logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[BK7231N] Tuya Temperature & Humidity Monitor: Teardown, Hackability & Features Explained

TurkeyMan 10704 52
ADVERTISEMENT
Reply | New topic
  • #31 20371348
    p.kaczmarek2
    Moderator Smart Home  
    tmSensor is here:
    https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/driver/drv_tuyaMCUSensor.c
    it is supposed to send data to TuyaMCU telling MCU to do not power off the module yet and request the measurement results.

    https://developer.tuya.com/en/docs/iot/tuyacl...niversalserialaccessprotocol?id=K95afs9h4tjjh

    It was tested with TuyaMCU door and flood sensors.

    We might need to compare if the packets from original firmware are the same as the ones in the code...
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #32 20372249
    TurkeyMan
    Level 3  
    I don't have the original firmware, but my captures from before should have captured those requests, assuming they are always present.
    I think a UART logger would really help; now that it's running OBK, I don't really see the point of hard-wiring and externally scraping UART data, the "UART Tool" should have a raw mode to just dump all TX and RX bytes as hex to an output area... is it possible? I wonder if you can hook the low-level UART functions (which may be used by other libraries/drivers) and intercept the bytes before passing them forward?
    Is the UART interface an SO? Dynamically linked? Can be overridden with your own interception shim? Or perhaps the low level API already supports an intercept feature?
  • #33 20398854
    djbenson
    Level 3  
    Is there any way to get these devices into AP mode or can they only be flased using a cable?

    EDIT: the answer is "yes" - I have no idea how I did it, just kept pressing the button and the WiFi logo switched from a slow cycle through the levels of the icon to a blink - it looks to me like it flashed successfully but the Openbeken SSID isn't showing up.

