Can't analyze firmware dump

[Bl00d-B0b]

Hello,

I bot quite cheap thermostat from AliExpress
https://www.aliexpress.com/item/1005006020556081.html

I download firmware using BK7231GUIFlashTool, with ignoring key check, it's BK7231N chip on a board with LCD and tuya.
when I try to upload custom firmware, i forced to rewrite bootloader. otherwise custom firmware is not loaded. with bootloader rewrite I can install esphome, its reads tuya:
uart:

• id: mcu_uart
  tx_pin: TX2
  rx_pin: RX2
  baud_rate: 38400
  parity: NONE
  stop_bits: 1

But when I try to analyze firmware dump, it's gives me an error, and ask to report, please see attached firmware:

readResult_BK7231N_QIO_222_2025-22-8-10-54-08.zip

But I have another issue, which possible have dependency with bootloader. by accident, I put thermostat in tuya link mode, and then return it back, so my thermostat can't load firmware. I need to rewrite my bootloader one more time.

I assume it's interesting dump to research.

[Cossid]

Not sure what you mean by being forced to rewrite the bootloader, this is standard BK7231N 1.0.1 bootloader, and you never should have needed to touch it.

It can't analayze the firmware because A) it's a TuyaOS3 device, so the storage is different and B) it appears to be a TuyaMCU device which doesn't store configuration in storage anyway.

This isn't the bog standard Tuya MCU firmware, so there is no guarantee this one uses the standard TuyaMCU UART protocol, and the baud rate of 38400 would seem to confirm that (TuyaMCU baud is 9600 or 115200 per their documentation).

Here are the DPIDs Tuya provides when activating the device : schema.txt
product key is: dq6nlukkifyawj9n

There probably isn't going to be too much more additional information you'll get from the dump.

[Bl00d-B0b]

