logo elektroda
logo elektroda
X
logo elektroda

Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

p.kaczmarek2 1479 59
ADVERTISEMENT
📢 Listen (AI):
  • Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs
    BK7231GUIFlashTool version 98 and above introduces a new Beken flashing method via SPI. Only a CH341 SPI programmer is required. This method can be used to recover bricked Beken devices whose bootloader has been overwritten. It can also serve as a general-purpose SPI flasher, supporting various memory chips.

    Recommended Reading
    This topic builds on my previous presentation, BK7231 Programming via SPI in Flash Memory Mode – Python and Banana Pi. Here, I’ll expand on that knowledge and adapt the same logic for use with the CH341 and C#.
    Additionally, the current approach is based on the work of @divadiow — see this post. The main difference is that we’ve transitioned to a more complete and suitable tool.

    Required Hardware
    For this guide, you’ll need a CH341 programmer — either the same one used in our video or a similar model:



    Additionally, you’ll need a soldering iron to attach a wire to the D2 pin, which will be used to control CEN:
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs
    Here’s how it looks in my setup:
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs
    Alternatively, you can use another version of the CH341 — the one with routed-out pins:
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs
    Make sure the device jumper is set to the I2C position so that Windows detects it as USB-EPP/I2C... CH341A.
    Next, connect the CH341 to the Beken device in SPI mode:
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs
    Use the following pins: P20, P21, P22, P23 (SCK, CSN, SI, and SO).
    As usual, connect MOSI → SI and MISO → SO. Additionally, connect CEN to the previously mentioned D2 pin.
    You can also check for board markings — they might be available on some devices.
    Here’s an example photo from @divadiow:
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs
    Connections summary:
    Generic IOTuya Doorbell PadsCH341A
    CE/CENCED2
    SCKTCKSCK
    CSNTMSCS0
    SITDIMOSI
    SOTDOMISO
    GNDGNDGND

    So, the pad naming may vary, but the connection remains the same. Don’t forget to connect power.

    Implementation Details
    Skip this section if you just want to flash your device!
    Beken chips include an SPI mode — in this mode, they behave just like standard SPI memory, using the same protocol details and commands. I’ve described this in a previous topic.
    However, this mode is only available after entering SPI mode — that’s why we need a custom script and the D2 pin connected to CEN. The new flasher tool uses CH341 DLL C# bindings to first toggle CEN, resetting the Beken device, then sends the 0xD2 bytes to switch it into SPI mode. After that, it handles the Beken chip just like any generic SPI flash memory. In our implementation, SPIFlasher_Beken class actually inherits from generic SPIFlasher, making it reusable and giving us "free" generic SPI flash support as well.
    Code: C#
    Log in, to see the code

    Interestingly, once switched to SPI mode, you can even use a generic SPI flashing tool such as CH341 Programmer or NeoProgrammer. However, that’s not necessary — see the next section for details.

    ADVERTISEMENT


    Flash Tool Usage for Beken
    First, download our tool from the following link:
    https://github.com/openshwprojects/BK7231GUIFlashTool
    You can either download one of the prebuilt binaries or compile it yourself in Visual Studio.
    After launching the tool, you should see a window like this — select the Beken SPI chip type:
    Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs
    Next, you can use the buttons to Read, Write, Verify, or Erase the firmware.
    If you encounter an error like the one below:
    
    Backup name has not been set, so output file will only contain flash type/date.
    Now is: niedziela, 5 października 2025 00:35:37.
    Flasher mode: BekenSPI
    CH341 error Failed to open CH341 device.
    Starting flash read, ofs 0x0, len 0x0
    Done!
    Performing a Beken CEN reset on D2 of CH341...
    Failed to toggle CEN - is CH341 connected and ok?
    

    Check if the CH341 is properly configured and detected by your PC.

    If the Beken chip does not enter SPI mode, verify the SPI and CEN connections.
    Once properly connected, the tool should correctly identify the flash ID and size, and begin the selected operation.

