First unscrew and detach the plastic ring
Then desolder the antenna cable
Measure the total length of the outlet pins towards the plastic to have a known measurement when pressing and reassembling. Then remove the circuitboards through pressing the outlet pins
Then you will find the needed solder/programming points
To reassemble, place the circuit boards back in and then place the outlet pins in the vice and leave a small gap so you can fit a wide screwdriver in between to press back the plastic housing back up on the outlet pins. Make sure you get it pressed in completely, using the measurements from before. After this resolder the antenna and screw the plastic lid back on.
Ive found that:
P6 is LED
P9 is Button
P26 is Relay
And for the BL0942 energy metering you would need to use "startDriver BL0942" in startup commands
Thank you for presenting this interesting teardown process. I had a similar plugs once, and it was very problematic to deal with them.
Polish teardown NAS-WR01W and NAS-WR07W [BK7231/BL0937/BL0942] I had serious issues with dismantling this socket, in the end I figured out that I can just cut the case here and access pins:
On the other hand, your methods looks very interesting. I might give it a try in the future. Thanks!
They do it all the time.
One of my readers also send me an older version of this plug, which was still ESP based. We didn't translate this teardown yet, but you can find it here (use google translate):
https://www.elektroda.pl/rtvforum/viewtopic.php?p=20332677#20332677 Have you managed to do a firmware dump for your plug? a 2MB flash backup
@clabbe not yet, but I will write an article on that.
For now, I will give you a short version - get USB to UART converter, power the device from 3.3V LDO or from 5V if LDO is on board, connect common ground, and then connect first RX of converter to TXD1 of module (to capture what module sends), open RealTerm, choose correct baud rate, find settings for capture to file, setup hex format, then reboot device (power off and power on) and capture all packets. Then do the same, but connect to RXD1 of device.
Here' s how a sample capture looks like: