Qiachip Smart Switch - BK7231N / CB2S - interior, programming

Rather, RX is replaced by TX, i.e. RX to TX and TX to RX. It`s worth reading about UART.

You can do it on Windows and Raspberry pi. Try to install Python3 and then run the code I gave.

Do this so that you have Python in CMD:


And so you could run the UART program with it:



Let me know when it starts and I will guide you through the process. Remember to make a backup copy of the software that is already there before uploading my software.

Command to make a backup:

The second command is worth using, with offset 0, also a backup:


You can place a backup copy on the forum, the tuya-cloudcutter project collects various data from devices to prepare an OTA hack for them (possibility to change firmware without opening the case). Read the description of this project and remember that your SSID may be saved in flash.


Also provide photos from inside your device.

I downloaded what you told me, ran the install file and something was installed there.
I managed to install Python on Windows.
I ran cmd and entered python, now I have this window and I don`t know what to do next

This way you don`t have to enter the Python console.

Simply go to the folder where you have the uartprogram in a regular console and execute:

as a rule, do the same thing but with offset 0:

And that`s all from the software side for now.

Once you run uartprogram, this will be the second issue to solve. Downloading a batch (or uploading a new one) requires a reboot of the system you are programming. There are two ways to do this:
- cutting off/restoring power to the board (but you have to power it from a source other than the USB you have connected, because the capacitor on the board consumes too much when connected and overloads the USB...)
- temporarily short CEN to ground to perform a RESET (this may be problematic because you have to short it for exactly a short moment and not for a long time)

The sequence of steps is:
1. connect usb to uart
2. enter and run the programming command
3. when the program shows "getting bus", you reboot
4. then the program itself will perform read or write operations on the batch

hi

i follow the manual
I have a mistake

Hey @edwardtich , I will try to help you. I can see two potential issues.

1. you are inside Python directory and not inside hid_download_py directory :


2. my python version is 3.10.2, yours look like 2.7?


Edit: what do you get when you enter "python -V" command?

i copied all files to C:\Python27

i installed the latest version

same error

After a lot of struggle with this cmd, I reached this level. I entered this command into the backup copy and I got "Read getting bus", I shorted it and released CEN to GND and I got something like this.

Which windows version are you using?

p.kaczmarek2 wrote:

Which windows version are you using?

Windows 10
python-3.10.6-amd64

Can`t get the bus means you did not reboot while waiting.

You have several options to improve it.
1. try to short these CEN to GND for literally a fraction of a second, it takes practice to get the timing right
2. Power the programmed system from a separate 5V power supply (and if necessary, through a separate 3.3V regulator), of course common ground (all GNDs together), TX and RX to USB, but power supply from a separate power supply. And perform a reboot by disconnecting and connecting this power supply (the simplest method, you don`t have to use CEN at all)
3. you can unsolder the 22uF capacitor or 47uF on the board, and reboot by disconnecting the power supply from the USB dongle, but without removing the USB (I do not recommend it)

I recommend trying point 2 if step 1 doesn`t work. Method 2 is the most reliable

NOTE - if you have RX and TX connected incorrectly (to the wrong TX or TX to TX and not swapped), you will receive same error so maybe just to check it out and take some photos to see if everything is OK...


Of course, there is also a very small chance (but there is always) that you have a situation like mine here: https://www.elektroda.pl/rtvforum/topic3895572.html
in your device, there is, for example, an additional resistor on the RX pin that interferes with programming and will need to be unsoldered or cut. I don`t know, I`d have to see a good photo of the PCB

cannot get bus

Added after 4 [minutes]:

Well, I see two problems.
First of all, what is USB to UART? Users reported that the CP2102 did not work, but the CH340 did. Is this CP2102?

And secondly... it`s probably a door sensor? The one on TuyaMCU?
Although no, it`s a humidity sensor, but it`s probably also on TuyaMCU...
The same PCB as in the door opening sensor. I analyzed it, but did not post it on the forum:


This is a device that consists of a WiFi module (CB3S) and TuyaMCU (microcontroller). The microcontroller runs all the time and only turns on the Wifi module (its power supply) via the transistor when data needs to be sent. TuyaMCU communicates with CB3S via UART (the same one used for programming).

