[ECR6600 ] Teardown and OpenBeken Conversion of TNCE TUYA Smart Plug WiFi from AliExpress

djbios 18 Mar 2025 19:30 28 4359 Cool? (+8)

📢 Listen (AI):

TL;DR

TNCE TUYA Smart Plug WiFi from AliExpress was torn down and converted from unstable Tuya firmware to OpenBeken.
The PCB uses an ECR6600 SoC with a BL0937CF measurement chip, and it has convenient back pads for UART flashing.
The plug cost 5 euros, and the flash used ESWIN_ECR6600_RDTool_v1.0.21 with OpenECR6600_1.18.62.bin.
After flashing, the device ran free firmware and started a Wi‑Fi hotspot, though syncing sometimes needed repeated power-on timing attempts.

Generated by the language model.

Hi all! Let me share my teardown of TNCE TUYA Smart Plug WiFi I recently bought on AliExpress for 5 euros. The original Tuya firmware was pretty unstable and I decided to covert it to OpenBeken. Luckily, OpenBeken supports ECR6600 platform so it was possible to flash it via UART. I'll show the flashing process here step by step.

Here is the look of the device

To open up the device without much damage I used a vice: slightly squeezing from both sides till the little crack sound allows to crack the glue and split the plastic into 2 parts

Then removing one little screw allows to extract the PCB

We can see that the socket is built on the basis of ECR6600, which OpenBeken recently supported. To measure the voltage/current they use BL0937CF.

On the back of the PCB, there are convenient pads to solder the USB-UART adapter

Then we need an external 3.3V power source, I used an adjustable lab one

I used this guide https://www.elektroda.com/rtvforum/topic4111822.html to flash the firmware, in a nutshell you need to:
1) Download ESWIN_ECR6600_RDTool_v1.0.21.zip from here https://github.com/openshwprojects/FlashTools/tree/main/TransaSemi-ESWIN and use RDTool.exe
2) In RDTool you double click "develop tool" tab, select the COM port, and on "all-in-one file path" select the firmware from latest release https://github.com/openshwprojects/OpenBK7231T_App/releases/ (ECR6600 UART Flash) - I used OpenECR6600_1.18.62.bin
3) Then you need to click start and enable the power source of a device. You might not get in sync from the first attempt (there is some very specific timing, smth like 0.5 sec to power device after start clicked) - that's okay, you will succeed eventually.
4) After the program finishes the flashing - you all set, the device runs free firmware now.

Now you can unsolder the wires, put PCB back in a case and try to put it in the socket. WiFi hotspot should be running now.

The pins configuration is:

UPD: Attached the original firmware

Enjoy!
AI: Did you encounter any specific issues or challenges during the teardown or firmware conversion process?
No, just needed to collect the info from different sources
AI: How familiar are you with similar teardown and firmware flashing processes?
A bit

Attachments:

ECR6600_tuya_socket.bin (2 MB) You must be logged in to download this attachment.

About Author

djbios wrote 2 posts with rating 8 . Been with us since 2025 year.

Comments

Add a comment

p.kaczmarek2 19 Mar 2025 11:14

Thank you for sharing! It's good to see that ECR6600 support is being useful for our users. Did you see that, @divadiow @insmod ? You did good job with research and porting. Did you try some other drivers... [Read more]

divadiow 19 Mar 2025 13:01

😁😁 are you finding wifi is OK @djbios? what's your RSSI shown in OBK? what's the distance from device to router/AP? what speed has it connected (if your router tells you)? Added after 14 [minutes]:... [Read more]

p.kaczmarek2 19 Mar 2025 17:46

@divadiow how many ECRs did you have with WiFi problems? [Read more]

divadiow 19 Mar 2025 18:07

only the WG236 modules in testing. Same as @insmod. I don't have a real ECR6600 device yet. [Read more]

p.kaczmarek2 19 Mar 2025 18:21

Did they come blank by default or with AT firmware? Is there a RF-calibration utility in the SDK? [Read more]

divadiow 19 Mar 2025 18:29

They come with something on. It feels more likely it's a calib issue with the WG236 modules specifically, yes. I'll take a fresh look this evening. I have already transplanted RF nv partition from Tuya... [Read more]

jannie_doedel 01 Apr 2025 14:52

works like a charme !! Tried to load NTP and worksfine too. Only chip temp is 0.0. Without config it showed 44 degrees. https://obrazki.elektroda.pl/5528931800_1743511812_thumb.jpg What is the... [Read more]

divadiow 01 Apr 2025 14:56

this one maybe? Added after 52 : template in device list is "14": "BL0937CF;0", "15": "BL0937SEL;0", "20": "BL0937CF1;0", "22": "WifiLED;0", "24": "Btn;1", "25": "Rel;1" [Read more]

jannie_doedel 01 Apr 2025 15:38

Yes thats the one. Thx ! Added after 2 [minutes]: The temperature indication must have been a glitch as it is working now [Read more]

