logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
Thinking about a 3D printer?
Thinking about a 3D printer? Last days of the promotion »
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

p.kaczmarek2 15525 393

TL;DR

  • BK7231GUIFlashTool v98+ adds CH341-based SPI flashing and recovery for Beken BK7231/BK7252 chips, including bricked devices with overwritten bootloaders.
  • The tool uses CH341 DLL C# bindings to toggle CEN via D2, reset the chip, send 0xD2, then flash Beken chips like generic SPI memory.
  • Connections use P20, P21, P22, and P23 for SCK, CSN, SI, and SO, with CEN wired to D2 and the CH341 jumper set to I2C mode.
  • A sample read identifies JEDEC ID FF-EF-40-16 and a 4096 KB flash, and the same tool can Read, Write, Verify, and Erase firmware.
  • If CH341 is not detected or CEN toggle fails, check driver configuration, jumper position, SPI wiring, and power before trying Beken SPI mode again.
Summary generated by AI based on the discussion content.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):

  • Flash size leak when switching chip modes

    #361 21930656
    divadiow
    Level 38  
    Posts: 5153
    Help: 442
    Rate: 906
    p.kaczmarek2 wrote:
    BK7231 changes - I see you're saying they are checked, but are they really correct? Hardcoded 4 MB flash? Just making sure.


    I guess you mean BK7252_MAX_FLASH_SIZE https://github.com/divadiow/BK7231GUIFlashToo...d72fe/BK7231Flasher/Flashers/BK7231Flasher.cs

    This was a safety constraint because if flash is blank, wrap-around detection can become ambiguous and keeps wrapping upwards

    The known BK7252U variants are 2MB and 4MB, so the detector only considers those sizes and will not infer anything larger from mirrored/blank reads. Worst-case a read will have a mirror at 2mb and likely only when flash is blank anyway.

    BK7231T/U are still reset to the existing 2MB size during setup

    seems there is an edge case where 
    FLASH_SIZE
    could leak changing between chip modes, which I don't think is likely to be seen:

    eg
    1. Use BK7252U.
    2. Detect a 4MB chip, so FLASH_SIZE becomes 0x400000.
    3 .Without restarting the app, switch chip type to BK7231T/U.
    etc

    I have a fix for that if you think it should be in

    Added after 15 [minutes]:

    leakage also possible if switching to jedec ID flash size set chips. unlikely to matter much though?
  • ADVERTISEMENT

  • CMP/TB bit clearing added to flash tool

    #362 21931235
    divadiow
    Level 38  
    Posts: 5153
    Help: 442
    Rate: 906
    divadiow wrote:
    14: CMP/TB seems to be the one


    Pivoting to ASProgrammer just to clear this bit to be able to erase/write to flash is a pain. So here's added bit checks, clearance of CMP and recheck.

    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

    https://github.com/openshwprojects/BK7231GUIFlashTool/pull/148

    Added after 6 [minutes]:

    wire in flash list lookup
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

    Added after 9 [hours] 16 [minutes]:

    added 39 new flash IDs from latest BKFIL
    added SPI general info file for Generic/Beken SPI mode use

    eg
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs
  • #363 21931376
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14699
    Help: 656
    Rate: 12743
    Nice, now it makes me wonder, did I actually add a feature to specify flash size by hand and ignore ID check? There are some flash chips that have locked JEDEC ID readout but still can be read.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT

  • BKFIL requires usable JEDEC ID in SPI mode

    #364 21931382
    divadiow
    Level 38  
    Posts: 5153
    Help: 442
    Rate: 906
    as far as I can tell EF in SPI modes MUST get a usable JEDEC ID first

    Added after 6 [minutes]:

    back to the BKFlashList, BKFIL has these differences compared to EF when anchoring on MID
    Code: Text
    Log in, to see the code

  • Flashing tool fits BK7231/BK7252 boards well

    #366 21931747
    divadiow
    Level 38  
    Posts: 5153
    Help: 442
    Rate: 906
    nice fit

    Screenshot of BK7231 Easy UART Flasher showing the message “Doing nothing..”