Look at the photo with my signatures. See two things.
1. RX and TX lines go to TuyaMCU (microcontroller in SOIC), so it interferes with programming
2. VDD line (3.3V) to the CB3S module goes through a transistor controlled by TuyaMCU, so TuyaMCU controls the CB3S power supply (so your CB3S is not even powered)

At the moment, to program it, you would have to unsolder the TuyaMCU (SOIC chip) or interrupt their paths, but this does not fully solve the problem because the protocol of this device is not supported at the moment anyway.

So anyway, you won`t fully release it for now, you`d have to wait until I add support for it, unless....

If you are willing to shorten the battery life, you can remove the TuyaMCU completely (then the UART and RX/TX lines will be free) and connect the water sensor directly to CB3S, and modify the CB3S power supply so that it is constantly present. Maybe it would work. But overall, I haven`t had this device yet.

The converter is ftdi ft232rl.
Well, it`s a pity that there is no integration, I wanted to free myself from the cloud and connect to HA. I bought three such sensors, I can send you one for testing.😁 The option without MCU is also not bad, as long as I had some data in HA.

@edwardtich Great! That's a progress.

Now, how do you reset the device while the program is waiting to "Get bus"?

The simplest solution is to do a power on/power off cycle.

i did reset and power
no result

Maybe your device is TuyaMCU or has a button on RX/TX line? Can you show photos of your device PCB and connection?

If you want, PM me. I will be happy to discuss this sensor in another topic and record a batch from it for tuya-cloudcutter so that subsequent ones can be programmed without opening the housing.
When it comes to integration, the question is basically whether, in your opinion, the version that the WiFi module is connected directly is acceptable (we throw away TuyaMCU). Something like this was done in older sensors, I have several sensors on XR809 (I transplanted one to ESP12F) and each WiFi module is constantly powered.
I would also have to take measurements to see how sensible it is, at least until there is a better solution.

Hello!

I have a smart plug using this the "BK7321N" chip model.



When I was trying to upload firmware, through python, I got stuck on the message : Unprotect Failed


In Beken Writer it said i successfully uploaded the BIN file. I could also backup and erase flash content but, even saying that there was no error, the hotspot for configuration does not appear on the wifi.

[edit] *** The Beken Writer just erased the flash, did not uploaded the new firmware*** [edit]

Is there any procedure I can try to break this chip protection?

Thanks in advance!

Added after 1 [hours] 12 [minutes]:

Made some evolution!

I changed de baud rate to 115200 and now I can iniciate the writing!

Now I tried like 50 x and it is the max that it goes.




[EDIT 2] =========

WRITE SUCCESSFUL!!

I changed the UART adapter to the CH341A, and tried different baud rate.
I got it to work at the rate of 15000. It took about 10 minutes but I got it.

Thanks!

@eazevedo88 good job, but I am wondering, is it a power-metering plug with BL0942 or BL0937 chip?
EDIT: now looking at your pictures, I am not too much suprised that lower speed helped. In general, the rule is to keep connections as short as possible, especially at higher frequencies it's crucial to avoid the noise that causes communication errors

@edwardtich sorry but I am not able to determine anything from a single photo. Can you show whole setup?
Or can you check if:
- is the device really correctly powered
- is your USB to UART converter in 3.3V mode
- is TX and RX swapped (you usually connect RX to TX and TX to RX)
- is there anything soldered to TX/RX lines, like a button, or TuyaMCU, or a resistor, that can interfere with flashing?

also, the CH340 USB to UART converter is preferred, some users reported issues with different ones

Can the RMC W302 system be modified? I have Smart sockets with these systems.

Ps. The shipment has been sent.

Is there a command list of all possible commands?

