logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
Build faster with M5Stack »
Build faster with M5Stack » Stick • Unit • Cardputer
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polskÄ… wersjÄ™ strony elektroda?

Nie, dziękuję Przekieruj mnie tam

WBR3 MTG276-WF-RL 24H Human Presence Sensor: Can It Be Flashed In-Circuit?

lamero345 675 15
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #1 21787859
    lamero345
    Level 2  
    Name: 24-hour Human presence sensor MTG276-WF-RL - Wi-Fi mmWave radar

    URL: https://www.aliexpress.com/item/1005005652743663.html

    Module: WBR3

    Photos:

    Disassembled presence sensor with exposed circuit board and casing parts.

    What do you think? Is it flashable without desoldering?
  • ADVERTISEMENT
  • ADVERTISEMENT
  • #3 21787961
    p.kaczmarek2
    Moderator Smart Home  
    WBR2, WBR3, WBRU, W701-VA2-CG pinout, datasheet, flashing for Home Assistant
    WBR3 (RTL8720CF) pinout and flashing guide with labeled photos and config tools


    Helpful post? Buy me a coffee.
  • #4 21787976
    divadiow
    Level 38  
    Don't forget to take a backup if you do continue! 🤓
  • #5 21787983
    lamero345
    Level 2  
    I asked for flashing without desolder
  • #6 21787984
    p.kaczmarek2
    Moderator Smart Home  
    Our flasher supports now WBR3:
    https://github.com/openshwprojects/BK7231GUIFlashTool
    But I still think you need to access the pads on the bottom of the board, RX TX will not suffice. It's not Beken!
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #7 21787988
    insmod
    Level 31  
    There is a possibility that it can be flashed via cloudcutter
    https://github.com/tuya-cloudcutter/tuya-cloudcutter/blob/main/running-with-known-secrets.md

    >>21787961
    This guide is in need for an update, since it RTL8720C read/write is supported by BK7231GUIFlashTool.
    (pg tool can read flash if a secret combination is entered. Left click slowly on "Offset" 3 times and then right click on "Length(Byte)" 4 times, a button "Read" will appear on the right to "Erase" button. If failed, then restart tool)
  • #11 21792038
    tomik67
    Level 12  
    I have gone through the subject with this presence sensor, and before that with the flush-mounted version.
    Unfortunately it is necessary to solder, in the flush-mounted version I replaced the module with a CB3S because at the time it was not yet possible to flash the WBR3.
    I have prepared a config for it as far as I know, both versions work successfully.
    Files are available if required.
  • ADVERTISEMENT
  • #12 21792219
    lamero345
    Level 2  
    How did you desolder it? With hot air solder?
  • #13 21792443
    tomik67
    Level 12  
    As shown by p.kaczmarek2 in one of the tutorials - with a soldering iron, with the flush-mounted version the electronic components were a bit further away from the WBR3, in the flush-mounted version which is the one you have very close there are electrolytic capacitors so there is less space, I damaged a couple of solder points but fortunately the WBR3 only talks to the MCU with Tx and Rx.
    On the back behind the WBR3 there are four solder points including Rx and Tx so if a path is damaged you can short wire them.
    Next time (I've ordered four more pieces) I think I'll try hot air while carefully shielding the capacitors from the temperature, I have the impression that the module is soldered with lead-free tin so it goes harder and the temperature must be higher.
  • #14 21793750
    lamero345
    Level 2  
    Not all dp are exposed. With tuya app I can manage led status color, but on api explorer there is not dp to control it
  • #15 21794181
    tomik67
    Level 12  
    The behaviour of the LED can be managed, whether to indicate the status of the presence sensor or the lack of response...:

    Code: text Expand Select all Copy to clipboard
    dpID.: 109   Enum   Status indication   0 - silence  1 - instructions


    and force the state of the presence sensor...:

    Code: text Expand Select all Copy to clipboard
    dpID.: 115   Enum   Sensor     0 - running. 1 - stop running. 2 - force reporting occupy  3 - force reporting unocuppy
  • #16 21802100
    divadiow
    Level 38  
    insmod wrote:
    This guide is in need for an update, since it RTL8720C read/write is supported by BK7231GUIFlashTool.

    +BL602 +LN882H

    Maybe a bold banner edit to every guide's first post should be added directing users to Easy Flasher. Even if there's not a full new guide thread, that alone would clear up some confusion I think.
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion concerns the possibility of flashing the WBR3 MTG276-WF-RL 24-hour human presence sensor module, a Wi-Fi mmWave radar device, without desoldering it from the circuit board. The module is identified as WBR3, and users seek methods for in-circuit flashing. It is noted that the RX/TX serial interface alone is insufficient for flashing, and access to specific pads on the bottom of the board is required. The BK7231GUIFlashTool now supports WBR3 modules, enabling flashing and reading of flash memory, but physical access to the pads remains necessary. Additionally, there is a mention of the Tuya Cloudcutter tool as a potential alternative for flashing via software, with instructions for enabling read/write operations on RTL8720C chips using secret key sequences in BK7231GUIFlashTool. Users are advised to back up firmware before attempting flashing.
Today's popular

FAQ

TL;DR: Yes, in-circuit flashing is possible by wiring 4 pins (3.3V, GND, RX, TX); however, some units need bottom pads and patched firmware blocks OTA. “Just solder the four wires and flash.” [Elektroda, xury, post #21787928]

Why it matters: This FAQ helps makers decide if the MTG276-WF-RL’s WBR3 module can be flashed without desoldering and how to proceed safely.

