[BK7231N / T34 ] Teardown Tuya Generic Wifi Wall Light Switch 3 Gang

CameronDev 19 Feb 2024 01:56 124 34770 Cool? (+13)

📢 Listen (AI):

TL;DR

A Tuya Generic WiFi Wall Light Switch 3 Gang with a BK7231N/T34 was torn down and prepared for OpenBeken flashing.
The front glass lifts off from the bottom opening, and the motherboard unclips easily, but the T34 QFN chip has no exposed programming pads.
It shipped from AliExpress with firmware 1.3.10 and was already patched against the CloudCutter exploit.
Hot-air desoldering, jumper wires, and bk7231flasher were needed to dump and reflash the chip, and the T34 was resoldered successfully.
OpenBeken and ESPHome pin maps are provided, but the dump could not extract Tuya config, so this is a difficult mod to attempt.

Generated by the language model.

Here is how you can flash a T34-based wall switch with OpenBeken. This switch has no programming pads available, so desoldering T34 in QFN case is required.

Purchased from AliExpress: https://www.aliexpress.com/item/1005005732402318.html

Nothing special in the box, comes with a capacitor and some screws, and a wiring diagram.

Teardown is very straightforward, a flat head screwdriver is all that is required: Just gently lever the front glass off (There is an opening at the bottom for this purpose). Removing the motherboard is as simple as unclipping 4 plastic clips and lifting it up. It is joined to the back via 6 pins.

Flashing is a lot less straightforward. This switch came patched for the cloudcutter exploit. (Firmware 1.3.10).
The 4 pads on the board don't appear to be connected to the T34 which is the brains of the operation. The far right pad is 3.3V, the one next to it is GND, unsure of the other two.

All the pins of the T34 are hidden, so flashing is non-trivial. I had to hot air desolder it, solder some jumper wires, and then dump/flash it via bk7231flasher. Miraculously, I managed to resolder it successfully. This is not for the faint of heart.
The dump also failed to extract the tuya config, but I was able to reverse it via inspection.

OpenBeken config is:


{
  "vendor": "Tuya",
  "bDetailed": "0",
  "name": "Tuya Generic Touch Light Switch 3 Gang",
  "model": ???",
  "chip": "BK7231N",
  "board": "",
  "flags": "1024",
  "keywords": [
    "T34",
  ],
  "pins": {
    "8": "WifiLED;55",
    "14": "Rel;1",
    "22": "Btn;3",
    "23": "Btn;2",
    "24": "Btn;1",
    "26": "Rel;2",
    "28": "Rel;3"
  },
  "command": "",
  "image": "https://obrazki.elektroda.pl/2902642800_1708303164.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/viewtopic.php?p=20968165"
}

ESPHome Config:


esphome:
  name: lightswitch-3gang

# Enable logging
logger:

# Enable Home Assistant API
api:
  encryption:
    key: "REPLACEME"
    
ota:
  password: "REPLACEME"

wifi:
  ssid: !secret wifi_ssid
  password: !secret wifi_password
  fast_connect: true
  reboot_timeout: 0s

  # Enable fallback hotspot (captive portal) in case wifi connection fails
  ap:
    password: !secret wifi_password
captive_portal:

button:
  - platform: restart
    name: "Restart"

sensor:
  - platform: wifi_signal
    name: "WiFi Signal Sensor"
    update_interval: 60s

bk72xx:
  board: generic-bk7231n-qfn32-tuya

binary_sensor:
  - platform: gpio
    id: binary_switch_1
    pin:
      number: P22
      inverted: true
      mode: INPUT_PULLUP
    on_press:
      then:
        - switch.toggle: switch_1
  - platform: gpio
    id: binary_switch_2
    pin:
      number: P23
      inverted: true
      mode: INPUT_PULLUP
    on_press:
      then:
        - switch.toggle: switch_2
  - platform: gpio
    id: binary_switch_3
    pin:
      number: P24
      inverted: true
      mode: INPUT_PULLUP
    on_press:
      then:
        - switch.toggle: switch_3

switch:
  - platform: gpio
    id: switch_1
    name: Relay 1
    pin: P28
  - platform: gpio
    id: switch_2
    name: Relay 2
    pin: P26
  - platform: gpio
    id: switch_3
    name: Relay 3
    pin: P14

status_led:
  pin: 
    number: P8
    inverted: true  # Inverting enables the key backlights.

Hope this is helpful to someone, but I would strongly advise not purchasing this one. With the T34 package, and no exposed pads or silk screen, these are non-trivial to flash.

Attachments:

readResult_BK7231N_QIO_2024-18-2-14-38-38.zip (1.04 MB) You must be logged in to download this attachment.

About Author

CameronDev wrote 12 posts with rating 15 , helped 1 times. Been with us since 2024 year.

