37m[1970-1-1 18:12:19.464  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0xc3600] success
[0;m
[0;37m[1970-1-1 18:12:19.474  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x2c800] success
[0;m
[0;37m[1970-1-1 18:12:19.484  ty_ps.c ty_ps_subscribe(135) Info] subscribe event [0x10000] success
[0;m
[01-01 18:12:19 TUYA I][uni_thread.c:220] thread_create name:wk_th-0,stackDepth:1536,totalstackDepth:24576,priority:4
[01-01 18:12:19 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[0;31m[1970-1-1 18:12:19.510  user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default![0;m
[0;37m[1970-1-1 18:12:19.520  tuya_led_ctrl.c led_light_mode_set(214) Info] change led status => [8]
[0;m
[01-01 18:12:19 TUYA I][uni_thread.c:220] thread_create name:blue_led_light_ctrl,stackDepth:1024,totalstackDepth:25600,priority:1
[01-01 18:12:19 TUYA D][ipc_key.c:116] min_timer_period :10
[01-01 18:12:19 TUYA D][ipc_key.c:116] min_timer_period :10
[01-01 18:12:19 TUYA D][key_proc.c:62]  key_proc_init done !!!

[01-01 18:12:19 TUYA E][sys_timer.c:177] Start tm err:0 10000 1 -2
[0;31m[1970-1-1 18:12:19.564  tuya_device.c __check_device_status_init(520) Error] sys_start_timer error!
[0;m
[01-01 18:12:19 TUYA D][app_agent.c:413] lan disable
[01-01 18:12:19 TUYA N][tuya_iot_wifi_api.c:276] wifi soc init. pid:keytqn8773d8kwuu firmwarekey:keytqn8773d8kwuu ver:2.2.5
[01-01 18:12:19 TUYA D][tuya_svc_upgrade.c:789] tuya svc upgrade init success!
[PLATFORM DEBUG]bk_rst:0 tuya_rst:0
[01-01 18:12:19 TUYA N][tuya_devos_entry.c:1621] Last reset reason: 0
[01-01 18:12:19 TUYA D][ws_db_gw.c:159] gw base read finish:0
[01-01 18:12:19 TUYA D][tuya_tls.c:326] tls register constant 5cf609e002c9b430 EpSKADA266U9L681IqGGmCiE0CQAKriV b6cYMHHNcJmuncrKjvHb71sUpnWE4DJvBXuTP
[01-01 18:12:19 TUYA D][tuya_tls.c:269] load tls_ca_cnt fail. no ca in local db
[01-01 18:12:19 TUYA N][tuya_devos_entry.c:1110] serial_no:d8c80cbce2ad
rw_ieee80211_set_[0;31m[1970-1-1 18:12:1country code:
code: CN9.640  tuya_peripheral.
channel: 1 - 13
modec ty_peripheral_get_bat: MANUAL
bk_wlan cca c_volt(340) Error] volt=losed
[2812]
[0;m
[01-01 18:12:19 TUYA D][ws_db_gw.c:291] gw_wsm read success
[01-01 18:12:19 TUYA N][tuya_devos_entry.c:1141] gw_cntl.gw_wsm.stat:0
[01-01 18:12:19 TUYA D][tuya_devos_netcfg.c:628] <__gw_upd_nc_type> bcustom_mode:0, old_wf_start_mode: 0
[01-01 18:12:19 TUYA N][tuya_devos_netcfg.c:1294] gw_cntl->gw_wsm.nc_tp:2
[01-01 18:12:19 TUYA N][tuya_devos_netcfg.c:1295] gw_cntl->gw_wsm.md:0
[01-01 18:12:19 TUYA D][uni_network.c:403] set_dns_cache_priority:0
[01-01 18:12:19 TUYA D][ws_db_gw.c:454] gw_di read success
[01-01 18:12:19 TUYA D][tuya_devos_entry.c:764] stride from flash: 0.
[01-01 18:12:19 TUYA D][tuya_devos_entry.c:771] no actived, no upgrade:0
[01-01 18:12:19 TUYA N][tuya_devos_entry.c:1195] gw_cntl.gw_if.abi:0 input:0
[01-01 18:12:19 TUYA N][tuya_devos_entry.c:1196] gw_cntl.gw_if.product_key:keytqn8773d8kwuu, input:keytqn8773d8kwuu
[01-01 18:12:19 TUYA N][tuya_devos_entry.c:1197] gw_cntl.gw_if.tp:0, input:0
[01-01 18:12:19 TUYA N][tuya_devos_entry.c:1199] gw_cntl.gw_if.firmware_key:keytqn8773d8kwuu, input:keytqn8773d8kwuu
[01-01 18:12:19 TUYA D][ws_db_gw.c:579] gw_ai read success
[01-01 18:12:19 TUYA D][uni_network.c:417] set_dns_region:0
[01-01 18:12:19 TUYA D][tuya_devos_entry.c:1643] enter success_proc
[01-01 18:12:19 TUYA D][tuya_devos_health.c:37] init watchdog, interval: 60
[PLATFORM DEBUG]tuya_os_adapt_watchdog_init_start
[PLATFORM DEBUG]tuya_os_adapt_watchdog_init_start OK
[01-01 18:12:19 TUYA D][tuya_devos_health.c:318] watch_dog_interval:60, monitor_detect_interval:600
[01-01 18:12:19 TUYA I][uni_thread.c:220] thread_create name:health_monitor,stackDepth:1536,totalstackDepth:27136,priority:5
[01-01 18:12:19 TUYA D][mqc_app.c:144] mq_pro:11 cnt:9
[01-01 18:12:19 TUYA D][mqc_app.c:144] mq_pro:41 cnt:10
[01-01 18:12:19 TUYA D][mqc_app.c:144] mq_pro:100 cnt:11
[01-01 18:12:19 TUYA D][mqc_app.c:144] mq_pro:27 cnt:12
[01-01 18:12:19 TUYA N][tuya_bt_sdk.c:162] ty bt upd product:keytqn8773d8kwuu 1
[01-01 18:12:19 TUYA N][tuya_ble_api.c:415] upd product_id type:1 keytqn8773d8kwuu 5cf609e002c9b430 EpSKADA266U9L681IqGGmCiE0CQAKriV
[01-01 18:12:19 TUYA D][tuya_devos_netcfg.c:1044] nc_tp:2, md:0
[01-01 18:12:19 TUYA D][tuya_iot_wifi_api.c:415] register wifi network monitor. interval:1
[01-01 18:12:19 TUYA D][mqc_app.c:144] mq_pro:103 cnt:13
[0;3[01-01 18:12:19 TUYA D]4m[1970-1-1 18:12:19.85[uni_thread.c:247] Threa4  tuya_power_save.c tyd:health_monitor Exec S_power_save_deal_wake_start. Set to Running Stoure(161) Notice] 
--#at
[01-01 18:12:19 TUY3---sctrl_get_deep_sleeA D][tuya_devos_health.cp_wake_soure [0], gpio :30] feed watchdog
[PL[-1][0;m
ATFORM DEBUG]tuya_os_adapt_watchdog[01-01 18:12:19 TUYA E][0;31m[1970-1-1 18:12:_refresh
[uf_flash_fil19.888  tuya_peripheral.e_app.c:286] uf_open ipc ty_peripheralc_param _get_bat_volt(340) Errerr 8
[0;31m[1970-1-1 or] volt=[2814]
[0;m
18:12:19.900  user_flas
h.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default![0;m
[01-01 18:12:19 TUYA N][soc_camera.c:890] gc0328c driver_register success