    Code: text Expand Select all Copy to clipboard
    
==> Toggle Tuya device's power off and on again 6 times, with ~1 sec pauses in between, to enable AP mode. Repeat if your device's SSID doesn't show up within ~30 seconds. For smart plugs long press the reset button on the device for about 5 seconds. See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
Scanning for open Tuya SmartLife AP
......................................................................................................................................................
Found access point name: "SmartLife-E14C", trying to connect..
Device 'wlan0' successfully activated with '9a41bf73-fb77-413d-acfa-d46987756de1'.
Connected to access point.
Waiting 1 sec to allow device to set itself up..
Running initial exploit toolchain..
Exploit run, saved device config to!
output=/work/configured-devices/nWWRvwMi9Pjx.deviceconfig
Saved device config in /work/configured-devices/nWWRvwMi9Pjx.deviceconfig
==> Turn the device off and on again once. Repeat 6 more times if your device's SSID doesn't show up within ~5 seconds. For smart plugs long press the reset button on the device for about 5 seconds. See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
Scanning for open Tuya SmartLife AP
..
Found access point name: "SmartLife-E14C", trying to connect..
Error: Connection activation failed: (53) The Wi-Fi network could not be found.
...
Found access point name: "A-E14C", trying to connect..
Device 'wlan0' successfully activated with '9edb58ad-049e-4401-a24e-ac8a6b592c4b'.
Connected to access point.
Configured device to connect to 'cloudcutterflash'
Device is connecting to 'cloudcutterflash' access point. Passphrase for the AP is 'abcdabcd' (without ')
Flashing custom firmware ..
==> Wait for 20-30 seconds for the device to connect to 'cloudcutterflash'. This script will then show the firmware upgrade requests sent by the device.
Using WLAN adapter: wlan0
Jan 22 11:41:20 dnsmasq[15]: started, version 2.80 cachesize 150
Jan 22 11:41:20 dnsmasq[15]: compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth DNSSEC loop-detect inotify dumpfile
Jan 22 11:41:20 dnsmasq-dhcp[15]: DHCP, IP range 10.42.42.10 -- 10.42.42.40, lease time 12h
Jan 22 11:41:20 dnsmasq-dhcp[15]: DHCP, sockets bound exclusively to interface wlan0
Jan 22 11:41:20 dnsmasq[15]: read /etc/hosts - 5 addresses
Configuration file: /dev/stdin
Using interface wlan0 with hwaddr b4:b0:24:e7:a4:5f and ssid "cloudcutterflash"
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED 
Jan 22 11:41:27 dnsmasq-dhcp[15]: 1589176993 available DHCP range: 10.42.42.10 -- 10.42.42.40
Jan 22 11:41:27 dnsmasq-dhcp[15]: 1589176993 client provides name: wlan0
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 DHCPDISCOVER(wlan0) a0:92:08:9a:e1:4c 
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 tags: wlan0
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 DHCPOFFER(wlan0) 10.42.42.10 a0:92:08:9a:e1:4c 
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 requested options: 1:netmask, 3:router, 28:broadcast, 6:dns-server
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 next server: 10.42.42.1
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  1 option: 53 message-type  2
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 54 server-identifier  10.42.42.1
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 51 lease-time  12h
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 58 T1  6h
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 59 T2  10h30m
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option:  1 netmask  255.255.255.0
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 28 broadcast  10.42.42.255
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option:  3 router  10.42.42.1
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option:  6 dns-server  10.42.42.1
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 available DHCP range: 10.42.42.10 -- 10.42.42.40
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 client provides name: wlan0
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 DHCPDISCOVER(wlan0) a0:92:08:9a:e1:4c 
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 tags: wlan0
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 DHCPOFFER(wlan0) 10.42.42.10 a0:92:08:9a:e1:4c 
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 requested options: 1:netmask, 3:router, 28:broadcast, 6:dns-server
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 next server: 10.42.42.1
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  1 option: 53 message-type  2
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 54 server-identifier  10.42.42.1
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 51 lease-time  12h
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 58 T1  6h
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 59 T2  10h30m
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option:  1 netmask  255.255.255.0
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 28 broadcast  10.42.42.255
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option:  3 router  10.42.42.1
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option:  6 dns-server  10.42.42.1
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 available DHCP range: 10.42.42.10 -- 10.42.42.40
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 client provides name: wlan0
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 DHCPREQUEST(wlan0) 10.42.42.10 a0:92:08:9a:e1:4c 
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 tags: wlan0
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 DHCPACK(wlan0) 10.42.42.10 a0:92:08:9a:e1:4c wlan0
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 requested options: 1:netmask, 3:router, 28:broadcast, 6:dns-server
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 next server: 10.42.42.1
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  1 option: 53 message-type  5
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 54 server-identifier  10.42.42.1
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 51 lease-time  12h
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 58 T1  6h
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 59 T2  10h30m
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option:  1 netmask  255.255.255.0
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option: 28 broadcast  10.42.42.255
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option:  3 router  10.42.42.1
Jan 22 11:41:30 dnsmasq-dhcp[15]: 1589176993 sent size:  4 option:  6 dns-server  10.42.42.1
Jan 22 11:41:49 dnsmasq[15]: query[A] h3.iot-dns.com from 10.42.42.10
Jan 22 11:41:49 dnsmasq[15]: config h3.iot-dns.com is 10.42.42.1
Using PSK v1 - Received PSK ID version 01
[LOG (Client)] Request: HTTPServerRequest(protocol='https', host='h3.iot-dns.com', method='POST', uri='/v2/url_config', version='HTTP/1.1', remote_ip='10.42.42.10')
[LOG (Client)] ==== Request body ===
b'{"region":"AA","env":"","uuid":"nWWRvwMi9Pjx","ts":51,"sign":"Og3QmnRQVKwvuP4IP+HtXww4cQwHykmnhG2nqyiO4gs=","config":[{"key":"httpUrl","need_ca":false},{"key":"mqttUrl","need_ca":false},{"key":"httpsPSKUrl","need_ca":false},{"key":"mqttsPSKUrl","need_ca":false}]}'
[LOG (Client)] ==== End request body ===
[LOG (Server)] Response:  {"caArr":null,"httpUrl":{"addr":"http://10.42.42.1/d.json","ips":["10.42.42.1"]},"mqttUrl":{"addr":"10.42.42.1:1883","ips":["10.42.42.1"]},"ttl":600}
[I 230122 11:41:50 web:2271] 200 POST /v2/url_config (10.42.42.10) 97.29ms
[LOG (Client)] Request: HTTPServerRequest(protocol='http', host='10.42.42.1', method='POST', uri='/d.json?a=tuya.device.active&et=1&t=52&uuid=nWWRvwMi9Pjx&v=4.4&sign=67d820ecb1afce3158e6d8556eb4465d', version='HTTP/1.1', remote_ip='10.42.42.10')
[LOG (Client)] ==== Request body ===
{'token': 'AAAAAA', 'softVer': '1.0.10', 'productKey': 'yqiqbaldtr0i7mru', 'protocolVer': '2.2', 'baselineVer': '40.00', 'productKeyStr': 'keyr5qhaxgstx9ys', 'devId': 'bfe5a90124941e152a5v2z', 'hid': 'a092089ae14c', 'modules': '[{"otaChannel":9,"softVer":"1.1.6","online":true}]', 'devAttribute': 579, 'cadVer': '1.0.3', 'cdVer': '1.0.0', 'options': '{"isFK":false,"otaChannel":0}', 't': 52}
[LOG (Client)] ==== End request body ===
[LOG (Server)] Response:  {'result': {'schema': '[{"trigger":"direct","type":"obj","mode":"ro","property":{"range":["alarm","normal"],"type":"enum"},"id":1},{"type":"obj","mode":"ro","property":{"range":["low","middle","high"],"type":"enum"},"id":3}]', 'devId': 'NCh1AQO2ZT2gUeGiM35C', 'resetFactory': False, 'timeZone': '+02:00', 'capability': 1025, 'secKey': 'YOWlMWCwWg1UjKrG', 'stdTimeZone': '+01:00', 'schemaId': '000003ald7', 'dstIntervals': [], 'localKey': 'piUJdvmwj7U7rC6C'}, 'success': True, 't': 1674387710}
[I 230122 11:41:50 web:2271] 200 POST /d.json?a=tuya.device.active&et=1&t=52&uuid=nWWRvwMi9Pjx&v=4.4&sign=67d820ecb1afce3158e6d8556eb4465d (10.42.42.10) 102.73ms
