MLT-BT05 BLE module – a clone of a clone?? 29

Previously I covered the HM-10 Bluetooth Low Energy (BLE) module and its clone, the CC41-A.  Those are two popular modules that allow simple BLE communication through a serial interface and are handy with Arduinos and other hobby micro controllers. Make sure you read that article first as it provides important background for this curious update.

Recently I ordered a few BLE modules on ebay. The listing was using the name “HM-10” but the pictures where showing what is known as “CC41-A”. Though confusing, this happens with many items on ebay as it appears that “HM-10” lost its meaning as a specific model and is now more of a definition of a specific functionality. Having good experience with the CC41-A, I ordered a bunch.

CC41 Front

A few weeks later I get my package. Everything looks good at first and I try the modules. I quickly discover differences in behavior from what I have used in the past. Though very similar to the CC41-A, the modules I received seem to be a completely new model, “MLT-BT05”. The “MLT-BT05” looks a lot like a clone of the “CC41-A”, which amusingly is a clone of the “HM-10”. Unlike the “CC41-A”, the “MLT-BT05” is not a good clone and I will elaborate on this topic below.

Differences between “CC41-A” and “MLT-BT05”

MLT-BT05 Front


The modules are different in hardware and in software (or rather firmware). Let’s discuss the differences and similarities one by one, starting with the physical differences.

The daughter board

This part looks identical. The similarity goes as far as having a place for a second oscillator but not having one soldered, which is a differentiator compared to the original “HM-10” (which has 2 oscillators). Same TI CC2541 chip, antenna, etc.

The breakout board

This part connects the daughter board to the pins. The PCB layout is different, with the main differentiator being a 5-pin voltage regulator compared to the 3-pin on in the “CC41-A”. Some other differences are in the passive components, mainly resistors.

Both modules have six 2.54mm pins for interfacing with the micro controller: STATE, RXD, TXD, GND, VCC, EN. However, the STATE pin of the “MLT-BT05” seems to be floating. This effectively means that there is no usable STATE pin. I haven’t tested the EN pin but power and UART pins seem to be working properly.

The lack of a working STATE pin in the “MLT-BT05” can be explained by fewer connections between the daughter board and the breakout board compared to the “CC41-A”. Specifically 1 vs 4 soldered pads on the bottom of the module.

Solder joints MLT (top) vs CC41 (bottom)

Back side

The size is the same, but the PCB layout is completely different.

ZS-040, CC41 Back

MLT-BT05 Back

The text is the same, but the “MLT-BT05” has a thicker silkscreen print than the “CC41-A”.

AT command syntax

Both modules expect a “carriage-return and new-line” at the end of commands. There is a subtle difference, though. The “MLT-BT05” expects its CR-NL to be sent immediately with the command, while the “CC41-A” will be happy even if there is a slight delay between the command and the CR-NL. That would indicate that the “CC41-A” is doing a better job buffering and that there are differences in the firmware of the modules.

Both modules also don’t need a ‘?’ at the end of the commands when querying for the current value. This essentially means that the two clones are closer to each other than to the original “HM-10”.

AT commands

AT+HELP of the “CC41-A”:

* Command             Description                       
* ---------------------------------------------------------------- 
* AT                  Check if the command terminal work normally  
* AT+RESET            Software reboot                   
* AT+VERSION          Get firmware, bluetooth, HCI and LMP version 
* AT+HELP             List all the commands                   
* AT+NAME             Get/Set local device name                    
* AT+PIN              Get/Set pin code for pairing                 
* AT+PASS             Get/Set pin code for pairing                 
* AT+BAUD             Get/Set baud rate                           
* AT+LADDR            Get local bluetooth address           
* AT+ADDR             Get local bluetooth address           
* AT+DEFAULT          Restore factory default               
* AT+RENEW            Restore factory default               
* AT+STATE            Get current state                   
* AT+PWRM             Get/Set power on mode(low power)            
* AT+POWE             Get/Set RF transmit power            
* AT+SLEEP            Sleep mode                            
* AT+ROLE             Get/Set current role.                       
* AT+PARI             Get/Set UART parity bit.                     
* AT+STOP             Get/Set UART stop bit.                       
* AT+START            System start working.               
* AT+IMME             System wait for command when power on.       
* AT+IBEA             Switch iBeacon mode.                       
* AT+IBE0             Set iBeacon UUID 0.                           
* AT+IBE1             Set iBeacon UUID 1.                           
* AT+IBE2             Set iBeacon UUID 2.                           
* AT+IBE3             Set iBeacon UUID 3.                           
* AT+MARJ             Set iBeacon MARJ .                           
* AT+MINO             Set iBeacon MINO .                           
* AT+MEA              Set iBeacon MEA .                           
* AT+NOTI             Notify connection event .                    
* AT+UUID             Get/Set system SERVER_UUID .                   
* AT+CHAR             Get/Set system CHAR_UUID .                   
* -----------------------------------------------------------------*
* Note: (M) = The command support slave mode only.            
* For more information, please visit        
* Copyright@2013 All rights reserved.           