[01-01 18:12:19 TUYA N][gc0328c.c:1018] gc0328c sensor init 
[01-01 18:12:19 TUYA N][soc_camera.c:890] gc0308c driver_register success

[01-01 18:12:19 TUYA N][gc0308c.c:860] gc0308c sensor init 
[01-01 18:12:19 TUYA N][soc_camera.c:890] gc0312c driver_register success

[01-01 18:12:19 TUYA N][gc0312c.c:1107] gc0312c sensor init 
[01-01 18:12:19 TUYA N][soc_camera.c:890] bf3703 driver_register success

[01-01 18:12:19 TUYA N][soc_camera.c:890] gc2145 driver_register success

[01-01 18:12:19 TUYA N][gc2145.c:1621] gc2145 sensor init 
[01-01 18:12:19 TUYA N][soc_camera.c:890] gc0329c driver_register success

[01-01 18:12:19 TUYA N][gc0329c.c:922] gc0329c sensor init 
[01-01 18:12:19 TUYA N][soc_camera.c:127] sensor_auto_recognite start
[01-01 18:12:19 TUYA D][uni_thread.c:2NACK: sending repeated addr
receive NACK from device addr 0x21 msg 0
NACK: sending repeated addr
receive NACK from device addr 0x21 msg 0
47] Thread:ty_ps Exec Start. Set to RunningNACK: sending repeated addr
receive NACK from device addr 0x21 msg 0
NACK: sending repeated addr
receive NACK from device addr 0x21 msg 0
 Stat
[01-01 18:12:20 TUYA D][uni_thread.cNACK: sending repeated addr
receive NACK from device addr 0x21 msg 0:247] Thread:wk_th-0 Ex
ec Start. Set to Running Stat
[0;31m[1970-1-1 18:12:20.036  tuya_peripheral.c ty_peripheNACK: sending repeated aral_get_bat_volt(340) Eddr
receive NACK from rror] volt=[2776]
[0;device addr 0x21 msg 0
m

[01-01 18:12:20 TUYA D][netcfg_module.c:13NACK: sending repeated addr
receive NACK from device addr 0x6e msg 0
2] type:0x10002,is_set:0
[01-01 18:12:20 TUYNACK: sending repeated addr
receive NACK from device addr 0x3c msg 0
A D][netcfg_module.c:132] type:0x10004,is_set:0
[01-01 18:12:20 TUYA N][gc0329c.c:547] GC0329_chip recognite
[01-01 18:12:20 TUYA N][gc0329c.c:574] GC0329_chip address: 49 ,chipid:192
[01-01 18:12:20 TUYA N][soc_camera.c:178] sensor_auto_recognite gc0329c
[01-01 18:12:20 TUYA N][soc_camera.c:815] gc0329c device_register success