    Sample ID output (your values may vary):
    
    JEDEC ID: FF-EF-40-16
    Detected flash size: 4096 KB
    

    Wait for the entire operation to complete:
    BK7231 Easy UART Flasher interface with “Reading done” message
    To write firmware, simply drag and drop the binary file onto the flasher window:
    Screenshot of BK7231 Easy UART Flasher with a firmware file path selected.

    Sample application
    This method can be used to recover bricked BK7252 camera device:
    Camera module with multicolored wires connected to a USB adapter

    Flash Tool Usage for Generic SPI
    The tool can also handle generic SPI chips. While there isn’t yet a complete list of JEDEC IDs, it attempts to decode the flash size directly from the ID — this may improve in future updates.
    Just connect the SPI memory as you would for any other flasher and choose Generic SPI mode:
    BK7231 Easy UART Flasher interface during flash erase process
    It should work without issue. If you’re uncertain, you can always run Verify afterward to confirm.


    Summary
    With the latest versions of BK7231GUIFlashTool (v98 and above), you can easily recover bricked Beken devices and flash new firmware using only a CH341 programmer. New BK7231GUIFlashTool utilizes CH341 for easier BK SPI mode control and flashing.

    To summarize:
    - Set the CH341 jumper to I2C mode (if applicable).
    - Connect the SPI lines (P20, P21, P22, P23) and CEN to D2, power your device.
    - Use the Beken SPI mode in the flasher tool.
    - Verify connections if you get a CEN toggle or CH341 not detected error.
    - The tool can also handle Generic SPI flash chips if needed.

    This approach is much simpler than Banana/Raspberry PI method present before and hopefully makes SPI flashing of Beken chips easier to approach for anyone.

    Get it here: https://github.com/openshwprojects/BK7231GUIFlashTool

    We're still working on adding futher features to to our flasher, including support for other platforms, so stay tuned and let us know if you have any feature requests!

    Cool? Ranking DIY
    Helpful post? Buy me a coffee.
    About Author
    p.kaczmarek2
    Moderator Smart Home
    Offline 
    p.kaczmarek2 wrote 13018 posts with rating 10782, helped 601 times. Been with us since 2014 year.
  • ADVERTISEMENT
  • #2 21711794
    divadiow
    Level 36  
    cool! thanks for adding this feature. Easy Flasher has grown in a number of regards in recent weeks/months!

    A couple of things I have noticed, however:

    v98:
    -In SPI mode EF requires a COM port to be present/selected
    Screenshot of BK7231 Easy UART Flasher with serial port selection error message

    -In SPI mode with COM port present but missing CH341A EF will quit without warning - no CH341A detection

    -In SPI mode with COM and CH341A present I get missing ch341dll.dll not found
    BK7231 Easy UART Flasher interface with “Reading done” message displayed
  • #3 21712014
    p.kaczmarek2
    Moderator Smart Home
    Thank you for testing. The incorrect COM port requirement should be fixed now, can you check?

    I can add CH341DLL later.

    Are you able to run the project with Visual Studio to check what crashes? I was sure that I handle all CH341 init exception well...
    Helpful post? Buy me a coffee.
  • #4 21712310
    divadiow
    Level 36  
    p.kaczmarek2 wrote:
    The incorrect COM port requirement should be fixed now, can you check?

    yep. COM no longer mandatory.

    computer rebooted. test setup:
    Driver properties for USB-EPP/I2C CH341A showing date 10/10/2023 and version 2.4.2023.10 CH341A programmer with SOIC-8 adapter and soldered flash memory on blue background

    1st - detection with Neo OK
    NeoProgrammer screenshot showing GD25Q80 CLONE 3.3V chip and memory parameters

    Closed Neo. v99 EF from GH, generic SPI read:
    Screenshot of BK7231 Easy UART Flasher showing Reading done status in green
    same with test write

    build own (VS 2022) with latest code and read completes
    BK7231Flasher interface showing Reading done with flash read details

    write of test XF16 backup also completes and verifies
    BK7231 Easy UART Flasher interface with Verify OK and SPI flash operation log

    Added after 50 [seconds]:

    ps, what is the verify exactly? does it compare against loaded firmware in "select firmware"?

