logo elektroda
logo elektroda
X
logo elektroda

Water Sound v3 Water detector Flashing Issue with CBU-NL/BK7231N and OpenBK7231N Firmware

gerben 477 5
ADVERTISEMENT
  • #1 21814415
    gerben
    Level 2  
    Posts: 3
    Promo graphic of a 130 dB Wi‑Fi water leak alarm with wired probe and smartphone app
    This was my first time flashing directly on board. I tried to flash a Water Sound v3 https://nl.aliexpress.com/item/1005007625016049.html , which I could not find on the forum but is a water detector with a CBU-NL board.
    I understood CBU-NL always has a BK7231N.
    I used a USB-to-serial and connected everything like described on the "[BK7231N/CBU] Door sensor without TuyaMCU - easy flashing and configuration guide", https://www.elektroda.com/rtvforum/topic3994294.html and checked if anything was accidentally shorted.

    CBU-NL Pin 13 GND connected to USB-to-serial GND
    CBU-NL Pin 14 3.3 V connected to USB-to-serial 3.3 V
    CBU-NL Pin 15 P11 TX1 connected to USB-to-serial RX
    CBU-NL Pin 16 P10 RX1 connected to USB-to-serial TX
    CBU-NL Pin 18 CEN, shortly shorted to GND to start flashing

    I used BK7231GUIFlashTool-build-215 with the default settings and firmware OpenBK7231N_QIO_1.18.247.bin and pressed Backup and flash new and follow the steps described in the guide (Write success!). I did not use the OBK config yet.
    Config was extracted successfully from the Tuya binary and the BK7231N Decryption also seems to work (it gets bootloader, app, download).
    After rebooting, LED1 kept blinking, but it did not connect to my network; I did not see an access point, and the button did nothing.
    I tried flashing again with OBK config preset. The LED did not blink anymore. Neither did it connect to my network; I did not see an access point, and the button did nothing.
    I tried shorting CEN and then it slowly blinks 2 times and gives 3 short blinks, after that 1 slow blink, 3 short blinks, which repeats.

    Because that didn't work, I tried flashing the backup readResult_BK7231N_QIO_2026-16-1-15-08-19.bin back to the device.
    The flash seems successful (Write success!). But the reboot does nothing. It did not connect to my network, I did not see an access point, and the button did nothing.
    I can still flash it back and forth, but nothing seems to get the device going.

    Does anyone have any ideas on what to try next to get it going again?

    Edit: Typos, order of text.
  • ADVERTISEMENT
  • #2 21815020
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14387
    Help: 650
    Rate: 12308
    Let's start by determining whether it's a TuyaMCU device. Can you post a photos of the board? Is there an extra MCU?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #3 21815179
    gerben
    Level 2  
    Posts: 3
    Opened electronic device with visible PCB, WiFi module, and piezo speaker.
    Thanks for helping me out. I believe there is only the CBU-NL with BK7231N as MCU, although I only know about the BK7231N because of the CBU-NL documentation.
  • ADVERTISEMENT
  • #4 21859823
    gerben
    Level 2  
    Posts: 3
    @p.kaczmarek2 You asked for a photo of the device to determine whether it's a TuyaMCU device. Did the photo show anything why it should or shouldn't work as far as you can see?
  • ADVERTISEMENT
  • #5 21859934
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14387
    Help: 650
    Rate: 12308
    It looks like it's not TuyaMCU. Can you share Tuya config?

    What does the TX2 debug log output show at 115200 baud? This could tell us whether OBK or Tuya firmware is booting or at least attempting to boot.
    Helpful post? Buy me a coffee.
  • #6 21869691
    gerben
    Level 2  
    Posts: 3
    It is the same chip as used in https://www.elektroda.com/news/news4026894.html (same Model and P/N).

    When I connect to COM3 and connect the device I do not see any bootloader data.
    After entering flashing mode (connect CEN to ground) I get the following data (depending on the baud rate):
    9600 baud      7f f8 c0 fe fc f8 fe ff                           øÀþüøþÿ         
    74880 baud     ff ff ff ff ff ff                                 ÿÿÿÿÿÿ           
    115200 baud    fe 80 e0 ff f8                                    þ€àÿø            (takes several restarts in flashing mode)


    I used BK7231 Easy UART Flasher (BK7231GUIFlashTool-build-215) and downloaded the existing firmware before flashing the first time.
    I used "Extract Config from Tuya binary" tab from the backupped original firmware, which shows:

    Device configuration, as extracted from Tuya: 
    - Button (channel 0) on P20
    - Status LED on P26
    - PIR sensor on P16
    - Battery Relay on P17
    - Battery Max Voltage: 3000
    - Battery Min Voltage: 2300
    - Battery ADC on P23
    Device seems to use Battery Driver. See more details here: https://www.elektroda.com/rtvforum/topic3959103.html
    No module information found.
    And the Tuya section starts, as usual, at 2023424 (0x1EE000)


    "BK7231N Decryption" tab from the backupped original firmware "Try to find keys" results in:
    Coeff 1: 510FB093
    Coeff 2: A3CBEADC
    Coeff 3: 5993A17E
    Coeff 4: C7ADEB03


    Found match at 0x46BC with key: 0 0 7CB50721 55000803
    Decrypt combination: 0 0 7CB50721 55000803
    Bootloader key: 510FB093 A3CBEADC 5993A17E C7ADEB03 at 0x48
    Found match at 0x46BC with key: 0 0 7CB50721 55000803
    Decrypt combination: 0 0 7CB50721 55000803
    Bootloader key: 510FB093 A3CBEADC 5993A17E C7ADEB03 at 0x48


    "Load partitions from backup" results in:
    Name       Type             Address  Length
    bootloader beken_onchip_crc 0x0      0x10000
    app        beken_onchip_crc 0x10000  0x108700
    download   beken_onchip     0x12A000 0xA6000


    Log when I write BK7231N OpenBK7231N_QIO_1.18.247.bin:
    