[01-01 18:12:20 TUYA N][soc_camera.c:763] match gc0329c success 

[01-01 18:12:20 TUYA N][gc0329c.c:871] gc0329_probe success :92b490 31
[01-01 18:12:20 TUYA N][soc_camera.c:58] video_dev new name:ty_video 
[01-01 18:12:20 TUYA N][video_lib.c:154] tuya_soc_camera_init
[01-01 18:12:20 TUYA N][soc_host_for7252.c:832] bk add camera device complete
[01-01 18:12:20 TUYA D][netcfg_module.c:132] type:0x10002,is_set:1
[01-01 18:12:20 TUYA N][gc0329c.c:626] GC032_chip address: 49 ,chipid:0
[0;31m[1970-1-1 18:12:20.230  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[2605]
[0;m
[01-01 18:12:20 TUYA N][gc0329c.c:775] gc_0329_get_mbus_config
[01-01 18:12:20 TUYA N][soc_host_for7252.c:903] bk7252_set_crop:280-1E0
[01-01 18:12:20 TUYA N][soc_host_for7252.c:937] bk7252_set_fmt:4745504a 3c1f5012
[01-01 18:12:20 TUYA N][gc0329c.c:775] gc_0329_get_mbus_config
[01-01 18:12:20 TUYA N][vbq.c:73] vbq_init success:2
[PLATFORM DEBUG]ssid:SmartLife-E2AD key:  channnel: 6
[saap]MM_RESET_REQ
[bk]tx_txdesc_flush
tx_txdesc_init: i=0, j=0, ct=1
tx_txdesc_init: i=1, j=0, ct=1
tx_txdesc_init: i=2, j=0, ct=64
tx_txdesc_init: i=3, j=0, ct=4
tx_txdesc_init: i=4, j=0, ct=1
[saap]ME_CONFIG_REQ
[saap]ME_CHAN_CONFIG_REQ
[saap]MM_START_REQ
[csa]csa_in_progress[0:0]-clear
mm_add_if_req_handler:0
hapd_intf_add_vif,type:3, s:0, id:0
apm start with vif:0
------beacon_int_set:100 TU
set_active param 0
[msg]APM_STOP_CFM
update_ongoing_1_bcn_update
mm_set_vif_state_req_handler
vif_idx:0, ch_idx:0, bcmc_idx:2
update_ongoing_1_bcn_update
enter low level!
mac d8:c8: c:bc:e2:ac
leave low level!
[net]addvif_idx:0
uap_ip_start

configuring interface uap (with Static IP)def netif is no ap's netif, sending[0;37m[1970-1-1 18:12:20.426  tuya_device.c d[0;31m[1970-1-1 18:12:evice_init(661) Info] 
20.430  tuya_peripheral.
--#1---TUYA_APP_Init_Sc ty_peripheral_get_battream_Storage
[0;m
_volt(340) Error] volt=[[01-01 18:12:20 TUYA I]2599]
[0;m
[tuya_sdcard.c:207] Init Stream_Storage SD
Init tuya_ipc_ss_init[01-01 18:12:20 TUYA D][tuya_ipc_stream_storage.c:1902] Init stream_storage.base_path: v:0 a:0, max event per day 1500 skills 1
[01-01 18:12:20 TUYA I][uni_thread.c:220] thread_create name:disk_monitor,stackDepth:4096,totalstackDepth:31232,priority:2
[01-01 18:12:20 TUYA I][uni_thread.c:220] thread_create name:playback,stackDepth:5120,totalstackDepth:36352,priority:2
[01-01 18:12:20 TUYA D][tuya_ipc_stream_storage.c:2035] __ss_pb_video_main_task created 

[01-01 18:12:20 TUYA D][tuya_ipc_stream_storage.c:2062] stream storage task init success
[01-01 18:12:20 TUYA D][tuya_ipc_dp_handler.c:541]  create sd_format_mutex  
[01-01 18:12:20 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[0;31m[1970-1-1 18:12:20.514  user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default![0;m
[01-01 18:12:20 TUYA E][uf_flash_file_app.c:286] uf_open ipc_param err 8
[0;31m[1970-1-1 18:12:20.532  user_flash.c user_flash_read(117) Error] uf file ipc_param can't open and read data! use default![0;m
[01-01 18:12:20 TUYA E][tuya_ipc_stream_storage.c:1780] the ss mgr not inited, but msg buffered: set mode 1
[0;34m[1970-1-1 18:12:20.552  tuya_device.c __wait_online(553) Notice] wait online ...[0;m
 boardcast or no-subnet ip packets may failed
[01-01 18:12:20 TUYA D][ap_netcfg.c:800] start ap success:SmartLife-E2AD
[01-01 18:12:20 TUYA D][netcfg_module.c:132] type:0x10002,is_set:0
[01-01 18:12:20 TUYA D][netcfg_module.c:132] type:0x10004,is_set:0
[01-01 18:12:20 TUYA D][netcfg_module.c:132] type:0x10002,is_set:0
[01-01 18:12:20 TUYA D][netcfg_module.c:132] type:0x10004,is_set:0
[01-01 18:12:20 TUYA D][netcfg_module.c:368] netcfg module start type:0x10002
[01-01 18:12:20 TUYA D][netcfg_module.c:368] netcfg module start type:0x10004
[01-01 18:12:20 TUYA D][ap_netcfg.c:899] ap cfg start:65538
[01-01 18:12:20 TUYA D][uni_thread.c:247] Thread:udp_ap_v3 Exec Start. Set to Running Stat
[01-01 18:12:20 TUYA I][uni_thread.c:220] thread_create name:udp_ap_v3,stackDepth:3584,totalstackDepth:39936,priority:5
[01-01 18:12:20 TUYA D][netcfg_module.c:115] start 0x10002 ret:0
[01-01 18:12:20 TUYA D][bt_netcfg.c:117] bt netcfg start
[01-01 18:12:20 TUYA N][tuya_ble_api.c:439] update bound stat:0
[01-01 18:12:20 TUYA D][netcfg_module.c:115] start 0x10004 ret:0
[01-01 18:12:20 TUYA D][tuya_ble_api.c:315] upd adv para, send conn_req beacon.
dev id key: 16
6d 65 25 f2 34 fb 69 34 74 0e 9e fc 3d 01 87 49 
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_reset_adv
[01-01 18:12:20 TUYA N][tuya_ble_api.c:727] ble adv && resp changed
fetch msg success. event type = [0x80]
gapm_cmp_evt_handler operat[0;31m[1970-1-1 18:12:20.684  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[2596]
[0;m
ion = 0x10, status = 0x0 
[01-01 18:12:20 TUYA D][uni_thread.c:247] Thread:disk_monitor Exec Start. Set to Running Stat
[01-01 18:12:20 TUYA D][tuya_ipc_stream_storage.c:1454] SD task begin___
[01-01 18:12:20 TUYA D][tuya_ipc_stream_storage.c:1465] sd card status 5
[01-01 18:12:20 TUYA D][tuya_ipc_stream_storage.c:1468] report sd status 0 -> 5

