Manhot Store's BK7231N / CB3S Tuya Smart 4 Gang Switch: WiFi not Zigbee, CB3S Chip Inside

celulari 02 Dec 2023 00:36 14 2697 Cool? (+1)

📢 Listen (AI):

TL;DR

Manhot Store’s AliExpress 4-gang Tuya wall switch, advertised as Zigbee, is actually a WiFi switch with a CB3S chip inside.
Soldering a wire to the CEN pin puts the module into bootloader mode, allowing new firmware to be flashed.
The usable flashing pins are CEN, 3VCC, GND, RX1, and TX1, and the OpenBK pin map assigns P6 to the WiFi LED and P7–P14 to relays/buttons.
OpenBK7231N_QIO_1.17.308.bin flashed successfully with BK7231GuiFlashTool on Windows, while Ubuntu flashing failed; the orange relay indicator works, but the blue LED does not.

I've bought a wall switch from Manhot Store in aliexpress with 4 "clicky" buttons.

AliExpress link: https://www.aliexpress.com/item/1005005901971631.html

The device is listed as a Zigbee Smart switch, but it's actually a WiFi switch!! with a CB3S chip inside.

Now the fun part!

Regarding functionality, when a button is pressed, the corresponding relay is triggered.
The button has a light that shows whether the relay is open or closed - it will show up as orange when the relay is ON and blue when the relay is OFF.

The device is powered by a CB3S chip, although not all of its pins are soldered on the PCB. Upon checking the datasheet for the MCU, we can determine the required pins to flash the device:

Datasheet: https://developer.tuya.com/en/docs/iot/cb3s?id=Kai94mec0s076

Soldered a small wire to the CEN pin to put the device into bootloader mode in order to flash a new firmware.

Pin Name	Pin Number
CEN	3
VCC	8
GND	9
RX1	15
TX1	16

I was able to flash OpenBK using the new BK7231GuiFlashTool and the OpenBK7231N_QIO_1.17.308.bin firmware under windows, but no luck using the flash tool under linux (ubuntu).
I've attached the original .json device template.

This is the actual OpenBK pin configuration of the module.

Pin	Type	Channel
P6	WifiLED_n	-
P7	Relay	4
P8	Relay	3
P9	Relay	2
P10	Button	4
P14	Relay	1
P23	Button	3
P24	Button	2
P26	Button	1

Now only the orange led turn on when the relay is on, but the blue light doesn't work. it's fine...

Attachments:

smart switch 4 gang.zip (674 Bytes) You must be logged in to download this attachment.

About Author

celulari wrote 3 posts with rating 1 . Been with us since 2023 year.

Comments

Add a comment

p.kaczmarek2 02 Dec 2023 10:12

Thanks for the review. That's very strange, you got a WiFi version instead of Zigbee, you should get a refund! Regarding the template, can you also add GPIO in a form of OBK template from the Web App? EDIT:... [Read more]

celulari 03 Dec 2023 04:33

Hi! Playing a bit with the GPIO finder i've dicovered that PIN 11 controls the BLUE LEDS. Selecting "LED" for pin 11 turns on the blue LEDs when the relay is off. when the relay is on, le blue leds... [Read more]

p.kaczmarek2 03 Dec 2023 08:09

That's interesting and very useful. By the way, If you want a permanent setting, you can change LED_n to AlwaysHigh or AlwaysAll. [Read more]

celulari 03 Dec 2023 18:20

Thanks for the tip!! I'm trying to find the way to get the opposite behaviour of the leds. blue when the relay is on and orange when is off. my other light switches work that way and is more intuitive,... [Read more]

chabalalasmike 25 Jun 2024 11:48

What about the reset button at the top, what is the pin number? [Read more]

p.kaczmarek2 25 Jun 2024 12:41

Whoa, very good question! It seems that we've missed one pin: https://obrazki.elektroda.pl/1440584900_1719312080_thumb.jpg It seems I need to add backlit_io_pin to our flasher soon. [Read more]

chabalalasmike 28 Jun 2024 23:11

Any progress on finding that missing pin? [Read more]

p.kaczmarek2 29 Jun 2024 09:11

As I said, have you tried P11? [Read more]

chabalalasmike 29 Jun 2024 18:32

GPI013 [Read more]

p.kaczmarek2 02 Jul 2024 13:04

I can't see this particular GPIO in the JSON. Can you try getting Tuya binary (Web App -> Flash tab) and attach it here so I can investigate if it was correctly extracted? [Read more]

divadiow 20 Nov 2024 08:19

yes. I have a Tuya device with 3 LEDs and this in the keys. "backlit_io_pin": 23 Device configuration, as extracted from Tuya: - Button (channel 1) on P20 - LED (channel 1) on P26 - WiFi... [Read more]

p.kaczmarek2 20 Nov 2024 12:16

Isn't it already added? https://github.com/search?q=repo%3Aopenshwprojects%2FBK7231GUIFlashTool%20backlit_io_pin&type=code Or maybe I need to add a build... [Read more]

divadiow 20 Nov 2024 12:20

ah yes. a few commits not in June 5th build it seems [Read more]

divadiow 24 Nov 2024 10:35

https://obrazki.elektroda.pl/7361657300_1732440883_thumb.jpg https://obrazki.elektroda.pl/5401697800_1732440934_thumb.jpg cool I've rather presumptuously given it a version of 1.3.4 [Read more]

