Cloud Cutting Dreo 517s Wall Mount Heater using an approach similar to TuyaMCU

markusdd 300 34

#31 21856501 07 Mar 2026 14:08

markusdd markusdd

Level 2

Topic author Helpful post? (0)

Post #31
21856501 07 Mar 2026 14:08

Can I get you guys any more captures that would be helpful? Certain transitions, etc.?
ADVERTISEMENT
#32 21856568 07 Mar 2026 15:50

divadiow divadiow

Level 38

Helpful post? (+1)

Post #32
21856568 07 Mar 2026 15:50

user Lygris on Discord has the same device and has posted their findings into a new Github repo. https://github.com/lygris/dreo_heater

reported to be fully working with transplanted ESP in place of the BL2028N module. Head-start on a driver maybe?
ADVERTISEMENT
#33 21856931 08 Mar 2026 01:26

markusdd markusdd

Level 2

Topic author Helpful post? (0)

Post #33
21856931 08 Mar 2026 01:26

>>21856568

Wow. I almost felt stupid seeing this and asking myself why I did not find this. Until I realized it's really just been uploaded^^

That being said: Can't ESPHome run on Bekens now anyway? I mean, a transplant is easy enough, but probably not even needed.

But I guess the goal here is to port this driver to OpenBK? Anyway, it seems there's no need to reverse-engineer anymore, it's basically already done.
ADVERTISEMENT
#34 21856933 08 Mar 2026 01:30

DeDaMrAz DeDaMrAz

Level 22

Helpful post? (0)

Post #34
21856933 08 Mar 2026 01:30

Porting such a driver will be a pain without a device in hand so that path is blocked currently I am afraid ( I may be wrong!! )

I suggest you go ESPHome route for now and if the situation arises we can check again to port that driver to OBK in the future.

If you like my work, support me at: https://paypal.me/openshwprojects
#35 21856994 08 Mar 2026 08:30

divadiow divadiow

Level 38

Helpful post? (0)

Post #35
21856994 08 Mar 2026 08:30

markusdd wrote:
I almost felt stupid seeing this and asking myself why I did not find this. Until I realized it's really just been uploaded^^

ah yeh. I asked Lygris for their resources and they spun up a repo with it all in
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Topic summary

The discussion focuses on reverse engineering the Dreo 517s wall-mount heater's communication protocol to enable cloud cutting similar to the TuyaMCU approach used for other generic heaters. The device uses an OpenBeken-compatible module, specifically identified as a Hesung Innovation Limited MBL01 - BL2028N (BK7231N), communicating via UART with an MCU. Initial challenges include grounding issues when connecting a logic analyzer due to the heater's mains-powered high-voltage board supplying 5 V. The heater contains an additional MCU on the mains board responsible for fan speed control and system monitoring, indicated by an error display ("E0") if disconnected. Captured UART traffic reveals periodic status and alive ping-pong messages every ten seconds, with command sequences changing upon temperature adjustments and power toggling via the app. Protocol analysis shows a fixed header starting with 0xAA and a rolling code, with a checksum algorithm similar but not identical to the one used in the dreo-cloudcutter project for a Dreo tower fan. Disassembly of command structures and state messages is underway, with temperature setpoints appearing to be scaled values. The protocol differs from TuyaMCU but shares some structural similarities, suggesting feasible protocol cracking through logic analysis and CRC verification. Further testing involves cycling through modes and temperature settings to fully map command and response patterns.
Summary generated by the language model.

FAQ

TL;DR: Cloud-cutting the Dreo 517s works by speaking its UART protocol: a 0x55 0xAA 0x00 header, rolling ID, and a ~10‑second heartbeat. “Header is always 0x55 0xAA 0x00 .” Use 5 V bench power for safe sniffing and back up flash at 230400 baud. [Elektroda, markusdd, post #21856296]

Why it matters: This lets you keep full local control (no cloud) while retaining buttons and safety features, and paves the way for OpenBeken/ESPHome drivers.

Quick Facts

Radio module spotted: Hesung MBL01 (BL2028N), commonly mapped to BK7231N by community teardown. [Elektroda, divadiow, post #21856107]
Safe bench sniff: backfeed 5 V to logic board; mains disconnected avoids ground loops; app still reports temperature. [Elektroda, markusdd, post #21856029]
Link protocol: Header 0x55 0xAA 0x00 + 1‑byte ID; heartbeat every ~10 s; 1‑byte checksum (sum(ID+payload)−1 mod 256). [Elektroda, markusdd, post #21856296]
Flash backup tip: BK7231GUIFlashTool worked when selecting BK7231M profile; dump at 230400 baud. [Elektroda, markusdd, post #21856327]
Edge case: Disconnecting the mains-board MCU triggers “E0” on the display and blocks normal operation. [Elektroda, markusdd, post #21856029]

What exactly is “cloud cutting” for the Dreo 517s?