    Added after 3 [hours] 44 [minutes]:

    speedy. no progress bar with compression box checked though
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

    Added after 4 [minutes]:


    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

    Added after 9 [hours] 30 [minutes]:

    playing with something else
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

    Added after 11 [hours] 25 [minutes]:

    reasonable platforms.md starting point?
    https://github.com/openshwprojects/BK7231GUIFlashTool/pull/149

    because it's not in other branches, I've been failing to update it as I check features on different platforms. It's be good if it was merged so it can be dipped into bit by bit?

    so, draft, some statuses and the notes need review.

    these have been the definitions used for these two statuses. Needs checking basically exists because I wasn't sure if the feature was implemented or not applicable to the platform

    Code: Text
    Log in, to see the code
  • #368 21932413
    divadiow
    Level 38  
    Posts: 5153
    Help: 442
    Rate: 906
    insmod wrote:
    RF restore/reloc should be BK/ECR only. Not applicable otherwise

    ta. changed. and a couple more

    For Beken I think erase needs changing to erase whole flash on all but the obvious ones - T/U/7252U.

    Added after 7 [minutes]:

    insmod wrote:
    5


    Screenshot of BK7231 Easy UART Flasher showing “Read complete!” and a read operation logScreenshot of BK7231 Easy UART Flasher showing “Write done” and flashing log output.
  • #370 21933124
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14699
    Help: 656
    Rate: 12743
    Seems very nice, can you explain what's this? Also... is this form section to choose UART settings DRY? With no code duplication?
    Screenshot of BK7231 Easy UART Flasher showing chip type dropdown and COM port settings
    Helpful post? Buy me a coffee.

  • ROM/OTP/eFuse reader with UART download instructions

    #371 21933130
    divadiow
    Level 38  
    Posts: 5153
    Help: 442
    Rate: 906
    I've taken as DRY as an approach as possible I believe. WIP https://github.com/divadiow/BK7231GUIFlashTool/tree/rom

    it's just a ROM/OTP/eFuse reader for different platforms. Requires some updated ramcode/stubs which @insmod has been working on.

    Added after 4 [minutes]:

    includes basic uart download mode instructions which could be re-used for main flasher https://github.com/openshwprojects/BK7231GUIF...1b24e728254b9faa6ba2e4030b11ef4bb9b157e292186
  • #373 21933965
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14699
    Help: 656
    Rate: 12743
    Nice, merged, let me know if any futher PRs are ready.
    Helpful post? Buy me a coffee.
  • #376 21934479
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14699
    Help: 656
    Rate: 12743
    Great! Can I have "skip JEDEC Flash ID" feature (along with ability to read custom flash size, since no JEDEC FLAsh id check means we won't know the flash size automatically)?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #377 21934481
    divadiow
    Level 38  
    Posts: 5153
    Help: 442
    Rate: 906
    p.kaczmarek2 wrote:
    Great! Can I have "skip JEDEC Flash ID" feature (along with ability to read custom flash size, since no JEDEC FLAsh id check means we won't know the flash size automatically)?


    yep!
  • #378 21934494
    insmod
    Level 31  
    Posts: 1424
    Help: 164
    Rate: 446
    >>21934479
    Why?
    I used flash id request as a stub synchronization on ECR-based stubs (except for GD32).
  • #379 21934551
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14699
    Help: 656
    Rate: 12743
    >>21934494 I want to use this flasher for such flash chips:
    https://www.elektroda.com/rtvforum/topic4166606.html
    Helpful post? Buy me a coffee.