This information I extract, looks like a TUYA

{ "schemaId": "e5vyik", "services": [ { "name": "默认服务 (Default Service)", "properties": [ { "abilityId": 1, "accessMode": "rw", "code": "switch", "name": "开关 (Switch)", "description": "", "typeSpec": { "type": "bool" } }, { "abilityId": 2, "accessMode": "rw", "code": "mode", "name": "工作模式 (Work Mode)", "description": "", "typeSpec": { "type": "enum", "range": ["auto", "manual"] } }, { "abilityId": 10, "accessMode": "rw", "code": "frost", "name": "防霜冻功能 (Anti-Frost Function)", "description": "", "typeSpec": { "type": "bool" } }, { "abilityId": 16, "accessMode": "rw", "code": "temp_set", "name": "设温 (Set Temperature)", "description": "实际温度值乘10表示 (Actual temperature value ×10)", "typeSpec": { "type": "value", "max": 3000, "min": 50, "scale": 1, "step": 5, "unit": "℃" } }, { "abilityId": 19, "accessMode": "rw", "code": "upper_temp", "name": "设置温度上限 (Upper Temperature Limit)", "description": "设置温度的上限，实际温度乘10表示 (Set upper temperature limit, actual value ×10)", "typeSpec": { "type": "value", "max": 3000, "min": 50, "scale": 1, "step": 10, "unit": "" } }, { "abilityId": 23, "accessMode": "rw", "code": "temp_unit_convert", "name": "温标切换 (Temperature Unit Switch)", "description": "", "typeSpec": { "type": "enum", "range": ["c", "f"] } }, { "abilityId": 24, "accessMode": "ro", "code": "temp_current", "name": "当前温度 (Current Temperature)", "description": "实际温度值乘10表示 (Actual temperature value ×10)", "typeSpec": { "type": "value", "max": 1000, "min": -300, "scale": 1, "step": 1, "unit": "℃" } }, { "abilityId": 26, "accessMode": "rw", "code": "lower_temp", "name": "设置温度下限 (Lower Temperature Limit)", "description": "实际温度乘10表示 (Actual temperature ×10)", "typeSpec": { "type": "value", "max": 3000, "min": 50, "scale": 1, "step": 10, "unit": "" } }, { "abilityId": 30, "accessMode": "rw", "code": "week_program3", "name": "周程序（工作日） (Week Program - Workdays)", "description": "每段定时可以设置第1，2字节时间，第3,4字节温度；6段定时；默认时间06:00 20°C；08:00 15°C；11:30 15°C；13:30 15°C；17:00 22°C；22:00 15°C；每段占4个字节，如果温度带小数数据要扩大10倍传，如果不带小数正常传，06:00 35.0 则传06 00 01 5e；6*4*2=48字节；7天工作日周程序则6*4=24字节 (Each segment: 2 bytes time, 2 bytes temp; 6 segments; defaults listed; encoding rules explained)", "typeSpec": { "type": "raw", "maxlen": 128 } }, { "abilityId": 31, "accessMode": "rw", "code": "work_days", "name": "工作日设置 (Workday Settings)", "description": "", "typeSpec": { "type": "enum", "range": ["5_2", "6_1", "7"] } }, { "abilityId": 36, "accessMode": "ro", "code": "valve_state", "name": "阀门状态 (Valve State)", "description": "", "typeSpec": { "type": "enum", "range": ["close", "open"] } }, { "abilityId": 40, "accessMode": "rw", "code": "child_lock", "name": "童锁 (Child Lock)", "description": "", "typeSpec": { "type": "bool" } }, { "abilityId": 45, "accessMode": "ro", "code": "fault", "name": "故障告警 (Fault Alarm)", "description": "e1：内探头温度异常 (Internal probe temp abnormal)\\ne2：外探头温度异常 (External probe temp abnormal)\\ne3：电池电量低，请及时更换电池 (Battery low, replace soon)", "typeSpec": { "type": "bitmap", "label": ["e1", "e2", "e3"], "maxlen": 3 } }, { "abilityId": 101, "accessMode": "ro", "code": "support_features", "name": "支持的特性 (Supported Features)", "description": "设备支持的特性，位有效。