insmod 01 Apr 2025 16:01

Not a glitch, on your screenshot there are 2 incomplete boots. If more than one - internal temperature readout is disabled. [Read more]

divadiow 24 May 2025 08:37

thanks for updating first post with a backup. Nothing new I'm afraid. boot log, fw version, product ID all same as the other plugs seen https://github.com/divadiow/Misc/tree/main/ECR6600_DECRYPT [Read more]

mlb 17 Aug 2025 18:46

It worked! :) I've modified 3 plugs successfully. The small challenge is indeed to turn power supply in a blink of an eye after pressing the start button in RDTool. Another issue I've noticed with the... [Read more]

mlb 21 Aug 2025 12:45

After trying to use those plugs for a few days, unfortunately I've discovered recurring wifi issues. They existed before uploading the new firmware, so I guess this is related to faulty wifi in ECR6600... [Read more]

divadiow 21 Aug 2025 13:06

maybe they have the same mac address. Do they each connect fine, in turn, if only one is switched on at any one time? I flashed my EU ECR6600 smart plug last night and mac is generic/0s, but I did... [Read more]

kennyyzm 23 Aug 2025 18:38

Hi guys, I have the same smart plug but I was not able to either backup old firmware not flash a new one. I keep getting RECV_RSP: recv timeout: recv length is: 1 (sometimes it's 3). https://obrazki.elektroda.pl/6596780400_1755966906_thumb.jpg... [Read more]

p.kaczmarek2 23 Aug 2025 18:48

So, how do you connect UART to your plug? Can you share some photos? [Read more]

kennyyzm 23 Aug 2025 19:02

Here's the photo, I broke both TX and RX pads and resorted to use the copper trace for both. https://obrazki.elektroda.pl/9111449500_1755968410_thumb.jpg [Read more]

p.kaczmarek2 23 Aug 2025 19:11

Well, first of all, you need to have a common ground between power supply and the UART... if you use external power supply, GND must connect to both external power supply GND and USB to UART converter... [Read more]

kennyyzm 23 Aug 2025 19:31

@pkaczmarek2 Wow, it works right away. Thanks for your help. I thought it's not possible to flash it anymore since I broke the pads, hehe, Thanks again! [Read more]

FAQ

TL;DR: For users converting a €5 AliExpress TNCE smart plug, this FAQ shows how to open it, wire 3.3V UART, and flash OpenBeken on ECR6600. The key practical lesson is: "common ground" and fast power-on timing solve most RDTool failures. [#21642493]

Why it matters: This thread turns scattered teardown, flashing, and troubleshooting notes into a single reusable procedure for ECR6600-based Tuya plugs.

Option	Flashing OpenBeken	Backup old firmware	Tuya settings extraction
ESWIN RDTool	Works on this plug	Works for multiple users	Not shown to extract Tuya config
BK7231Flasher	Works for flashing on some units	Failed for at least one backup case	Did not extract Tuya settings

Key insight: Most failures were not caused by OpenBeken itself. They came from wiring mistakes, missing shared ground, or the narrow timing window when RDTool waits for the ECR6600 bootloader.

Quick Facts

The original poster bought the TNCE Tuya Smart Plug on AliExpress for 5 euros and converted it from unstable Tuya firmware to OpenBeken. [#21485550]
The plug uses an ECR6600 Wi-Fi platform and a BL0937CF metering chip, with UART flashing powered from an external 3.3V supply. [#21485550]
A practical sync window exists: users reported the plug may only enter flashing mode if power is applied about 0.5 seconds after pressing Start in RDTool. [#21485550]
Temperature reporting showed 44 degrees before config on one unit, then 0.0 after incomplete boots, and later returned to normal. [#21503392]
One failed BK7231Flasher backup attempt happened with the USB-TTL adapter accidentally set to 1.8V, while flashing still succeeded afterward. [#21744012]

How do I open the TNCE Tuya Smart Plug from AliExpress without damaging the plastic case or PCB?

Open it by gently squeezing both sides in a vice until the glue cracks, then split the plastic shell into 2 halves. After that, remove the single small screw and lift out the PCB. This method was reported to open the case with little damage to either the enclosure or board. [#21485550]

What is the step-by-step process to flash OpenBeken onto an ECR6600-based Tuya smart plug using ESWIN_ECR6600_RDTool?

Use RDTool with UART Flash firmware for ECR6600. 1. Download ESWIN_ECR6600_RDTool_v1.0.21 and load the latest OpenECR6600 UART Flash .bin. 2. Select the correct COM port, double-click the develop tool tab, then press Start. 3. Apply external 3.3V power immediately after Start; if sync fails, retry the timing until flashing completes. [#21485550]

Why does RDTool show "RECV_RSP: recv timeout" when trying to back up or flash an ECR6600 plug, and how can I fix it?

