logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

p.kaczmarek2 11430 310

TL;DR

  • BK7231GUIFlashTool v98+ adds CH341-based SPI flashing and recovery for Beken BK7231/BK7252 chips, including bricked devices with overwritten bootloaders.
  • The tool uses CH341 DLL C# bindings to toggle CEN via D2, reset the chip, send 0xD2, then flash Beken chips like generic SPI memory.
  • Connections use P20, P21, P22, and P23 for SCK, CSN, SI, and SO, with CEN wired to D2 and the CH341 jumper set to I2C mode.
  • A sample read identifies JEDEC ID FF-EF-40-16 and a 4096 KB flash, and the same tool can Read, Write, Verify, and Erase firmware.
  • If CH341 is not detected or CEN toggle fails, check driver configuration, jumper position, SPI wiring, and power before trying Beken SPI mode again.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #91 21718693
    divadiow
    Level 38  
    insmod wrote:
    And on W600 flash id command outputs either 1 or 2 bytes, i'm not sure which, because i get 1C

    ah yes. remember now. weird.

    CMD window showing W600 bootloader detection and device information

    Added after 2 [minutes]:

    what I have played with
    Attachments:
    • W600_TESTING_SCRIPTS.zip (3.4 KB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #93 21719187
    p.kaczmarek2
    Moderator Smart Home  
    Nice, W800 read seem to work.
    BK7231 Easy UART Flasher interface reading firmware from device via COM3
    @insmod by msvc didn't see System.Text.Json and I had to install it via NuGet , is it intended, or is my MSVC old?
    Screenshot of NuGet Package Manager showing System.Text.Json package

    Added after 6 [hours] 34 [minutes]:

    PS: I tried to add retry for BK7231T on UART in EF:
    Flashing tool UI with UART errors and flash process log failing at sector 69362
    It fails to retry everytime.
    On the other hand... on N:
    Screenshot of BK7231 Easy UART Flasher erasing firmware from BK7231N chip
    I cause interference by shorting RX and TX together.
    Helpful post? Buy me a coffee.
  • #94 21719650
    insmod
    Level 31  
    >>21718744
    Nothing interesting here

    >>21719187
    Intended.

    Maybe move all the other chips bar bk spi into another topic? But what to call it...
  • #95 21720013
    p.kaczmarek2
    Moderator Smart Home  
    Well, considering the discussion is more or less about new features of the flasher, I can say it's marginally acceptable to at least let it stay here.

    I am posting a WiFi flasher demo. Currently, it's a dirty copy of BK7123 flashing routines to C# with serial port changed to TCP socket.
    It is available here: https://www.elektroda.com/rtvforum/topic4148743.html
    Helpful post? Buy me a coffee.
  • #97 21720718
    divadiow
    Level 38  
    >>21720700

    amazing! in that case I might have to have another stab at backing up the ELM327 W600 I still have on stock fw, though the pins are quite small and IC placement particularly awkward. PB6 is right next to VDD33 too. xtal could be removed I guess

    Added after 40 [minutes]:

    very good. does EF acknowledge flash completion for you?

    BK7231 Easy UART Flasher program writing firmware to W600 chip.

    boots, AP, HC-25 web
    Visible Wi-Fi network named HC-25-286dcd0b8d1 with a signal iconHC-25 login page with password field and two buttons on a white background

    Added after 13 [minutes]:

    divadiow wrote:
    does EF acknowledge flash completion for you?

    if writing custom bin*

    OpenW600 written OK and boots. Air602

    BK7231N Easy UART Flasher interface with “Writing done” message

    Added after 1 [minutes]:

    insmod wrote:
    there was no log on any UART

    same.
  • #98 21721526
    divadiow
    Level 38  
    hello.

    I'm curious about the current state of BK7252U backup in EF. I've got a new 2MB BK7252UQN48 and I took an SPI backup with Neo and Beken SPI. Easy Flasher BK7231T and BK7231U uart mode takes identical backup to both SPI - so 4 identical backups. But if you take a BK7252U backup it will get it wrong, creating a different backup to the rest.

    Comparison of two binary files showing identical hex code and confirmation message

    EF says it is starting at 0x11000:

    Code: Text
    Log in, to see the code


    and at the end:

    Code: Text
    Log in, to see the code


    but then makes a 2,097,152 bytes file with UA in the name.

    If you do a custom read from 0x0 for 0x200000 length you get this, which has been seen in posts before:

    Code: Text
    Log in, to see the code


    I gather there's an ongoing issue with 4mb BK7252U and wrap-around but a 2mb backup should just be the same as T/U but with different names?