bit0 周编程；bit1 日编程；bit2 毛巾架；bit3 定时；bit4 功耗统计；bit5 温度单位转换；bit6 电池；bit7 门卡；bit8 防冻功能；bit9 风口温度；bit10 Wi-Fi功能；bit11 夜模式功能；bit12 温度校准值 (Bit flags for supported features: week program, day program, towel rack, timer, energy stats, temp unit switch, battery, card, antifreeze, vent temp, Wi-Fi, night mode, temp calibration)", "typeSpec": { "type": "value", "max": 2147483647, "min": 0, "scale": 1, "step": 1, "unit": "" } }, { "abilityId": 102, "accessMode": "ro", "code": "temp_adjust_step", "name": "温度调节步进 (Temperature Adjustment Step)", "description": "设温调节的步进，乘10表示的值。该值为5，表示步进为0.5 (Adjustment step for set temp, value×10; 5 = 0.5°C)", "typeSpec": { "type": "value", "max": 50, "min": 1, "scale": 1, "step": 5, "unit": "" } }, { "abilityId": 105, "accessMode": "ro", "code": "mfg_model", "name": "机型 (Model)", "description": "", "typeSpec": { "type": "string", "maxlen": 255 } }, { "abilityId": 106, "accessMode": "rw", "code": "light_mode", "name": "背光关闭功能 (Backlight Off Function)", "description": "Byte0-1: Start time (min from 00:00)\\nByte2-3: End time (min from 00:00)\\nByte4-5: Time to night mode (sec)\\nByte6: Backlight brightness 1–100\\nByte7: Night mode enable", "typeSpec": { "type": "raw", "maxlen": 128 } }, { "abilityId": 107, "accessMode": "ro", "code": "battery_percent", "name": "电池电量 (Battery Level)", "description": "0–100为正常值，不在范围内，则显示无电池 (Valid 0–100; outside range = no battery)", "typeSpec": { "type": "value", "max": 101, "min": 0, "scale": 0, "step": 1, "unit": "%" } }, { "abilityId": 108, "accessMode": "ro", "code": "temp_calib_step", "name": "温度校准调节步进 (Temperature Calibration Step)", "description": "该值为1，表示调节步进为0.1 (Value=1 → step = 0.1°C)", "typeSpec": { "type": "value", "max": 50, "min": 1, "scale": 1, "step": 1, "unit": "" } }, { "abilityId": 109, "accessMode": "rw", "code": "temp_calib", "name": "温度校准 (Temperature Calibration)", "description": "温度校准值，值为1表示0.1 (Calibration value: 1=0.1°C)", "typeSpec": { "type": "value", "max": 99, "min": -99, "scale": 1, "step": 1, "unit": "" } }, { "abilityId": 110, "accessMode": "ro", "code": "graph_valve_state", "name": "阀门状态 (Valve State)", "description": "只用于图表显示的阀门状态 (For chart display only)", "typeSpec": { "type": "bool" } }, { "abilityId": 111, "accessMode": "ro", "code": "soft_version", "name": "软件版本 (Software Version)", "description": "", "typeSpec": { "type": "string", "maxlen": 255 } }, { "abilityId": 112, "accessMode": "rw", "code": "switch_diff", "name": "开关偏差 (Switch Offset)", "description": "开关偏差 (Switch offset)", "typeSpec": { "type": "value", "max": 100, "min": 0, "scale": 1, "step": 1, "unit": "" } }, { "abilityId": 113, "accessMode": "rw", "code": "sensor_type", "name": "探头模式 (Sensor Mode)", "description": "", "typeSpec": { "type": "enum", "range": ["IN", "OUT", "ALL"] } }, { "abilityId": 114, "accessMode": "rw", "code": "floor_sensor_type", "name": "外探头类型 (External Sensor Type)", "description": "", "typeSpec": { "type": "value", "max": 100, "min": 0, "scale": 0, "step": 1, "unit": "" } }, { "abilityId": 115, "accessMode": "rw", "code": "floor_temp", "name": "外传感器温度 (External Sensor Temperature)", "description": "", "typeSpec": { "type": "value", "max": 1000, "min": -300, "scale": 1, "step": 10, "unit": "" } }, { "abilityId": 116, "accessMode": "rw", "code": "towel_config", "name": "毛巾架定时配置 (Towel Rack Timer Config)", "description": "", "typeSpec": { "type": "raw", "maxlen": 128 } } ] } ] }