Comments

Add a comment

p.kaczmarek2 19 Feb 2024 07:53

This is the most pro way of flashing I've ever seen here: https://obrazki.elektroda.pl/5096754300_1708325564_thumb.jpg Just a quick question - was using CEN really necessary? [Read more]

CameronDev 19 Feb 2024 08:56

A pro wouldn't have taken 3 hours to do it :D Don't know, I didn't try without grounding CEN. I just read somewhere that I needed to ground it. Either way, TX/RX are also inaccessible, so it required... [Read more]

ferbulous 19 Feb 2024 09:30

Hi @camerondev How did you apply the solder paste to the back chip? Do you cover the entire back or just meticulously apply to each of the small pads? [Read more]

CameronDev 19 Feb 2024 09:40

I didn't use solder paste. I tried to add solder to the board using the soldering iron, but it mostly went onto the ground and ignored the pins. Those pads are TINY. The wires in that picture are 0.25mm... [Read more]

ferbulous 19 Feb 2024 10:13

I see, so it’s mostly solder reflow and you heat it up with hot air. I tried it once with esp32 ic chip that got displaced when i was desoldering. Didn’t quite work for me though [Read more]

divadiow 19 Feb 2024 10:36

this is impressive. kudos [Read more]

jkwim 24 Feb 2024 07:12

Just curious to know the temperature ranges and the air flow settings use in Hotair guns that you use for these kind of desoldering/soldering. Some recommend preheating the board and then having a quick... [Read more]

p.kaczmarek2 24 Feb 2024 07:56

It varies from station to station, I have a 50$ station that can't desolder a component at 450C and I have a 400$ station that desolders the same component at 350C. [Read more]

CameronDev 29 Feb 2024 02:09

I didn't pre-heat the board, and used one of these: https://www.aliexpress.com/item/1005005855040180.html https://obrazki.elektroda.pl/7633115700_1709188118_thumb.jpg I just set it as hot... [Read more]

p.kaczmarek2 29 Feb 2024 07:29

Which flux did you use (if any)? [Read more]

jkwim 29 Feb 2024 09:21

:-) I have the exact same device. I am a novice when it comes to use of heat gun. So far I have used it once to remove a CB3S module. Some nearby small SMD components flew off the board. That is why... [Read more]

CameronDev 29 Feb 2024 09:41

Flux I used: https://www.ebay.com.au/itm/203741564643 Ill try work out the settings, but i suspect they are on the defaults. The controls for that hot air thing are awful. I am also a novice (as... [Read more]

p.kaczmarek2 29 Feb 2024 09:44

Did you use the Pb solder and flux trick? I've did a small research on that and it turned out that the same temperature setting (like 350C) gives different results on various stations: https://openshwprojects.github.io/hotair/350c.html So,... [Read more]

divadiow 29 Feb 2024 09:50

sorry to chime in on everything it probably seems! I did the pb/flux trick like your video once but it seems if you have a module with 3 sides of soldered pins you can't liquify the pb fast enough between... [Read more]

p.kaczmarek2 29 Feb 2024 10:18

My video used JCD 8908 at 450C I think. Review: https://www.elektroda.pl/rtvforum/topic3970314.html (Use Google Translate) but as I said, 450 on one station is not like 450 on the other: https://openshwprojects.github.io/hotair/350c.html https://openshwprojects.github.io/hotair/450c.html Two... [Read more]

CameronDev 01 Mar 2024 01:02

I used 480c (Whatever that actually ends up being), and the fastest fan speed. Desoldering smaller things is easier, the T34 came off fairly easily. [Read more]

t2004dd 16 Mar 2024 23:35

Hi ! About bridge from PIN 9 - CEN to the GND : do you have it permanently or short up it when flash was started ? and what baud rate did you use ? [Read more]

t2004dd 17 Mar 2024 14:44

I flashed T34 chip successfully. Bridge CEN is not needed. You can start flashing if you just interrupt 3.3V , attached to the PIN8. I flashed it with baud rate 921600. https://obrazki.elektroda.pl/2585614500_1710683016_thumb.jpg... [Read more]

p.kaczmarek2 17 Mar 2024 15:53

Good job! I actually never use CEN for flashing these days, but I haven't really encountered any T34s so far, only BK7231N [Read more]

FAQ

TL;DR: At 480°C and 921600 baud, one expert conclusion was: "Bridge CEN is not needed." This FAQ helps OpenBeken users flash hard-to-access Tuya T34/BK7231N wall switches, recover pin maps when config extraction fails, and avoid common UART, power, and LED pitfalls on 1–3 gang boards. [#21007722]

Why it matters: These Tuya switches can look identical at purchase time, yet one version may flash from exposed pads while another requires chip removal, needles, or pogo-pin probing.