    Added after 57 [seconds]:

    divadiow wrote:
    does it compare against loaded firmware in "select firmware"?

    I guess yes :)

    Screenshot of BK7231 Easy UART Flasher showing Verify bad in red box

    Added after 2 [minutes]:

    Code: Text
    Log in, to see the code


    erase success. Maybe every submission should clear previous completion status, "verify bad" persists after erase. No erase success in green to replace it.

    Added after 5 [minutes]:

    VS 2022 build - with no CH341 present EF does not die.
    BK7231 Easy UART Flasher interface showing Reading done status

    so is the Github workflow breaking something?

    Added after 44 [minutes]:

    forgot to mention that adding CH341DLL.DLL alongside Github build of EF exe does stop the 'missing dll' error but that's when EF will just quit
  • ADVERTISEMENT
  • #5 21712551
    p.kaczmarek2
    Moderator Smart Home
    Verify verifies against selected firmware.

    So you're having a crash only with older NET? Well, I can't reproduce it in my MSVC anyway...

    I also see there is upgraded NET proposal by @insmod ? What are the advantages?
    Helpful post? Buy me a coffee.
  • #6 21712560
    divadiow
    Level 36  
    p.kaczmarek2 wrote:
    What are the advantages?

    SPI works for me with GH build
  • #7 21712570
    insmod
    Level 28  
    >>21712551
    Tasks, System.Text.Json, Hot reload while debugging, possibly others.
    I would've upgraded to 4.8, but i remember that mono support for it is incomplete.
    I also don't know if it will work with mono with 4.7.2, and can't check it myself.

    As it is, this pull request is only bare minimum to get .net 4 support and System.Text.Json instead of Newtonsoft.Json.
    One hack was required to get it working though: https://github.com/openshwprojects/BK7231GUIF...f0f9a63f68/BK7231Flasher/OBKDeviceAPI.cs#L456
    My RTL8710B plug reply is malformed (0 float is printed as "0." instead of "0.0").
    "ENERGY":{"Power": 0.,"ApparentPower": 0.,"ReactivePower": 0.,"Factor":1.000000,"Voltage":234.138565,"Current":0.,"ConsumptionTotal":46199.652344,"Yesterday": 0.,"ConsumptionLastHour":0.}

    Added after 1 [minutes]:

    What is your VS version?
    I would like to update csproj to Microsoft.NET.Sdk
  • #8 21712587
    p.kaczmarek2
    Moderator Smart Home
    The reason for using older NET is that I still have this Windows 7 laptop, which works very quickly and I sometimes use it for testing. Still, if you are convinced that newer NET is better for users, I can accept this change.

    On my main laptop (Windows 10, the one from this DIY - https://www.elektroda.com/rtvforum/topic4074433.html ), I have newer NET, but still use this MSVC:
    About window of Visual Studio Community 2017 with list of installed components
    Still, this isn't the older tool I have! I have also this, in which I started OBK:
    Windows taskbar with app icons and a red arrow pointing to one of them
    That's a great tool:
    About window of Microsoft Visual C++ 2008 Express Edition showing installed updates.
    Ok, seriously now, if you think there are advantages, then we can upgrade, but I can't help with mono - I never used it.