Quick Facts

Can I flash the MTG276-WF-RL (WBR3) without desoldering?

Often yes. Solder four wires to the WBR3 UART pads (3.3V, GND, RX, TX). Some boards still need bottom pads, so full access is required. If OTA tools fail due to patched firmware, use wired flashing. A user confirmed, “Just solder the four wires and flash.” Bring stable 3.3V and avoid powering from USB-TTL alone if unstable. [Elektroda, xury, post #21787928]

Which pins do I need to connect on WBR3 for serial flashing?

Connect 3.3V, GND, TX, and RX. Observe 3.3V logic levels only. Cross TX to RX between adapter and module. Do not use 5V on UART. The Tuya WBR3 datasheet documents the UART interface and electrical levels for safe in-circuit programming. ["WBR3 Module Datasheet"]

Is RX/TX alone enough, or do I need extra pads?

RX/TX alone may not work on some boards. Access to pads on the underside is often needed to place the module in the correct mode and ensure reliable flashing. Plan for bottom-pad access when in-circuit attempts fail. [Elektroda, p.kaczmarek2, post #21787984]

Does CloudCutter work on this sensor’s firmware?

Reports show the firmware appears patched against the CloudCutter exploit. Users trying the known-secrets flow did not succeed with module 2.7.7 and MCU v1.0.6. Expect to use wired flashing instead of OTA for this device. [Elektroda, divadiow, post #21789209]

How do I back up the original firmware before flashing?

Use BK7231GUIFlashTool’s hidden Read function: left-click Offset three times, then right-click Length four times to reveal Read. Dump flash before any erase or write. “Don’t forget to take a backup.” This step protects recovery options. [Elektroda, insmod, post #21787988]

What tool supports WBR3 read/write today?

BK7231GUIFlashTool now supports WBR3, with a hidden Read option for RTL8720C-based flows. Follow the tool’s sequence to enable Read and capture a full backup before writing new firmware. [Elektroda, insmod, post #21787988]

What is Tuya and why does it matter here?

Tuya provides IoT modules, firmware, and cloud services used in many smart devices. The WBR3 is a Tuya Wi‑Fi module. Tuya’s firmware versions and security updates influence whether OTA exploits work, pushing many users to wired flashing. [Elektroda, lamero345, post #21789123]

How do I enter flashing mode on WBR3?

Use the module’s documented boot/IO pads per the WBR3 datasheet, then apply 3.3V and connect UART. If the board lacks exposed pads, solder thin wires to the underside test points to assert the required state during power‑up. ["WBR3 Module Datasheet"]

What’s a safe, short how-to for in-circuit flashing?

  1. Identify WBR3 3.3V, GND, RX, TX and required mode pads from the datasheet.
  2. Solder four wires; power with a stable 3.3V source; connect USB‑TTL (3.3V).
  3. Use BK7231GUIFlashTool to Read (backup), then Erase/Write as needed. ["WBR3 Module Datasheet"]

What if my unit still refuses to flash in-circuit?

Your firmware may be patched and the board may gate boot pins. Remove the module or expose underside pads for proper boot mode. Some users replaced WBR3 with a supported module to proceed. Wired access remains the reliable path. [Elektroda, p.kaczmarek2, post #21787984]

Is module replacement a viable path if flashing fails?

Yes. One user swapped the original module for a CB3S on a similar sensor and achieved a working configuration. This avoids patched firmware issues but requires hot‑air rework skills and reconfiguration. Files were offered upon request. [Elektroda, tomik67, post #21792038]

What baud rate should I use with Tuya UART tools?

Use the UART interface as specified by the WBR3 datasheet and your flashing tool guidance. Start with the tool’s default and adjust only if logs indicate mismatches. Keep levels at 3.3V and wiring short for signal integrity. ["WBR3 Module Datasheet"]

What is an edge case I should plan for?

If your board ships with module firmware 2.7.7 and MCU v1.0.6, CloudCutter’s known-secret method may still fail. This indicates patched security; proceed with wired backup and flashing to avoid bricking. [Elektroda, lamero345, post #21789123]

Any expert tips before I start?

Back up first and verify reads with a checksum. As one member advised, “Don’t forget to take a backup.” Stable 3.3V power and short UART leads improve reliability during flashing. [Elektroda, divadiow, post #21787976]
ADVERTISEMENT