[LOG (Client)] Request: HTTPServerRequest(protocol='http', host='10.42.42.1', method='POST', uri='/d.json?a=tuya.device.dynamic.config.get&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387710&v=2.0&sign=97bb2b5faf7ea220136d914eb8852a67', version='HTTP/1.1', remote_ip='10.42.42.10')
[LOG (Client)] ==== Request body ===
{'type': '["timezone"]', 't': 1674387710}
[LOG (Client)] ==== End request body ===
[LOG (Server)] Response:  {'result': {'ackId': '0-0', 'validTime': 1800, 'time': 1674387711, 'config': {'stdTimeZone': '+01:00', 'dstIntervals': [[1648342800, 1667091600], [1679792400, 1698541200]]}, 'timezone': {'ackId': '0-0', 'validTime': 1800, 'time': 1674387711, 'config': {'stdTimeZone': '+01:00', 'dstIntervals': [[1648342800, 1667091600], [1679792400, 1698541200]]}}}, 't': 1674387711, 'success': True}
[I 230122 11:41:51 web:2271] 200 POST /d.json?a=tuya.device.dynamic.config.get&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387710&v=2.0&sign=97bb2b5faf7ea220136d914eb8852a67 (10.42.42.10) 109.93ms
[LOG (Client)] Request: HTTPServerRequest(protocol='http', host='10.42.42.1', method='POST', uri='/d.json?a=tuya.device.dynamic.config.get&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387713&v=2.0&sign=975ebe6857ade7acea0e34237f856d33', version='HTTP/1.1', remote_ip='10.42.42.10')
[LOG (Client)] ==== Request body ===
{'type': '["timezone","rateRule"]', 't': 1674387713}
[LOG (Client)] ==== End request body ===
[LOG (Server)] Response:  {'result': {'ackId': '0-0', 'validTime': 1800, 'time': 1674387714, 'config': {'stdTimeZone': '+01:00', 'dstIntervals': [[1648342800, 1667091600], [1679792400, 1698541200]]}, 'timezone': {'ackId': '0-0', 'validTime': 1800, 'time': 1674387714, 'config': {'stdTimeZone': '+01:00', 'dstIntervals': [[1648342800, 1667091600], [1679792400, 1698541200]]}}}, 't': 1674387714, 'success': True}
[I 230122 11:41:54 web:2271] 200 POST /d.json?a=tuya.device.dynamic.config.get&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387713&v=2.0&sign=975ebe6857ade7acea0e34237f856d33 (10.42.42.10) 130.56ms
[LOG (Client)] Request: HTTPServerRequest(protocol='http', host='10.42.42.1', method='POST', uri='/d.json?a=tuya.device.uuid.pskkey.get&et=1&t=1674387713&uuid=nWWRvwMi9Pjx&v=1.0&sign=d7f4ebb023dd240ae7e24ee8846ee4ee', version='HTTP/1.1', remote_ip='10.42.42.10')
[LOG (Client)] ==== Request body ===
{'t': 1674387713}
[LOG (Client)] ==== End request body ===
[LOG (Server)] Response:  {'result': {'pskKey': ''}, 't': 1674387714, 'success': True}
[I 230122 11:41:54 web:2271] 200 POST /d.json?a=tuya.device.uuid.pskkey.get&et=1&t=1674387713&uuid=nWWRvwMi9Pjx&v=1.0&sign=d7f4ebb023dd240ae7e24ee8846ee4ee (10.42.42.10) 87.42ms
[LOG (Client)] Request: HTTPServerRequest(protocol='http', host='10.42.42.1', method='POST', uri='/d.json?a=tuya.device.dynamic.config.ack&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387714&v=2.0&sign=67d85507dfbf4c383bb0fef94d139fb9', version='HTTP/1.1', remote_ip='10.42.42.10')
[LOG (Client)] ==== Request body ===
{'ackList': [{'type': 'timezone', 'ackId': '0-0'}], 't': 1674387714}
[LOG (Client)] ==== End request body ===
[LOG (Server)] Response:  {'t': 1674387714, 'success': True}
[I 230122 11:41:54 web:2271] 200 POST /d.json?a=tuya.device.dynamic.config.ack&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387714&v=2.0&sign=67d85507dfbf4c383bb0fef94d139fb9 (10.42.42.10) 101.52ms
Sending firmware update message {"data":{"firmwareType":0},"protocol":15,"t":1674387716} using protocol 2.2
Firmware update messages triggered. Device will download and reset. Exiting in 30 seconds.
[LOG (Client)] Request: HTTPServerRequest(protocol='http', host='10.42.42.1', method='POST', uri='/d.json?a=tuya.device.upgrade.get&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387715&v=4.4&sign=85cec61ef67a49d6280ff239996da08a', version='HTTP/1.1', remote_ip='10.42.42.10')
[LOG (Client)] ==== Request body ===
{'type': 0, 't': 1674387715}
[LOG (Client)] ==== End request body ===
[LOG (Server)] Response:  {'result': {'url': 'http://10.42.42.1:80/files/OpenBK7231N_UG_1.15.344.bin', 'hmac': 'B42E38CD069618E5F8A0D5BCA9C8B0C997DBD349BCC1083F03CEC781577C3933', 'version': '9.0.0', 'size': '610640', 'type': 0}, 'success': True, 't': 1674387717}
[I 230122 11:41:57 web:2271] 200 POST /d.json?a=tuya.device.upgrade.get&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387715&v=4.4&sign=85cec61ef67a49d6280ff239996da08a (10.42.42.10) 117.32ms
[LOG (Client)] Request: HTTPServerRequest(protocol='http', host='10.42.42.1', method='POST', uri='/d.json?a=tuya.device.upgrade.status.update&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387717&v=4.1&sign=acd94108e83b55f62b63975ae73ad6ff', version='HTTP/1.1', remote_ip='10.42.42.10')
[LOG (Client)] ==== Request body ===
{'type': 0, 'upgradeStatus': 2, 't': 1674387717}
[LOG (Client)] ==== End request body ===
!!! Endpoint default response not found - tuya.device.upgrade.status.update
[LOG (Server)] Response:  {'success': True, 't': 1674387717}
[I 230122 11:41:57 web:2271] 200 POST /d.json?a=tuya.device.upgrade.status.update&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387717&v=4.1&sign=acd94108e83b55f62b63975ae73ad6ff (10.42.42.10) 101.77ms
Sending firmware update message {"data":{"firmwareType":0},"protocol":15,"t":1674387719} using protocol 2.2
Firmware update messages triggered. Device will download and reset. Exiting in 30 seconds.
[LOG (Client)] Request: HTTPServerRequest(protocol='http', host='10.42.42.1', method='POST', uri='/d.json?a=tuya.device.upgrade.get&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387718&v=4.4&sign=0eab500eb4cdb29cd2768ed8565297c1', version='HTTP/1.1', remote_ip='10.42.42.10')
[LOG (Client)] ==== Request body ===
{'type': 0, 't': 1674387718}
[LOG (Client)] ==== End request body ===
[LOG (Server)] Response:  {'result': {'url': 'http://10.42.42.1:80/files/OpenBK7231N_UG_1.15.344.bin', 'hmac': 'B42E38CD069618E5F8A0D5BCA9C8B0C997DBD349BCC1083F03CEC781577C3933', 'version': '9.0.0', 'size': '610640', 'type': 0}, 'success': True, 't': 1674387719}
[I 230122 11:41:59 web:2271] 200 POST /d.json?a=tuya.device.upgrade.get&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387718&v=4.4&sign=0eab500eb4cdb29cd2768ed8565297c1 (10.42.42.10) 24.41ms
[I 230122 11:41:59 web:2271] 200 GET /files/OpenBK7231N_UG_1.15.344.bin (10.42.42.10) 2204.27ms
[DEVICE OTA] Responding to device OTA HTTP request range: bytes=0-610639/610640
[I 230122 11:42:04 web:2271] 206 GET /files/OpenBK7231N_UG_1.15.344.bin (10.42.42.10) 125.17ms
[DEVICE OTA] Responding to device OTA HTTP request range: bytes=56864-610639/610640
[LOG (Client)] Request: HTTPServerRequest(protocol='http', host='10.42.42.1', method='POST', uri='/d.json?a=tuya.device.upgrade.silent.get&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387726&v=4.4&sign=e21c4eb62866e1f82414dd3435570f39', version='HTTP/1.1', remote_ip='10.42.42.10')
[LOG (Client)] ==== Request body ===
{'subId': None, 't': 1674387726}
[LOG (Client)] ==== End request body ===
[LOG (Server)] Response:  {'result': {'url': 'http://10.42.42.1:80/files/OpenBK7231N_UG_1.15.344.bin', 'hmac': 'B42E38CD069618E5F8A0D5BCA9C8B0C997DBD349BCC1083F03CEC781577C3933', 'version': '9.0.0', 'size': '610640', 'type': 0}, 'success': True, 't': 1674387726}
[I 230122 11:42:06 web:2271] 200 POST /d.json?a=tuya.device.upgrade.silent.get&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387726&v=4.4&sign=e21c4eb62866e1f82414dd3435570f39 (10.42.42.10) 110.77ms
[LOG (Client)] Request: HTTPServerRequest(protocol='http', host='10.42.42.1', method='POST', uri='/d.json?a=tuya.device.timer.count&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387726&v=4.0&sign=b04902b97bd110f7e0441e5e12f47ed7', version='HTTP/1.1', remote_ip='10.42.42.10')
[LOG (Client)] ==== Request body ===
{'devId': 'NCh1AQO2ZT2gUeGiM35C', 'lastFetchTime': '0', 't': 1674387726}
[LOG (Client)] ==== End request body ===
[LOG (Server)] Response:  {'result': {'devId': 'NCh1AQO2ZT2gUeGiM35C', 'count': 0, 'lastFetchTime': 0}, 't': 1674387727, 'success': True}
[I 230122 11:42:07 web:2271] 200 POST /d.json?a=tuya.device.timer.count&devId=NCh1AQO2ZT2gUeGiM35C&et=1&t=1674387726&v=4.0&sign=b04902b97bd110f7e0441e5e12f47ed7 (10.42.42.10) 101.19ms
[I 230122 11:42:10 web:2271] 206 GET /files/OpenBK7231N_UG_1.15.344.bin (10.42.42.10) 131.92ms
[DEVICE OTA] Responding to device OTA HTTP request range: bytes=56864-610639/610640
[I 230122 11:42:14 web:2271] 206 GET /files/OpenBK7231N_UG_1.15.344.bin (10.42.42.10) 136.58ms
[DEVICE OTA] Responding to device OTA HTTP request range: bytes=56864-610639/610640
[I 230122 11:42:20 web:2271] 206 GET /files/OpenBK7231N_UG_1.15.344.bin (10.42.42.10) 227.88ms
[DEVICE OTA] Responding to device OTA HTTP request range: bytes=56864-610639/610640
[I 230122 11:42:25 web:2271] 206 GET /files/OpenBK7231N_UG_1.15.344.bin (10.42.42.10) 229.53ms
[DEVICE OTA] Responding to device OTA HTTP request range: bytes=56864-610639/610640


