logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
Thinking about a 3D printer?
Thinking about a 3D printer? Last days of the promotion »
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

Inside a Tuya Doorbell: BK7252 Exploration and SPI Programming with Python/NeoProgrammer

divadiow 10233 38
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #31 21717022
    divadiow
    Level 38  
    Posts: 5159
    Help: 443
    Rate: 907
    yes. more GPIOs could be done probably but it's OK for now. it looks a bit messy inside. Hoping the enamel holds on these wires. there are no shorts (at the moment)
    PCB with jumper wires connected and visible electronic components Close-up of a PCB with thin soldered wires and various connectors
  • ADVERTISEMENT
  • #32 21738029
    akeilox
    Level 2  
    Posts: 3
    Stumbled on this thread during search, and delighted with the amount of tinkering.
    These doorbells are sold in two types: Kement or Tuya app compatible. Kement one being widely available and cheaper.
    My question is: can I change firmware from Kement to Tuya by OTA update?
  • ADVERTISEMENT

  • Different chip and board complicate firmware extraction

    #34 21738175
    akeilox
    Level 2  
    Posts: 3
    >>21738166

    Thanks for the link! I did not expect they'd gone with different chip and board for the same product.
    I did not yet order it; I came across a listing of Kement type which was dramatically cheaper than Tuya version and thought firmware might be the only difference.
    It's also interesting how much detail can be found inside the APK file, like the JSON object used.
    I have a bunch of Tuya sensors, recently added Cat Feeder and plan to eventually go with ESPHome/HomeKit automation and thought this doorbell was cheap and hackable. It seems in very early stages now, as chips/board differ and extracting firmware has nuances between XR872 and BK725U.
  • ADVERTISEMENT
  • #35 21753146
    divadiow
    Level 38  
    Posts: 5159
    Help: 443
    Rate: 907
    divadiow wrote:
    14: CMP/TB seems to be the one


    This may relate to OpenBeken booting. I've been flashing BK7252U with bootloader only quite a few times this weekend, power cycles in between and SREG2:14 isn't becoming ticked, so no need to clear it. Only when OpenBeken boots did it become enabled for the next SPI flash
  • #36 21759739
    divadiow
    Level 38  
    Posts: 5159
    Help: 443
    Rate: 907
    Hello @insmod. Before I forget why/what, should I try to fix the Tuya BK7252U BL for working OTA (as worked on in DMs) or were you going to?

    There's also the fact that the Tuya variant is missing in release asset list at the moment...
  • ADVERTISEMENT
  • Helpful post
    #37 21760281
    insmod
    Level 31  
    Posts: 1424
    Help: 166
    Rate: 448
    >>21759739
    Sure, but it needs to be decrc'ed and with normal, non-N partitions.

  • Patched BK7252U bootloader to encrypt OTA writes

    #38 21931198
    divadiow
    Level 38  
    Posts: 5159
    Help: 443
    Rate: 907
    I seem to have a working OTA Tuya BK7252U variant using a tweaked RT-Thread 
    BK7251_1.0.15
    bootloader - the one used in unencrypted OpenBK7252.

    The SDK RT-Thread BK7252 bootloader can validate and copy a normal BK7252 .rbl from the download slot into the app slot, but on Tuya-encrypted BK7252U it was writing that app payload as-is, which would fail expected crc after writing, then it would go into an OTA boot loop. The app slot must be written using the Tuya coeff-key transform. Stock RT-Thread bl doesn't have that ability.

    to achieve:
    Found the OTA copy helper in the v1.0.15 bootloader.
    Redirected two calls that wrote decoded firmware to fal_partition_write.
    Added a tiny wrapper, 180 bytes of Thumb code.
    The wrapper pads the final chunk to 32 bytes with 0xff, applies the Tuya coeff encryption per 32-bit word using the real encrypt_n algorithm, then calls the original fal_partition_write in Thumb state.
    Repacked the patched bootloader into the QIO using the Beken 32+2 CRC layout.

    https://github.com/openshwprojects/OpenBK7231...divadiow:OpenBK7231T_App:tuyabk7252u?expand=1

    The Tuya A9 is single-slot and the Tuya coeff 
    510fb093 a3cbeadc 5993a17e c7adeb03
    is present but the non-Tuya OpenBK7252 works on it, so I guess it would need a hacky approach too.