  • Asset filename matching needs ALT variants for btproxy

    #380 21934588
    divadiow
    Level 38  
    Posts: 5153
    Help: 442
    Rate: 906
    I was just looking into the asset filename matching in EF does not offer the ALT variants, which excludes btproxy for BK
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

    with a little tweak we can add
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs
    https://github.com/openshwprojects/BK7231GUIFlashTool/pull/154

    'review enabled features..' link needs this merging, if it's any good though. https://github.com/openshwprojects/OpenBK7231T_App/pull/2147
    https://github.com/divadiow/OpenBK7231T_App/b...95944c4f3fc3a768a5a2a/docs/enabledFeatures.md

    Still, a proper variant explanation is needed.

  • PR review concerns for ROM/eFuse tab refactor

    #381 21935190
    divadiow
    Level 38  
    Posts: 5153
    Help: 442
    Rate: 906
    I'm a little worried the ROM/eFuse tab work might look a bit daunting for a PR review and it doesn't look attractive for merging. Also, if changes need to be made, better now rather than further down the line perhaps.

    Screenshot of BK7231 Easy UART Flasher on the Read ROM tab showing the message “ROM read success!”

    https://github.com/openshwprojects/BK7231GUIFlashTool/pull/156
    I've also prepared a list of possible questions and some answers that may be raised by a review

    Code: Text
    Log in, to see the code


    I've tried to make it DRY :)
  • #382 21935325
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14699
    Help: 656
    Rate: 12743
    @insmod can I ask for your input?

    Separate ROM reader sounds like a clean split. Well, basically, as long as we don't break existing functionality, it should be acceptable.
    Helpful post? Buy me a coffee.
  • #383 21935507
    insmod
    Level 31  
    Posts: 1424
    Help: 164
    Rate: 446
    What i currently don't like there, is that it introduces a second tab row. Since OTA tool isn't used, remove it. And move ROM page so that it's after flasher page.
    COM port/baud aren't selectable until chip type is selected.
    Read details are unnecessary. Why would user want to know how it's done?
  • ADVERTISEMENT

  • Remove OTA tab and reorder ROM page after flasher

    #384 21935523
    divadiow
    Level 38  
    Posts: 5153
    Help: 442
    Rate: 906
    insmod wrote:
    What i currently don't like there, is that it introduces a second tab row. Since OTA tool isn't used, remove it. And move ROM page so that it's after flasher page.


    can be changed. didn't want to make a call on OTA tab removal though. I don't think I've know it to be used and it doesn't know about most platforms now anyway.

    insmod wrote:
    COM port/baud aren't selectable until chip type is selected.

    ok. can change.

    insmod wrote:
    Read details are unnecessary. Why would user want to know how it's done?

    guide creation was more for the main flasher eventually, but it's useful?

    related:
    https://www.elektroda.com/rtvforum/topic4092465-330.html#21696066
    https://www.elektroda.com/rtvforum/topic4093142-360.html#21785975

    but, dunno..
  • #385 21935525
    insmod
    Level 31  
    Posts: 1424
    Help: 164
    Rate: 446
    divadiow wrote:
    guide creation was more for the main flasher eventually, but it's useful?

    Guides - yes, i agree. I talked about groupBoxReadRomRange
  • #386 21935527
    divadiow
    Level 38  
    Posts: 5153
    Help: 442
    Rate: 906
    yes. of course :) read details box.

    yeh dunno. seemed like a nice little info thing. can remove
  • #387 21935531
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14699
    Help: 656
    Rate: 12743
    Good point with tabs, I think you can Enabled = false on OTA tab. The details can stay as long as we have enough space on this tab, otherwise remove.
    Helpful post? Buy me a coffee.

  • COM port options disabled until chip type selected

    #388 21935557
    divadiow
    Level 38  
    Posts: 5153
    Help: 442
    Rate: 906
    combine these two and move to the far right tab?
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

    Added after 56 [seconds]:

    tab title simply "Help"?