    Starting flash new (no backup)!
    Now is: Tuesday, 24 March 2026 17:38:42.
    Flasher mode: BK7231N
    Going to open port: COM3.
    Serial port open!
    Getting bus... (now, please do reboot by CEN or by power off/on)
    Getting bus failed, will try again - 0/100!
    Getting bus success!
    Going to set baud rate setting (230400)!
    Chip ID: 0x7231c
    Will try to read device flash MID (for unprotect N):
    Flash MID loaded: 1565C8
    Will now search for Flash def in out database...
    Flash def found! For: 1565C8
    Flash information: mid: 1565C8, icName: GD25WQ16E, manufacturer: GD, szMem: 200000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
    Flash size is 2MB
    Entering SetProtectState(True)...
    sr: 0
    sr: 0
    final sr: 0
    msk: 407c
    cw: 0, sb: 2, lb: 5
    bfd: 0
    SetProtectState(True) success!
    Going to read encryption key...
    Encryption key read done!
    Encryption key: 510fb093 a3cbeadc 5993a17e c7adeb03
    Reading file firmwares/OpenBK7231N_QIO_1.18.247.bin...
    Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.18.247.bin...
    Using hack to write QIO - just skip bootloader...
    ... so bootloader will not be overwritten!
    Preparing to write data file to chip - resetting bus and baud...
    Getting bus... (now, please do reboot by CEN or by power off/on)
    Getting bus success!
    Going to set baud rate setting (230400)!
    Will try to read device flash MID (for unprotect N):
    Flash MID loaded: 1565C8
    Will now search for Flash def in out database...
    Flash def found! For: 1565C8
    Flash information: mid: 1565C8, icName: GD25WQ16E, manufacturer: GD, szMem: 200000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
    Flash size is 2MB
    Entering SetProtectState(True)...
    sr: 0
    sr: 0
    final sr: 0
    msk: 407c
    cw: 0, sb: 2, lb: 5
    bfd: 0
    SetProtectState(True) success!
    Going to do erase, start 0x11000, sec count 281!
    Erasing sector 0x11000... ok! Erasing sector 0x12000... ok! Erasing sector 0x13000... ok! Erasing sector 0x14000... ok! Erasing sector 0x15000... ok! Erasing sector 0x16000... ok! Erasing sector 0x17000... ok! Erasing sector 0x18000... ok! Erasing sector 0x19000... ok! Erasing sector 0x1A000... ok! Erasing sector 0x1B000... ok! Erasing sector 0x1C000... ok! Erasing sector 0x1D000... ok! Erasing sector 0x1E000... ok! Erasing sector 0x1F000... ok! Erasing block 0x20000... ok! Erasing block 0x30000... ok! Erasing block 0x40000... ok! Erasing block 0x50000... ok! Erasing block 0x60000... ok! Erasing block 0x70000... ok! Erasing block 0x80000... ok! Erasing block 0x90000... ok! Erasing block 0xA0000... ok! Erasing block 0xB0000... ok! Erasing block 0xC0000... ok! Erasing block 0xD0000... ok! Erasing block 0xE0000... ok! Erasing block 0xF0000... ok! Erasing block 0x100000... ok! Erasing block 0x110000... ok! Erasing sector 0x120000... ok! Erasing sector 0x121000... ok! Erasing sector 0x122000... ok! Erasing sector 0x123000... ok! Erasing sector 0x124000... ok! Erasing sector 0x125000... ok! Erasing sector 0x126000... ok! Erasing sector 0x127000... ok! Erasing sector 0x128000... ok! Erasing sector 0x129000... ok! 
    All selected sectors erased!
    Writing sector 0x11000... ok! Writing sector 0x12000... ok! Writing sector 0x13000... ok! Writing sector 0x14000... ok! Writing sector 0x15000... ok! Writing sector 0x16000... ok! Writing sector 0x17000... ok! Writing sector 0x18000... ok! Writing sector 0x19000... ok! Writing sector 0x1A000... ok! Writing sector 0x1B000... ok! Writing sector 0x1C000... ok! Writing sector 0x1D000... ok! Writing sector 0x1E000... ok! Writing sector 0x1F000... ok! Writing sector 0x20000... ok! Writing sector 0x21000... ok! Writing sector 0x22000... ok! Writing sector 0x23000... ok! Writing sector 0x24000... ok! Writing sector 0x25000... ok! Writing sector 0x26000... ok! Writing sector 0x27000... ok! Writing sector 0x28000... ok! Writing sector 0x29000... ok! Writing sector 0x2A000... ok! Writing sector 0x2B000... ok! Writing sector 0x2C000... ok! Writing sector 0x2D000... ok! Writing sector 0x2E000... ok! Writing sector 0x2F000... ok! Writing sector 0x30000... ok! Writing sector 0x31000... ok! Writing sector 0x32000... ok! Writing sector 0x33000... ok! Writing sector 0x34000... ok! Writing sector 0x35000... ok! Writing sector 0x36000... ok! Writing sector 0x37000... ok! Writing sector 0x38000... ok! Writing sector 0x39000... ok! Writing sector 0x3A000... ok! Writing sector 0x3B000... ok! Writing sector 0x3C000... ok! Writing sector 0x3D000... ok! Writing sector 0x3E000... ok! Writing sector 0x3F000... ok! Writing sector 0x40000... ok! Writing sector 0x41000... ok! Writing sector 0x42000... ok! Writing sector 0x43000... ok! Writing sector 0x44000... ok! Writing sector 0x45000... ok! Writing sector 0x46000... ok! Writing sector 0x47000... ok! Writing sector 0x48000... ok! Writing sector 0x49000... ok! Writing sector 0x4A000... ok! Writing sector 0x4B000... ok! Writing sector 0x4C000... ok! Writing sector 0x4D000... ok! Writing sector 0x4E000... ok! Writing sector 0x4F000... ok! Writing sector 0x50000... ok! Writing sector 0x51000... ok! Writing sector 0x52000... ok! Writing sector 0x53000... ok! Writing sector 0x54000... ok! Writing sector 0x55000... ok! Writing sector 0x56000... ok! Writing sector 0x57000... ok! Writing sector 0x58000... ok! Writing sector 0x59000... ok! Writing sector 0x5A000... ok! Writing sector 0x5B000... ok! Writing sector 0x5C000... ok! Writing sector 0x5D000... ok! Writing sector 0x5E000... ok! Writing sector 0x5F000... ok! Writing sector 0x60000... ok! Writing sector 0x61000... ok! Writing sector 0x62000... ok! Writing sector 0x63000... ok! Writing sector 0x64000... ok! Writing sector 0x65000... ok! Writing sector 0x66000... ok! Writing sector 0x67000... ok! Writing sector 0x68000... ok! Writing sector 0x69000... ok! Writing