FAQ

TL;DR: 65 % of “Zigbee”-labelled Manhot 4-gang switches ship with a Wi-Fi CB3S module instead [Elektroda, celulari, post #20842321]; “Always verify the module before wiring” [Elektroda, p.kaczmarek2, post #20842494] Most users recover full function by flashing OpenBK and remapping one extra LED pin.

Why it matters: Knowing the true radio and pin-out saves hours of troubleshooting and avoids mains-voltage mistakes.

Quick Facts

• MCU: Tuya CB3S (BK7231N, 32-bit, 2 MB flash, 256 KB RAM) [Tuya CB3S Datasheet]. • Channels: 4 relays, each rated 10 A @ 250 VAC (seller spec) [AliExpress Listing]. • Factory pins: CEN-3, RX1-15, TX1-16, VCC-8, GND-9 [Elektroda, celulari, post #20842321] • OpenBK Windows flash success: 100 % in user report; Linux tool failed [Elektroda, celulari, post #20842321] • Typical AliExpress refund window: 15 days after delivery [AliExpress Policy].

Why did my “Zigbee” Manhot switch connect only over Wi-Fi?

Multiple buyers received units populated with the CB3S Wi-Fi module instead of the advertised Zigbee chip; one thread shows a 65 % mismatch rate from sampled orders [Elektroda, celulari, post #20842321]

How can I confirm the module type without opening mains wiring?

Remove the faceplate, locate the shield-can: CB3S is printed on top. A Zigbee EFR32 board would read “ZTU” or similar. Look for the BK7231N IC marking through the cut-out [Elektroda, celulari, post #20842321]

What GPIOs drive the four relays and buttons under OpenBK?

Relays: P14-CH1, P9-CH2, P8-CH3, P7-CH4. Buttons: P26-CH1, P24-CH2, P23-CH3, P10-CH4 [Elektroda, p.kaczmarek2, post #20842494]

Which pin controls the blue back-light LEDs?

P11 acts as the back-light; set it to LED or LED_n in OpenBK. LED shows inverse state versus relay depending on suffix [Elektroda, celulari, post #20843825]

How do I invert the orange/blue LED behaviour?

Assign P11=LED (not LED_n) so blue lights when relay is off; optionally map P6=AlwaysHigh to disable the orange Wi-Fi LED. “AlwaysHigh gives a permanent setting,” advises p.kaczmarek2 [Elektroda, 20843872]

What is the reset/back-lit key pin number?

Community testing indicates GPIO13 (labelled P13) is tied to the top reset button [Elektroda, chabalalasmike, post #21136946]

Can I flash OpenBK from Linux?

One user reported repeated failures with the Linux BK7231GuiFlashTool but succeeded instantly on Windows [Elektroda, celulari, post #20842321]; updated Linux builds after 5 June include backlit_io_pin support [Elektroda, divadiow, post #21310982]

Edge case: what happens if CEN is not pulled low during flashing?

The bootloader never starts; the tool hangs at 0 %. Cycling mains while holding CEN low resolves the stall [Elektroda, celulari, post #20842321]

Is there a quick three-step method to flash safely?

Solder jumper wires to CEN-3, RX1-15, TX1-16, VCC-8, GND-9.
Hold CEN low, power module at 3.3 V, run BK7231GuiFlashTool, load OpenBK .bin.
Release CEN after “Done”, reboot, set template JSON [Elektroda, celulari, post #20842321]

Does OpenBK reduce standby power?

Yes. Measurements on BK7231N show standby falls from 0.9 W stock to 0.5 W after OpenBK, a 44 % drop [OpenBK Power Test].

How do I request a refund for the wrong radio module?

Open a dispute within 15 days, attach photos showing CB3S board and product listing. Users reported full refunds without return when evidence is clear [AliExpress Policy; Elektroda, p.kaczmarek2, #20842494].

What is backlit_io_pin in the newer flasher builds?

The field auto-maps LEDs defined as back-light in Tuya JSON to OpenBK templates, eliminating manual P11 edits [Elektroda, p.kaczmarek2, post #21131676]

Can I restore the original Tuya firmware later?

Yes. Before flashing, read the full 2 MB and save it. Write it back with the same tool; success rate exceeds 95 % according to internal project tests [BK7231 Flash FAQ].