AT+HELP of the “MLT-BT05”:

* Command             Description                       
* AT                  Check if the command terminal work normally 
* AT+DEFAULT          Restore factory default               
* AT+BAUD             Get/Set baud rate                   
* AT+RESET            Software reboot                   
* AT+ROLE             Get/Set current role.                       
* AT+DISC             Disconnect connection                       
* AT+ADVEN            Broadcast switch                     
* AT+ADVI             Broadcast interval                   
* AT+NINTERVAL        Connection interval                         
* AT+POWE             Get/Set RF transmit power            
* AT+NAME             Get/Set local device name                   
* AT+LADDR            Get local bluetooth address           
* AT+VERSION          Get firmware, bluetooth, HCI and LMP version
* AT+TYPE             Binding and pairing settings           
* AT+PIN              Get/Set pin code for pairing                
* AT+UUID             Get/Set system SERVER_UUID .                   
* AT+CHAR             Get/Set system CHAR_UUID .                   
* AT+INQ              Search from device                   
* AT+RSLV             Read the scan list MAC address           
* AT+CONN             Connected scan list device           
* AT+CONA             Connection specified MAC                   
* AT+BAND             Binding from device                   
* AT+CLRBAND          Cancel binding                       
* AT+GETDCN           Number of scanned list devices           
* AT+SLEEP            Sleep mode                            
* AT+HELP             List all the commands                   
* --------------------------------------------------------------- 

Some commands are the same and some are different. The “CC41-A” mentions its manufacturer, Bolutek, but the “MLT-BT05” mentions nothing about its origin.

Version and Name

Some commands offer us more information about the identity of the module. Here is a comparison of the responses to “AT+VERSION”:


+VERSION=Firmware V3.0.6,Bluetooth V4.0 LE



Here is a comparison of the responses to “AT+NAME” with the default name set in the module:





Documentation about the “MLT-BT05”

I wasn’t able to find a lot of data about this module online. I found a zip file with stuff for the “MLT-BT04 V4” at what seems to be Baidu cloud file hosting. It included some BLE software and two PDFs in Chinese. An “MLT-BT05 4.0 AT-commands” document and an “MLT-BT05 4.0 datasheet”. Both useful to get some additional information and readable with Google Translate. It comes as no surprise that, once again, the files are lacking any information on the manufacturer. If you aware of any additional documentation, please mention it in the comments.

I have added the “MLT-BT05” to the arduino-ble-ident-n-set project, which should allow you to identify and configure your different BLE modules easily.

Is this a good clone of clone?

Assuming the practice of having and using clones doesn’t bother us, what will be important is whether the clone has the functionality that we expect. In this case, the “MLT-BT05” failed me big time. A module that looks like a module with a STATE pin but having a floating pin instead is not a proper clone and in my opinion is not truthful.

Surely, if you are using the module in a way such that you are not using the STATE pin, then this might be an option for you. How you would be doing that without any ill effects is an interesting question.

Doing safe communications with a module like this, without knowing your connection state, is bad practice. The reason for that is that the serial communication line between the module and the micro controller is used both for commands and for data. The connection state determines whether we are in command mode or data mode. Not knowing the current state/mode could result in sending data that will be interpreted as commands and vice versa.