    I also think I have some newer MSVC on this machine, but don't use it for OBK currently.
    Helpful post? Buy me a coffee.
  • #9 21712598
    insmod
    Level 28  
    Well, Windows 7 can use .NET 6 and earlier just fine, exception being .NET 4.8.1, and even it can be installed with some tricks.
  • #11 21712602
    p.kaczmarek2
    Moderator Smart Home
    I remember we had multiple reports saying that Easy Flasher UART timings are broken with mono, can this be fixed by NET SDK upgrade?
    Helpful post? Buy me a coffee.
  • #12 21712604
    insmod
    Level 28  
    >>21712601
    For linux users - yes.
    It's that, or wine. And i don't know how wine handles com ports.
  • #14 21712648
    p.kaczmarek2
    Moderator Smart Home
    We need someone to test it with mono https://github.com/openshwprojects/BK7231GUIFlashTool/pull/72 . To be honest, it's probably not that hard, maybe even GPT can guide
    Helpful post? Buy me a coffee.
  • #15 21712663
    insmod
    Level 28  
    $ mono --version
    Mono JIT compiler version 6.12.0.200 (tarball Tue Jul 11 21:32:10 UTC 2023)
    Copyright (C) 2002-2014 Novell, Inc, Xamarin Inc and Contributors. www.mono-project.com
       TLS:           __thread
       SIGSEGV:       altstack
       Notifications: epoll
       Architecture:  amd64
       Disabled:      none
       Misc:          softdebug 
       Interpreter:   yes
       LLVM:          yes(610)
       Suspend:       hybrid
       GC:            sgen (concurrent by default)

    BK7231 Easy UART Flasher interface showing memory reading progress and status log.
    Had to lower baud rate to 921600, while on windows 1500000 works fine.

    LAN Scanner works too.
  • ADVERTISEMENT
  • #17 21712668
    insmod
    Level 28  
    >>21712665
    If you mean v99 flasher, then yes.
    If you mean automatic firmware downloader in flasher, then yes too

    With mono too:
    Target platform: RTL8720D
    Will request page: https://github.com/openshwprojects/OpenBK7231T_App/releases
    Got reply length 215016
    Now will search page for binary link...
    Searching for: OpenRTL8720D_!
    Found link: https://github.com/openshwprojects/OpenBK7231T_App/releases/download/1.18.189/OpenRTL8720D_1.18.189.bin!
    Now will try to download it to firmwares/OpenRTL8720D_1.18.189.bin!
    Downloaded and saved firmwares/OpenRTL8720D_1.18.189.bin!
    


    Easyflash isn't working on linux, but it shouldn't have worked before.
    