[01-01 18:12:20 TUYA D][smart_frame.c:3400] dp filtered, dev no act
[01-01 18:12:20 TUYA E][tuya_ipc_stream_storage.c:1782] storage not inited
[01-01 18:12:20 TUYA D][uni_thread.c:247] Thread:playback Exec Start. Set to Running Stat
[01-01 18:12:20 TUYA D][uni_thread.c:247] Thread:blue_led_light_ Exec Start. Set to Running Stat
[01-01 18:12:20 TUYA D][tuya_iot_wifi_api.c:381] wifi netstat changed to:2  -->>
[0;37m[1970-1-1 18:12:20.854  tuya_device.c __wifi_status_cb(426) Info] wf_nw_status_cb,wifi_status:2[0;m
[0;37m[1970-1-1 18:12:20.858  tuya_led_ctrl.c led_light_mode_set(214) Info] change led status => [9]
[0;m
[01-01 18:12:20 TUYA D][tuya_iot_wifi_api.c:384] wifi netstat changed to:2  <<--
[0;31m[1970-1-1 18:12:20.890  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[2595]
[0;m
publish event [0x80] success
[0;31m[1970-1-1 18:12:21.102  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[2595]
[0;m
[0;31m[1970-1-1 18:12:21.300  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[2591]
[0;m
[0;31m[1970-1-1 18:12:21.512  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[2591]
[0;m
[0;34m[1970-1-1 18:12:21.580  tuya_device.c __wait_online(553) Notice] wait online ...[0;m
[0;31m[1970-1-1 18:12:21.720  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[2591]
[0;m
[0;31m[1970-1-1 18:12:21.932  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[2592]
[0;m
[0;31m[1970-1-1 18:12:22.132  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[2592]
[0;m
[0;31m[1970-1-1 18:12:22.332  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[2591]
[0;m
----------------------------------abs2_timeout_reset_agc
[0;31m[1970-1-1 18:12:22.532  tuya_peripheral.c ty_peripheral_get_bat_volt(340) Error] volt=[2555]
[0;m
[0;33m[1970-1-1 18:12:22.532  tuya_power.c check_power_to_sleep(205) Warn] detect battery low power. [0] < [5]  power off
[0;m
fetch msg success. event type = [0x8]
[01-01 18:12:22 TUYA E][tuya_ipc_stream_storage.c:1780] the ss mgr not inited, but msg buffered: set mode 0
[01-01 18:12:22 TUYA D][tuya_ipc_stream_storage.c:4262] stop all pb videos
[01-01 18:12:22 TUYA D][tuya_ipc_stream_storage.c:4093] stop pb:0
[01-01 18:12:22 TUYA D][tuya_ipc_stream_storage.c:4127] stop pb:0
[0;37m[1970-1-1 18:12:22.572  tuya_sdcard.c sd_unmount(131) Info] -----unmount fatfs success-----
[0;m
publish event [0x8] success
[0;34m[1970-1-1 18:12:22.600  tuya_device.c __wait_online(553) Notice] wait online ...[0;m
[0;34m[1970-1-1 18:12:23.620  tuya_device.c __wait_online(553) Notice] wait online ...[0;m
[0;34m[1970-1-1 18:12:24.640  tuya_device.c __wait_online(553) Notice] wait online ...[0;m
[01-01 18:12:24 TUYA D][tuya_devos_health.c:30] feed watchdog
[PLATFORM DEBUG]tuya_os_adapt_watchdog_refresh
[0;34m[1970-1-1 18:12:25.660  tuya_device.c __wait_online(553) Notice] wait online ...[0;m
[01-01 18:12:25 TUYA D][tuya_ipc_stream_storage.c:1465] sd card status 5
[0;34m[1970-1-1 18:12:26.680  tuya_device.c __wait_online(553) Notice] wait online ...[0;m
---enter deep sleep :wake up with gpio 0~31 ps: 0x2020 0x2020

Important, I guess? Is yours the same?