    EDIT2: I don't think the device is downloading the firmware.
  • #34 20424864
    BWare123
    Level 2  
    I've been playing with a similar device (https://aliexpress.com/item/1005003894428378.html), although it has the BK7231T chipset.

    After flashing the Openbeken firmware with tuya-cloudcutter it took some fiddling to get it to do what it is supposed to do. However, I ran into several issues:
    - Using the webapp to create an autoexec.bat and reboot the device does not seem to result in drivers being loaded
    Workaround was to use the 'change startup command' to run:
    Code: text Expand Select all Copy to clipboard
    backlog startDriver NTP; exec autoexec.bat ; startDriver tmSensor
    (this shows 3 drivers being loaded: NTP, TuyaMCU and tmSensor).
    - After configuring MQTT to connect to the mosquitto mqtt server (I see the device entries being created), attempting to perform a HomeAssistant discovery fails with the message 'No relay, PWM, sensor or power driver running. MQTT discovery queued.'
    - The weekday is not set by 'tuyaMcu_sendCurTime' (It is set to Friday on boot)
    - The WiFi logo does not represent the state of the wifi connection (expected as much, but would be nice to have)

    autoexec.bat:
    Code: text Expand Select all Copy to clipboard
    startDriver NTP
startDriver TuyaMCU
startDriver tmSensor
// set NTP server
ntp_setServer 192.168.1.1
ntp_timeZoneOfs 1
// enable tmSensor
startDriver tmSensor
// dpID 1 is temperature div 10
setChannelType 1 temperature_div10
linkTuyaMCUOutputToChannel 1 val 1
// dpID 2 is % humidity
setChannelType 2 Humidity
linkTuyaMCUOutputToChannel 2 val 2
tuyaMcu_sendCurTime


    In the log console I see the following:
    Code: text Expand Select all Copy to clipboard
    
Info:TuyaMCU:TUYAMCU received: 55 AA 03 00 00 01 01 04 
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 0 (Heartbeat) with 8 bytes
Info:TuyaMCU:TUYAMCU received: 55 AA 03 00 00 00 26 
Info:TuyaMCU:TuyaMCU_ProcessIncoming: discarding packet bad expected checksum, expected 38 and got checksum 2

// Temperature and Humidity values:
Info:TuyaMCU:TUYAMCU received: 55 AA 03 07 00 08 01 02 00 04 00 00 00 C8 E0 
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 7 (State) with 15 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 1, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 4 int: 200
Info:TuyaMCU:TUYAMCU received: 55 AA 03 07 00 08 02 02 00 04 00 00 00 3F 58 
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 7 (State) with 15 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 2, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 4 int: 63

