[BK7231T] My HTTP server, configurator, MQTT support from Home Assistant

@MustangMatt ermmm the list of commits is here:
https://github.com/openshwprojects/OpenBK7231T_App/commits/main
Is this link working for you? I am trying to be descriptive in the commits I make, but I must admit, I haven't been using github much before this project. Only private GIT repos and of course SVN repos as well (sourceforge site, anyone? Old good times!)

@boozeman I will keep that in mind. I have much more in plans for futher commits, stay tuned

MustangMatt wrote:

p.kaczmarek2 wrote:

One more MQTT crash fix pushed to repo now. I am testing in both open access point and client modes.

Would you mind posting a link to the commit? I'm trying to follow along but I'm not seeing it.

Thanks!

I Think it was this: Again; delay MQTT initialization

Perfect. I was looking at the other repo. Thanks!

MustangMatt wrote:

Perfect. I was looking at the other repo. Thanks!

I will make organization of repos and readmes more clear soon.

Also, please note that we have a separate SDK repo for BK7231N version (the App compiles fine with both repos, I will have to rename it....)
https://github.com/openshwprojects/OpenBK7231N

Seems like Tuya is like Keepers in Babylon 5. They do not give up easily

My Homeassistant discovers openBK device as Tuya while I was guessing the pin setup. Seems like I cannot connect now to my mqtt broker. Hmm...

EDIT; My previous build (Build on Feb 9 2022 15:42:00) before todays GiT chages works now OK and I can Save MQTT settings too. I think that my issue is blank mqtt settings when flashing new module at first time and there's nothing on flash memory. Does this sound reasonable?

boozeman wrote:

My previous build (Build on Feb 9 2022 15:42:00) before todays GiT chages works now OK and I can Save MQTT settings too.

First of all, do you know that recent change in unique device name generation (using latter bytes of MAC instead of first four) has invalidated all Home Assistant MQTT configs (because MQTT device names has changed) and thus all configs have to be regenerated? Options->Generate HA Config
(don't worry, your pins setting are left intact, only device ID changed)

boozeman wrote:

My Homeassistant discovers openBK device as Tuya while I was guessing the pin setup.

That is utmost peculiar. I don't know right now how HA searches for devices - anyone?
Maybe it just recognized the module by MAC address (MAC address have vendor-specific section).

I just bought a 4 pack of these and got the new version.

https://templates.blakadder.com/feit_electric-BPA800RGBWAG2P.html

I guess it's time to give the new firmware a go. Any tips for breaking open the bulbs without destroying them? I got the top off but I don't see any easy way to remove the board yet.



Okay, got it with some destruction. That white 8 pin block holds the two boards together.

I can just barely get to the 5 pins it looks like but I can't get to RST. U1 is serial, U2 is log



https://developer.tuya.com/en/docs/iot/wb2l-datasheet?id=K9duegc9bualu

Hi! I started playing around with my WB2S, I soldered 3v3 (Red), GND (Orange), RX (Yellow) and TX (Green) and then connected Orange to GND on PL2303, Red to 3v3 on PL2303, Yellow to TX on PL2303 and Green to RX on PL2303.



Launched screen for serial console but nothing happens, typing does not work and I tried with 115200 and 921600 baud rates, it seems to be a wiring issue...

I also tried to connect CEN to GND of PL2303 without luck also. All tests were done plugging TX, RX and GND first and then 3v3 to turn on the module, whan can I be doing wrong?

Also swiped TX and RX as usual confusion with UART, no luck either

I see the SSID of the module after it boots so it's not fried yet

pepesuriano wrote:

Hi! I started playing around with my WB2S, I soldered 3v3 (Red), GND (Orange), RX (Yellow) and TX (Green) and then connected Orange to GND on PL2303, Red to 3v3 on PL2303, Yellow to TX on PL2303 and Green to RX on PL2303.



Launched screen for serial console but nothing happens, typing does not work and I tried with 115200 and 921600 baud rates, it seems to be a wiring issue...

Try to desolder WB2S module VCC to main board. Use solder sucker or copper strip. Use multimeter continyity mode to check there's no connection. BEWARE! do not overheat the pads. I destroy one of my plugs when soldering pad detached from the pcb.

After that normal wiring vcc, gnd, rx1 and tx1 and cen. You can use CEN pin opposite of the PWM5 (You do not need to use that pad if that is hard to solder. Look at module pinout above. Your device is easy because test pads are towards.

RX2 and TX2 gives you some debug with 115200 bps.



Remember to connect module RX1 to your usb2serial converter TX and TX1 to RX. and VCC only 3.3V I have tested 3 different smart plugs and only RX1/TX1 can be used for programming. In your picture you do just like that. Good. Start beken writer programming (not flash) and connect CND and CEN for a moment (I have push button for that)

I also figured out that insulating the WB2S-module off the rest of the circuitry helps flashing (no relays klicking or light flickering and then 15 sec init and Failed. No need to desolder whole thing or removing any other components.