[01-01 18:12:20 TUYA N][gc0329c.c:547] GC0329_chip recognite
[01-01 18:12:20 TUYA N][gc0329c.c:574] GC0329_chip address: 49 ,chipid:192
[01-01 18:12:20 TUYA N][soc_camera.c:178] sensor_auto_recognite gc0329c
[01-01 18:12:20 TUYA N][soc_camera.c:815] gc0329c device_register success

Helpful post? Buy me a coffee.

#49 21714547 08 Oct 2025 23:55

divadiow divadiow

Level 36

Helpful post? (0)

Post #49
21714547 08 Oct 2025 23:55

p.kaczmarek2 wrote:
Important, I guess? Is yours the same?

mine seems to be GC0328C
#50 21714554 09 Oct 2025 00:24

insmod insmod

Level 29

Helpful post? (+1)

Post #50
21714554 09 Oct 2025 00:24

>>21714541
Since it's a 24pin camera, would it work in ESP32-CAM?

BL602 update.
SHA256 verify on both read and write.
Erase hack

Added after 9 [minutes]:

Plus added 1mb partitions

>>21714477
If command timed out - then flashloader died. Reset is needed.
#51 21714622 09 Oct 2025 07:08

divadiow divadiow

Level 36

Helpful post? (0)

Post #51
21714622 09 Oct 2025 07:08

insmod wrote:
Since it's a 24pin camera, would it work in ESP32-CAM?

I'll have to get one now to find out 😌

insmod wrote:
BL602 update.
SHA256 verify on both read and write.
Erase hack

i'm not getting past erase step at any baud with 1mb

erase all attempt in same session

4mb backup/flash new seems ok still

921600 baud is max for any BL602 operation it seems - sync fail anything higher

Added after 10 [minutes]:

EF quits if COM port open when trying BL operations
Code: Text
Log in, to see the code
#52 21714729 09 Oct 2025 09:35

insmod insmod

Level 29

Helpful post? (0)

Post #52
21714729 09 Oct 2025 09:35

>>21714622
Ai-WB2-12f module works fine for me with 1500000 baud.
On 1mb, for how long have you tried to wait?
#53 21714737 09 Oct 2025 09:41

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #53
21714737 09 Oct 2025 09:41

It seems we still can improve SPI flash operation a bit. I've described a problem there:
https://www.elektroda.com/rtvforum/topic4073760.html#21714732
Long story short, it seems UnprotectFlash has to be expanded to follow logic from AsProgrammer. I couldn't reflash my BK7252 doorbell without it. Interestingly enough, the problem occured for the first time after many flash cycles...

I think we also need a checkbox for reset state so I can easily enter SPI mode (and exit it ) from gui.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#54 21714772 09 Oct 2025 10:11

divadiow divadiow

Level 36

Helpful post? (0)

Post #54
21714772 09 Oct 2025 10:11

insmod wrote:
On 1mb, for how long have you tried to wait?

15mins:

#55 21715543 10 Oct 2025 04:30

insmod insmod

Level 29

Post #55

21715543 10 Oct 2025 04:30

>>21714772

Flasher mode: BL602
Going to open port: COM6.
Port ready!
Sync attempt 0/1000 ... failed, will retry!
Sync attempt 1/1000 ... failed, will retry!
If doing something immediately after another operation, it might not sync for about half a minute
Otherwise, please pull high BOOT/IO8 and reset.
Sync attempt 2/1000 ... failed, will retry!
Sync attempt 3/1000 ... failed, will retry!
Sync attempt 4/1000 ... failed, will retry!
Sync attempt 5/1000 ... failed, will retry!
Sync attempt 6/1000 ... failed, will retry!
Sync attempt 7/1000 ... failed, will retry!
Sync attempt 8/1000 ... failed, will retry!
Sync attempt 9/1000 ... failed, will retry!
Sync attempt 10/1000 ... OK!
Command fail!
Flash ID: C2201480
Flash size is 1MB
Eflash loader is already uploaded!
Writing boot...
Erasing at 0x0 len 0x10000
Starting flash write 65536
.0..4092..8184..12276..16368..20460..24552..28644..32736..36828..40920..45012..49104..53196..57288..61380..65472.
Hash matches 1B8790157DA37D8FECCE0A333BABCCAB3A6DCAF4DCF89D334E2B0338D107A3FB!
Done flash write 65536
Reading firmwares/OpenBL602_1.18.189.bin...
Erasing at 0x10000 len 0xBD000
Starting flash write 771136
.0..4092..8184..12276..16368..20460..24552..28644..32736..36828..40920..45012..49104..53196..57288..61380..65472..69564..73656..77748..81840..85932..90024..94116..98208..102300..106392..110484..114576..118668..122760..126852..130944..135036..139128..143220..147312..151404..155496..159588..163680..167772..171864..175956..180048..184140..188232..192324..196416..200508..204600..208692..212784..216876..220968..225060..229152..233244..237336..241428..245520..249612..253704..257796..261888..265980..270072..274164..278256..282348..286440..290532..294624..298716..302808..306900..310992..315084..319176..323268..327360..331452..335544..339636..343728..347820..351912..356004..360096..364188..368280..372372..376464..380556..384648..388740..392832..396924..401016..405108..409200..413292..417384..421476..425568..429660..433752..437844..441936..446028..450120..454212..458304..462396..466488..470580..474672..478764..482856..486948..491040..495132..499224..503316..507408..511500..515592..519684..523776..527868..531960..536052..540144..544236..548328..552420..556512..560604..564696..568788..572880..576972..581064..585156..589248..593340..597432..601524..605616..609708..613800..617892..621984..626076..630168..634260..638352..642444..646536..650628..654720..658812..662904..666996..671088..675180..679272..683364..687456..691548..695640..699732..703824..707916..712008..716100..720192..724284..728376..732468..736560..740652..744744..748836..752928..757020..761112..765204..769296.
Hash matches 4B624D83990004DA328891B8004DDE7E8B9912EA0BAC47B6A4B356B213304698!
Done flash write 771136
Writing dts...
Erasing at 0xFC000 len 0x4000
Starting flash write 16384
.0..4092..8184..12276..16368.
Hash matches 6400B648247B176B90E14E638CBE80BC2B106ADA6CF7E51DCC4F020C3C2D2A87!
Done flash write 16384