RDTool usually times out because the UART wiring or power reference is wrong. One successful fix was adding a shared ground between the external power supply and the USB-UART adapter. Another common cause is boot timing; the plug may need power about 0.5 seconds after clicking Start. [#21642476]

How should I wire the USB-UART adapter and external 3.3V power supply to the ECR6600 smart plug, including the common ground connection?

Wire TX, RX, and GND to the PCB pads, then power the plug from an external 3.3V source. The critical rule is that the USB-UART adapter and the external supply must share the same ground. One user fixed instant failures only after connecting GND to both the power supply and the UART converter. [#21642476]

What pin configuration works for the TNCE Tuya Smart Plug with ECR6600, relay, button, BL0937CF power metering, and WiFi LED?

A working OpenBeken template is P14 BL0937CF, P15 BL0937SEL, P20 BL0937CF1, P22 WifiLED, P24 Btn, and P25 Rel. The first published template omitted the LED, but later replies confirmed P22 for the WiFi LED. That 6-pin mapping is the most complete config shown for this plug. [#21503405]

Where is the WiFi LED connected on this ECR6600 smart plug, and how should it be configured in OpenBeken?

The WiFi LED is on pin P22 and should be configured as WifiLED;0 in OpenBeken. A later reply corrected the earlier template and matched the device-list entry for this model. If the LED is missing after flashing, P22 is the first pin to check. [#21503405]

What is BL0937CF, and how does it measure voltage and current in Tuya smart plugs?

BL0937CF is a power-metering chip that measures the plug’s electrical values and exposes them through CF, CF1, and SEL pins. In this plug, the board uses BL0937CF for voltage and current measurement, and the published OpenBeken map assigns P14, P15, and P20 to those metering signals. [#21485550]

What is ESWIN RDTool, and when should I use it instead of BK7231Flasher for ECR6600 devices?

ESWIN RDTool is the vendor flashing utility used to communicate with ECR6600 devices over UART, load firmware images, and perform operations such as backup and flashing. Use it when BK7231Flasher cannot back up the chip or cannot recover Tuya data. In this thread, RDTool was the original working method and also succeeded where BK backup failed. [#21485550]

BK7231Flasher vs ESWIN RDTool for ECR6600 plugs: which one works better for backup, flashing, and extracting Tuya settings?

ESWIN RDTool worked better overall in this thread. Users flashed successfully with both tools, but one user could not back up old firmware with BK7231Flasher and had to switch to ESWIN. The same user also reported BK7231Flasher could not extract Tuya settings from the old firmware image. [#21743995]

Why does the ECR6600 plug sometimes fail to sync unless power is applied right after pressing Start in RDTool?

The bootloader appears to expose only a short entry window at power-up. The original guide says the correct timing is very specific, around 0.5 seconds after pressing Start, and repeated attempts may be needed before the tool syncs. Users later confirmed this narrow timing is a real flashing challenge on these plugs. [#21637258]

How does OpenBeken behave with NTP, SSDP, and chip temperature reporting on ECR6600 smart plugs?

NTP was confirmed working on this plug after conversion. SSDP was only suggested for testing in the discussion, so the thread does not confirm its result. Chip temperature can read normally, but one user saw 44 degrees before config and later 0.0 during abnormal boot behavior. [#21503392]

Why does chip temperature show 0.0 on OpenBeken after incomplete boots, and how can I restore the normal reading?

Chip temperature shows 0.0 because repeated incomplete boots disable the internal temperature readout. A developer explained that if there is more than one incomplete boot, the internal sensor is turned off. Restore normal reading by fixing the boot stability issue and letting the device complete a clean boot cycle. [#21503467]

What could cause recurring WiFi connection problems on multiple ECR6600 smart plugs placed close together, even when their MAC addresses are different?

The thread points to ECR6600 Wi-Fi instability under crowded conditions. One user reported that when several plugs were close together, only one would connect and the others kept retrying. Another check ruled out duplicate MAC addresses, and the failing network used WPA2, mesh roaming, VLANs, and many IoT clients. [#21644658]

How can I back up the original Tuya firmware from an ECR6600 smart plug before flashing OpenBeken, and which addresses or tools should I use?

Back up the original firmware before flashing, and prefer ESWIN RDTool if BK7231Flasher fails. One later user explicitly asked for the instructions to include backup because skipping it caused concern after flashing. Another user read from address 0x0, got a repeatable dump, and confirmed ESWIN backup matched the original firmware structure. [#21823082]

Why are RX0 and TX0 shown twice on the ECR6600 config page, and which UART pins are the correct ones to use?

The duplicate RX0 and TX0 entries appear to be a config-page labeling issue, not a second usable UART pair. A later post noted the duplication on pins 5, 6, 21, and 22 and questioned it directly. For flashing this plug, users relied on the actual PCB UART pads shown on the board back side, not the duplicated labels. [#21745196]

Generated by the language model.