Diivoo WT-03/WG02 Smart Water Timer teardown, photos, logs - CR3L/RTL8720CM/BT7L/TLSR8250

Took a gamble on an ebay water irrigation valve in the hope I'd get a DCDC XR806 for testing.

It didn't work out, but it's an interesting device nonetheless. Here's a dump of photos and logs. To be added to as I discover more.

Meet the Diivoo WT-03/WG02 single-valve smart irrigation device. Smart Water Timer









boot log from CR3L A16




A13/RX+A0 pulled high. EF firmware dump. AmebaZ2 family. CR3L = RTL8720CM = W701M-VT2-CG




Decrypted Tuya KV content


Pairs with Tuya as a 'Gateway'


later I will explore the BT7L/Telink TLSR8250F512ET32 side.

---

keywords and bits:
ECF-SP10-WG02 Rev03 2022-8-5
ECF-WT03 REV1.0 20220509
FCC ID:2A4EPWT-03
Zhuhai Tessan Power Technology Co.,Ltd
https://fcc.report/FCC-ID/2A4EPWT-03/
KP3211SG (Kiwi Instruments PWM power switch)
BM8563 (Gatemode RTC)

CR3L dump: https://github.com/divadiow/FlashDumps/tree/main/IoT/RTL8720CM

For the BT7L/TSLR8250. I couldn't seem to get a stable read using the SWire/USB-TTL methods seen here and here with whatever TTL adaptor I used. Pvvx has an old STM32/Blue Pill option and I happen to have 2 STM32s not used for anything. The 3rd being reserved for CK-Link flash jobs.

The same steps in the CK-Link post were used to flash USB2Swire-STM32F103C8-v06.hex using J-Flash 8.30 and a cheap J-Link clone



on re-insertion of the STM32 after programming two unknown/error status devices appeared in Device Manager



Pvvx's image here shows what to change the

USB to SPI Converter

to using Zadig



With these files present locally, TLSRtool.exe can be run and connected to the BT7L for flash ID read and dump. TLSRTool config and dump steps here: https://github.com/pvvx/TlsrTools825x/tree/master

Not content with the unreadable Cyrillic text spoiling the experience

I got ChatGPT to patch all instances into English


This is how I connected the BT7L to the STM32


I got away with 470Ω.

Successful 512k read




read file is here: https://github.com/divadiow/FlashDumps/blob/m...ater_valve_phase_two)_TLSR8250_BT7L_1.0.2.bin

that's all for tonight.

Thanks for posting, I haven't seen such device yet. 2022 may seem old but i didn't see this kind of module yet.

So basically... it's a two pieces set with two different modules? Well I think I may need to see manual of that to get a grasp of the functionality.

If you managed to read BT7L that way, then it should be also possible to make OBK-based flasher for that?

p.kaczmarek2 wrote:

So basically... it's a two pieces set with two different modules? Well I think I may need to see manual of that to get a grasp of the functionality.

yes. after pairing the WG02 (plug part with CR3L) with the Tuya app you then 'add device' to the gateway to discover the WT-03 BT7L valve part. I have not replicated real operation yet so could put it back together to demonstrate, though Diivoo do have a YouTube channel, complete with nauseating royalty-free backing music https://www.youtube.com/channel/UC-rdA7rXtm4tCvm3EdkGqEA

when in pairing mode the BT7L advertises as such:


and in the CR3L dump from

0x3C5000

you can see several records for the paired BT7L device



mac, product key line up with what's seen in the BT7L dump.