    The bootloaders in the Tuya SDKs all seem to be for the ping-pong A/B style OTA.

    OpenBK7252_Tuya_QIO_tuyabk7252u_49d58b7bd019.bin -> OTA OpenBK7252_1.18.296.rbl -> OTA OpenBK7252_tuyabk7252u_8cf566e7382b.rbl -> OTA OpenBK7252_1.18.296.rbl ✅

    initial QIO boot
    Code: Text
    Log in, to see the code


    OTA
    Code: Text
    Log in, to see the code


    Inside a Tuya Doorbell: BK7252 Exploration and SPI Programming with Python/NeoProgrammer
  • #39 21931896
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14705
    Help: 658
    Rate: 12757
    Great, merged, now we only need a camera driver?
    Helpful post? Buy me a coffee.
Reply | New topic
Report a violation of the law

Topic summary

✨ Discussion of a cheap Tuya doorbell based on the BK7252/BK7252U SoC, focusing on UART boot logs, firmware backup, and SPI flashing with CH341A and NeoProgrammer/Easy Flasher. The thread covers test-pad pin mapping, entering SPI mode with a Python wrapper, reading and writing full flash images, bootloader/partition layout, and issues caused by Tuya-encrypted firmware and efuse/SREG bits. It also compares different firmware builds and bootloaders, notes that standard OpenBK7252 images may not boot without the correct bootloader and Tuya encryption handling, and later develops a working OTA-capable Tuya BK7252U bootloader patch using RT-Thread bootloader code and Tuya coeff-key transformation.
Summary generated by AI based on the discussion content.
Today's popular

FAQ

TL;DR: For Tuya BK7252 doorbells, reliable backups/flashing work over CH341A SPI; one unit needed 398 attempts — “Today this look 398 attempts.” Run the Python helper, then read/write with NeoProgrammer. [Elektroda, divadiow, post #21512355]

Why it matters: This FAQ helps hardware tinkerers back up, unbrick, or experiment with BK7252-based Tuya doorbells without losing factory firmware.

Quick Facts

What chipset and flash are inside this Tuya doorbell?

It uses a Beken BK7252 (QFN68). The SPI flash is XTX XT25F32B, 4 MiB capacity, with JEDEC ID 0B 40 16. The PCB exposes well-labeled test pads for UART and JTAG/SPI access. Photos and a full boot log confirm the platform and memory. This baseline helps you choose the right flasher, offsets, and OTA expectations. [Elektroda, divadiow, post #21213265]

Which UART pins should I use for logs and flashing?

Use UART2_TX for boot logs. Use P10 (UART1_RX) and P11 (UART1_TX) for flashing and backups. The thread identifies both UART sets on the test pads. Keep wires short and solidly soldered or use quality pogo pins to reduce noise during high-baud transfers. [Elektroda, divadiow, post #21213265]

How do I enter BK7252 SPI mode and dump flash with a CH341A?

Three steps:
  1. Put CH341A in I2C mode; wire pads: CE→D2, TCK→SCK, TMS→CS0, TDI→MOSI, TDO→MISO.
  2. Run the provided Python wrapper to toggle CEN and enter SPI; wait for the 0x9F ID pattern.
  3. Once in SPI mode, use NeoProgrammer to detect and read/erase/program the flash. [Elektroda, divadiow, post #21512355]

How long can entering SPI mode take on BK7252?

