RTL8710CM flashing guide - how to free RTL from the cloud and pair with Home Assistant?

p.kaczmarek2 1272 0

TL;DR

RTL8710CM (Ameba Z2) inside a Meross MSS810HK-UN V7.0 smart switch is flashed with OpenBK7231T-style firmware to cut cloud dependence and enable Home Assistant.
The module is desoldered, wired to a USB-to-UART adapter, bootloader pins are pulled to 3.3 V, and the flasher is set to the Ameba Z2 family.
The switch handles a single load up to 150 W for CFL and LED or 400 W for incandescent lights, and the UART bootlog is 115200 baud.
Flashing works, then the module joins the AP at 192.168.4.1, but programming requires desoldering because the back-side pads are inaccessible.

Generated by the language model.

ADVERTISEMENT

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

Follow us

📢 Listen (AI):

Topic author Helpful post? (+6)

Post #1
21807382 13 Jan 2026 11:37

How to flash the RTL8710CM (Ameba Z2) with our Tasmota/ESPHome-style multiplatform firmware? Welcome to this step-by-step guide for the Meross MSS810 Apple Home smart switch.

With this guide, you will be able to regain your privacy and run the device independently of the manufacturer’s servers, fully locally. You’ll also be able to script it however you like, add new sensors, and of course integrate it with Home Assistant.

Before we begin, make sure to check out related guides:
WBR2, WBR3, WBRU, W701-VA2-CG pinout, datasheet, flashing for Home Assistant
[youtube] WBR2/WBR3 - RTL8720CF flashing step by step guide/tutorial - how to solder and flash[/youtube]

Device used for presentation
RTL8710CM can be found in various IoT devices, but in this case we'll present a simple smart switch compatible with the Meross app, model MSS810HK-UN V7.0. It can control a single light up to 150 W (for CFL and LED) or up to 400 W (for incandescent lights).

Let's unbox it. The device comes with a set of short wires, which are useful for wiring it behind a classic, non-smart switch. The module itself has manufacturer and app info on the case, so it's not yet another no-name gadget.

Pairing manual:

MSS810 teardown
Let's look inside. It's easy to remove the top cover with a flat screwdriver.

The device is powered by BP2525 step down power supply circuit, it generates 5V from mains. There is also AMS1117-3.3V visible, which provides stable 3.3V for the WiFi module. I didn't identify U4 chip, does anyone know what's its purpose?

Device board is marked as DzMrWFS1JDQ-K V1.6 2023-08-11, and the WiFi module inside is using RTL8710CM. It also has an onboard flash memory chip, just like some ESP modules do. That's where firmware is stored.

Original firmware bootlog
I've also managed to capture original firmware output at UART TX 115200 baud:
Code: text Expand Select all Copy to clipboard
== Rtl8710c IoT Platform == Chip VID: 5, Ver: 3 ROM Version: v3.0 == Boot Loader == Aug 31 2021:15:42:24 Boot Loader <== == RAM Start == Build @ 14:51:40, Jan 5 2024 $8710c>interface 0 is initialized interface 1 is initialized Initializing WIFI ... [inContentAd] WIFI initialized MRS-WIFI-COUNTR-0069 | set country code: JP, 0x0b write mac address success, please reset wifi driver! init_thread(61), Available heap 0x356308 ############################### #### Meross Smart Things #### ############################### reset reason : 0 model : mss810 Enter INTERACTIVE MODE # mac : 48:e1:e9:d8:d0:ce chip set : rtl8710cm hw_ver : 7.0.0 fw_ver : 7.3.3 compiler : gcc 6.5.0 compile time : 2024/01/05-14:51:34 curr_fw_idx : 1 Login:

I haven't figured out if it's possible to "log in" there.

Desoldering WiFi module
This WiFi module has programming pads on the back, so it's not accessible without desoldering. I had to use some flux and copper wire to clean the pads and remove the module.

WiFi module is marked as MR2EHK_REV7.0. The four pads on the back are marked as GPIOA_0, GPIOA_13, RX and TX. The bottom pads are not marked.

Flash backup method - CH341
This step is not necessary, as you can back it up via UART, but I will show it here just for reference. BoyaMicro 25Q32BSTIG on the board is a classic flash chip with an SPI interface, it can be read with CH341 in, for example, NeoProgrammer:

I didn't try flashing firmware that way, as we have an UART solution for that.

