logo elektroda
logo elektroda
X
logo elektroda

[ECR6600 ] Teardown and OpenBeken Conversion of TNCE TUYA Smart Plug WiFi from AliExpress

djbios  Cool? (+6)
📢 Listen (AI):
Laboratory power supply and prototype board on a glass desk.
Hi all! Let me share my teardown of TNCE TUYA Smart Plug WiFi I recently bought on AliExpress for 5 euros. The original Tuya firmware was pretty unstable and I decided to covert it to OpenBeken. Luckily, OpenBeken supports ECR6600 platform so it was possible to flash it via UART. I'll show the flashing process here step by step.

Here is the look of the device
A person holding a white electrical adapter with a Schuko socket on a dark background.
Electrical adapter held in a hand.
Smart electric socket in gray with a visible power button.
Travel adapter with two pins on a dark background.

To open up the device without much damage I used a vice: slightly squeezing from both sides till the little crack sound allows to crack the glue and split the plastic into 2 parts

Electrical socket adapter with an on/off switch.

Then removing one little screw allows to extract the PCB


Open plug with visible interior.
A circuit board held in hand with various electronic components.
Close-up of a blue printed circuit board with visible electronic components.
Close-up photo of a blue circuit board with electronic components and the inscription ESWIN.
A printed circuit board with electronic components held in a hand.
Blue circuit board with a mounted relay.
Blue circuit board with a lever switch on a black background.

We can see that the socket is built on the basis of ECR6600, which OpenBeken recently supported. To measure the voltage/current they use BL0937CF.

On the back of the PCB, there are convenient pads to solder the USB-UART adapter

Electronic circuit with JIEYING relay and connected wires.

Then we need an external 3.3V power source, I used an adjustable lab one

Laboratory power supply and prototype board on a glass desk.

I used this guide https://www.elektroda.com/rtvforum/topic4111822.html to flash the firmware, in a nutshell you need to:
1) Download ESWIN_ECR6600_RDTool_v1.0.21.zip from here https://github.com/openshwprojects/FlashTools/tree/main/TransaSemi-ESWIN and use RDTool.exe
2) In RDTool you double click "develop tool" tab, select the COM port, and on "all-in-one file path" select the firmware from latest release https://github.com/openshwprojects/OpenBK7231T_App/releases/ (ECR6600 UART Flash) - I used OpenECR6600_1.18.62.bin
3) Then you need to click start and enable the power source of a device. You might not get in sync from the first attempt (there is some very specific timing, smth like 0.5 sec to power device after start clicked) - that's okay, you will succeed eventually.
4) After the program finishes the flashing - you all set, the device runs free firmware now.

Now you can unsolder the wires, put PCB back in a case and try to put it in the socket. WiFi hotspot should be running now.

The pins configuration is:

Code: JSON
Log in, to see the code


UPD: Attached the original firmware

Enjoy!
AI: Did you encounter any specific issues or challenges during the teardown or firmware conversion process?
No, just needed to collect the info from different sources
AI: How familiar are you with similar teardown and firmware flashing processes?
A bit

About Author
djbios wrote 2 posts with rating 6 . Been with us since 2025 year.

Comments

p.kaczmarek2 19 Mar 2025 11:14

Thank you for sharing! It's good to see that ECR6600 support is being useful for our users. Did you see that, @divadiow @insmod ? You did good job with research and porting. Did you try some other drivers... [Read more]

divadiow 19 Mar 2025 13:01

😁😁 are you finding wifi is OK @djbios? what's your RSSI shown in OBK? what's the distance from device to router/AP? what speed has it connected (if your router tells you)? Added after 14 [minutes]:... [Read more]

p.kaczmarek2 19 Mar 2025 17:46

@divadiow how many ECRs did you have with WiFi problems? [Read more]

divadiow 19 Mar 2025 18:07

only the WG236 modules in testing. Same as @insmod. I don't have a real ECR6600 device yet. [Read more]

p.kaczmarek2 19 Mar 2025 18:21

Did they come blank by default or with AT firmware? Is there a RF-calibration utility in the SDK? [Read more]

divadiow 19 Mar 2025 18:29

They come with something on. It feels more likely it's a calib issue with the WG236 modules specifically, yes. I'll take a fresh look this evening. I have already transplanted RF nv partition from Tuya... [Read more]

jannie_doedel 01 Apr 2025 14:52

works like a charme !! Tried to load NTP and worksfine too. Only chip temp is 0.0. Without config it showed 44 degrees. https://obrazki.elektroda.pl/5528931800_1743511812_thumb.jpg What is the... [Read more]

divadiow 01 Apr 2025 14:56

this one maybe? Added after 52 : template in device list is "14": "BL0937CF;0", "15": "BL0937SEL;0", "20": "BL0937CF1;0", "22": "WifiLED;0", "24": "Btn;1", "25": "Rel;1" [Read more]

jannie_doedel 01 Apr 2025 15:38

Yes thats the one. Thx ! Added after 2 [minutes]: The temperature indication must have been a glitch as it is working now [Read more]

insmod 01 Apr 2025 16:01

Not a glitch, on your screenshot there are 2 incomplete boots. If more than one - internal temperature readout is disabled. [Read more]

divadiow 24 May 2025 08:37

thanks for updating first post with a backup. Nothing new I'm afraid. boot log, fw version, product ID all same as the other plugs seen https://github.com/divadiow/Misc/tree/main/ECR6600_DECRYPT [Read more]

%}