Cloud cutting is a local-control retrofit that replaces the vendor cloud link with a direct UART protocol between the Wi‑Fi module and the main MCU, keeping buttons and safety logic intact. It relies on decoding 0x55 0xAA framed packets and the 10‑second heartbeat. [Elektroda, markusdd, post #21856296]

Which Wi‑Fi module is inside the Dreo 517s wall heater?

The PCB carries a Hesung Innovation MBL01 module labeled BL2028N, which the community maps to the Beken BK7231N family used by OpenBeken-compatible devices. A user posted FCC imagery matching MBL01. [Elektroda, divadiow, post #21856107]

How do I safely capture UART without tripping the heater or the logic analyzer?

Power the logic board with a stable 5 V bench supply and keep mains disconnected to avoid ground issues. With RX/TX/5V/GND reconnected, the app still links and reports temperature for clean captures. [Elektroda, markusdd, post #21856029]

What is the Dreo 517s UART packet format and checksum?

Packets start 55 AA 00, followed by a 1‑byte transaction ID that increments from boot, payload bytes, then a checksum computed as (ID + sum(payload bytes) − 1) mod 256. Heartbeat exchanges occur about every 10 seconds. [Elektroda, markusdd, post #21856296]

How do I back up the stock firmware before any flashing?

Use BK7231GUIFlashTool. Connect TX/RX/3.3 V/GND, click “firmware backup,” then power or briefly pull CEN low to enter boot. A successful dump used the BK7231M profile at 230400 baud. [Elektroda, markusdd, post #21856327]

Does the 517s behave like TuyaMCU devices?

Yes, the framing and DP-style fields resemble TuyaMCU, but IDs and checksum differ. Status messages are full-state frames, and the driver can likely reuse TuyaMCU parsing with a different frame runner. [Elektroda, p.kaczmarek2, post #21856491]

Can I use ESPHome today, or should I wait for an OpenBeken driver?

You can use ESPHome now by transplanting an ESP module; a community repo reports full operation. Porting to OpenBeken is feasible but slower without test hardware. “Go ESPHome route for now.” [Elektroda, DeDaMrAz, post #21856933]

How are modes and ECO temperatures encoded on the wire?

Multi‑DP set frames include DP01 power, DP02 mode, DP03 level, and DP04 parameter. ECO uses Fahrenheit byte targets: 15°C→0x3B, 20°C→0x44, 25°C→0x4D, 30°C→0x56, derived from C→F. [Elektroda, markusdd, post #21856387]

What failure modes should I expect while probing?

Ground loops with mains connected can crash captures, and removing the mains-board MCU shows “E0” and stops operation. Always bench-power at 5 V during logic analysis to avoid these faults. [Elektroda, markusdd, post #21856029]

Do physical buttons and IR still work after cloud cutting?

Yes. Buttons are on a separate capacitive line into the main MCU. Presses trigger MCU→Wi‑Fi status messages, so local controls and IR remain functional during UART-based control. [Elektroda, markusdd, post #21856436]

Which serial speed and lines should I monitor?

Use a logic analyzer on the module UART RX/TX at LVCMOS levels. A successful flash dump ran at 230400 baud, while normal UART captures used standard analyzer settings with LSB‑first decoding. [Elektroda, markusdd, post #21856327]

What extra features are exposed (beep, child-lock, display, °C/°F)?

Toggles for display on/off, beep, child lock, window‑open detection, ambient temperature compensation, and °C/°F switching appear as DP fields and cause MCU→Wi‑Fi messages when changed. [Elektroda, markusdd, post #21856404]

How do I put the unit into pairing or observe boot handshakes?

Capture the startup sequence from cold power‑on. You’ll see init queries (cmd 0x01/0x03), a ready trigger (0x08), then status and heartbeat frames. Use that to clone boot timing in your driver. [Elektroda, markusdd, post #21856338]

Is there a known constant or sentinel in the DP set?

Yes. Users observed DP07 as a constant 4‑byte value (0x0000004A) across samples, plus multiple zeroed 4‑byte DPs (e.g., DP09, DP0F, DP11). Treat them as required template fillers. [Elektroda, DeDaMrAz, post #21856379]

What heater power does this effort target?

The reverse‑engineering follows a prior 1000 W/2000 W wall‑mount heater project; the Dreo 517s is a quieter, popular variant tackled with a similar UART approach. [Elektroda, markusdd, post #21855755]

What 3‑step process should I follow to send a mode change?

Send a DP‑prep frame (cmd 0x06) with new rolling ID. 2. Send a 0x07 multi‑DP set using the fixed 126‑byte template, update power/mode/level/param, and recompute checksum. 3. Expect 0x07 ack and a full status frame. [Elektroda, markusdd, post #21856387]