I don't get any output after flashing though
Disabled dts, and it booted.

Added after 19 [minutes]:

Uploaded small fix so that dts erase wouldn't erase boot

Added after 5 [hours] 47 [minutes]:

Added BL602 config read/write.
Since easyflash on BL602 uses granularity value of 8, instead of default 1 - this forced me to compile and add 2 new dlls.

Moved easyflash dll's/so's to separate folder.
Exe will now be packed in workflow, resulting in a single binary (except easyflash, since they're native libraries).

Ready to merge?

#56 21715695 10 Oct 2025 08:48

divadiow divadiow

Level 36

Helpful post? (0)

Post #56
21715695 10 Oct 2025 08:48

damn. ok. trusty USB-TTL taken offline for refurb or something. can't get above 921600 with another CH340 still but it does erase/write 1mb. Will try other adaptors too.

BLDC is OK at 2000000 erase/write with both CH340 but maybe it's more forgiving/does retries - not that there's obvious sign of correction/retry in log I don't think.

anyway, good work.

Added after 20 [minutes]:

'FTDI' also doesn't erase (for me).
no matter perhaps. everyone's setups differ, so many variables etc. I could probably find other 1mb module and it may be different.

I'm using BLDC as a benchmark and it does continue to erase/write 1mb with these adaptors and at 2m baud.

This full erase with fake FTDI also has fewer 'erase pending' for whole chip, so maybe they are retries. lower the baud to 1mb and 'erase pending' is listed only once.

Added after 6 [minutes]:

I've the decompiled BLDC Python guts somewhere if that's of any interest? But I'm sure you could do that anyway if wanted.
#57 21715874 10 Oct 2025 11:10

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #57
21715874 10 Oct 2025 11:10

By the way, regarding futher testing and improvements, I've got this idea - we have some of the core features messy (write offset management for QIO/UA hacks, etc), maybe I could create a "Beken UART chip simulator", probably as a C# class, and move Serial port data to abstraction layer? Then I could introduce automatic testing, like I did for OBK itself. Still, it probably is not worth the effort... maybe just for fun.

Second idea: I wonder how much those devices are prone to delays. Could we flash over TCP? Implement Serial backend as TCP to second Beken device (or ESP device) and use this device as a flasher. We would need to plug a 50ms delay before Serial Write and check how Beken behaves. Probably bad.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

#58 21716222 10 Oct 2025 17:33

insmod insmod

Level 29

Post #58

21716222 10 Oct 2025 17:33

>>21715874
Don't think it's worth the effort, plus it would be beken only, so testing would miss if other chips flashers are broken.

Improved BL602 erase logging

Flasher mode: BL602
Going to open port: COM7.
Port ready!
Sync attempt 0/1000 ... OK!
Command fail!
Flash ID: 5E401680
Flash size is 4MB
Eflash loader is already uploaded!
Writing boot...
Erasing from 0x0 to 0x10000
Erase pending...
Starting flash write 65536
.0..4092..8184..12276..16368..20460..24552..28644..32736..36828..40920..45012..49104..53196..57288..61380..65472.
Hash matches 330D7EBF8709EB425BE083DEC50DA987399B363AA7C1E87132B2A629AB05BCC4!
Done flash write 65536
Reading firmwares/OpenBL602_1.18.189.bin...
Erasing from 0x10000 to 0xCD000
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Starting flash write 771136
.0..4092..8184..12276..16368..20460..24552..28644..32736..36828..40920..45012..49104..53196..57288..61380..65472..69564..73656..77748..81840..85932..90024..94116..98208..102300..106392..110484..114576..118668..122760..126852..130944..135036..139128..143220..147312..151404..155496..159588..163680..167772..171864..175956..180048..184140..188232..192324..196416..200508..204600..208692..212784..216876..220968..225060..229152..233244..237336..241428..245520..249612..253704..257796..261888..265980..270072..274164..278256..282348..286440..290532..294624..298716..302808..306900..310992..315084..319176..323268..327360..331452..335544..339636..343728..347820..351912..356004..360096..364188..368280..372372..376464..380556..384648..388740..392832..396924..401016..405108..409200..413292..417384..421476..425568..429660..433752..437844..441936..446028..450120..454212..458304..462396..466488..470580..474672..478764..482856..486948..491040..495132..499224..503316..507408..511500..515592..519684..523776..527868..531960..536052..540144..544236..548328..552420..556512..560604..564696..568788..572880..576972..581064..585156..589248..593340..597432..601524..605616..609708..613800..617892..621984..626076..630168..634260..638352..642444..646536..650628..654720..658812..662904..666996..671088..675180..679272..683364..687456..691548..695640..699732..703824..707916..712008..716100..720192..724284..728376..732468..736560..740652..744744..748836..752928..757020..761112..765204..769296.
Hash matches 4B624D83990004DA328891B8004DDE7E8B9912EA0BAC47B6A4B356B213304698!
Done flash write 771136
Writing dts...
Erasing from 0x1FC000 to 0x200000
Erase pending...
Erase pending...
Erase pending...
Erase pending...
Starting flash write 16384
.0..4092..8184..12276..16368.
Hash matches 6400B648247B176B90E14E638CBE80BC2B106ADA6CF7E51DCC4F020C3C2D2A87!
Done flash write 16384