Info:TuyaMCU:TUYAMCU received: 55 AA 03 00 00 01 01 04 
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 0 (Heartbeat) with 8 bytes
Info:TuyaMCU:TUYAMCU received: 55 AA 03 24 00 00 26 
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 36 (Unknown) with 7 bytes
Info:TuyaMCU:TuyaMCU_ProcessIncoming: (test for TH06 calendar) received 0x24, so sending back time
Info:TuyaMCU:MCU time to set: 1675683607
Info:TuyaMCU:ptime ->gmtime => tm_hour: 11
Info:TuyaMCU:ptime ->gmtime => tm_min: 40
  • #35 20424927
    p.kaczmarek2
    Moderator Smart Home  
    My first advice would be to remove
    Code: text Expand Select all Copy to clipboard
    
tuyaMcu_sendCurTime

    from your script. It does nothing, this script is only ran on boot, and you can clearly see that time is sent to device automatically when device requests it:
    Code: text Expand Select all Copy to clipboard
    
Info:TuyaMCU:TuyaMCU_ProcessIncoming: (test for TH06 calendar) received 0x24, so sending back time


    This:
    Code: text Expand Select all Copy to clipboard
    
- After configuring MQTT to connect to the mosquitto mqtt server (I see the device entries being created), attempting to perform a HomeAssistant discovery fails with the message 'No relay, PWM, sensor or power driver running.MQTT discovery queued.'

    is actually normal, we don't have discovery yet for custom tuyaMCU devices, but I can look into that.

    This:
    Code: text Expand Select all Copy to clipboard
    
- Using the webapp to create an autoexec.bat and reboot the device does not seem to result in drivers being loaded

    is very strange, I will check this out on my BK7231 device.... but maybe you just went into safe mode accidentally and autoexec didn't run? Device will ignore autoexec when rebooted quickly several times. The "correct boot" delay by default is 30 seconds, you can alter it in options.

    Code: text Expand Select all Copy to clipboard
    
- The WiFi logo does not represent the state of the wifi connection (expected as much, but would be nice to have)

    Which WiFi logo? LED on device?

    Code: text Expand Select all Copy to clipboard
    
- The weekday is not set by 'tuyaMcu_sendCurTime' (It is set to Friday on boot)

    Are you sure? We just had a report also from user of TuyaMCU device, did a little weekday fix and it was reported that weekday works correctly:
    https://github.com/openshwprojects/OpenBK7231T_App/issues/649
    is your version from before the time of linked fix? It was fixed 2 days ago. Bug was up to 1.15.305.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #36 20424980
    BWare123
    Level 2  
    p.kaczmarek2 wrote:
    My first advice would be to remove
    Code: text Expand Select all Copy to clipboard
    
tuyaMcu_sendCurTime

    from your script. It does nothing, this script is only ran on boot, and you can clearly see that time is sent to device automatically when device requests it:
    Code: text Expand Select all Copy to clipboard
    
Info:TuyaMCU:TuyaMCU_ProcessIncoming: (test for TH06 calendar) received 0x24, so sending back time


    I removed the line from the autoexec.bat.

    p.kaczmarek2 wrote:

    This:
    Code: text Expand Select all Copy to clipboard
    
- After configuring MQTT to connect to the mosquitto mqtt server (I see the device entries being created), attempting to perform a HomeAssistant discovery fails with the message 'No relay, PWM, sensor or power driver running.MQTT discovery queued.'

    is actually normal, we don't have discovery yet for custom tuyaMCU devices, but I can look into that.

    Is there an alternative method to configure/read the device?

    p.kaczmarek2 wrote:

    This:
    Code: text Expand Select all Copy to clipboard
    
- Using the webapp to create an autoexec.bat and reboot the device does not seem to result in drivers being loaded

    is very strange, I will check this out on my BK7231 device.... but maybe you just went into safe mode accidentally and autoexec didn't run? Device will ignore autoexec when rebooted quickly several times. The "correct boot" delay by default is 30 seconds, you can alter it in options.

    As I mentioned, I removed the 'sendCurTime' command from the file and modified the startup command to simply read 'exec autoexec.bat'. This results in only the TuyaMCU driver being loaded. From the log it seems that there are some issues parsing the autoexec.bat:
    Code: text Expand Select all Copy to clipboard
    
Info:MAIN:Module reboot in 1...
CMD:cmd 2 NOT found (args )
Error:CMD:cmd val NOT found (args )
Error:CMD:cmd 2 NOT found (args )
Info:CMD:Requires driver name
Error:CMD:cmd NTP NOT found (args )
Info:MAIN:Drv TuyaMCU is already loaded.
Info:CMD:Requires driver name
Error:CMD:cmd tmSensor NOT found (args )
Error:CMD:cmd ntp_setServer NOT found (args 192.168.107.1)
Error:CMD:cmd ntp_timeZoneOfs NOT found (args 1)
Error:CMD:cmd dpID NOT found (args )
Error:CMD:cmd 1 NOT found (args )
Error:CMD:cmd is NOT found (args )
Error:CMD:cmd tempererature NOT found (args )
Error:CMD:cmd div NOT found (args )
Error:CMD:cmd 10 NOT found (args )
Info:GEN:This command requires 2 arguments
Error:CMD:cmd 1 NOT found (args )
Error:CMD:cmd temperature_div10 NOT found (args )
Info:TuyaMCU:TuyaMCU_LinkTuyaMCUOutputToChannel: requires 3 arguments (dpId, dpType, channelIndex)
Error:CMD:cmd 1 NOT found (args )
Error:CMD:cmd val NOT found (args )
Error:CMD:cmd 1 NOT found (args )
Error:CMD:cmd dpID NOT found (args )
Error:CMD:cmd 2 NOT found (args )
Error:CMD:cmd is NOT found (args )
Error:CMD:cmd % NOT found (args )
Error:CMD:cmd humidity NOT found (args )
Info:GEN:This command requires 2 arguments
Error:CMD:cmd 2 NOT found (args )
Error:CMD:cmd Humidity NOT found (args )
Info:TuyaMCU:TuyaMCU_LinkTuyaMCUOutputToChannel: requires 3 arguments (dpId, dpType, channelIndex)
Error:CMD:cmd 2 NOT found (args )
Error:CMD:cmd val NOT found (args )
Error:CMD:cmd 2 NOT found (args )
Info:MAIN:Main_Init_After_Delay done


    The autoexec.bat now reads:
    Code: text Expand Select all Copy to clipboard
    
startDriver NTP
startDriver TuyaMCU
startDriver tmSensor
// set NTP server
ntp_setServer 192.168.107.1
ntp_timeZoneOfs 1
// dpID 1 is tempererature div 10
setChannelType 1 temperature_div10
linkTuyaMCUOutputToChannel 1 val 1
// dpID 2 is % humidity
setChannelType 2 Humidity
linkTuyaMCUOutputToChannel 2 val 2


    p.kaczmarek2 wrote:

    Code: text Expand Select all Copy to clipboard
    
- The WiFi logo does not represent the state of the wifi connection (expected as much, but would be nice to have)

    Which WiFi logo? LED on device?