Method	Hardware access	Risk level	Proven result in thread
Hot-air chip removal	Full T34 desolder	High	Worked, but described as "not for the faint of heart"
Needle / sewing-needle UART	Touch hidden pins in-circuit	Medium	Successful dump and flash without desoldering
Pogo-pin probe rig	Weighted vertical probes	Medium	Used to flash multiple T34 devices quickly
Exposed factory pads	Direct board pads	Low	Some later boards flashed easily from pads

Key insight: The hardest part is usually not OpenBeken itself. It is gaining stable electrical access to T34 UART, then keeping power, contact pressure, and baud rate stable long enough to read or write flash.

Quick Facts

One 3-gang T34 switch shipped with Tuya firmware 1.3.10, blocked Cloudcutter, and had four board pads where only 3.3 V and GND were identified as useful for power, not direct flashing. [#20968165]
Reported hot-air settings ranged from 400°C to 480°C, with one successful T34 removal taking under 60 seconds and another user running the fan at maximum speed. [#21049685]
Successful direct flashing reports used 921600 baud and also 230400 baud on similar T34 boards, but unstable setups produced read or write failures even after a nominally successful erase. [#21007722]
One buyer paid 1.87 euro per switch on 2024-03-18, which explains why some users still accepted the extra rework needed for T34 packages. [#21008716]
A cheap $50 hot-air station could fail at 450°C, while a $400 station removed the same part at 350°C; the temperature number alone was not a reliable benchmark. [#20975908]

How do you flash a Tuya T34/BK7231N wall light switch with OpenBeken when the module has no exposed programming pads?

You flash it by either removing the T34 or reaching its hidden UART pins in-circuit. 1. Open the switch by prying off the glass front and unclipping the board. 2. Expose UART by hot-air desoldering the QFN T34 or by touching RX/TX with needles or pogo probes. 3. Dump first, then write OpenBeken with a BK7231N-compatible tool and restore the board carefully. One successful 3-gang case needed full T34 removal because no programming pads reached the chip. [#20968165]

Why does Tuya config extraction sometimes fail on T34 firmware dumps with 'no json start found', and how can you recover the pin mapping manually?

It fails because the dump can contain Tuya data that the extractor does not parse cleanly, even though the configuration still exists in flash. You can recover the mapping by reading decrypted strings or boot logs and matching relay, button, and LED pins manually. On one 3-gang dump, the author rebuilt the map by inspection and published P8 as WiFi LED, P14/P26/P28 as relays, and P22/P23/P24 as buttons. That gives a working template even when automatic extraction fails. [#20968165]

What is the CEN pin on a T34 or BK7231N, and how is it used during flashing?

CEN is a control pin used to reset or enable the chip during entry to flashing mode. Early attempts grounded it because that was thought necessary, but later successful T34 flashes showed it was not required. A direct report stated, "Bridge CEN is not needed," and flashing started by interrupting 3.3 V on pin 8 instead. That makes CEN optional in this thread’s T34 cases, not a mandatory wire for every setup. [#21007722]

What is the BL0937 chip in Tuya smart plugs and switches, and why does it matter for OpenBeken PowerSave settings?

"BL0937 is an energy-measurement IC that reads electrical parameters, uses timing-sensitive signals, and appears in some Tuya plugs and switches, which makes aggressive MCU sleep settings more sensitive than on simple relay-only boards." It matters because one OpenBeken maintainer said PowerSave is fine on devices without BL0937, but BL0937 devices may need a different PowerSave approach. A 2025 plug example without BL0937 ran cooler after PowerSave, while BL0937 cases were called out as exceptions. [#21486413]

Which hot air settings work best for desoldering and resoldering a T34 QFN chip without frying the PCB or blowing away nearby SMD parts?

No single temperature works best; station behavior matters more than the number on the display. The safest thread-backed practice was: 1. Use Kapton tape on nearby parts. 2. Use a narrow nozzle and the lowest setting that actually melts solder on your station. 3. Verify on scrap boards before touching T34. Reported successful settings ranged from 400°C to 480°C, but a maintainer showed that 350°C on different stations produced very different real temperatures and heating times. [#21050033]

When flashing a T34, why might interrupting 3.3V or briefly making and breaking the TX connection work better than grounding CEN?

It can work better because the chip often enters the bootloader on a power-state transition or a momentary valid UART event, not from a permanent CEN short. One T34 user flashed successfully by interrupting 3.3 V on pin 8, and another later discovered that briefly lifting and re-touching the TX probe triggered communication. Those reports point to timing and contact quality as the real issue on hidden-pin T34 boards. [#21636218]

What OpenBeken pin configuration works for the Tuya Generic Touch Light Switch 3 Gang with T34 and BK7231N?