    Terminal window showing list of duplicate and unique binary files by hash

    I attach all backups for reference.
    Attachments:
    • 167. Pocket WiFi Cam INO-A15-V1.1 AK23 BK7252UQN48.zip (5.57 MB) You must be logged in to download this attachment.
  • #99 21722488
    divadiow
    Level 38  
    insmod wrote:
    Since it's a 24pin camera, would it work in ESP32-CAM?


    ESP32 modules and OV3660 camera on a blue background

    GPT sketch. it got OmniVision OV3660 right

    Code: Text
    Log in, to see the code


    Detects some stuff if 24-pin doorbell GC0328C inserted

    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
  • #100 21730989
    divadiow
    Level 38  
    ah yes, this old chestnut.
    Screenshot showing BK7231 flasher writing error and IC not responding in programmer log

    fiddling with https://www.elektroda.com/rtvforum/topic4150112.html

    Screenshot of flash programming tool with successful full chip erase in BekenSPI mode.

    it's weird because unchecking SREG2:14 then allows erase/write but subsequent reads of values in AS shows it checked still BUT you can continue to erase/write. hmm

    Also, could we have an SPI-entry/D2 mode only for Beken SPI? At the moment you have to do an operation (erase/write/read) to get into SPI mode, but sometimes you my just want to get into SPI mode to then use other apps.
  • #101 21731041
    p.kaczmarek2
    Moderator Smart Home  
    Good idea, I added "Detect" button, it currently works by doing custom operation with 0 read and 0 write size. Can you check if it works?
    Helpful post? Buy me a coffee.
  • #103 21734531
    divadiow
    Level 38  
    forgot I'd tried W806 too. pretty sure this is the same as when tried with Python thing. detect flash size but nothing more
    BK7231 Easy UART Flasher interface with a flash memory reading error.

    Write works OK though. Or says it does. Doesn't boot.

    BK7231 Easy UART Flasher interface with Writing done message

    Added after 2 [hours] 17 [minutes]:

    here's what seems to be a working full erase inspired by Upgrade Tool's serialthread.py
    Code: Python
    Log in, to see the code


    CMD window showing flash erase process for W806 microcontroller

    Erase success for 1mb W806 too but I can't confirm it.

    on 2mb W800 read-backs appear blank apart from the first few bytes. Read-back content is the same after stopping Upgrade Tool's own erase function just before it starts to write new image (erase selection requires flash image selection too to start).

    Four flash memory dump windows in hex editor view with decoded text
  • #104 21747802
    divadiow
    Level 38  
    there was a suggestion somewhere that BK7238 in EF might default to QIO I think. Or maybe the option, and why, should be made clearer when the user hits the flash button without "overwrite bootloader" selected. It just feels like with BK7238's increasing popularity, there will potentially be a number of people that don't flash QIO then later realise OTA doesn't work and be annoyed.

    Added after 1 [minutes]:

    or the need will arise to add a variant that caters for OTA at other popular offsets
  • #105 21747805
    insmod
    Level 31  
    >>21747802
    If i remember correctly, bootloader is always overwritten on 7238 and 7252N.
  • ADVERTISEMENT
  • Helpful post
    #107 21748843
    divadiow
    Level 38  
    does ECR6600 stub pr read OK for you @insmod ?

    I get this
    Screenshot of BK7231 Flasher tool showing SHA mismatch error in red text

    but v148 reads ok
    BK7231 Easy UART Flasher interface with firmware read completed
  • ADVERTISEMENT
  • #109 21748866
    divadiow
    Level 38  
    cool. initial read fails but then click read again and it will start

    BK7231 Easy UART Flasher interface reading flash memory via COM46.

    same pattern with a few tries. device resets in between
  • Helpful post
    #111 21748882
    divadiow
    Level 38  
    Ta. Now afk until this evening

    Added after 8 [hours] 50 [minutes]:

    Screenshot of BK7231 Easy UART Flasher showing memory read completed

    Firmware flashing process for ECR6600 using file OpenECR6600_1.18.210.bin

    ✅

    Added after 21 [minutes]:

    bit more.

    every baud in EF read first time apart from 460800 which errors with

    Code: Text
    Log in, to see the code


    Added after 2 [hours] 7 [minutes]:

    writing worked first time for all but 460800. I never flash at 460800 to be honest.
  • #113 21773694
    p.kaczmarek2
    Moderator Smart Home  
    Seems acceptable, nice, thank you. Let me know if you are able to find more such issues in the flasher.
    Helpful post? Buy me a coffee.
  • #115 21776068
    divadiow
    Level 38  
    I think this text needs tweaking

    https://github.com/openshwprojects/BK7231GUIF...90910c1ab7918/BK7231Flasher/FormMain.cs#L1315

    Code: Text
    Log in, to see the code


    0x11000 is only true for BK-N/T? and then erase all doesn't work for some platforms but then erase all is from 0x0 for those that do work?