    Unhandled Exception:
    System.DllNotFoundException: WinEF_x64.dll assembly:<unknown assembly> type:<unknown type> member:(null)
      at (wrapper managed-to-native) BK7231Flasher.EasyFlash+EF64.set_env_size(uint)
      at BK7231Flasher.EasyFlash.LoadFromData (System.Byte[] data, System.Int32 size, System.Byte[]& efdata) [0x00010] in <fffccf93173546e4a80bb7af5169149c>:0 
      at BK7231Flasher.OBKConfig.loadFrom (System.Byte[] dat, BK7231Flasher.BKType type, System.Boolean bApplyOffset) [0x00055] in <fffccf93173546e4a80bb7af5169149c>:0 
      at BK7231Flasher.FormOBKConfig.tryToLoadOBKConfig (System.Byte[] dat, BK7231Flasher.BKType curType, System.Boolean bApplyOffset) [0x00000] in <fffccf93173546e4a80bb7af5169149c>:0 
      at (wrapper remoting-invoke-with-check) BK7231Flasher.FormOBKConfig.tryToLoadOBKConfig(byte[],BK7231Flasher.BKType,bool)
      at BK7231Flasher.FormMain.doOnlyReadOBKConfig () [0x00068] in <fffccf93173546e4a80bb7af5169149c>:0 
      at System.Threading.ThreadHelper.ThreadStart_Context (System.Object state) [0x00014] in <d636f104d58046fd9b195699bcb1a744>:0 
      at System.Threading.ExecutionContext.RunInternal (System.Threading.ExecutionContext executionContext, System.Threading.ContextCallback callback, System.Object state, System.Boolean preserveSyncCtx) [0x00071] in <d636f104d58046fd9b195699bcb1a744>:0 
      at System.Threading.ExecutionContext.Run (System.Threading.ExecutionContext executionContext, System.Threading.ContextCallback callback, System.Object state, System.Boolean preserveSyncCtx) [0x00000] in <d636f104d58046fd9b195699bcb1a744>:0 
      at System.Threading.ExecutionContext.Run (System.Threading.ExecutionContext executionContext, System.Threading.ContextCallback callback, System.Object state) [0x0002b] in <d636f104d58046fd9b195699bcb1a744>:0 
      at System.Threading.ThreadHelper.ThreadStart () [0x00008] in <d636f104d58046fd9b195699bcb1a744>:0 
    [ERROR] FATAL UNHANDLED EXCEPTION: System.DllNotFoundException: WinEF_x64.dll assembly:<unknown assembly> type:<unknown type> member:(null)
      at (wrapper managed-to-native) BK7231Flasher.EasyFlash+EF64.set_env_size(uint)
      at BK7231Flasher.EasyFlash.LoadFromData (System.Byte[] data, System.Int32 size, System.Byte[]& efdata) [0x00010] in <fffccf93173546e4a80bb7af5169149c>:0 
      at BK7231Flasher.OBKConfig.loadFrom (System.Byte[] dat, BK7231Flasher.BKType type, System.Boolean bApplyOffset) [0x00055] in <fffccf93173546e4a80bb7af5169149c>:0 
      at BK7231Flasher.FormOBKConfig.tryToLoadOBKConfig (System.Byte[] dat, BK7231Flasher.BKType curType, System.Boolean bApplyOffset) [0x00000] in <fffccf93173546e4a80bb7af5169149c>:0 
      at (wrapper remoting-invoke-with-check) BK7231Flasher.FormOBKConfig.tryToLoadOBKConfig(byte[],BK7231Flasher.BKType,bool)
      at BK7231Flasher.FormMain.doOnlyReadOBKConfig () [0x00068] in <fffccf93173546e4a80bb7af5169149c>:0 
      at System.Threading.ThreadHelper.ThreadStart_Context (System.Object state) [0x00014] in <d636f104d58046fd9b195699bcb1a744>:0 
      at System.Threading.ExecutionContext.RunInternal (System.Threading.ExecutionContext executionContext, System.Threading.ContextCallback callback, System.Object state, System.Boolean preserveSyncCtx) [0x00071] in <d636f104d58046fd9b195699bcb1a744>:0 
      at System.Threading.ExecutionContext.Run (System.Threading.ExecutionContext executionContext, System.Threading.ContextCallback callback, System.Object state, System.Boolean preserveSyncCtx) [0x00000] in <d636f104d58046fd9b195699bcb1a744>:0 
      at System.Threading.ExecutionContext.Run (System.Threading.ExecutionContext executionContext, System.Threading.ContextCallback callback, System.Object state) [0x0002b] in <d636f104d58046fd9b195699bcb1a744>:0 
      at System.Threading.ThreadHelper.ThreadStart () [0x00008] in <d636f104d58046fd9b195699bcb1a744>:0
  • #18 21712671
    DeDaMrAz
    Level 20  
    >>21712668

    insmod wrote:
    Easyflash isn't working on linux, but it shouldn't have worked before.


    So how important/relevant is mono support again?
  • #19 21712673
    insmod
    Level 28  
    >>21712671
    Relevant enough to get a mention in readme.md
    Will have to compile .so library then.
  • ADVERTISEMENT
  • #20 21712678
    DeDaMrAz
    Level 20  
    I have to ask another very stupid question then.

    Why are "we" dissipating so much energy and time on such a trivial tasks? We had 35 releases before workflow change and 99 releases now with various bug fixes and for that entire time EF was only running in the first couple of releases with mono on Linux. Nothing against that support whatsoever but hundreds of Linux users asked if there was a port/support for Linux on this forum for EF.... do you get what I am saying?