I need to set my device as a Static IP andI intend to use your project in a door sensor, but I also need you to increase the sleep time.

How can I do this?


Awesome Project! Thanks!

eazevedo88 wrote:

Is there a command list of all possible commands?

I am currently creating list of the commands in readme (then I will move it elsewhere):
https://github.com/openshwprojects/OpenBK7231T_App

eazevedo88 wrote:

I need to set my device as a Static IP andI intend to use your project in a door sensor,

Currently the best way to setup a IP reservation for device MAC on your router

eazevedo88 wrote:

but I also need you to increase the sleep time.

What do you mean by sleep time? How your device looks like?

p.kaczmarek2 wrote:

What do you mean by sleep time? How your device looks like?

I flashed this PB-69W WIFI Smart Wireless Magnetic Door and Window Sensor. (CB3S - BK7321N)

.

The original Tuya firmware puts the device in a deep sleep mode after about 10 seconds with no activities, to reduce battery consumption. Its even disconnects the Wifi.

I've already mapped the magnet sensor, but cannot find the internal led, its always on (but no problem)

P0 - Tamper alarm
P7 - Magnet Sensor
?? - Internal Led

Now, I need to increase the sleep [edit] time* [edit], or put it a deep sleep to increase the battery duration.

Hi,
I recently bought 2 switches Tuya Mini Smart Switch .
They work on CB2S. Small [40x40mm], neat, fits into the socket.
It is relatively easy to solder the pins necessary for re-flashing.
Flashing itself using hid_download_py/uartprogram is trouble-free with a little practice.
I have downloaded the original firmware [2M from 0x0] and I can post/send it if it would be useful to someone.
Many thanks to Mr. Kaczmarek2 great job on the coding and tutorials.

A final question regarding OpenBK7231N_QIO_1.12.19.bin.
I use GET methods to enable/disable. relay. Is it possible to set a static IP address in them?
Regards

Hello @ksichu, I think I recognize this switch, isn`t it some version of this?
https://www.elektroda.pl/rtvforum/topic3895572.html

The input will definitely be useful, post it here or send it as an issue on github tuya-cloudcutter with a description of what it is exactly (specific product details) so that they can create an OTA hack for this product

Fixed IP address? I didn`t deal with it from the firmware side because all you need is a MAC reservation on the router , does your router support something like this? This should probably be in the DHCP settings. Check. If not, I`ll think about the static IP...

Really similar.
I have different pin functions.
P7 - LED,
P8 - Btn,
P24 - Rel,
P26 - Btn_Tgl_All

I took firmware dumps many times and each time they differ by about 20 bytes [apparently in the same place].
IMO it`s some variable or configuration field...
I`m including a few just in case.

As for IP. My router has long since run out of reservation tables
so if it worked with static_IP, it would be great.

Regards

djlukas wrote:

Ps. The shipment has been sent.

Thanks to you, I started working on the lower power tuya mcu protocol (version 0x00, not 0x03 as in dimmers):



(I also have a copy of the batch)

We`ll see how it goes. Thanks again for your donation.

@ksichu thanks for the input, I passed it on.

@djlukas
the base works and the sensor now reports variables to HA (more precisely, TuyaMCU reports via UART to CB3S, and CB3S reports to HA via MQTT).
I found two variables:
- dpId 1 is 1 or 0 flood status
- dpId 3 is the battery status (2 full, 1 half??, I don`t know, 0 requires replacement?)



I think I still need to set the retainer, but I don`t think it has been done in HA for some time, only on the device side.

By the way, I measured power consumption with and without CB3S running:


At the moment, there is one problem that needs to be solved, namely, I have the irresistible impression that after I place the sensor in water, TuyaMCU first reports that it is actually wet, and then it seems to "change its mind" and report that it is dry. Maybe I`m interpreting the data incorrectly and/or I`ve got something mixed up, but initially I expected that TuyaMCU wouldn`t "change its mind" until I took the sensor out of the water.

It`s up to you whether you want to test this unfinished version or wait until I fix all possible problems.