    My preferences would be: greyed out for any platform that doesn't support erase, then erase from 0 if the platform has a rom and flasher code supports it. Only for BK7252U (which has the other problem still) and BK7231T is erase from 0x11000 performed. Text updated to reflect this situation.

    thoughts?
  • #116 21777249
    p.kaczmarek2
    Moderator Smart Home  
    Tool is now for many platforms so UI could be improved...

    @insmod https://github.com/openshwprojects/BK7231GUIFlashTool/pull/86 nice , how did you figure out chip ID?
    Helpful post? Buy me a coffee.
  • #118 21777264
    insmod
    Level 31  
    >>21777249
    BKFIL with bk_loader 3.0.1.2 + debug mode
  • #119 21777290
    p.kaczmarek2
    Moderator Smart Home  
    We also probably need to narrow down what causes false alarms and scares out users:
    https://github.com/openshwprojects/BK7231GUIFlashTool/issues/84
    Helpful post? Buy me a coffee.
  • Helpful post
    #120 21777296
    divadiow
    Level 38  
    p.kaczmarek2 wrote:
    https://github.com/openshwprojects/BK7231GUIFlashTool/pull/86


    erase all of N just now showed empty flash from 11000 on read-back. it's very quick.

    Screenshot of BK7231 Easy UART Flasher showing Reading success! and flash erase logs

    success when erase is part of firmware write too

    Added after 47 [minutes]:

    p.kaczmarek2 wrote:
    We also probably need to narrow down what causes false alarms and scares out users:
    https://github.com/openshwprojects/BK7231GUIFlashTool/issues/84


    I don't really know but I've been chatting to GPT about it and had it go back through all the changes and take into account the issues posts and the detection type.

    Code: Text
    Log in, to see the code


    Code: Text
    Log in, to see the code


    ltchiptool has the same issue for the packed single-file Java exe version.

    I seem to remember seeing more dll files in the zip alongside the exe at one point, I guess @insmod packed them in or something. Maybe that was when it became more suspicious?
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ BK7231GUIFlashTool version 98 and later introduces a new SPI flashing method for Beken BK7231/BK7252 devices using only a CH341 SPI programmer. This method enables recovery of bricked devices with overwritten bootloaders and functions as a general-purpose SPI flasher supporting various memory chips. The approach builds on previous SPI programming techniques using Python and Banana Pi, adapting them for CH341 hardware and C# implementation. Required hardware includes a CH341 programmer and soldering tools for wire attachment. Recent user feedback on version 98 highlights issues such as the tool requiring a COM port selection in SPI mode, lack of CH341A detection warnings, and missing ch341dll.dll errors. The developer has addressed the COM port requirement and plans to add the missing DLL, requesting further debugging via Visual Studio to handle CH341 initialization exceptions.
Generated by the language model.
Today's popular

FAQ

TL;DR: New BK7231GUIFlashTool v98+ adds SPI flashing for Beken chips; sample 4,096 KB flash detected. “Only a CH341 SPI programmer is required.” Use CH341A D2 to toggle CEN, send 0xD2, then read/write like generic SPI. [Elektroda, p.kaczmarek2, post #21711721]

Why it matters: It lets you recover bricked BK7231/BK7252 devices without a working bootloader, using low‑cost tools.

Who this is for: DIYers, repair techs, and firmware engineers asking how to unbrick or mass‑flash Beken SoCs via SPI with a CH341A and the latest tool.

Quick Facts

What exactly is the new Beken SPI flashing method and what do I need?

The tool drives CH341A as an SPI master, resets BK via CEN on D2, sends 0xD2 to enter BK’s SPI-memory mode, then treats the chip like a standard SPI flash. You need a CH341A (jumper at I2C), 3.3 V power, and wiring for P20–P23 (SCK/CSN/SI/SO) plus CEN. Select “Beken SPI” in BK7231GUIFlashTool v98+. “Only a CH341 SPI programmer is required.” [Elektroda, p.kaczmarek2, post #21711721]

How do I wire CH341A to BK7231/BK7252 for SPI mode?