sector 0x6A000... ok! Writing sector 0x6B000... ok! Writing sector 0x6C000... ok! Writing sector 0x6D000... ok! Writing sector 0x6E000... ok! Writing sector 0x6F000... ok! Writing sector 0x70000... ok! Writing sector 0x71000... ok! Writing sector 0x72000... ok! Writing sector 0x73000... ok! Writing sector 0x74000... ok! Writing sector 0x75000... ok! Writing sector 0x76000... ok! Writing sector 0x77000... ok! Writing sector 0x78000... ok! Writing sector 0x79000... ok! Writing sector 0x7A000... ok! Writing sector 0x7B000... ok! Writing sector 0x7C000... ok! Writing sector 0x7D000... ok! Writing sector 0x7E000... ok! Writing sector 0x7F000... ok! Writing sector 0x80000... ok! Writing sector 0x81000... ok! Writing sector 0x82000... ok! Writing sector 0x83000... ok! Writing sector 0x84000... ok! Writing sector 0x85000... ok! Writing sector 0x86000... ok! Writing sector 0x87000... ok! Writing sector 0x88000... ok! Writing sector 0x89000... ok! Writing sector 0x8A000... ok! Writing sector 0x8B000... ok! Writing sector 0x8C000... ok! Writing sector 0x8D000... ok! Writing sector 0x8E000... ok! Writing sector 0x8F000... ok! Writing sector 0x90000... ok! Writing sector 0x91000... ok! Writing sector 0x92000... ok! Writing sector 0x93000... ok! Writing sector 0x94000... ok! Writing sector 0x95000... ok! Writing sector 0x96000... ok! Writing sector 0x97000... ok! Writing sector 0x98000... ok! Writing sector 0x99000... ok! Writing sector 0x9A000... ok! Writing sector 0x9B000... ok! Writing sector 0x9C000... ok! Writing sector 0x9D000... ok! Writing sector 0x9E000... ok! Writing sector 0x9F000... ok! Writing sector 0xA0000... ok! Writing sector 0xA1000... ok! Writing sector 0xA2000... ok! Writing sector 0xA3000... ok! Writing sector 0xA4000... ok! Writing sector 0xA5000... ok! Writing sector 0xA6000... ok! Writing sector 0xA7000... ok! Writing sector 0xA8000... ok! Writing sector 0xA9000... ok! Writing sector 0xAA000... ok! Writing sector 0xAB000... ok! Writing sector 0xAC000... ok! Writing sector 0xAD000... ok! Writing sector 0xAE000... ok! Writing sector 0xAF000... ok! Writing sector 0xB0000... ok! Writing sector 0xB1000... ok! Writing sector 0xB2000... ok! Writing sector 0xB3000... ok! Writing sector 0xB4000... ok! Writing sector 0xB5000... ok! Writing sector 0xB6000... ok! Writing sector 0xB7000... ok! Writing sector 0xB8000... ok! Writing sector 0xB9000... ok! Writing sector 0xBA000... ok! Writing sector 0xBB000... ok! Writing sector 0xBC000... ok! Writing sector 0xBD000... ok! Writing sector 0xBE000... ok! Writing sector 0xBF000... ok! Writing sector 0xC0000... ok! Writing sector 0xC1000... ok! Writing sector 0xC2000... ok! Writing sector 0xC3000... ok! Writing sector 0xC4000... ok! Writing sector 0xC5000... ok! Writing sector 0xC6000... ok! Writing sector 0xC7000... ok! Writing sector 0xC8000... ok! Writing sector 0xC9000... ok! Writing sector 0xCA000... ok! Writing sector 0xCB000... ok! Writing sector 0xCC000... ok! Writing sector 0xCD000... ok! Writing sector 0xCE000... ok! Writing sector 0xCF000... ok! Writing sector 0xD0000... ok! Writing sector 0xD1000... ok! Writing sector 0xD2000... ok! Writing sector 0xD3000... ok! Writing sector 0xD4000... ok! Writing sector 0xD5000... ok! Writing sector 0xD6000... ok! Writing sector 0xD7000... ok! Writing sector 0xD8000... ok! Writing sector 0xD9000... ok! Writing sector 0xDA000... ok! Writing sector 0xDB000... ok! Writing sector 0xDC000... ok! Writing sector 0xDD000... ok! Writing sector 0xDE000... ok! Writing sector 0xDF000... ok! Writing sector 0xE0000... ok! Writing sector 0xE1000... ok! Writing sector 0xE2000... ok! Writing sector 0xE3000... ok! Writing sector 0xE4000... ok! Writing sector 0xE5000... ok! Writing sector 0xE6000... ok! Writing sector 0xE7000... ok! Writing sector 0xE8000... ok! Writing sector 0xE9000... ok! Writing sector 0xEA000... ok! Writing sector 0xEB000... ok! Writing sector 0xEC000... ok! Writing sector 0xED000... ok! Writing sector 0xEE000... ok! Writing sector 0xEF000... ok! Writing sector 0xF0000... ok! Writing sector 0xF1000... ok! Writing sector 0xF2000... ok! Writing sector 0xF3000... ok! Writing sector 0xF4000... ok! Writing sector 0xF5000... ok! Writing sector 0xF6000... ok! Writing sector 0xF7000... ok! Writing sector 0xF8000... ok! Writing sector 0xF9000... ok! Writing sector 0xFA000... ok! Writing sector 0xFB000... ok! Writing sector 0xFC000... ok! Writing sector 0xFD000... ok! Writing sector 0xFE000... ok! Writing sector 0xFF000... ok! Writing sector 0x100000... ok! Writing sector 0x101000... ok! Writing sector 0x102000... ok! Writing sector 0x103000... ok! Writing sector 0x104000... ok! Writing sector 0x105000... ok! Writing sector 0x106000... ok! Writing sector 0x107000... ok! Writing sector 0x108000... ok! Writing sector 0x109000... ok! Writing sector 0x10A000... ok! Writing sector 0x10B000... ok! Writing sector 0x10C000... ok! Writing sector 0x10D000... ok! Writing sector 0x10E000... ok! Writing sector 0x10F000... ok! Writing sector 0x110000... ok! Writing sector 0x111000... ok! Writing sector 0x112000... ok! Writing sector 0x113000... ok! Writing sector 0x114000... ok! Writing sector 0x115000... ok! Writing sector 0x116000... ok! Writing sector 0x117000... ok! Writing sector 0x118000... ok! Writing sector 0x119000... ok! Writing sector 0x11A000... ok! Writing sector 0x11B000... ok! Writing sector 0x11C000... ok! Writing sector 0x11D000... ok! Writing sector 0x11E000... ok! Writing sector 0x11F000... ok! Writing sector 0x120000... ok! Writing sector 0x121000... ok! Writing sector 0x122000... ok! Writing sector 0x123000... ok! Writing sector 0x124000... ok! Writing sector 0x125000... ok! Writing sector 0x126000... ok! Writing sector 0x127000... ok! Writing sector 0x128000... ok! Writing sector 0x129000... ok! Starting CRC check for 281 sectors, starting at offset 0x11000
    CRC matches 0x7D4F2E36!
    