    The Icon in the upper right corner of the screen.

    p.kaczmarek2 wrote:

    Code: text Expand Select all Copy to clipboard
    
- The weekday is not set by 'tuyaMcu_sendCurTime' (It is set to Friday on boot)

    Are you sure? We just had a report also from user of TuyaMCU device, did a little weekday fix and it was reported that weekday works correctly:
    https://github.com/openshwprojects/OpenBK7231T_App/issues/649
    is your version from before the time of linked fix? It was fixed 2 days ago. Bug was up to 1.15.305.

    Apologies, it seems I should look at the screen more often. The weekday is correctly set in the newer firmware.
  • #37 20532533
    mkmunichmk
    Level 7  
    Hi, I´m new to this forum and very interested. As I have a device out of the box with the original firmware, I could help to provide it. Unfortunately it is not yet clear to me how to access the device. There are three connectors labeled P1, P2 and P3. My device has no further labeling printed nearby P2 like your device (VCC, GND, RX and TX). I hope, it is the same wiring as your device.

    I am lost with picture gallery-14&15. Can I assume, that it just shows, how P2 is wired (by PCB) to IC3 and Q1? How did you finally manage it, that CB3S is permanently powered as directly power VCC to CB3S seems not to work? Was it successful after desoldering R3, R4 (as you wrote)? Means, to retrieve the original firmware I'll need to desolder R3, R4 in advance and then use which (Windows) program? Could someone provide the link to the program & online help? This would be great. Happy eastern and Best Regards
  • #38 20532697
    p.kaczmarek2
    Moderator Smart Home  
    Please provide good quality photos of your device.

    Here's flasher:
    https://github.com/openshwprojects/BK7231GUIFlashTool
    Here are guides:
    https://www.youtube.com/@elektrodacom
    Here is firmware repository:
    https://github.com/openshwprojects/OpenBK7231T_App

    There are two main tasks you need to do to flash this device:
    1. check is this device using TuyaMCu to power on/off WiFi module (is WiFi module VDD connected through a transistor?)
    2. check how to access RX/TX port (RXD1/TXD1) of WiFI module (TuyaMCU is most likely blocking it, in case of some devices you can just desolder resistors, in case of other devices you need to cut traces)

    It's hard to say more without any photos.

    I have a TH06 humidity & temperature LCD monitor but a USB powered one, where CB3S is by default always powered, and it works for me on OpenBeken, I don't know if battery one will work out of the box, maybe it will need some more debugging and work on the firmware.
    Helpful post? Buy me a coffee.
  • #39 20533604
    mkmunichmk
    Level 7  
    Hi,
    my device is nearly the same as in this post; except the labeling of P2.
    New picture attached. As the devices are not quite 'readable' I took a lens and wrote down all parts:
    [BK7231N] Tuya Temperature & Humidity Monitor: Teardown, Hackability & Features Explained
    R1 105
    R2 102
    R3 101
    R4 101
    R5 104
    R6 332
    R7 332
    R8 102
    R9 -
    R10 101
    R11 101
    R12 104
    R13 104
    R14 474
    R15 474
    R16 101
    R19 472
    R20 472

    few C1..C6
    C7 J476

    Q1 MOSFET KFH 848
    IC1 CB3S-C
    IC2 LCD Driver GNV 1792S (71J62)
    IC5 Level converter MOSFET? 65X5
    UM IC3 UMIC UM8005 A786854-1 2125 (Ultra-low power consumption 8-bit MCU: 1T8051, 32KB eFlash, 2KB 256B SRAM, 12-bit ADC)
    IC20 AHT20 Temperature & Humidity Sensor (AHT20 210602)
  • #40 20533615
    p.kaczmarek2
    Moderator Smart Home  
    Your photo is a small device picture on big black background.

    I struggle to see anything there, but it indeed looks like CB3S connects to the MCU via TuyaMCU protocol and there are R3 and R4 resistors on the UART lines.

    You won't be able to change the firmware without desoldering those resistors temporary and then soldering them back.

    The next problem is that this device doesn't have a ready configuration yet. We would need to work together to figure out the config.

    This device is also problematic because MCU seems to control the power of CB3S and can turn on/off it at will, so basically WiFi will go offline when MCU feels like it.

    We can try to use @TurkeyMan UART capture to figure something out...
    Helpful post? Buy me a coffee.
  • #41 20534675
    mkmunichmk
    Level 7  
    Hi, I'll manage it (hopefully) to desolder R3 R3. Thanks to the hint to resolder them afterwards (I guess afterwards, when reflushed). For my understanding... Is the final goal to replace the MCU firmware and/or just the firmware of the module CB3S? Maybe, that the MCU firmware can remain, as it works (as designed) including powering on/off the CB3S and distributing the measured values from time to time. My wish is, that the WiFi communication is 'free', that means not phoning home to tuya. If the new CB3S firmware would offer a way to update its firmware OTA, then I can resolder R3 R4 immediately. However, please let me know, what you need and I'll try to provide it. Many thanks in advance.
  • #42 20548612
    gabrielklein
    Level 1  
    My device looks quite similar AS90_W - It died after a firmware update, it's why I try to "revive it"

    [BK7231N] Tuya Temperature & Humidity Monitor: Teardown, Hackability & Features Explained [BK7231N] Tuya Temperature & Humidity Monitor: Teardown, Hackability & Features Explained [BK7231N] Tuya Temperature & Humidity Monitor: Teardown, Hackability & Features Explained [BK7231N] Tuya Temperature & Humidity Monitor: Teardown, Hackability & Features Explained [BK7231N] Tuya Temperature & Humidity Monitor: Teardown, Hackability & Features Explained
  • #43 20548730
    mkmunichmk
    Level 7  
    >>20533615
    Hi p.kaczmarek2,
    meanwhile I desoldered R3&R4 connected Gnd RX and TX to the CB3S and was successfully saving&flashing the firmware OpenBK7231N_QIO_1.17.10.bin Please find the log in the attachments.
    Resoldering R3/R4 took me a while - these SMDs are so small... Next time I would fix them on the pcb with a heat resistant glue before soldering them.
    Before flashing I recorded the serial communication using the original Tuya firmware and commented a few commands between MCU and CB3S. I put this in the attachments as well.
    Finally I reassembled the temperature/humidity/clock device - all seems fine.