    Added after 3 [minutes]:

    insmod wrote:
    COM port/baud aren't selectable until chip type is selected.


    oh this was because I introduced a blank so the 'guide' for a given platform didn't automatically show because a platform was chosen by default - eg BK7231N, like main flasher.
  • #389 21935570
    DeDaMrAz
    Level 23  
    Posts: 619
    Help: 34
    Rate: 130
    I feel the need to chime in to @insmod and @p.kaczmarek2 - I was proposing something similar regarding UI/UX changes long time ago and was snubbed and decided to give up on anything EF related.

    Do not "stop" @divadiow on his path, he is doing an amazing job - go easy on him!
  • #390 21935571
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14699
    Help: 656
    Rate: 12743
    Merge into something with obvious but short name, so even non english speakers can still click it. "Docs & Help" ?
    Helpful post? Buy me a coffee.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion centers on BK7231/BK7252 SPI flashing and recovery using BK7231GUIFlashTool v98+, which adds a new SPI-based flashing method requiring only a CH341 SPI programmer. The method is intended for recovering bricked Beken devices with overwritten bootloaders and also works as a general SPI flasher for external flash chips. Participants test and debug the new SPI mode, including COM-port handling, CH341 DLL loading, verify behavior, and Linux/Mono compatibility. The thread then expands into broader flasher development: UART and SPI improvements, flash-size detection, unprotect logic, retry mechanisms, baud-rate limits, and support for additional platforms such as RTL8720D, RTLZ/RTLZ2, BL602, LN882H, W600/W800, ECR6600, and remote flashing over TCP-to-UART. Several fixes are merged, including backup restore, erase/write handling, config read/write, and improved detection and logging.
Summary generated by AI based on the discussion content.
Today's popular

FAQ

TL;DR: New BK7231GUIFlashTool v98+ adds SPI flashing for Beken chips; sample 4,096 KB flash detected. “Only a CH341 SPI programmer is required.” Use CH341A D2 to toggle CEN, send 0xD2, then read/write like generic SPI. [Elektroda, p.kaczmarek2, post #21711721]

Why it matters: It lets you recover bricked BK7231/BK7252 devices without a working bootloader, using low‑cost tools.

Who this is for: DIYers, repair techs, and firmware engineers asking how to unbrick or mass‑flash Beken SoCs via SPI with a CH341A and the latest tool.

Quick Facts

What exactly is the new Beken SPI flashing method and what do I need?

The tool drives CH341A as an SPI master, resets BK via CEN on D2, sends 0xD2 to enter BK’s SPI-memory mode, then treats the chip like a standard SPI flash. You need a CH341A (jumper at I2C), 3.3 V power, and wiring for P20–P23 (SCK/CSN/SI/SO) plus CEN. Select “Beken SPI” in BK7231GUIFlashTool v98+. “Only a CH341 SPI programmer is required.” [Elektroda, p.kaczmarek2, post #21711721]

How do I wire CH341A to BK7231/BK7252 for SPI mode?

Connect CH341A SCK→P20, CS0→P21, MOSI→P22 (SI), MISO→P23 (SO), and D2→CEN. Keep MOSI→SI and MISO→SO mapping. Provide GND and target power. Some boards have pads labeled CE/TCK/TMS/TDI/TDO that map to CEN/SCK/CSN/SI/SO respectively. [Elektroda, p.kaczmarek2, post #21711721]

How do I reliably enter BK SPI mode? (3‑step)

  1. Use CH341 D2 to pull CEN low then high to reset the BK chip. 2. Stream 0xD2 bytes repeatedly over SPI. 3. Issue 0x9F and confirm a valid JEDEC response; then proceed to Read/Write/Erase. [Elektroda, p.kaczmarek2, post #21711721]

I get “Failed to open CH341 device” or “Failed to toggle CEN.” What should I check?