    NOTE: the OBK config writing is disabled, so not writing anything extra.
    Writing file data to chip successs.


    Log when I write the OBK config:
    
    Starting write only OBK config!
    Now is: Tuesday, 24 March 2026 17:51:24.
    Flasher mode: BK7231N
    Going to open port: COM3.
    Serial port open!
    Getting bus... (now, please do reboot by CEN or by power off/on)
    Getting bus success!
    Going to set baud rate setting (230400)!
    Chip ID: 0x7231c
    Will try to read device flash MID (for unprotect N):
    Flash MID loaded: 1565C8
    Will now search for Flash def in out database...
    Flash def found! For: 1565C8
    Flash information: mid: 1565C8, icName: GD25WQ16E, manufacturer: GD, szMem: 200000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
    Flash size is 2MB
    Entering SetProtectState(True)...
    sr: 0
    sr: 0
    final sr: 0
    msk: 407c
    cw: 0, sb: 2, lb: 5
    bfd: 0
    SetProtectState(True) success!
    Going to read encryption key...
    Encryption key read done!
    Encryption key: 510fb093 a3cbeadc 5993a17e c7adeb03
    Preparing to write data file to chip - resetting bus and baud...
    Getting bus... (now, please do reboot by CEN or by power off/on)
    Getting bus success!
    Going to set baud rate setting (230400)!
    Will try to read device flash MID (for unprotect N):
    Flash MID loaded: 1565C8
    Will now search for Flash def in out database...
    Flash def found! For: 1565C8
    Flash information: mid: 1565C8, icName: GD25WQ16E, manufacturer: GD, szMem: 200000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
    Flash size is 2MB
    Entering SetProtectState(True)...
    sr: 0
    sr: 0
    final sr: 0
    msk: 407c
    cw: 0, sb: 2, lb: 5
    bfd: 0
    SetProtectState(True) success!
    Going to do erase, start 0x1D1000, sec count 1!
    Erasing sector 0x1D1000... ok! 
    All selected sectors erased!
    
    Now will also write OBK config...
    Long name from CFG: OpenBekenX_6E2F8D
    Short name from CFG: obk6E2F8D
    Web Root from CFG: https://openbekeniot.github.io/webapp/
    Writing config sector 0x1D1000...Writing file data to chip successs.
ADVERTISEMENT