Connect CH341A SCK→P20, CS0→P21, MOSI→P22 (SI), MISO→P23 (SO), and D2→CEN. Keep MOSI→SI and MISO→SO mapping. Provide GND and target power. Some boards have pads labeled CE/TCK/TMS/TDI/TDO that map to CEN/SCK/CSN/SI/SO respectively. [Elektroda, p.kaczmarek2, post #21711721]

How do I reliably enter BK SPI mode? (3‑step)

  1. Use CH341 D2 to pull CEN low then high to reset the BK chip. 2. Stream 0xD2 bytes repeatedly over SPI. 3. Issue 0x9F and confirm a valid JEDEC response; then proceed to Read/Write/Erase. [Elektroda, p.kaczmarek2, post #21711721]

I get “Failed to open CH341 device” or “Failed to toggle CEN.” What should I check?

Confirm CH341A is jumpered to I2C, recognized by Windows, and the D2 wire is soldered to CEN. Re‑seat USB, power the target, and verify SPI lines. The tool logs these errors when CH341 isn’t detected or CEN can’t be driven; fix wiring or driver, then retry. [Elektroda, p.kaczmarek2, post #21711721]

The app says “missing ch341dll.dll” or quits in SPI mode—how do I fix that?

Place CH341DLL.DLL alongside the GitHub build, or build from source in Visual Studio. Earlier builds could exit if CH341A wasn’t present; recent fixes improved handling, but adding the DLL resolved missing‑library errors during testing. [Elektroda, divadiow, post #21712310]

Do I need to select a COM port for SPI flashing?

No. As of v99, SPI mode does not require a COM port. This was confirmed after fixes; previous v98 prompts were removed. Ensure CH341A is connected; SPI operations run without a serial port. [Elektroda, divadiow, post #21712310]

What does the Verify button do?

Verify compares flash contents against the firmware file currently selected in the tool. Use it after Write or Erase to confirm success. “Verify verifies against selected firmware.” [Elektroda, p.kaczmarek2, post #21712551]

Can this recover a bricked BK7252 camera?

Yes. After wiring CEN and SPI lines, use Beken SPI mode to read/erase/write. The author provides a BK7252 camera recovery example using this exact method with CH341A and the new flasher. [Elektroda, p.kaczmarek2, post #21711721]

Can I use CH341 Programmer or NeoProgrammer once SPI mode is active?

Yes. After the 0xD2 hand‑off, the BK behaves like a generic SPI flash. You can then operate with common SPI flash tools (CH341 Programmer or NeoProgrammer) if you prefer. [Elektroda, p.kaczmarek2, post #21711721]

Linux support: what baud rates are stable under mono?

Mono 6.12 worked for testers. They reported stable operation at 921,600 baud; 1,500,000 worked on Windows, but they lowered to 921,600 on Linux. LAN Scanner and release downloader also worked. [Elektroda, insmod, post #21712663]

The tool shows a 4,096 KB device. Is that normal for these chips?

Yes. A sample JEDEC ID FF‑EF‑40‑16 decoded to 4,096 KB and printed by the tool. That confirms JEDEC read and size decoding in SPI mode. Actual sizes vary by module; always check the tool’s detected flash size. [Elektroda, p.kaczmarek2, post #21711721]

How do I just switch a BK device into SPI mode without reading or writing?

Use the new “Detect” button. It performs a zero‑length custom operation to toggle CEN and send the 0xD2 sync, placing the chip in SPI mode for use with other SPI tools. [Elektroda, p.kaczmarek2, post #21731041]

I flashed many times and now erase fails. What should I try?

Expand Unprotect logic before erase, similar to AsProgrammer. A contributor noted needing stronger Unprotect after many BK7252 cycles. Add an Unprotect/Status-Register release step, then retry the erase/write. [Elektroda, p.kaczmarek2, post #21714737]

What is OpenBeken (OBK) in this context?

OpenBeken is an open‑source firmware used across supported Wi‑Fi MCUs in this ecosystem. The author uses OBK devices for testing and demos, including camera boards and remote flashing concepts. [Elektroda, p.kaczmarek2, post #21714427]

Can I flash a BK device over Wi‑Fi/TCP instead of USB?

Yes, a Wi‑Fi flasher demo proxies UART over TCP and controls CEN via an OBK device. It’s a separate utility that mirrors the BK UART routines, useful when PC‑to‑target wiring is hard. [Elektroda, p.kaczmarek2, post #21720013]

Any known edge cases or failure symptoms I should expect?

If CH341DLL is missing, some GitHub builds previously exited. On mono/Linux, 1,500,000 baud may fail while 921,600 works. Also, after heavy cycling, protection bits may block erase until Unprotect expands. Address each symptom as noted, then retry. [Elektroda, divadiow, post #21712310]
Generated by the language model.
ADVERTISEMENT