Backup existing firmware and flash new with UART
First of all, you need USB-to-UART converter, like CH340, and you need to set it in 3.3V mode by setting a jumper. You also need a reliable 3.3V power supply, I am using AMS1117-3.3V for that. 3.3V from the USB-to-UART converter may not be enough.
You will also need to pull extra pins high (connect to vdd - 3.3V) to enable bootloader:

Get our flasher tool there:
https://github.com/openshwprojects/BK7231GUIFlashTool
Now, you need to connect wires to the WiFi module. Tin the pads with some solder, don't forget the flux.
This is how the tinned module looks like:

And here is my full setup:

This is the LDO I use (TC1264-3.3V), it can be any LDO for 3.3V. It converts 5V to 3.3V for WiFi module:

Select the matching family in our flasher - Ameba Z2:

First, do a flash backup:

Then, use our flasher to download new firmware:

You can also manually get it in Releases tab, here:
https://github.com/openshwprojects/OpenBK7231T_App
Finally, flash the new binary:

Flashing is now done. You can disconnect extra boot GPIO pins from 3.3V and power cycle the module. Then you should be able to see OBK logs at 115200 at the same UART port you used for flashing:

Initial setup
Just like with every other OBK device. Connect to configuration AP:

Open the page at 192.168.4.1, configure the WiFi:

Device should join your network:

Now, if you are sure that it works, solder back the WiFi module to the device, disconnect the whole UART, and power it from mains.
Then you can use GPIO Doctor to figure out GPIO roles:
https://www.elektroda.com/rtvforum/topic3976371.html
GPIODoctor can find a relay pin quickly. Just listen and toggle each pin, you'll hear the relay click:

For button, set pin input roles and press button and see what changes:

OBK template:
Code: JSON
Log in, to see the code

Pairing with HA
Follow our guide:

Summary
So that's how you can flash RTL8710CM with our multiplatform open source firmware. No need for third-party flasher tools, just use our flasher and your device will be ready to go. Then you can configure it easily with GPIO doctor and pair with Home Assistant.
Let us know if you have any questions, we'll do our best to help!
PS: Original firmware backup:
https://github.com/openshwprojects/FlashDumps/commit/049388d70921ee03a60a56b3b969fcba5280a842

Cool? Ranking DIY
Helpful post? Buy me a coffee.
About Author
p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Offline

Joined: 26 Dec 2014

Posts: 14400

Help: 650

Posts rating: 12330

Points: 140924
p.kaczmarek2 wrote 14400 posts with rating 12330, helped 650 times. Been with us since 2014 year.
ADVERTISEMENT
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

Follow us

📢 Listen (AI):

Report a violation of the law

FAQ

TL;DR: Free your Meross MSS810 (RTL8710CM) from the cloud by flashing OpenBeken via UART; the switch supports 150 W LED/400 W incandescent, and “Flashing is now done.” [Elektroda, p.kaczmarek2, post #21807382]

Why it matters:** It’s a privacy-first, local-control path to Home Assistant without vendor servers, ideal for DIYers who ask “how do I flash RTL8710CM and pair with HA?”

Quick Facts

SoC/module: RTL8710CM (Ameba Z2), MR2EHK_REV7.0; UART logs at 115200 baud. [Elektroda, p.kaczmarek2, post #21807382]
Load ratings: up to 150 W CFL/LED or 400 W incandescent. [Elektroda, p.kaczmarek2, post #21807382]
Backup paths: UART dump with BK7231GUIFlashTool or SPI read of BoyaMicro 25Q32BSTIG using CH341. [Elektroda, p.kaczmarek2, post #21807382]
Power/boot: use a stable 3.3 V LDO; pull required pins high; USB‑UART 3.3 V may be insufficient. [Elektroda, p.kaczmarek2, post #21807382]
Post-flash setup: connect to OBK AP, set Wi‑Fi, find Relay/Button with GPIO Doctor, then pair with HA. [Elektroda, p.kaczmarek2, post #21807382]

How do I flash RTL8710CM on the Meross MSS810 with OpenBeken?

Desolder the MR2EHK_REV7.0 module to access pads. Wire UART TX/RX and 3.3 V via a stable LDO. Pull the specified boot pins high. Use BK7231GUIFlashTool, select Ameba Z2, back up flash, download the OBK release, then program the binary. Power-cycle and watch 115200 logs. [Elektroda, p.kaczmarek2, post #21807382]

What tools and parts do I need for this flash?