Added after 2 [minutes]:

And suddenly read/write with 2000000 br works for me on CH340 esp adapter board.

#59 21716347 10 Oct 2025 20:24

divadiow divadiow

Level 36

Helpful post? (0)

Post #59
21716347 10 Oct 2025 20:24

cool. will do more BL602 flashing. Just checking Beken SPI is OK with WIP BK7252U doorbell dev board

it'd be cool if you could download QIO for BK7252, BK7231U/T
#60 21716364 10 Oct 2025 21:41

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Topic author Helpful post? (0)

Post #60
21716364 10 Oct 2025 21:41

I've decided to play a bit with possibility to flash from another Beken. NiceMCU, UART test.
Code: text Expand Select all Copy to clipboard
uartInit 115200 uartSendASCII Hello123

Well, I can send from BK7238 to PC, but can't BK7238 can't see what I send from PC. I'm investigating.

Ahh, UART debug tool has a buffer overrun. Probably from XJ PR? Not sure...

I am planning to check if I can connect one NiceMCU to my Arduino-Wemos-CB3S via UART1 and GPIO for CEN and try to remotely CEN it and do some bootloader operation.

Added after 2 [minutes]:

Ok step 1:

Added after 3 [minutes]:

Added after 28 [minutes]:

It can get bus:
Code: C#
Log in, to see the code

Added after 9 [minutes]:

Added after 20 [minutes]:

It's reading, it seems:

I guess I need to merge your PR today @insmod , so I can split serial backend into "hardware" serial and "TCP TO UART" serial

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

Topic summary

BK7231GUIFlashTool version 98 and later introduces a new SPI flashing method for Beken BK7231/BK7252 devices using only a CH341 SPI programmer. This method enables recovery of bricked devices with overwritten bootloaders and functions as a general-purpose SPI flasher supporting various memory chips. The approach builds on previous SPI programming techniques using Python and Banana Pi, adapting them for CH341 hardware and C# implementation. Required hardware includes a CH341 programmer and soldering tools for wire attachment. Recent user feedback on version 98 highlights issues such as the tool requiring a COM port selection in SPI mode, lack of CH341A detection warnings, and missing ch341dll.dll errors. The developer has addressed the COM port requirement and plans to add the missing DLL, requesting further debugging via Visual Studio to handle CH341 initialization exceptions.
Summary generated by the language model.

Home page
/
Forum
/
Smart Home
/
Smart Home IoT
/
Smart Home Guides
/
Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

FAQ

TL;DR: New BK7231GUIFlashTool v98+ adds SPI flashing for Beken chips; sample 4,096 KB flash detected. “Only a CH341 SPI programmer is required.” Use CH341A D2 to toggle CEN, send 0xD2, then read/write like generic SPI. [Elektroda, p.kaczmarek2, post #21711721]

Why it matters: It lets you recover bricked BK7231/BK7252 devices without a working bootloader, using low‑cost tools.

Who this is for: DIYers, repair techs, and firmware engineers asking how to unbrick or mass‑flash Beken SoCs via SPI with a CH341A and the latest tool.

Quick Facts

- Hardware: CH341A set to I2C position so Windows shows “USB‑EPP/I2C… CH341A”; wire D2→CEN, and P20–P23 for SCK/CSN/SI/SO. [Elektroda, p.kaczmarek2, post #21711721]
- Enter SPI mode: reset CEN via D2, stream 0xD2, then JEDEC 0x9F; sample ID FF‑EF‑40‑16 → 4,096 KB. [Elektroda, p.kaczmarek2, post #21711721]
- Common setup fix: in v99, COM is no longer mandatory in SPI mode; add CH341DLL if the GitHub build complains. [Elektroda, divadiow, post #21712310]
- Linux/mono: mono 6.12 works; max stable baud typically 921,600; LAN scanner and downloader tested. [Elektroda, insmod, post #21712663]
- Recovery scope: Works even when the BK bootloader is overwritten; can serve as a generic SPI flasher too. [Elektroda, p.kaczmarek2, post #21711721]

What exactly is the new Beken SPI flashing method and what do I need?