I have sacrificed 3 devices for the science so far and one of them are now permanently dead. So keep in mind the few casualties in this process. Hope this somewhat unclear instructions help you a bit.

boozeman wrote:

pepesuriano wrote:

Hi! I started playing around with my WB2S, I soldered 3v3 (Red), GND (Orange), RX (Yellow) and TX (Green) and then connected Orange to GND on PL2303, Red to 3v3 on PL2303, Yellow to TX on PL2303 and Green to RX on PL2303.



Launched screen for serial console but nothing happens, typing does not work and I tried with 115200 and 921600 baud rates, it seems to be a wiring issue...

Try to desolder WB2S module VCC to main board. Use solder sucker or copper strip. Use multimeter continyity mode to check there's no connection. BEWARE! do not overheat the pads. I destroy one of my plugs when soldering pad detached from the pcb.

After that normal wiring vcc, gnd, rx1 and tx1 and cen. You can use CEN pin opposite of the PWM5 (You do not need to use that pad if that is hard to solder. Look at module pinout above. Your device is easy because test pads are towards.

RX2 and TX2 gives you some debug with 115200 bps.



Remember to connect module RX1 to your usb2serial converter TX and TX1 to RX. and VCC only 3.3V I have tested 3 different smart plugs and only RX1/TX1 can be used for programming. In your picture you do just like that. Good. Start beken writer programming (not flash) and connect CND and CEN for a moment (I have push button for that)

I also figured out that insulating the WB2S-module off the rest of the circuitry helps flashing (no relays klicking or light flickering and then 15 sec init and Failed. No need to desolder whole thing or removing any other components.

I have sacrificed 3 devices for the science so far and one of them are now permanently dead. So keep in mind the few casualties in this process. Hope this somewhat unclear instructions help you a bit.

Apologies, but I got confused, you mean to desolder only VCC from WB2S from the mainboard (keeping all the rest soldered like GND, TX, RX, etc)? Or do you mean to remove the whole WB2S module from the mainboard and flash it?

Yeah once I heard the relay clicking over and over, I thought I lost it, but for the moment there are 0 casutalties

What about CEN, is GND of the PL2303 good to connect it or I need to connect it in another place? I saw that you typed CND, was it a typo and it was supposed to say GND right?

Thanks so much for your help


Cheers

pepesuriano wrote:

Apologies, but I got confused, you mean to desolder only VCC from WB2S from the mainboard (keeping all the rest soldered like GND, TX, RX, etc)? Or do you mean to remove the whole WB2S module from the mainboard and flash it?

Yep, try to desolder only VCC pin so your usb2serial converter do not power rest of the plug's circuit. This is the only way I have successfully do for first flash. After then you can solder it back. No relay or light flickering for the next flashes with OpenBK firmware.

pepesuriano wrote:

Yeah once I heard the relay clicking over and over, I thought I lost it, but for the moment there are 0 casutalties

What about CEN, is GND of the PL2303 good to connect it or I need to connect it in another place? I saw that you typed CND, was it a typo and it was supposed to say GND right?

You can connect CEN to PL2303 GND or do some jump wire to sort CEN pad and thar circuilar big copper area from the right side of WB2s module. I have GND wire with CEN wire and push button. I recon it is safer than sorting CEN and GND directly at the board. you know "Uups! s***t the manufacturing smoke is gone now!"


My GND wire. with push button operated CEN/I00 wire.

boozeman wrote:

usb2serial converter do not power rest of the plug's circuit

Even with this, the power from 3.3v of USB to Serial is probably not *normally* good enough to power the MCU, so if you have failure to start flashing.... (it's designed more as a 3.3v signal than a supply?)
Based on ESP, you might expect it to need >500mA from the 3.3v

On my mains powered device, I used the 3.3v from a breadboard supply (with the mains disconnected!!!), and it was fine.
For my 12v LED strip controller, I powered it via the 12v (not scared of killing myself with a 12v wall-wart....)

tjclement wrote:

Hi all, for those interested in running custom firmware on devices that can't be opened without breaking them: a buddy and I have made a wireless jailbreak for BK7231-based devices from Tuya that has so far worked on all devices (lights) we tried it on. It makes use of a bug that is currently in Tuya's SDK and has been since 2019.

We'll be able to publish it after coordinated disclosure with Tuya. More info (I'm not allowed to post links yet on here): twitter dot com /Tom_Clement/status/1490796204862627853



PS: to those who were interested in looking at the bootloader but couldn't get it dumped (it's protected against dumping via the bootloader's own UART protocol, but still possible), you can also find a copy in the SDK -> github dot com /tuya/tuya-iotos-embeded-sdk-wifi-ble-bk7231t/blob/master/platforms/bk7231t/bk7231t_os/tools/generate/bootloader.bin

Hey Tom, What sort of timeframe are you thinking? I'd love to be able to flash bulbs without destroying them!