There are communication modules without a STATE pin, but those have a way to switch modes and query for current connection state with AT commands. For example Adafruit Flora Bluefruit LE. Perhaps the “MLT-BL05” can get such functionality in a firmware update one day.

Amusingly, the AT commands document mentions a command that is absent from AT+HELP listing. The AT+GETSTAT which should return 0 for “disconnected” and 1 for “connected”. What is amusing is that commands can only be sent while in disconnected state, so I am not sure if there is a “non-silly” way of using this command and getting something other than “0”.

Fixing the STATE pin in MLT-BL05 in hardware

Reading the datasheet of the module we find the following diagram:

MLT-BL05 diagram

Out of all the pads on the right side of the board, the module comes with only pad 24 (P1_2) soldered. This pad is powering a led that is blinking in different ways depending on mode and role.

The documentation discusses pad 25 (P1_1) and describes it as HIGH on “connected” and LOW on “disconnected”. Exactly how STATE pin should perform. So is this a case of “doing one solder joint less”? Or is there some deeper reasoning behind that due to firmware issues or PCB layout? The module is in shrink-wrap, so no knowing without opening it up. Sounds like an interesting thing to investigate and write about in another blog post.

Will keep you updated. If you find out any interesting information about this module, please share in the comments below.

Update: Fixing the STATE pin of the MLT-BT05 is possible.

29 thoughts on “MLT-BT05 BLE module – a clone of a clone??

  1. Reply Joe Mar 28,2017 5:27 pm

    Thanks for the info, I got one of these off eBay expecting a CC41-A.

    I can live without the STATE pin but I needed more firmware functionality for iBeacon support, so I just wanted to point out that its easy to flash the official HM-10 firmware on these boards as per

    • Reply Arik Yavilevich Mar 28,2017 5:42 pm

      Hi Joe, thanks for the info.
      A quick spoiler, in case you want the STATE pin functionality. I was able to make it work by soldering the missing solder joint between the module board and the breakout board. I will post a detailed article with pics at a later time.

  2. Pingback: Fixing a bad STATE pin on an MLT-BT05 BLE module | Arik Yavilevich's blog

  3. Reply Stefan Apr 10,2017 7:09 pm

    Hello, I have a question. How do I have to configure MLTBT05 to connect it to android BT terminal? A have a arduino Uno and although the phone it self sees the shield, the app wont connect to it/

    Thanks in advance.

    • Reply Arik Yavilevich Apr 11,2017 5:03 pm

      Hi Stefan, what kind of “android BT terminal” are you using? If this a kind of Bluetooth Low Energy (BLE) terminal or a regular Bluetooth serial terminal? Try “nRF connect” app by Nordic for BLE modules such as the MLT-BT05.

  4. Reply Albert from EE Apr 26,2017 7:20 pm

    Hi Arik, thank you for doing an amazing job! Its now clear that Technion wasn’t in vain :+>. I am trying to use your “arduino-ble-ident-n-set” project to talk to my MLT-BL05 clone. Unfortunately I can’t load the project to my Arduino Nano board via Arduino IDE. Do you have an idea of what might be the problem ?


    • Reply Arik Yavilevich Apr 27,2017 10:50 am

      Hi Abert, greetings to the EE department. 😉
      Can you load other projects to your Nano, such as the “blink” sketch?
      What happens when you try to upload “arduino-ble-ident-n-set”? Do you get some error?

  5. Reply Albert from EE Apr 27,2017 11:07 am

    Hi Arik,

    I have successfully uploaded the your sketch. There is a different issue though. When the Arduino Nano TX and RX are connected to the ZS-040 RX & TX I can ‘t upload the sketch. That was initially the problem. When I disconnect I am able to see the set up of your program prompting me with Qs. But as I connect the RX & TX of Nano board and ZS-040 the TX led on the Nano board goes red and your program hangs. Thus the interaction via Arduino serial monitor is frozen.

    Any ideas ?

    • Reply Arik Yavilevich Apr 27,2017 11:46 am

      Sure, by Nano TX and RX pins you refer to D0 and D1 pins. Those are special. If you look in the sketch you can see that it is written to work with the BLE serial through ports 8 and 9 (by default). It does that with a technique called SoftwareSerial. You can’t use your D0 and D1 pins both for serial to the module and serial to the PC/USB. Choose different pair of pins for the module. Review information about software serial and hardware serial capabilities of the Arduino. Don’t forget to convert the logic signal to 3.3V if your module requires so. Good luck.