    Next, I'll try to connect WiFi. Up to now, I did not see any SID from my device yet :-( I'll need further information & investigation.
    Back to powering the CB3S, which is done by MCU. I have a question: As the MCU firmware is not changed, does OpenBK7231N_QIO_1.17.10.bin support everything from https://developer.tuya.com/en/docs/iot/tuyacl...niversalserialaccessprotocol?id=K95afs9h4tjjh ?
    Maybe it would be an option, that the CB3S firmware uses one of its output pins to control its power (of course this would be a HW hack) ?

    Best regards
    MkMunichMk
    Attachments:
  • #44 20550090
    mkmunichmk
    Level 7  
    Meanwhile I saw my device going into WiFi station mode with SID "OpenBK7231N_"+MAC-address.
    Unfortunately the device is seen just a few seconds - no chance to connect :-(

    @p.kaczmarek2 Could it be, that the CB3S must send some messages to MCU in order to keep to be powered on?

    I'm developing my own UART sniffer in order to save the communication of two COM ports (TX and RX of the CB3S) in parallel incl. timing.
    I searched a lot in www and could not find any fitting tool, so... :-)
  • ADVERTISEMENT
  • #45 20555460
    Legomannetje
    Level 1  
    I'm trying to convert the device, but is the screen working? If not, is there anything I can do to help you with this?
  • ADVERTISEMENT
  • #46 20556486
    mkmunichmk
    Level 7  
    Legomannetje wrote:
    convert
    Thanks for the reply. What do you mean by 'convert'?
    In my case, the reassembled clock/temp/humidity device is fully working as before. Means Temperature, Humidity and clock are displayed. The clock is counting up, but without WiFi, the time cannot be set. The device's LCD screen looks as before.

    I still have problems getting the CB3S a longer time into WiFi STAtion mode. Currently, the time is too short to get connected from my mobile to the CB3S. It is too quickly powered off (by MCU). I strongly guess that there is some missing OPENBK communication from CB3S towards MCU that is telling the MCU not to switch off the CB3S WiFi chip.
    Getting a hint, where to find this CB3S to MCU communication part in the OPENBK source code, would allow me to dig into it.

    P.S. without having the possibility to set the time the clock is useless :-(
  • #47 20640524
    mkmunichmk
    Level 7  
    I just connected the 4 wires of the serial USB adapter directly to the module CB3S:
    8 VCC P Power supply pin (3.3V)
    9 GND P Power supply reference ground
    15 RXD1 I/O
    16 TXD1 I/O

    Then I downloaded the BK7231Flasher.exe (I got version 1.10b) and had chosen the latest firmware: OpenBK7231N_QIO_1.17.165.bin
    The flasher exe will start flashing (assuming the right PC COM port) after grounding pin
    3 CEN I Enabling pin, which is pulled high internally to be compatible with other modules
    of the CB3S module for ~0.25 seconds. I managed this by hand - may give it several tries ;-)
    After this (this is the trick!) I left the CB3S connected to the USB serial adapter and used the flasher to configure my WAN (Sid+pwd) settings.
    After a reboot, the Tuya Clock/Temp/Humidity device was visible in my WiFi network. and it got an IP address.
    Now, I was able to continue using the Web App ('Launch Web Application' button) and I was able to update the firmware OTA to 1.17.166
    In this Web app in tab Config there is a list of 'Devices:' where I could find Chipset: BK7231N and then my device "Tuya Tuya Temperature & Humidity Monitor [BK7231N]". At least the picture of the device looks like mine.
    I was able to 'Copy Device Settings', but now I'm missing the next step :-(
    Further reading is recommended ;-)
  • #48 20641922
    mkmunichmk
    Level 7  

    Sorry, I wrote in the wrong post - No idea how to move it to post https://www.elektroda.com/rtvforum/topic3914412.html
    as my device is very similar to https://www.elektroda.com/rtvforum/topic3914412.html#gallery-64

    [img-0] [BK7231N] Tuya Temperature & Humidity Monitor: Teardown, Hackability & Features Explained >>20534675


    Hi all, I'm learning ;-)

    some (little) progress...
    In order to power tuyaMcu + CB3S I soldered additional wires to Bat- and Bat+. Now I'm sure that tuyaMcu will not switch off CB3S.
    The result is that there is a better chance to stay connected with WebApp.

    I tried the following autoexec.bat in my Tuya WiFi Door Sensor device:

    Code: text Expand Select all Copy to clipboard
    startDriver tuyaMCU
tuyaMCU_setBaudRate 9600
tuyaMcu_sendHeartbeat
startDriver DoorSensor
//DSEdge 1
linkTuyaMCUOutputToChannel 1 val 1
setChannelType 1 BatteryLevelPercent
linkTuyaMCUOutputToChannel 2 val 2
setChannelType 2 OpenClosed
linkTuyaMCUOutputToChannel 3 val 3
setChannelType 3 OpenClosed


    I'm sure it's wrong, but maybe a starting point...
    I'm using ioBroker running on a Raspberry Pi 3. In a Beken video tutorial, it was said that the Sonoff adapter should be installed. After I had installed it in ioBroker and created an instance Sonoff.0, my door device is shown :-)
    Unfortunately, it shows just the WiFi values and no other values like the (wrong) channels above.
    I'm struggling.