Confirm CH341A is jumpered to I2C, recognized by Windows, and the D2 wire is soldered to CEN. Re‑seat USB, power the target, and verify SPI lines. The tool logs these errors when CH341 isn’t detected or CEN can’t be driven; fix wiring or driver, then retry. [Elektroda, p.kaczmarek2, post #21711721]

The app says “missing ch341dll.dll” or quits in SPI mode—how do I fix that?

Place CH341DLL.DLL alongside the GitHub build, or build from source in Visual Studio. Earlier builds could exit if CH341A wasn’t present; recent fixes improved handling, but adding the DLL resolved missing‑library errors during testing. [Elektroda, divadiow, post #21712310]

Do I need to select a COM port for SPI flashing?

No. As of v99, SPI mode does not require a COM port. This was confirmed after fixes; previous v98 prompts were removed. Ensure CH341A is connected; SPI operations run without a serial port. [Elektroda, divadiow, post #21712310]

What does the Verify button do?

Verify compares flash contents against the firmware file currently selected in the tool. Use it after Write or Erase to confirm success. “Verify verifies against selected firmware.” [Elektroda, p.kaczmarek2, post #21712551]

Can this recover a bricked BK7252 camera?

Yes. After wiring CEN and SPI lines, use Beken SPI mode to read/erase/write. The author provides a BK7252 camera recovery example using this exact method with CH341A and the new flasher. [Elektroda, p.kaczmarek2, post #21711721]

Can I use CH341 Programmer or NeoProgrammer once SPI mode is active?

Yes. After the 0xD2 hand‑off, the BK behaves like a generic SPI flash. You can then operate with common SPI flash tools (CH341 Programmer or NeoProgrammer) if you prefer. [Elektroda, p.kaczmarek2, post #21711721]

Linux support: what baud rates are stable under mono?

Mono 6.12 worked for testers. They reported stable operation at 921,600 baud; 1,500,000 worked on Windows, but they lowered to 921,600 on Linux. LAN Scanner and release downloader also worked. [Elektroda, insmod, post #21712663]

The tool shows a 4,096 KB device. Is that normal for these chips?

Yes. A sample JEDEC ID FF‑EF‑40‑16 decoded to 4,096 KB and printed by the tool. That confirms JEDEC read and size decoding in SPI mode. Actual sizes vary by module; always check the tool’s detected flash size. [Elektroda, p.kaczmarek2, post #21711721]

How do I just switch a BK device into SPI mode without reading or writing?

Use the new “Detect” button. It performs a zero‑length custom operation to toggle CEN and send the 0xD2 sync, placing the chip in SPI mode for use with other SPI tools. [Elektroda, p.kaczmarek2, post #21731041]

I flashed many times and now erase fails. What should I try?

Expand Unprotect logic before erase, similar to AsProgrammer. A contributor noted needing stronger Unprotect after many BK7252 cycles. Add an Unprotect/Status-Register release step, then retry the erase/write. [Elektroda, p.kaczmarek2, post #21714737]

What is OpenBeken (OBK) in this context?

OpenBeken is an open‑source firmware used across supported Wi‑Fi MCUs in this ecosystem. The author uses OBK devices for testing and demos, including camera boards and remote flashing concepts. [Elektroda, p.kaczmarek2, post #21714427]

Can I flash a BK device over Wi‑Fi/TCP instead of USB?

Yes, a Wi‑Fi flasher demo proxies UART over TCP and controls CEN via an OBK device. It’s a separate utility that mirrors the BK UART routines, useful when PC‑to‑target wiring is hard. [Elektroda, p.kaczmarek2, post #21720013]

Any known edge cases or failure symptoms I should expect?

If CH341DLL is missing, some GitHub builds previously exited. On mono/Linux, 1,500,000 baud may fail while 921,600 works. Also, after heavy cycling, protection bits may block erase until Unprotect expands. Address each symptom as noted, then retry. [Elektroda, divadiow, post #21712310]
Summary generated by AI based on the discussion content.
ADVERTISEMENT