The tool drives CH341A as an SPI master, resets BK via CEN on D2, sends 0xD2 to enter BK’s SPI-memory mode, then treats the chip like a standard SPI flash. You need a CH341A (jumper at I2C), 3.3 V power, and wiring for P20–P23 (SCK/CSN/SI/SO) plus CEN. Select “Beken SPI” in BK7231GUIFlashTool v98+. “Only a CH341 SPI programmer is required.” [Elektroda, p.kaczmarek2, post #21711721]

How do I wire CH341A to BK7231/BK7252 for SPI mode?

Connect CH341A SCK→P20, CS0→P21, MOSI→P22 (SI), MISO→P23 (SO), and D2→CEN. Keep MOSI→SI and MISO→SO mapping. Provide GND and target power. Some boards have pads labeled CE/TCK/TMS/TDI/TDO that map to CEN/SCK/CSN/SI/SO respectively. [Elektroda, p.kaczmarek2, post #21711721]

How do I reliably enter BK SPI mode? (3‑step)

Use CH341 D2 to pull CEN low then high to reset the BK chip. 2. Stream 0xD2 bytes repeatedly over SPI. 3. Issue 0x9F and confirm a valid JEDEC response; then proceed to Read/Write/Erase. [Elektroda, p.kaczmarek2, post #21711721]

I get “Failed to open CH341 device” or “Failed to toggle CEN.” What should I check?

Confirm CH341A is jumpered to I2C, recognized by Windows, and the D2 wire is soldered to CEN. Re‑seat USB, power the target, and verify SPI lines. The tool logs these errors when CH341 isn’t detected or CEN can’t be driven; fix wiring or driver, then retry. [Elektroda, p.kaczmarek2, post #21711721]

The app says “missing ch341dll.dll” or quits in SPI mode—how do I fix that?

Place CH341DLL.DLL alongside the GitHub build, or build from source in Visual Studio. Earlier builds could exit if CH341A wasn’t present; recent fixes improved handling, but adding the DLL resolved missing‑library errors during testing. [Elektroda, divadiow, post #21712310]

Do I need to select a COM port for SPI flashing?

No. As of v99, SPI mode does not require a COM port. This was confirmed after fixes; previous v98 prompts were removed. Ensure CH341A is connected; SPI operations run without a serial port. [Elektroda, divadiow, post #21712310]

What does the Verify button do?

Verify compares flash contents against the firmware file currently selected in the tool. Use it after Write or Erase to confirm success. “Verify verifies against selected firmware.” [Elektroda, p.kaczmarek2, post #21712551]

Can this recover a bricked BK7252 camera?

Yes. After wiring CEN and SPI lines, use Beken SPI mode to read/erase/write. The author provides a BK7252 camera recovery example using this exact method with CH341A and the new flasher. [Elektroda, p.kaczmarek2, post #21711721]

Can I use CH341 Programmer or NeoProgrammer once SPI mode is active?

Yes. After the 0xD2 hand‑off, the BK behaves like a generic SPI flash. You can then operate with common SPI flash tools (CH341 Programmer or NeoProgrammer) if you prefer. [Elektroda, p.kaczmarek2, post #21711721]

Linux support: what baud rates are stable under mono?

Mono 6.12 worked for testers. They reported stable operation at 921,600 baud; 1,500,000 worked on Windows, but they lowered to 921,600 on Linux. LAN Scanner and release downloader also worked. [Elektroda, insmod, post #21712663]

The tool shows a 4,096 KB device. Is that normal for these chips?

Yes. A sample JEDEC ID FF‑EF‑40‑16 decoded to 4,096 KB and printed by the tool. That confirms JEDEC read and size decoding in SPI mode. Actual sizes vary by module; always check the tool’s detected flash size. [Elektroda, p.kaczmarek2, post #21711721]

How do I just switch a BK device into SPI mode without reading or writing?

Use the new “Detect” button. It performs a zero‑length custom operation to toggle CEN and send the 0xD2 sync, placing the chip in SPI mode for use with other SPI tools. [Elektroda, p.kaczmarek2, post #21731041]

I flashed many times and now erase fails. What should I try?

Expand Unprotect logic before erase, similar to AsProgrammer. A contributor noted needing stronger Unprotect after many BK7252 cycles. Add an Unprotect/Status-Register release step, then retry the erase/write. [Elektroda, p.kaczmarek2, post #21714737]

What is OpenBeken (OBK) in this context?

OpenBeken is an open‑source firmware used across supported Wi‑Fi MCUs in this ecosystem. The author uses OBK devices for testing and demos, including camera boards and remote flashing concepts. [Elektroda, p.kaczmarek2, post #21714427]

Can I flash a BK device over Wi‑Fi/TCP instead of USB?

Yes, a Wi‑Fi flasher demo proxies UART over TCP and controls CEN via an OBK device. It’s a separate utility that mirrors the BK UART routines, useful when PC‑to‑target wiring is hard. [Elektroda, p.kaczmarek2, post #21720013]

Any known edge cases or failure symptoms I should expect?

If CH341DLL is missing, some GitHub builds previously exited. On mono/Linux, 1,500,000 baud may fail while 921,600 works. Also, after heavy cycling, protection bits may block erase until Unprotect expands. Address each symptom as noted, then retry. [Elektroda, divadiow, post #21712310]