[BK7231N] Moes XZ-HPSW101 mmWave Radar Sensor Teardown with CBU Module

This is a short teardown of Moes mmWave Radar Sensor with CBU module.

Basic information:
Brand: MOES
Model: XZ-HPSW101
Chip: BK7231N [CBU]
Local Vendor: https://expo.tuya.com/product/1053016 (original link wasn't valid anymore so I'm putting this link from tuya)

Teardown Photos:



Tuya/smartlife configuration:



Flashing Method:
Using serial method with hid_download tool. Start flashing and do a power cycle or ground the CEN pin.
UART TX --> PCB RX
UART RX --> PCB RX
UART GND --> PCB GND
UART 3.3V --> PCB 3.3V

@p.kaczmarek2 I haven't started flashing this yet since I don't really know how to start configuring this.
Could this be using tuya mcu?

Pinout:
TBA

Very interesting device. One of the methods to determine is it using TuyaMCU would be simply hooking up UART to RX and TX lines and doing a packet dump, preferably in hex format, maybe with Realterm.
See the following topic: https://www.elektroda.com/rtvforum/topic3936455.html
I will need that data for the analysis.

Second way to check for TuyaMCU would be with multimeter, are the RX/TX tracks going to MCU?

The third way, the one for battery powered devices, would be checking if WiFi module is always powered. Some of the devices with TuyaMCU just disable the power of WiFi module when it's not needed. There is a MOSFET on the way between 3.3V and VDD of WiFi module and TuyaMCU controls that MOSFET. Does your device VDD of WiFi module connects directly to main VDD rail on the board?

but, in general, i'd say, first try to do UART packets dump. 9600 baud (most likely), Realterm, "capture to file", and paste here captures. I will use my TuyaMCU analyzer to check what's going on.

@p.kaczmarek2 I'm not able to read/write the firmware yet, keeps failing each time
I read from previous post that you might need to cut the tx/rx or just desolder the CBU chip to flash it?

Yes, but I'd suggest again - first do a packets dump so we know the communication protocol. Do not flash yet. Connect UART, open Realterm, configure capture in hex format and play with device, note what you are doing. Do both capture for RX and then TX.
Here is a sample how such communication look like (already in my analyzer tool):