Unknown bootloader CRC - 0x6BEB0924 (for a BK7238)

[Cthanatos]

This is for a string of Brizlabs Smart Fairy Lights. I'd be happy to donate the cost for you to order one yourself for testing.

It has "CBU" on the PCB, and the chip info comes up with this:

I saw in another thread about pulling just the bootloader, so here it is from BK7231Flasher

readResult_BK7238_QIO_BK7238-bootloader.zip

Here's the full flash read from BK7231Flasher

readResult_BK7238_QIO_full.zip

and here's the Rom (I think I got it, let me know if I need to try again)

ltchiptool_bk72xx_2025-04-16_16-06-08_rom.zip

Not sure if this helps but here's the output from the UART2 bus right after I connect ground to CEN. Let me know if (and maybe how) to get whatever else you need.

vHeapInit-start addr:0x412f20, size:184544
[Flash]id:0x852015
[Flash]init over
sctrl_sta_ps_init
SDK Rev: 3.0.65 
[THD]app:[tcb]414200 [stack]4131f8-4141f8:4096:5
[THD]extended_app:[tcb]414a70 [stack]414268-414a68:2048:4
[THD]idle:[tcb]414ee0 [stack]414ad8-414ed8:1024:0
[THD]timer_thd:[tcb]415c68 [stack]415060-415c60:3072:2
OSK Rev: F-3.0.40 
cset:0 0 0 0
[FUNC]rwnxl_init
chip id=7238 device id=22068000
IP Rev: W4-3.0.65-P0
txdesc flush
[FUNC]intc_init
[FUNC]calibration_main
device_id=0x22068000
calibration_main over
NO TXPWR_TAB_TAB found in flash
Load default txpwr for b:0xe3e10
Load default txpwr for g:0xe3e46
fit n20 table with dist:4
Load default txpwr for ble:0xe3e1e
calibrate low value:[477]
calibrate high value:[8f0]
temp in flash is:255
[THD]temp_detct:[tcb]416680 [stack]415e78-416678:2048:3
lpf_i & q in flash is:74, 76
xtal in flash is:23
xtal_cali:23
--init_xtal = 23
[FUNC]ps_init
int watchdog enabled, period=10000
task watchdog enabled, period=60000
[FUNC]func_init_extended OVER!!!

start_type:0
[THD]kmsgbk:[tcb]417748 [stack]416740-417740:4096:6
[THD]init_thread:[tcb]417f88 [stack]4177b0-417f80:2000:5
Initializing TCP/IP stack
tcp_port:55452
[THD]tcp/ip:[tcb]4189b8 [stack]4181b0-4189b0:2048:7
[THD]wpas_thread:[tcb]419e80 [stack]418e78-419e78:4096:4
bk_wlan_app_init finished
[THD]core_thread:[tcb]41ae38 [stack]41a630-41ae30:2048:7
[THD]rf_arbitrate:[tcb]41b7a0 [stack]41af98-41b798:2048:8
rf_thread_init ok
[THD]ble:[tcb]41c8b8 [stack]41b8b0-41c8b0:4096:5
ble mac:44-4a-d6-0c-9e-15
rwip_heap_env addr:0x41c920 size:2856
rwip_heap_db addr:0x41d450 size:3084
rwip_heap_msg addr:0x41e068 size:9844
rwip_heap_non_ret addr:0x4206e8 size:668
xvr_reg_init
load_ctx_xtal, MarkHead : 0x87, 0x87; MarkEnd ; 0x65, 0x65
load from flash
tx_pwr_idx:32
enter normal mode
[gapm_cmp_evt_handler] conidx:0,operation:0x1,status:0x0
cmd->addr.addr[5] :0
[gapm_cmp_evt_handler] conidx:0,operation:0x3,status:0x0
gapm_cmp_evt:GAPM_SET_DEV_CONFIG
gapm_cmp_evt:BLE_STACK_OK
[THD]cli:[tcb]423758 [stack]422750-423750:4096:3
[THD]uart1_main:[tcb]4247c8 [stack]4237c0-4247c0:4096:3
[THD]uart1_rx_task:[tcb]425038 [stack]424830-425030:2048:3
[rlink_check_main_partition][422]check triple partition pass
country:US, tz:-360
rw_ieee80211_set_country code:
code: US
channel: 1 - 11
mode: MANUAL
rn_iot_cfg.pid:sxebObqQRfXmgU
rn_iot_cfg.version:1.0.1
###################
tripleTmp.device_id:[rn01DBaAAdaDECA6]
tripleTmp.device_secret:[c6b54bc4201b4fd292f716f111907b72]
tripleTmp.mac:[444AD60C9E14]
###################
DBG|2021-01-01 00:00:00|rlink_main.c|rlink_main(649): hello, build Nov 28 2024 09:22:33
->rlink_production_test,40 entery
->rlink_dev_module_test,368 entery
val=1
val=1
val=1
val=1
val=1
val=1
val=1
val=1
val=1
val=1
->rlink_dev_module_test,509 exit
->rlink_production_test,44 exit
DBG|2021-01-01 00:00:00|rlink_ble.c|ble_start(584): ble_start, entry