    I am fighting windmills aren't I???
  • #21 21712679
    p.kaczmarek2
    Moderator Smart Home
    Well, to be honest, considering my previous experience with porting projects to Linux (commercial, etc), running Easy Flasher with Mono seems like a child's play... so maybe it's indeed worth it.
    Helpful post? Buy me a coffee.
  • Helpful post
    #22 21712681
    insmod
    Level 28  
    Some magic and now easyflash works
    sudo mono BK7231Flasher.exe
    Warning: Sector header check failed. Format this sector (0x00000000).
    Warning: Sector header check failed. Format this sector (0x00001000).
    Warning: Sector header check failed. Format this sector (0x00002000).
    Warning: Sector header check failed. Format this sector (0x00003000).
    ...
    Warning: All sector header check failed. Set it to default.
    EasyFlash V4.1.0 is initialize success.
    You can get the latest version on https://github.com/armink/EasyFlash .
    No config in EF!


    Added after 45 [seconds]:

    For some reason any baud higher that 921600 doesn't work for me on linux
  • #23 21712682
    p.kaczmarek2
    Moderator Smart Home
    What was wrong with EF? Linking method?
    Helpful post? Buy me a coffee.
  • #24 21712684
    insmod
    Level 28  
    >>21712682
    It was dllimport'ing from unmanaged windows dll

    Added after 23 [minutes]:

    Flasher mode: RTL87X0C
    Going to open port: /dev/ttyUSB0.
    Port ready!
    Starting read...
    Read parms: start 0x1F0000 (sector 496), len 0x10000 (16 sectors)
    Setting baud rate to 921600
    Reading at 0x1F1000... Reading at 0x1F2000... Reading at 0x1F3000... Reading at 0x1F4000... Reading at 0x1F5000... Reading at 0x1F6000... Reading at 0x1F7000... Reading at 0x1F8000... Reading at 0x1F9000... Reading at 0x1FA000... Reading at 0x1FB000... Reading at 0x1FC000... Reading at 0x1FD000... Reading at 0x1FE000... Reading at 0x1FF000... Reading at 0x200000... 
    Getting hash...
    Hash matches B0D78CC5D2A4AAF9E6AB4DE48DBE2A8C35892BF83445E0F986C8253FFEE9D3DB!
    Read complete!
    OBK config loaded. You can now view it by clicking 'Change OBK settings' button.
    You can also edit it whatever you want.
    You can also use 'Write OBK config' button to write it back with your changes.
    


    Added after 1 [hours] 33 [minutes]:

    Some further adjustments:
    RTL8720D config fixed. Cause - char is unsigned by default, so Tiny_CRC8 output is different.
    BL602 read can now be at offset with custom length. Easyflash still not working - there are 4 zero bytes before easyflash partition for some reason. Though even by offsetting those 4 bytes, while easyflash initializes successfully, it still can't find config.
  • #25 21713306
    insmod
    Level 28  
    I'm currently reworking LN882H ramcode
    I've got successful read at offset and variable baud rate.
    upload_ram_loader complete for loaders/ramcode_ln882h.bin!
    change_baudrate: Change baudrate 1500000
    change_baudrate: Waiting for change...
    change_baudrate: send version... wait for:  RAMCODE
    change_baudrate: send version... wait for:  RAMCODE
    RAMCODEchange_baudrate: Baudrate change done
    Reading..
    done in 0,0314265s
    OBK config loaded. You can now view it by clicking 'Change OBK settings' button.
    You can also edit it whatever you want.
    You can also use 'Write OBK config' button to write it back with your changes.
    


