Unusual firmware change for the non-detachable Blow 72-070 socket for PLN 30
I will show you a little interesting fact - a quite invasive but effective way to change the firmware of the cheapest WiFi-controlled socket. This socket is characterized by a low price (PLN 30) and a structure that makes it impossible to remove the board with the WiFi module from inside, which makes changing the insert very difficult. This is not a product like Blitzwolf sockets, where we have either a hidden screw or retractable pins, here everything is held together and there is really no way to get to the programming pads. Normally I wouldn`t touch it, but I received a request from a reader to change the insert of such a socket at all costs ...
You can buy this socket really cheap and it`s not strange at all - it`s the cheapest option possible:
The socket offers energy measurement:
This is a variation of the LSPA9 socket, described here:
Electrical socket with LSPA9 energy measurement - we program our own firmware
but this version has a grounding plate whose rivet makes it impossible to remove the PCB .
We`ll get to that in a moment, but first, photos of the packaging:
Set:
Polish-language instructions:
Socket itself:
Interior and blow flashing
At first, they are disassembled like LSPA9, but after a while we have a surprise - the ground plate holds the rest of the system:
I don`t know how to make sense of this:
After consulting the reader, the decision was made - we cut:
Already then I tried to connect with the programmer:
There is of course BK7231 inside, BK7231Flasher should be able to handle it:
https://github.com/openshwprojects/BK7231GUIFlashTool
but here is the problem, because the energy measurement system is probably on RX/TX... so you need to desolder the module:
Outside the system, you can change the input normally:
This is what the socket looks like from above:
The module returns to its place:
Flasher obviously detected the configuration:
Verbal description:
Device configuration, as extracted from Tuya:
- BL0937 SEL on P24
- Button (channel 1) on P11
- LED (channel 1) on P10
- BL0937 VI on P8
- WiFi LED on P6
- BL0937 ELE on P7
- Relay (channel 1) on P26
Device seems to be using WB2S module, which is using BK7231T.
And the Tuya section starts, as usual, at 2023424
JSON Tuya:
Code: JSON
OBK template:
Code: JSON
After changing the firmware, you still need to perform calibration, similarly to Tasmota - CurrentSet, VoltageSet, PowerSet commands.
Finally, we protected the socket - first with a solder mask, and then (on the reader`s side) with epoxy or some form of filler, at our discretion:
Summary
Nothing to be proud of here, terrible load changing device. Very problematic, especially since now the products are no longer susceptible to the exploit allowing the first OTA via WiFi. I have very fond memories original LSPA9 where it was possible to remove the entire PCB from the housing. In the case of Blow, this is not possible due to the previously mentioned rivet plate.
It`s possible that something better could be invented, but I only programmed two pieces, so the method from the topic worked anyway.
What not to do to have automation operating fully locally, without the Chinese cloud...
p.kaczmarek2 wrote 11960 posts with
rating 9995 , helped 572 times.
Been with us since 2014 year.
Comments
Wouldn`t it be easier to drill out the rivet? [Read more]
Well, I don`t know if I would be able to solder it solidly without melting the center of the socket. If I have some to destroy, I`ll try. [Read more]
If there was determination, it had to succeed. Alternatively, after drilling out the rivet, you can rivet it again or tighten it with an M3 screw. [Read more]
I would do that too. By the way, why change the load to something other than the factory one? I`m just guessing that the original batch doesn`t work with a given smartphone application, as we would li... [Read more]
I wrote about why people want to change the load in the topic The electrode list of interior IoT devices has reached 500 entries [Read more]
Why bottle it at all, what does it give? I`ve always wondered about this, and finally today I decided to ask. [Read more]
Dissociating yourself from observation by Rice Brother, e.g. . [Read more]
@K, there was an answer posted above. I will add that I also change the batch because I like to have the device available in the local network through a browser, normally by IP address, and Tuya etc.... [Read more]
but then you don`t have access to the device outside your home?? [Read more]
The point is that if the user is sitting on the sofa and wants to close the blinds from the smartphone, the request should not go through the server room in Shenzhen but only through the home router. ... [Read more]
Access to the device is whatever you organize, i.e. after flashing the IoT device with an alternative firmware that works without the cloud, such as Tasmota and connecting the device to your WiFi,... [Read more]
Isn`t it enough to, for example, redirect the DNS router to your own service? [Read more]
It may be possible, but you still need to support the original software protocol. I have never played with it, I prefer to move four letters, go to the switch and manually turn on the light. I only use... [Read more]
Just invest in a router with VPN or simply run a VPN server on your router if it has one. With public IP, access to your home network around the world. [Read more]
Or set up your own server with a public IP. Or subscribe to AWS or Azure and write your own applications with all the benefits of possibilities. There are many possibilities - it`s just a matter of ... [Read more]
But why, since VPN is the simplest and relatively safe way to access your home network. Most new routers are supported, configuration and launch on any device takes 5 minutes without any additional costs. ... [Read more]
You could have reached the arrangement in a simpler way [Read more]
@tomaszlonski How did you achieve this? [Read more]
I described only have a router with a VPN server (not with the client because that`s different). And at home I have two Vu+ Uno 4kSE tuners, one with satellite and the other with terrestrial. [Read more]