[THD]ble_wifi_config:[tcb]426128 [stack]425120-426120:4096:2
value:9
value:10
--write status reg:0,2--
--write status reg:4004,2--
--write status reg:0,2--
--write status reg:4004,2--
bk_save_env
INF|2021-01-01 00:00:00|rlink_main.c|rlink_env_init(499): set mac:444AD60C9E14
product_id:14, pid:14[THD]rlink_main_thread:[tcb]428198 [stack]426190-428190:8192:3
[THD]run_user_app_task:[tcb]428e08 [stack]428200-428e00:3072:2
load_thing_model
load_thing_model, properties_mini cnt=15
DBG|2021-01-01 00:00:00|user_app_main.c|user_app_main(3018): *************

DBG|2021-01-01 00:00:00|user_app_main.c|usDBG|2021-01-01 00:00:00ei_config_thread(570): |rlink_ble.c|ble_wifi_cble_wifi_config_threadonfig_thread(570): ble_w

DBG|2021-01-01 00:00i***

ble create new :00|user_app_main.c|usedb
r_app_main(3020): *DBG|2021-01-01 00:00:00*: exit

========|rl[bk_ble_service_init]p_cb null
ble_env->start_hdl = 0x16,prf_task:8
[gapm_profile_added_ind_handler] prf_task_id:0x64,prf_task_nb:8,start_hdl:22,state:0x1
conidx:0x0,dest_id:0x3,src_id:0x6
BLE_5_CREATE_DB
cd_ind:prf_id:0, status:0
[gapm_cmp_evt_handler] conidx:0,operation:0xa0,status:0x0
=====tink_ble.c|ble_wifi_confuya_hal_adc_init enter=ig_thread(577): exit
============channel:4 p
Data:404bb4 data_buff_size:1 mode:3==key init==
load from flash
11app_color_8[0]:127,0,0
11app_color_8[1]:113,14,0
11app_color_8[2]:84,42,0
11app_color_8[3]:0,127,0
11app_color_8[4]:0,63,63
11app_color_8[5]:0,0,127
11app_color_8[6]:46,0,80
SlaveMode 128
mode:3, customize_id:3, control_id:1, customize_control:2
pixel num is 4196
0tpUserControl->LineOrder = 1
value:10
rst=10
rlink_set_net_cfg_mode, m = 2
que type: 16, free memory 106744
bind type: 1, m=2
pixel_segment_num = 1, pixel_segment_len = 100
SlaveMode = 128
colorL =253  mode_color=96  idx =9  SlaveMode =128
pmode.motion_type = 13
p_pixel_db->direction = 11
pixel_init_mic_data : 100  4196  21
app_light_dp_process idx=3
DPID_MUSIC, tpUserControl->music_id = 0
app_light_music, mic_mode_id = 0x80
app_led_entry_main
g_wifi_buffer:0x7e 0x5 0x3 0x80 0x4 0xff 0xff 0x0 0xef
save_ctx_enable
tpUserControl->MasterMode =4
tpUserControl->SlaveMode = 0x80, Brightness = 100
seg:1,total:100,midle:50
ERR|2021-01-01 00:00:00|mqtt_client.c|IOT_MQTT_Destroy(166): Invalid argument, *pClient = (nil)
cal_bias!
cal dpll!
temp_code:-350 - adc_code:1043 - adc_trend:[13]:255->[3]:355
init_xtal:23, delta:2, last_xtal:23
is_save_enable
save param len:542
--write status reg:0,2--
--write status reg:7c,2--
que type: 10, free memory 106760
ble_update_resp_adv
rn_iot_cfg.pid(14) : sxebObqQRfXmgU
pid(17) :  
device_id:rn01DBaAAdaDECA6
flag = 0x11
adv_info.advDataLen = 23
adv:
00 | 03 02 01 a1 12 16 01 a1 00 73 78 65 62 4f 62 71 
01 | 51 52 66 58 6d 67 55 
res:
00 | 03 09 52 59 19 ff 00 00 11 03 02 00 04 00 72 6e 
01 | 30 31 44 42 61 41 41 64 61 44 45 43 41 36 
que type: 11, free memory 106744
rlink_wifi_scan, g_is_scan[gapm_cmp_evt_handler] conidx:0,operation:0x60,status:0x0
[gapm_cmp_evt_handler] conidx:0,operation:0x69,status:0x0
[gapm_cmp_evt_handler] conidx:0,operation:0x6a,status:0x0
[gapm_cmp_evt_handler] conidx:0,operation:0x64,status:0x0
cmd:7 idx:0 status:0
ing:0
[sa_sta]MM_RESET_REQ
txdesc flush
[sa_sta]ME_CONFIG_REQ
[sa_sta]ME_CHAN_CONFIG_REQ
[sa_sta]MM_START_REQ
sizeof(wpa_supplicant)=1016
mm_add_if_req_handler:0
hapd_intf_add_vif,type:2, s:0, id:0
wpa_dInit
hapd_intf_del_key: mac ff:ff:ff:ff:ff:ff, hw key idx 65
hapd_intf_del_key: mac ff:ff:ff:ff:ff:ff, hw key idx 65
hapd_intf_del_key: mac ff:ff:ff:ff:ff:ff, hw key idx 65
hapd_intf_del_key: mac ff:ff:ff:ff:ff:ff, hw key idx 65
hapd_intf_del_key: mac ff:ff:ff:ff:ff:ff, hw key idx 65
hapd_intf_del_key: mac ff:ff:ff:ff:ff:ff, hw key idx 65
wpa S: DISCONNECTED -> INACTIVE
wpa S: INACTIVE -> DISCONNECTED
enter low level!
mac 44:4a:d6: c:9e:14
leave low level!
[net]addvif_idx:0
wpa_supplicant_req_scan
Setting scan request: 0.000000 sec
wpa_supplicant_scan
wpa S: DISCONNECTED -> SCANNING
wpa_supplicant_scan 1004
wpa_drv_scan
wpa_send_scan_req
no ht in scan
scan_start_req_handler
wpa_driver_scan_start_cb
wpa rx E SCAN_STARTED
temp_code:-346 - adc_code:1036 - adc_trend:[3]:355->[0]:385
init_xtal:23, delta:-5, last_xtal:25
tuya_hal_adc_value_get: timeout!++++++++++last_adc = 3299+++++++wpa_driver_scan_cb
wpa rx E SCAN_RESULTS
Scan completed in 1.120000 seconds
wpa_get_scan_rst:7
rlink_light_sys_app_init
rino_light_prod_init
ret:0, test_mode:2
Prod test ssid chang to test2!
Got ap count:88***66********* 7
wpa S: SCANNING -> DISCONNECTED
que type: 18, free memory 100576
Got ap count: 7
free memory 100192
que type: 5, free memory 100192
WRN|2021-01-01 00:00:03|rlink_ble.c|ble_send_packet_by_ntf(606): ble peer disconnect
ble send, ret=-1
tuya_hal_adc_value_get: timeout!++++++++++last_adc = 3039+++++++value:0
--write status reg:0,2--
--write status reg:7c,2--
--write status reg:0,2--
--write status reg:7c,2--
bk_save_env
adc_value=3041, adc_value_max=3755, adc_value_min=341, RGBWMic=47, gMicSens=330, g_max_connt=3000, SlaveMode=0x80
adc_value=3315, adc_value_max=3752, adc_value_min=2488, RGBWMic=47, gMicSens=330, g_max_connt=3000, SlaveMode=0x80
tuya_hal_adc_value_get: timeout!++++++++++last_adc = 3124+++++++adc_value=3124, adc_value_max=3750, adc_value_min=2516, RGBWMic=47, gMicSens=330, g_max_connt=3000, SlaveMode=0x80