    Flasher mode: LN882H
    Going to open port: COM7.
    Port ready!
    upload_ram_loader will upload loaders/ramcode_ln882h.bin!
    Sync with LN882H...
    sending version... waiting for:  Mar 14 2021/00:23:32
    Mar 14 2021/00:23:32Connect to bootloader...
    Will send file via YModem
    0... 1024... 2048... 3072... 4096... 5120... 6144... 7168... 8192... 9216... 10240... 11264... 12288... 13312... 14336... 15360... 16384... 17304... Done!
    Done!
    Starting program. Wait....
    send version... wait for:  RAMCODE
    RAMCODEflash uid:0x433032313333342E3030230050009AFF
    upload_ram_loader complete for loaders/ramcode_ln882h.bin!
    change_baudrate: Change baudrate 1500000
    change_baudrate: Waiting for change...
    change_baudrate: send version... wait for:  RAMCODE
    change_baudrate: send version... wait for:  RAMCODE
    RAMCODEchange_baudrate: Baudrate change done
    Reading..25088... 50688... 76288... 101888... 127488... 153088... 178688... 204288... 229888... 255488... 281088... 306688... 332288... 357888... 383488... 409088... 434688... 460288... 485888... 511488... 537088... 562688... 588288... 613888... 639488... 665088... 690688... 716288... 741888... 767488... 793088... 818688... 844288... 869888... 895488... 921088... 946688... 972288... 997888... 1023488... 1049088... 1074688... 1100288... 1125888... 1151488... 1177088... 1202688... 1228288... 1253888... 1279488... 1305088... 1330688... 1356288... 1381888... 1407488... 1433088... 1458688... 1484288... 1509888... 1535488... 1561088... 1586688... 1612288... 1637888... 1663488... 1689088... 1714688... 1740288... 1765888... 1791488... 1817088... 1842688... 1868288... 1893888... 1919488... 1945088... 1970688... 1996288... 2021888... 2047488... 2073088... 
    done in 14,7192562s
    Wrote 2097152 to readResult_LN882H_test_2025-07-10-18-23-35.bin
    Backup created, now will attempt to extract OBK config.
    OBK config extracted.
    Backup created, now will attempt to extract Tuya config.
    Failed to extract Tuya keys - magic constant header not found in binary
    Sorry, failed to find Tuya Config in backup binary.
    
  • #26 21713309
    p.kaczmarek2
    Moderator Smart Home
    Nice, maybe we could also finish BL602? Just try to manually insert OBK partition into correct binary header...
    Helpful post? Buy me a coffee.
  • #28 21713425
    insmod
    Level 28  
    >>21713344
    i don't know, it's W600 only.
    I see that there is a command called DUMP, but no info about what it outputs.
    Plus we need W800 too.

    Pull req. updated.
    LN882H read and write via single ramcode binary, now stored as base64 string instead of file.
    Config read and write is working. CRC is using unsigned char, same as RTL8720D.
    There is no need to reset chip to boot mode after doing something, it will detect ramcode mode right away (assuming last operation was a success).
  • #29 21713478
    DeDaMrAz
    Level 20  
    insmod wrote:
    it's W600 only.


    I guess that repo can be used to implement flash write for W600 and I can certainly capture/sniff the original flasher traffic on flashing to compare. in fact I can do that for every flasher if need be.
  • #30 21713486
    p.kaczmarek2
    Moderator Smart Home
    I don't think that we need to capture traffic for W600/W800. I saw a complete flasher source code for that.

    I think we need to capture traffic for TWX817. See this topic:
    https://www.elektroda.com/rtvforum/viewtopic.php?p=21708789#21708789
    Helpful post? Buy me a coffee.
📢 Listen (AI):

Topic summary

BK7231GUIFlashTool version 98 and later introduces a new SPI flashing method for Beken BK7231/BK7252 devices using only a CH341 SPI programmer. This method enables recovery of bricked devices with overwritten bootloaders and functions as a general-purpose SPI flasher supporting various memory chips. The approach builds on previous SPI programming techniques using Python and Banana Pi, adapting them for CH341 hardware and C# implementation. Required hardware includes a CH341 programmer and soldering tools for wire attachment. Recent user feedback on version 98 highlights issues such as the tool requiring a COM port selection in SPI mode, lack of CH341A detection warnings, and missing ch341dll.dll errors. The developer has addressed the COM port requirement and plans to add the missing DLL, requesting further debugging via Visual Studio to handle CH341 initialization exceptions.
Summary generated by the language model.
ADVERTISEMENT