Hi,

I can't save mqtt settings with bin file compiled against up-to-date git repository.


When I hit that confirm, I get only below in log

EDIT: now I see what you meant, fixed now.

It wasn't "not saving", it was "not connecting", I'd say

p.kaczmarek2 wrote:

EDIT: now I see what you meant, fixed now.

It wasn't "not saving", it was "not connecting", I'd say

And it works now! I will publish tomorrow some data for about Nedis WiFIP130FWT 10A SmartPlug without power metering.

- How to open
- What must be do before flashing, etc.

Just flashed it with last build and configure settings. This is nicely done smart plug. No flux remains on board, no oxidized solderings.


Settings

MustangMatt wrote:

Hey Tom, What sort of timeframe are you thinking? I'd love to be able to flash bulbs without destroying them!

We're finishing up the coordinated disclosure report any day now, and will then send it over to the Tuya security team. Once they've patched it or a reasonable amount of time has passed (whichever comes first), we'll publish our write-up on the bug and our tooling for reflashing affected devices. The exact timeline will become clear when we've submitted the report.

Great. One more question, does it require physical access to the device to exploit I assume?

MustangMatt wrote:

Great. One more question, does it require physical access to the device to exploit I assume?

It requires being in the vicinity of the light, but the exploit is completely wireless so you don't need to take anything apart or solder anything. That's why it's nice: you can use it to flash devices that don't have the UART port accessible, such as most light bulbs.

Tom, is this exploit method closed by your uploaded code or are we all going to flash our friends bulbs as a joke, each time we're at their place/hackerspaces??

ExploWare wrote:

Tom, is this exploit method closed by your uploaded code or are we all going to flash our friends bulbs as a joke, each time we're at their place/hackerspaces??

If you flash firmware that either does not use the Tuya SDK or uses the latest version after they've patched it, the exploit is gone.

So, in practice, how useable do you think your OTA exploit will be? How many our users will be able to benefit from it before it gets patched forever by Tuya?

Can Tuya remotely patch the exploit in all of the devices that are currectly running at clients houses?

You might be doing them a massive favor in helping them keep their pledge for local only devices!

In the tuya app you have to opt-in to updating each individual device automatically so it would surprise me if they automatically patched all devices.

Hi,

One suggestion for generating Homeassistant cfg.

Change the beginning of the cfg from switch:
to switch <device name_1>:


No more Duplicate key errors

Or mention that if you have plenty off bk devices, do one named switch like switch beken:

and put all your devices to that same group like:

I see references to BKWriter 1.60 but where do I actually download that from?

use https://github.com/OpenBekenIOT/hid_download_py
else, go back though the pages, it's there somewhere....

@boozeman I will add a mention about it

@MustangMatt BKWriter 1.60 but is attached here https://www.elektroda.com/rtvforum/topic3850712-30.html#19840309

I have started working on adding XR809 support, based on my previous work here:
https://www.elektroda.com/rtvforum/topic3806769.html#19447386
There is more porting to be done but maybe sometime soon we'll support XR809 devices as well.

Note: using the latest updates, you can go to
http://<ip>/app

this loads a webapp from
https://github.com/OpenBekenIOT/webapp
(check gh-pages branch)

The webapp now allows you to OTA direct from the browser.

Also, the device CAN store a filesystem... this occupies the OTA flash area, so if you use it, it is destroyed each time you OTA.
So... The OTA page of the webapp allows you to backup the FS, and then restore after OTA.

Still a prototype, but have a go, and PRs welcome in terms of controllers for various devices.

br,
btsimonh

Initial XR809 platform support progress:


Setup:

Of course, this is a hello world app, but the OpenBK7231T app also will be running on XR809, so most of the OpenBK7231T will be also available on XRadioTech devices.
Repo:
https://github.com/openshwprojects/OpenXR809

btsimonh wrote:

Note: using the latest updates, you can go to
http://<ip>/app

this loads a webapp from
https://github.com/OpenBekenIOT/webapp
(check gh-pages branch)

The webapp now allows you to OTA direct from the browser.

Also, the device CAN store a filesystem... this occupies the OTA flash area, so if you use it, it is destroyed each time you OTA.
So... The OTA page of the webapp allows you to backup the FS, and then restore after OTA.

Still a prototype, but have a go, and PRs welcome in terms of controllers for various devices.

br,
btsimonh

Wow nice one! No need to second uart anymore!

I tested OTA and got my device reset (seems like that backup process got some hickupp) and the devicename changed to obk8C000000. Is this normal or something new "feature"?

It is nice if we have ability to set mqtt topic like Tasmota, ie. You can taylor the mqtt message with device client name and even topic. I am about to close this Nedis WIFIP130FWT with dupoint-header for serial if needed. Ota feature is super nice to have at this point of development.

Cheers