It can be slow. One capture needed 398 attempts before the expected SPI response appeared. As the author noted, “Today this look 398 attempts.” If retries take long, adjust timing and ensure stable CE control from CH341A GPIO2. [Elektroda, divadiow, post #21512355]

Which tools should I use once the chip is in SPI mode?

Use NeoProgrammer to auto-detect the flash and perform read/erase/program. The helper Python executable only handles the SPI-mode entry and basic JEDEC read; NeoProgrammer handles the actual dump and writes after that. Keep the wiring from the CH341A short and shielded. [Elektroda, divadiow, post #21512355]

Does BK7231GUIFlashTool support BK7252 over UART?

Yes. BK7252 support was added in the tool. Quoting the maintainer: “BK7252 is like BK7231T but without ‘wrap around 2MB’ hack … read/write just skips bootloader (0x11000 offset).” Use the new BK7252 mode and follow the tutorial notes. [Elektroda, p.kaczmarek2, post #21525243]

Why does Easy UART Flasher sometimes fail on this doorbell?

Some boards block or disturb T/N mode. The author could not back up this unit with Easy UART Flasher in T or N mode, and BKFIL did not recognize BK7252. When that happens, switch to the SPI method described above. [Elektroda, divadiow, post #21213265]

Is there an alternate UART method I can try if the normal one fails?

Yes. Use the hid_download_py method from the linked tutorial. It can succeed where standard UART bootstrap fails. Follow the steps carefully and confirm your USB‑UART (e.g., FT232R) and wiring quality before retries. [Elektroda, p.kaczmarek2, post #21526049]

What does a successful BK7252 UART dump look like?

One successful session started at 0x11000, read 495 sectors, verified CRC 0x64E354DE, and produced 2,027,520 bytes. Using an FT232R improved reliability in that case. Save the output and verify CRC before proceeding with any erase or write. [Elektroda, divadiow, post #21526057]

How does Tuya OTA work on BK7252?

It uses a ping‑pang (dual app) layout. Bootloader partitions are app1 at 0x11000 and app2 at 0x1BA000. The standard Tuya bootloader doesn’t use RBL; it toggles between these partitions. Package metadata matches that dual scheme. [Elektroda, insmod, post #21513232]

Why didn’t an OpenBK OTA persist after reboot?

Logs showed the OTA copy then a reboot, but the bootloader reported FAL partition table not found and jumped to 0x10000. This aligns with Tuya’s dual-partition scheme rather than OpenBK’s RBL approach. [Elektroda, divadiow, post #21514822]

Can I flash OpenBK7252 on this doorbell today?

You can experiment, but there is no fully-functioning, cloud‑free replacement yet for BK7252U doorbells. As the author cautioned, “there is no fully-functioning replacement firmware for BK7252U.” Always keep a verified full backup first. [Elektroda, divadiow, post #21578866]

Why won’t OpenBK7252_Tuya_QIO at 0x0 boot on this unit?

On this doorbell, the Tuya QIO image at 0x0 did not boot until a compatible bootloader was spliced in. Tuya’s BL and partitioning expectations differ, so include the matching BL if you test. [Elektroda, divadiow, post #21617297]

Should I back up the full 4 MB including the bootloader?

Yes. Keep a complete 4 MB dump that includes the bootloader, so you can restore factory behavior if needed. This is especially important while experimenting with OpenBK or custom builds. [Elektroda, divadiow, post #21578866]

Where can I get BK7252 Tuya SDKs for reference?

Multiple Tuya BK7252 SDK zip releases were shared (1.1.10 through 1.1.23). Use them to study partitioning, OTA handling, and drivers before attempting custom builds. [Elektroda, divadiow, post #21499790]

My logs show SD timeouts and "no sdcard"—is something broken?

No, that’s expected without a card. The boot log repeats CMD8 timeouts and reports “no sdcard,” then continues. Insert a supported microSD if you need on-device recording. The device boots and operates without it. [Elektroda, divadiow, post #21213265]
Summary generated by AI based on the discussion content.
ADVERTISEMENT