A proven 3-gang OpenBeken mapping is P8 = WifiLED;55, P14 = Rel;1, P22 = Btn;3, P23 = Btn;2, P24 = Btn;1, P26 = Rel;2, and P28 = Rel;3. The same thread also shared an ESPHome layout using P22/P23/P24 for buttons, P28/P26/P14 for relays, and P8 as an inverted status LED. That configuration came from a firmware dump and manual reverse-mapping after extractor failure. [#20968165]

How can you flash a T34 directly in-circuit with needles, pogo pins, or trace access instead of removing the chip?

You can do it by contacting the hidden UART points mechanically and avoiding full chip removal. 1. Solder stable 3.3 V and GND first. 2. Touch RX and TX with sewing needles, pogo probes, or accessible traces. 3. Start the flasher, then adjust contact pressure or re-touch TX until the bus syncs. One user dumped and flashed a concealed-leg T34 entirely in-circuit with sewing needles, and another later flashed multiple boards using vertical pogo-pin rods resting by weight. [#21117908]

BK7231GUIFlashTool vs hid_download_py: which is better for backing up and flashing T34/BK7231N devices?

Neither was presented as universally better; the thread treats them as complementary. BK7231GUIFlashTool is convenient for guided UART flashing, while hid_download_py was suggested when readout problems persisted and users needed an alternative path. One maintainer explicitly recommended trying the Python tool after UART read issues, alongside timeout tuning and shorter wires. In practice, the better choice in this thread was the one that matched your adapter, wire quality, and board behavior on that specific T34. [#21031906]

Why does a freshly flashed T34 switch sometimes fail to start the OpenBeken WiFi AP even though the write process reports success?

The usual cause is not the firmware file alone; it is unstable flashing, bad contact, or a partial write that still looked successful during the session. One 2025 case erased and wrote sectors, but the switch never entered AP mode after five power cycles, the WiFi LED flashed weakly once, then stayed bright blue, and even writing the original backup back failed at sector 0x11000. That pattern points to corrupted flash contents or unreliable electrical access during programming. [#21619518]

What causes UART flashing read or write errors on T34 boards, and how do wire length, baud rate, power supply quality, and USB-TTL adapters affect reliability?

Long wires, unstable 3.3 V, noisy supplies, weak USB-TTL adapters, and mismatched baud rates all cause failures. The thread gave concrete fixes: shorten wires, tune UART timeouts, try 115200 to 921600 baud, and avoid relying on the UART adapter’s 3.3 V pin for full module power. One user fixed repeated read errors simply by changing the lab supply, while others reported old adapters failing and FTDI232RL or CH340G working better. Enough current matters, especially once Wi-Fi starts. [#21032083]

How do you configure the WiFi LED on T34-based wall switches so it turns off after connecting instead of staying bright blue all the time?

Set the LED pin to the opposite WiFi LED polarity. A 2026 report solved the always-on blue LED by changing the original setting from WifiLED_n to WifiLED. Another 2025 ESPHome example used an inverted GPIO output on P7, but that could also change button backlight behavior. The simplest OpenBeken fix in this thread was to try WifiLED versus WifiLED_n on the same LED pin until the post-connect state matches your hardware. [#21810549]

What’s the difference between T34, CB2S, and CB3S Tuya modules when choosing a smart switch that is easier to reflash?

T34 is the risky choice when the board hides UART and exposes no usable pads. The thread repeatedly warned against buying T34-based switches because flashing often required chip removal, needles, or rework. By contrast, older stock in white boxes and some CB2S-based units were reported with accessible TX/RX pads, making them much easier to reflash. One buyer even advised looking for white-box stock specifically to avoid T34 trouble. [#21009070]

Which USB-to-UART adapter is more reliable for T34 flashing, CH340G or FTDI232RL, and why do some adapters fail on these boards?

Both CH340G and FTDI232RL can work, but the thread gave FTDI232RL a slight edge for stability on difficult boards. One user used an FTDI232RL-based red adapter successfully and said CH340G also works, while another failed with older adapters and had to switch hardware before flashing succeeded. Adapters fail when they provide noisy power, insufficient current, or marginal UART timing. The chip choice matters less than clean 3.3 V, solid contact, and a converter that handles the board reliably. [#21049770]

How could you program or access a T34 through alternative pins like JTAG or board-side MCU pads when RX and TX are hard to reach?

The thread did not provide a confirmed JTAG flashing method for T34. One later analysis noted that some board-side pads appear to reach a small companion MCU and that T34 pins P22 and P23 map to JTAG TDO and TDI in normal operation, but this stayed a hypothesis. The only proven alternatives in the thread were UART through hidden legs, exposed traces, removed companion parts, or board pads that happened to break out power and serial. Treat JTAG access here as unverified. [#21326143]

Generated by the language model.