BSD31 plug with dual USB charging ports BK7231 teardown

Thank you, have you also checked which BK7231 IOs are used to toggle relay and the USB? What is the real USB current capability?

I bought 3 BSD31 recently with the intention to flash Tasmota, since it is listed as a supported device: https://templates.blakadder.com/BSD31.html

However, after examine their tutorial, I realize that they are for ESP devices only. So they probably require an ESP-02S transplant. Google led me here and showed me the world of OpenBeken.

However, I simply can't get it flashed. tuya-cloudcutter failed after the 2nd device reset:

```
Loading options, please wait...

Performing safety checks to make sure all required ports are available
Checking UDP port 53... Available.
Checking UDP port 67... Available.
Checking TCP port 80... Available.
Checking TCP port 443... Available.
Checking TCP port 1883... Available.
Checking TCP port 8886... Available.
Safety checks complete.

Selected Device Slug: tuya-generic-bsd31-16a-smart-plug
Selected Profile: oem-bk7231s-rnd-switch-1.0.7-sdk-2.0.0-30.06

================================================================================
Place your device in AP (slow blink) mode. This can usually be accomplished by either:
Power cycling off/on - 3 times and wait for the device to fast-blink, then repeat 3 more times. Some devices need 4 or 5 times on each side of the pause
Long press the power/reset button on the device until it starts fast-blinking, then releasing, and then holding the power/reset button again until the device starts slow-blinking.
See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
================================================================================

common.sh: line 57: service: command not found
Scanning for open Tuya SmartLife AP
................
Found access point name: "SmartLife-832C", trying to connect...
Device 'wlan0' successfully activated with 'b13fa7c3-63f6-4a2b-94b2-6649a35d7258'.
Connected to access point.
Waiting 1 sec to allow device to set itself up...
Running initial exploit toolchain...
Exploit run, saved device config too!
output=/work/configured-devices/yAmcSkjJnVSa.deviceconfig
Saved device config in /work/configured-devices/yAmcSkjJnVSa.deviceconfig

================================================================================
Power cycle and place your device in AP (slow blink) mode again. This can usually be accomplished by either:
Power cycling off/on - 3 times and wait for the device to fast-blink, then repeat 3 more times. Some devices need 4 or 5 times on each side of the pause
Long press the power/reset button on the device until it starts fast-blinking, then releasing, and then holding the power/reset button again until the device starts slow-blinking.
See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
================================================================================

common.sh: line 57: service: command not found
Scanning for open Tuya SmartLife AP
...............
Found access point name: "SmartLife-832C", trying to connect...
Error: Connection activation failed: Secrets were required, but not provided.
common.sh: line 57: service: command not found
....................
Found access point name: "SmartLife-832C", trying to connect...
Device 'wlan0' successfully activated with 'b13fa7c3-63f6-4a2b-94b2-6649a35d7258'.
Connected to access point.
================================================================================
[!] The profile you selected did not result in a successful exploit.
================================================================================
```

So I have to flash with serial. After some soldering, I connected the device to my FTDI serial cable. BK7231 GUI Flash Tool will timeout after 100s no matter how many times I reset the device. I also tried all 3 serial baud and none of them worked. For the reference I used Xshell to check the serial output directly, and there was none.

I'm kinda stucked here. I was able to toggle the relay when the device is still enclosed, and I got another paired to Tuya Smart Life, so the haredware should be good. I'm not sure what I can do now.

Is it still the SYBK02 module or did you get something different in your BSD31’s? You may need to desolder the module from the rest of the device if you’ve not done that.

Also check the firmware version in your Tuya app of choice. The dump on cloudcutter is for version 1.0.7. Yours might be a newer firmware so a dump for a new profile would be a good addition if we can get that working.

Can you post photos of your flashing setup?