[SaschaKP]

this is almost the same thermostat I have, currently I had no luck in getting a serial communication to MCU, but from what I found so far:
RX1 and TX1 are used for logging, the main SOC sends everything in here.
RX2 and TX2 are probably inverted, as I've made a test yaml that changed at every boot data rate and at every cycle the report pin (if present, we don't know).
SOC is a bk7231n, but to swap RX2 and TX2 I will need to do some code mods to libretiny (and maybe this should be doable in yaml, not in full edit of code)

[SaschaKP]

After some more analisys I can confirm that the firmware is pretty custom, but not that much:
uart is number 2
baud_rate: 38400

LOG OUTPUT on RX from SOC:
55 AA 00 03 00 01 00 03
55 AA 00 03 00 01 00 03
??
00 00 21 61 60 17 70 D3 6A B1 32
30 79 19 80 0F 60 60 4D 47 B1 B0 E8 30 80 80 B0
B0 39 60 85 66 08 B0 60 C0 0B 76 60 18 E6 D0 30
30 F0 F0 30 AA 19 90 99 65 F0 7A 30 30 F0 F0 30
15 82 F3 B0 FA 67 3A 38 32 33 79 F8 30 30 F0 F0
30 AA 19 90 99 AB B0 38 60 77 60 FD 3A 38 30 30
F0 F0 30 AA 39 F3 F0 27 78 8F 87 E7 30 30 F0 F0
30 AA 39 90 F0 F0 B8 0F 75 87 E7 78 34 30 30 F0
F0 80 15 E2 F3 30 B1 67 07 8B E7 C8 C3
55 AA 00 01 00 00 00 30
30 F0 81 81 15 82 32 F2 43 C4 51
34 EA E5 32 98 CA F2 3A 5D 74 F4 73 80 6B AF 63
60 62 62 50 E2 32 F2 43 59 9D 99 EA E9 3A 33 C4
55 1D 7D E7 41 C8 CD 79 32 1D 19 91 B1 B8 F1 87
4B
55 AA 00 03 00 01 00 03
D1 C5 85 81 81 30 AA E2 32 F2 EA 65 72 38 3A 6A 3A 3A 33 E4 79 EE 72
BA F2 61 F2 32 1D 19 E8 B1 5C 91 F2 34 C5 85 F0
F0 30 AA E2 D5 F2 EA 65 72 38 3A 6A 3A BA 1D E5
73 F3 63 E7 41 C8 CD D0 32 1D 19 91 99 70 72 B2
39 A1 5C 58 62 62 50 82 F3 30 F9 67 55 7D E0 B2
38 71 61 60 60 60 02 75
55 AA 00 03 00 01 00 03
B1 79 51 E7 72 B1 D0 89 73 71 61 60 89 41 82 B2
F2 EA E5 60 28 3A F2 15 90 A3 CA F2 3A 5D 74 F4
73 80 6B A8 63 60 62 62 50 82 F3 30 B8 E7 32 3B
3B 7B 70 F2 EA 35 30 30 F0 F0 30 16 82 F3 30 B1
14 1D E0 E0 31 B3 38 71 61 60 60 60 02 75 0F 3A
3A F1 2B 14 EA 7D E7 DC 73 03 03 62 02 50 02 75
B2 FB 65 30 3A 59 3A F8 C8 61 47 32 3B 32 2A B3
38 71 61 60 60 80 82 32 F2 43 79 67 33 7D 75 1D
94 CA 95 89 C8 D0 3B 1D 73 AA CE 55 E7 38 73 E3
C8 C3 53 E7 E8 83
55 AA 00 03 00 01 02 05
95 1D
71 B9 81 CA FA 23 E7 78 E2 F3 30 B1 67 07 8B E7
C8 C3 30 30 F0 81 81 15 82 32 F2 43 C4 51 34 EA
E5 32 98 CA F2 3A 5D 74 F4 73 80 6B AF 63 60 62
62 50 E2 32 F2 43 59 9D 99 EA E9 3A 33 C4 55 1D
7D E7 41 C8 CD 79 32 1D 19 91 B1 B8 F1 87 4B D1
C5 85 81 81 30 AA E2 32 F2 EA 65 72 38 3A C8 C3
30 30 F0 81 81 15 82 32 F2 43 C4 51 34 EA E5 32
98 CA F2 3A 5D 74 F4 73 80 6B AF 63 60 62 62 50
E2 32 F2 43 59 9D 99 EA E9 3A 33 C4 55
55 AA 00 03 00 01 03 06
55 AA 00 08 00 00 07 1D 7D E7 41
C8 CD 79 32 1D 19 91 B1 B8 F1 87 4B D1 C5 85 81
81 30 AA E2 32 F2 EA 65 72 38 3A 6A 3A 3A 33 E4
79 EE 72 BA F2 61 F2 32 1D 19 E8 B1 5C 91 F2 34
C5 85 F0 F0 30 AA E2 D5 F2 EA 65 72 38 3A 6A 3A
BA 1D E5 73 F3 63 E7 41 C8 CD D0 32 1D 19 91 99
70 72
55 AA 00 07 00 02 01 00 09
55 AA 00 07 00 02 02
55 AA 00 07 00 02 24 00 2C
55 AA 00 07 00 02 0A 00
55 AA 00 07 00 02 6E 00 76
55 AA 00 07 00 02 65 00 6D
55 AA 00 07 00 02 73 00 7B
55 AA 00 07 00 02 66 00 6E
55 AA 00 07 00 02 69 00 71
55 AA 00 07 00 02 1E 00 26
55 AA 00 07 00 02 6A 00 72
55 AA 00 07 00 02 6C 00 74
55 AA 00 07 00 02 6D 00 75
55 AA 00 07 00 02 6F 00 77
55 AA 00 07 00 02 70 00 78
55 AA 00 07 00 02 71 00 79 6D
55 AA 00 07 00 02 66 00 6E
55 AA 00 07 00 02 69 00 71
55 AA 00 07 00 02 1E 00 26
55 AA 00 07 00 02 6A 00 72
55 AA 00 07 00 02 6C 00 74
55 AA 00 07 00 02 6D 00 75
55 AA 00 07 00 02 6F 00 77
55 AA 00 07 00 02 70 00 78
00 6D B2 39 A1 5C 58 62
62 50 82 F3 30 F9 67 55 7D E0 B2 38 71 61 60 60
60 02 75 B1 79 51 E7 72 B1 D0 89 73 71 61 60 89
41 82 B2 F2 EA E5 60 28 3A F2 15 90 A3 CA F2 3A
5D 74 F4 73 80 6B A8 63 60 62 62 50 82 F3 30 B8
E7 32 3B 3B 7B 70 F2 EA 35 30 30 F0 F0 30 16 82
F3 30 B1 14 1D E0 E0 31 B3 38 71 61 60 60 60 02
75 0F 3A 3A F1 2B 14 EA 7D E7 DC 73 03 03 62 02
50 02 75 B2 FB 65 30 3A 59 3A F8 C8 61 47 32 3B
32 2A B3 38 71 61
55 AA 00 1C 00 08 00 E2 01 01 01 00 06 04 12
55 AA 00 1C 00 08 00 E2 01 01 01
00 09 04 15
55 AA 00 1C 00 08 00 E2 01 01 01 00 0C 04 18
55 AA 00 1C 00 08 01 1A 01 17 01 23 32 05 B1
55 AA 00 34 00 0A 01 02 00 06 02 01 27 03 01 02 76

the device is massively requesti each and all DP from MCU, response from MCU is STANDARD TUYA, but dialog from SOC to MCU is not, no hearthbeat, and many other things missing, plus this seems a mix with midea protocol, but mostly customized/proprietary

EDIT:
This is not relevant to Itchiptool per se, but to the tuyamcu modded protocol (at least the inbound protocol SOC->MCU, MCU->SOC is STANDARD as I've seen in the logs)
If the author and maybe the responder could avoid closing completely this one, I'll work on something to hang on this MCU, but as I said, it's pretty custom and will require some time to guess all the other packets, if relevant, MCU is bigger than SOC, so anything is possible

[SaschaKP]

Reference for config and code, this device uses tuya MCU 3.5 with some custom addition and mods:
esphome/esphome#11631 (comment)

Will modify linked reply as I add and reveal any relevant part with reverse engineering.