[BK7231N / T34 ] Teardown Tuya Generic Wifi Wall Light Switch 3 Gang
Here is how you can flash a T34-based wall switch with OpenBeken. This switch has no programming pads available, so desoldering T34 in QFN case is required.
Purchased from AliExpress: https://www.aliexpress.com/item/1005005732402318.html
Nothing special in the box, comes with a capacitor and some screws, and a wiring diagram.
Teardown is very straightforward, a flat head screwdriver is all that is required: Just gently lever the front glass off (There is an opening at the bottom for this purpose). Removing the motherboard is as simple as unclipping 4 plastic clips and lifting it up. It is joined to the back via 6 pins.
Flashing is a lot less straightforward. This switch came patched for the cloudcutter exploit. (Firmware 1.3.10).
The 4 pads on the board don't appear to be connected to the T34 which is the brains of the operation. The far right pad is 3.3V, the one next to it is GND, unsure of the other two.
All the pins of the T34 are hidden, so flashing is non-trivial. I had to hot air desolder it, solder some jumper wires, and then dump/flash it via bk7231flasher. Miraculously, I managed to resolder it successfully. This is not for the faint of heart.
The dump also failed to extract the tuya config, but I was able to reverse it via inspection.
OpenBeken config is:
{
"vendor": "Tuya",
"bDetailed": "0",
"name": "Tuya Generic Touch Light Switch 3 Gang",
"model": ???",
"chip": "BK7231N",
"board": "",
"flags": "1024",
"keywords": [
"T34",
],
"pins": {
"8": "WifiLED;55",
"14": "Rel;1",
"22": "Btn;3",
"23": "Btn;2",
"24": "Btn;1",
"26": "Rel;2",
"28": "Rel;3"
},
"command": "",
"image": "https://obrazki.elektroda.pl/2902642800_1708303164.jpg",
"wiki": "https://www.elektroda.com/rtvforum/viewtopic.php?p=20968165"
}
ESPHome Config:
esphome:
name: lightswitch-3gang
# Enable logging
logger:
# Enable Home Assistant API
api:
encryption:
key: "REPLACEME"
ota:
password: "REPLACEME"
wifi:
ssid: !secret wifi_ssid
password: !secret wifi_password
fast_connect: true
reboot_timeout: 0s
# Enable fallback hotspot (captive portal) in case wifi connection fails
ap:
password: !secret wifi_password
captive_portal:
button:
- platform: restart
name: "Restart"
sensor:
- platform: wifi_signal
name: "WiFi Signal Sensor"
update_interval: 60s
bk72xx:
board: generic-bk7231n-qfn32-tuya
binary_sensor:
- platform: gpio
id: binary_switch_1
pin:
number: P22
inverted: true
mode: INPUT_PULLUP
on_press:
then:
- switch.toggle: switch_1
- platform: gpio
id: binary_switch_2
pin:
number: P23
inverted: true
mode: INPUT_PULLUP
on_press:
then:
- switch.toggle: switch_2
- platform: gpio
id: binary_switch_3
pin:
number: P24
inverted: true
mode: INPUT_PULLUP
on_press:
then:
- switch.toggle: switch_3
switch:
- platform: gpio
id: switch_1
name: Relay 1
pin: P28
- platform: gpio
id: switch_2
name: Relay 2
pin: P26
- platform: gpio
id: switch_3
name: Relay 3
pin: P14
status_led:
pin:
number: P8
inverted: true # Inverting enables the key backlights.
Hope this is helpful to someone, but I would strongly advise not purchasing this one. With the T34 package, and no exposed pads or silk screen, these are non-trivial to flash.
Comments
This is the most pro way of flashing I've ever seen here: https://obrazki.elektroda.pl/5096754300_1708325564_thumb.jpg Just a quick question - was using CEN really necessary? [Read more]
A pro wouldn't have taken 3 hours to do it :D Don't know, I didn't try without grounding CEN. I just read somewhere that I needed to ground it. Either way, TX/RX are also inaccessible, so it required... [Read more]
Hi @camerondev How did you apply the solder paste to the back chip? Do you cover the entire back or just meticulously apply to each of the small pads? [Read more]
I didn't use solder paste. I tried to add solder to the board using the soldering iron, but it mostly went onto the ground and ignored the pins. Those pads are TINY. The wires in that picture are 0.25mm... [Read more]
I see, so it’s mostly solder reflow and you heat it up with hot air. I tried it once with esp32 ic chip that got displaced when i was desoldering. Didn’t quite work for me though [Read more]
this is impressive. kudos [Read more]
Just curious to know the temperature ranges and the air flow settings use in Hotair guns that you use for these kind of desoldering/soldering. Some recommend preheating the board and then having a quick... [Read more]
It varies from station to station, I have a 50$ station that can't desolder a component at 450C and I have a 400$ station that desolders the same component at 350C. [Read more]
I didn't pre-heat the board, and used one of these: https://www.aliexpress.com/item/1005005855040180.html https://obrazki.elektroda.pl/7633115700_1709188118_thumb.jpg I just set it as hot... [Read more]
Which flux did you use (if any)? [Read more]
:-) I have the exact same device. I am a novice when it comes to use of heat gun. So far I have used it once to remove a CB3S module. Some nearby small SMD components flew off the board. That is why... [Read more]
Flux I used: https://www.ebay.com.au/itm/203741564643 Ill try work out the settings, but i suspect they are on the defaults. The controls for that hot air thing are awful. I am also a novice (as... [Read more]
Did you use the Pb solder and flux trick? I've did a small research on that and it turned out that the same temperature setting (like 350C) gives different results on various stations: https://openshwprojects.github.io/hotair/350c.html So,... [Read more]
sorry to chime in on everything it probably seems! I did the pb/flux trick like your video once but it seems if you have a module with 3 sides of soldered pins you can't liquify the pb fast enough between... [Read more]
My video used JCD 8908 at 450C I think. Review: https://www.elektroda.pl/rtvforum/topic3970314.html (Use Google Translate) but as I said, 450 on one station is not like 450 on the other: https://openshwprojects.github.io/hotair/350c.html https://openshwprojects.github.io/hotair/450c.html Two... [Read more]
I used 480c (Whatever that actually ends up being), and the fastest fan speed. Desoldering smaller things is easier, the T34 came off fairly easily. [Read more]
Hi ! About bridge from PIN 9 - CEN to the GND : do you have it permanently or short up it when flash was started ? and what baud rate did you use ? [Read more]
I flashed T34 chip successfully. Bridge CEN is not needed. You can start flashing if you just interrupt 3.3V , attached to the PIN8. I flashed it with baud rate 921600. https://obrazki.elektroda.pl/2585614500_1710683016_thumb.jpg... [Read more]
Good job! I actually never use CEN for flashing these days, but I haven't really encountered any T34s so far, only BK7231N [Read more]