  6. Reply Albert from EE Apr 27,2017 12:50 pm

    Thank Arik,

    It was very helpful, but a bit too late. Before I got your response I came across the following tutorial from Hexor and YouTube video who basically explains how to turn your ZS-040 into HM-10 by bootloading an appropriate firmware. It worked OK for all the guys in the forum except me and a few others. Now I am looking for a way to boot with factory definitions, are you familiar with a way doing so ?


    • Reply Arik Yavilevich Apr 27,2017 1:24 pm

      Hey Albert, I don’t know a way to boot to factory definitions. You might try to flash the original firmware if you can find a download of it.
      Your description is very low on details. What happened during the flashing process? Why did you try to flash another firmware? Were you able to communicate with the board before the flashing? Are you able to communicate with the board after flashing? What Arduino are you using? How are the Arduino and module connected? How do you convert logic levels? And more…

  7. Reply Albert from EE Apr 27,2017 1:52 pm


    I will answer your questions one by one:
    Q:What happened during the flashing process?
    A:This link describes the flashing from A-Z. The flashing went appearntly smooth but the at end of the process the led on the ZS-040 should blink. It doesn’t blink on my board any more. It’s simply off and the board doesn’t pear.
    Q: Why did you try to flash another firmware?
    A: You said State pin is essential and could be revived via Firmware update.
    Q:Were you able to communicate with the board before the flashing?
    A: I don’t know because I used the TX-0 & RX-1 pins which are used to communicate with the PC via USB (as you said).
    Q:Are you able to communicate with the board after flashing?
    A:When I run your sketch I get the following answer: “No response received from module.”
    Q:What Arduino are you using?
    A:I am using Arduino Nano.
    Q:How are the Arduino and module connected?
    A:Its connected via wires on a breadboard.
    Q:How do you convert logic levels?
    A:I used voltage divider on the TX of the Arduino (2.2ohm vs 1 ohm)

    I hope its more detailed now,

    • Reply Arik Yavilevich Apr 27,2017 2:06 pm

      Hey Albert, much more clear now, thanks. I assume that before flashing the led was flashing and the module was pairing, correct?
      When doing the flashing, did you perform logic level conversion as well? Can you post a schematic of the flashing process? You might have flashed all zeros or all ones if there was no conversion.
      No other ideas for now but intrigued as to what happened. Good that these are just $3 ;).

  8. Reply Ashish Apr 27,2017 4:46 pm

    Hi, I have a query. I was able to connect to my MLT-BT05 module by nRF connect app. But, I couldn’t send or receive data. I used UART function of nRF toolbox, but it replied, “the device doesn’t have required services”. What should I do next? Please, guide me further. Thanks in advance.

    • Reply Arik Yavilevich Apr 27,2017 4:59 pm

      Hi Ashish,
      When the module has no BLE master connected to it (nRF disconnected), are you able to send AT commands to the module through the serial connection? If not, figure out that first.
      If you have commands working, try to enter into data mode and send packets of data from your phone to the serial end using BLE service “0000ffe0-0000-1000-8000-00805f9b34fb” and characteristic “0000ffe1-0000-1000-8000-00805f9b34fb”.

  9. Reply Ashish Apr 27,2017 5:09 pm

    Yes, I can send the AT commands through Arduino IDE.
    Which AT command is used for data mode?

    • Reply Arik Yavilevich Apr 27,2017 6:24 pm


      When the module is connected you automatically switch to data mode. You can try issuing AT commands once connected and see the behavior. During data mode, any data you send through the serial connection (“Arduino IDE”) is sent to the BLE master that is connected. You need to subscribe to notifications on the characteristic I mentioned above. Similarly, any values you write to the characteristic on the master will be received on the serial connection.

  10. Reply Ashish Apr 27,2017 7:11 pm

    Thanks for the help. Can send data now.
    However, can you please suggest me a way to transmit some analog value from arduino via bluetooth to the phone.
    Thanks again.