You need a USB‑to‑UART adapter (e.g., CH340), a reliable 3.3 V LDO (e.g., AMS1117‑3.3 or TC1264‑3.3), wires, flux, and a soldering setup. Install BK7231GUIFlashTool for backup and flashing, and have the OpenBeken release binary ready. [Elektroda, p.kaczmarek2, post #21807382]

Is desoldering the Wi‑Fi module required?

Yes, for this board the programming pads are on the back of the MR2EHK_REV7.0 module. The author desoldered it with flux and cleaned pads to access GPIOA_0, GPIOA_13, RX, and TX for UART flashing. [Elektroda, p.kaczmarek2, post #21807382]

How do I enter bootloader mode on the RTL8710CM?

Pull the extra boot GPIO pins high to 3.3 V before power‑up. Keep TX/RX connected, then start BK7231GUIFlashTool with the Ameba Z2 family selected to detect and back up the device. [Elektroda, p.kaczmarek2, post #21807382]

What’s the safest way to power the module during flashing?

Use a dedicated 3.3 V LDO regulator. The guide warns that 3.3 V from many USB‑UART adapters may be insufficient under load, which can cause unstable flashing or resets. “Use a reliable 3.3 V power supply.” [Elektroda, p.kaczmarek2, post #21807382]

Can I back up the original firmware without removing the flash chip?

Yes. The recommended path is a full backup over UART using BK7231GUIFlashTool. As a reference alternative, the on‑board BoyaMicro 25Q32BSTIG SPI flash can be read with a CH341 programmer and software like NeoProgrammer. [Elektroda, p.kaczmarek2, post #21807382]

What UART settings and boot logs should I expect?

Use 115200 baud. You should see the Realtek boot banner, platform version, Meross model info, and later OpenBeken logs after flashing. The example shows RAM start time and firmware versions printing at boot. [Elektroda, p.kaczmarek2, post #21807382]

Is there a login for the stock firmware console?

A login prompt appears on the stock firmware’s UART console, but the author has not figured out valid credentials. Treat it as read‑only for information gathering before flashing. [Elektroda, p.kaczmarek2, post #21807382]

How do I configure Wi‑Fi and first‑run settings after flashing OpenBeken?

Connect to the OBK configuration AP, open 192.168.4.1, and enter your Wi‑Fi credentials. After it joins your LAN, confirm operation, then resolder the module to the main board and power from mains. [Elektroda, p.kaczmarek2, post #21807382]

How do I find Relay and Button GPIOs on this device?

Use GPIO Doctor. Toggle candidate pins and listen for the relay click, then test button inputs. The shared template maps P4 to Relay1 and P18 to Button1 for MSS810. [Elektroda, p.kaczmarek2, post #21807382]

What is OpenBeken (OBK)?

OpenBeken is a multiplatform open‑source firmware for Wi‑Fi IoT chips, offering local control, scripting, and easy Home Assistant integration without vendor clouds. The project publishes ready binaries and a simple flasher. [Elektroda, p.kaczmarek2, post #21807382]

What is Ameba Z2 (RTL8710CM) in simple terms?

Ameba Z2 refers to Realtek’s RTL8710C‑series Wi‑Fi MCU family. The RTL8710CM module in the MSS810 holds the application firmware in an external SPI flash package on the board. [Elektroda, p.kaczmarek2, post #21807382]

How do I pair the flashed switch with Home Assistant?

Follow the linked pairing walkthrough after verifying GPIO roles. With OBK running, use the project’s video guide to integrate the device in HA for local control. [Elektroda, p.kaczmarek2, post #21807382]

What hardware details should I know from the teardown?

The power stage uses a BP2525 step‑down to 5 V and an AMS1117‑3.3 V LDO for the Wi‑Fi module. The PCB is DzMrWFS1JDQ‑K V1.6 dated 2023‑08‑11. [Elektroda, p.kaczmarek2, post #21807382]

Any edge cases or failure modes to watch for?

Unstable 3.3 V causes flashing errors. Keep boot pins pulled high only during programming. After flashing, remove the pull‑ups and power cycle. If logs don’t appear at 115200, recheck TX/RX orientation and ground continuity. [Elektroda, p.kaczmarek2, post #21807382]

Can I restore the original firmware later?

Yes, if you made a full backup before flashing. The author also published an original dump reference link, which is useful for verification and structure, not as a universal image. [Elektroda, p.kaczmarek2, post #21807382]

Generated by the language model.

ADVERTISEMENT