[Cthanatos]

Not sure if this is helpful or not, but here's some documentation from Beken about the BK7238 hardware and CRC partitions.

[Ivkaiv]

I have the same chip and the same issue

[Cthanatos]

I'm learning as I go, but I'm looking for useful info. I was able to get the UART CLI to work with the UART 2 going to a terminal window in ltchiptool, and UART 1 going through Putty. the "partition" command gave me this:

Here's a list of the commands I get using tab-completion (pressing tab with nothing else typed)

No idea if any of those will give helpful info so I'm just tinkering and keeping an eye open.

[kuba2k2]

The "unknown bootloader" is just a warning message, there are too many bootloader versions to list them all in the program.

It should work properly nevertheless - are you experiencing issues with flashing/dumping via ltchiptool?

[Cthanatos]

I appear to be able to dump the flash. I'd like to move it to ESPHome, but when I try to analyze the firmware dump, I get this error.

I've dropped a different firmware with BK7231Flasher that seemed to work, but it obviously wipes all the configuration data so I don't know what I need to have everything work the way I want it to from ESPHome.

[kuba2k2]

This device is not connected to Tuya Cloud, it's a custom solution created by the manufacturer. UPK2ESPHome can't generate configuration for such devices.

That being said, BK7238 is not currently supported by ESPHome. You could try compiling ESPHome for BK7231N, but that probably wouldn't "just" work.

In any case, it's not an issue with ltchiptool, but a missing platform support in LibreTiny.

[Cthanatos]

Good to know, that's what I was afraid of. Looks like I'll need to order a different string of lights that I know works with the tuya cloud so I can get the configs. Thank you!