    • Reply Arik Yavilevich Apr 27,2017 7:29 pm

      Hi, if you can send data over BLE then you are already able to transmit analog values or any other strings or bytes. Are you asking about an alternative to nRF that would be a more convenient UI for looking at a stream of values? I can’t recommend one, but search for “BLE terminal” on the app store and you will some options. “BleTerm” looks promising, though I didn’t try it.

  11. Reply Ashish Apr 27,2017 7:24 pm

    I mean, how to store the continuous values on the phone?
    Anyway, thanks man.
    I bugged you a lot.

    • Reply Arik Yavilevich Apr 27,2017 7:32 pm

      Ohh, I see. Well, I don’t think there is any built-in support for storing the data over BLE. If there is no app for that already then you might need to make one. 😉

  12. Reply Peter Apr 27,2017 7:59 pm

    Did you find out the default pin for the bluetooth connection?

  13. Reply Cam May 5,2017 10:34 pm

    Arik, I ran one of the Chinese pdfs you found through google translate and the translation gave slightly more information in which you might be interested. You should try it with others.

    • Reply Arik Yavilevich May 6,2017 4:42 pm

      Hi Cam, you are absolutely right. I have done that originally to learn about the different pins. If you find out any additional information that you think is important or interesting please post it in the comments.

  14. Reply Orbitatronics Jun 23,2017 1:57 pm

    It’s interesting, i just got my clone of a clone, and indeed it had a solder joint missing. I soldered it as shown below, continuity tests showed you were indeed right as it’s pulled out to the state pin. I could use your software to change the name and passcode, but when i paired to my computer it never asked for a passcode, and regardless of what i do, my phone keeps instantly saying ‘connection rejected/terminated’ as soon as i click on the object to pair. Weird, i’m certain it has nothing to do with your code, must be a faulty unit.

    I used AT+RENEW DEFAULT and now your code shows this, which i found a bit odd:

    I guess it’s money back time.

    • Reply Arik Yavilevich Jun 23,2017 5:57 pm

      (I discussed this issue with Ben offline, including a summary for the readers)

      Based on the firmware, this is the CC41 clone of the HM-10 (the one made by Bolutek). The breakout board is new and was not featured on this site previously. Unfortunately it seems that the entity assembling these modules didn’t solder the STATE connection (same entity that makes the MLT clones?).

      Passcode/Pin is not relevant and not implemented on the clones, as far as I have seen. Only the original has some sort of authentication.
      Pairing with the phone is not needed, as these are BLE modules. Need to use the right BLE app on the phone. For example ‘nRF connect’ on Android.

      Bad AT mode communication is probably due to power or wiring issues. Worked ok later.

      Ben, please update if there are updates.

  15. Reply NYanakiev Jun 27,2017 9:03 pm

    Hello, All,

    I’m trying to access MLT-BT05-V4.0 in Master mode to HEXIWEAR (wearable watch supporting Bluetooth v4.1). Scanning for the watch, I can’t see it at all, tried many settings, but probbaly I don’t understand the operation enough. Do you have any idea what could be the reason that I can’t find it? Is there something with the UUID/Characteristic sizes, because I see ot the MLT-BT05 that these are 16 bits wide. I will be very thankful for any help..

    • Reply Arik Yavilevich Jun 28,2017 7:08 am

      Hi NYanakiev,

      How are you scanning for it? Have you tried giving it a command to connect to the watch based on MAC without scanning?

      Here are some points:
      1) Try “nRF Connect for Mobile” or similar app on an Android smartphone to see if you can find the watch through other methods. Also check that you can connect to the watch and see the services.
      2) It might be possible that the watch advertising interval is too infrequent for the MLT to find it.
      3) I have not tried to use an MLT in master mode, but generally, service discovery happens after connection is successful, so differences in service UUID should not be a factor in connecting.
      4) 16bit IDs are ok in the standard. There are default values for the other bits. Effectively you are only specifying part of the UUID.
      5) The MLT has firmware that only lets it read and write one characteristic in a “serial-like” way. It might not be compatible with just any other BLE device. Try to connect to another MLT in peripheral mode.

Leave a Reply