    I thought that in the 'Logs' tab of WebApp, there should appear MCU logging when TuyaMCU is ticked. I worry that there is nothing seen, even "TuyaMcu Explorer/Analyzer for OpenBeken" is showing some messages :-(
    It is a long way...
  • #49 20737316
    spin55
    Level 17  

    p.kaczmarek2 wrote:
    You won't be able to change the firmware without desoldering those resistors temporarily and then soldering them back.

    The next problem is that this device doesn't have a ready configuration yet. We would need to work together to figure out the config.

    This device is also problematic because the MCU seems to control the power of CB3S and can turn it on/off at will, so basically WiFi will go offline when the MCU feels like it.

    We can try to use @TurkeyMan's UART capture to figure something out...


    I don't have this device but from @TurkeyMan's capture and Tuya's version 00 protocol information I have seen this:

    55AA0010004701091402000400000003090400010111020004000000780D0200040000001712020004000000780B020004000000130A0200040000016F0C020004000000391302000400000004E1

    55AA00100047 01 09 --> Command 10 (16), with length 47 (71 bytes), which does (01) contain DPs (9). If (00) there are no DPs.

    14 02 00 04 00 00 00 03 --> 14 (DP20), 03 (HumiSensitivity: 3).
    09 04 00 01 01 --> 09 (DP9), 01 (TempUnitConvert: "F").
    11 02 00 04 00 00 00 78 --> 11 (DP17), 78 (TempReportInterval: 120 min).
    0D 02 00 04 00 00 00 17 --> 0D (DP13), 17 (MinHumi: 23 %).
    12 02 00 04 00 00 00 78 --> 12 (DP18), 78 (HumiReportInterval: 120 min).
    0B 02 00 04 00 00 00 13 --> 0B (DP11), 13 (MinTemp: 19 F).
    0A 02 00 04 00 00 01 6F --> 0A (DP10), 01 6F (MaxTemp: 367 F).
    0C 02 00 04 00 00 00 39 --> 0C (DP12), 39 (MaxHumi: 57 %).
    13 02 00 04 00 00 00 04 --> 13 (DP19), 04 (TempSensitivity: 4).

    55AA0010001F010411020004000000051202000400000008090400010014020004000000069D

    55AA0010001F 01 04 --> Command 10 (16), with length 1F (31 bytes), which does (01) contain DPs (4). If (00) there are no DPs.

    11 02 00 04 00 00 00 05 --> 11 (DP17), 05 (TempReportInterval: 5 min).
    12 02 00 04 00 00 00 08 --> 12 (DP18), 08 (HumiReportInterval: 8 min).
    09 04 00 01 00 --> 09 (DP9), 00 (TempUnitConvert: "C").
    14 02 00 04 00 00 00 06 --> 14 (DP20), 06 (HumiSensitivity: 6).

    List of DPs in Tuya LCD _ Clock _ Temperature/Humidity sensor:

    Temperature: 1, (0x01)
    Humidity: 2, (0x02)
    Battery: 4, (0x04)
    TempUnitConvert: 9, (0x09)
    MaxTemp: 10, (0x0A)
    MinTemp: 11, (0x0B)
    MaxHumi: 12, (0x0C)
    MinHumi: 13, (0x0D)
    TempAlarm: 14, (0x0E)
    HumiAlarm: 15, (0x0F)
    HumiSensitivity: 20, (0x14)
    TempSensitivity: 19, (0x13)
    TempReportInterval: 17, (0x11)
    HumiReportInterval: 18, (0x12)

    NOTE: Battery-powered devices usually have a button to pair them with a long press.

    Greetings
  • #50 20741402
    spin55
    Level 17  

    @p.kaczmarek2,

    It seems that you had already published the information on the DPs in an excellent thread here: https://www.elektroda.com/rtvforum/topic3975583.html

    --------------------
    By guessing and testing with the Tuya application, the following variables (dpID) can be distinguished:
    fnID1 temperature as an integer multiplied by 10 - so 23.1 as 231
    fnID2 % humidity
    fnID3 battery level (0=Low, 1=Medium, 2=High)
    fnID9 choice of unit, C or F (0 = C and 1 = F)
    fnID10 minimum temperature setting
    fnID11 maximum temperature setting
    fnID12 maximum humidity setting
    fnID13 minimum humidity setting
    fnID17 temperature measurement frequency
    fnID18 humidity measurement frequency
    fnID19 temperature accuracy (sensitivity) times 10.5 means 0.5C
    fnID20 humidity accuracy in %
    fnID21 switch state (1 or 0, role unknown)
    --------------------

    Greetings
  • #51 20741421
    p.kaczmarek2
    Moderator Smart Home  
    The following device has configurable data report time interval, which makes is more attractive than other who don't have this feature.
    Helpful post? Buy me a coffee.
  • #52 20870280
    Bobyco
    Level 1  

    Hello, I am new to Tuya tools. I also have this type of sensor with CB3S, and I would like to know if you have a solution for flashing with Tuya CloudCutter (MCU v1.1.6). If you want more information, I am available. Thanks in advance.
  • #53 21302668
    dunchann
    Level 1  
    Hi,
    I went through the posts. Has somebody managed to get working the WIFI report? What is the actual state? I have a couple of this device and I want to decide what to do with them :)

    Added after 1 [minute]:

    @TurkeyMan Hi Have you managed to solve the issue? Is it working for you?
    Thanks
    Viktor
Reply | New topic
Report a violation of the law

Topic summary

The discussion revolves around the teardown and hackability of a Tuya Temperature & Humidity Monitor powered by the BK7231N chip. Users share insights on the device's communication protocols, specifically the TuyaMCU, and its ability to report temperature and humidity data. The device is noted for its ease of disassembly, requiring only two screws, and features a straightforward circuit board layout. Participants explore the device's power management, noting that the WiFi module is controlled by the TuyaMCU, which can lead to challenges in maintaining a stable connection for configuration and data reporting. Various methods for flashing the device with custom firmware, such as OpenBeken, are discussed, including the need to desolder resistors to access the UART communication lines. Users also share their experiences with configuring the device for MQTT and Home Assistant integration, troubleshooting issues related to the device's power cycles, and the importance of maintaining communication between the CB3S module and the MCU for continuous operation.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT