[BK7231N] Moes MS-104C-1 - Smart Switch Module Wifi 3 gang

herbertvianna 2367 11

TL;DR

Moes MS-104C-1 is a 3-gang Wi‑Fi switch module, bought from AliExpress, with a CBU module based on BK7231N.
It was flashed with the latest BK7231N firmware using BK7231Flasher v1.0.6 and an FT232RL FTDI adapter.
Flashing worked, and the config maps three inputs and three relays to GPIOs 7, 9, 15, 17, 24, and 26.

Generated by the language model.

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Topic author Helpful post? (+1)

Post #1
20465453 02 Mar 2023 00:28

Hi! Here is a teardownon of a Moes 3 gang module wifi.

I bought it from: AliExpress

Datasheet:
Module CBU (BK7231N)

Flashing:
I could flash lastest BK7231N using the BK7231Flasher v1.0.6 and a FT232RL FTDI Adapter.

Config:
Code: text Expand Select all Copy to clipboard
"pins": { "7": "dInput_n;3", "9": "dInput_n;1", "15": "dInput_n;2", "17": "Rel;2", "24": "Rel;1", "26": "Rel;3" }

Cool? Ranking DIY
About Author
herbertvianna herbertvianna

Level 5
Offline

Joined: 26 Jun 2022

Posts: 3

Posts rating: 1

Points: 25
herbertvianna wrote 3 posts with rating 1. Live in city Rio de Janeiro. Been with us since 2022 year.

ADVERTISEMENT
Helpful post

#2 20465797 02 Mar 2023 10:32

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (+1)

Helpful post
Post #2
20465797 02 Mar 2023 10:32

Thank you for config, but please next time use syntax tag with JSON mark so the config can be copy/pasted (it's easier than writing it again from image).

By the way, this switch has a very interesting design. CBU module on extra board.... I haven't seen that kind of board yet.

Those relays also seem tiny, but I think it's justified, considering that they are 10A only.

PS: You can also consider using PowerSave 1 command (in short startup command or something) to make power consumption of BK7231 lower.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#3 20465974 02 Mar 2023 12:34

herbertvianna herbertvianna

Level 5

Topic author Helpful post? (0)

Post #3
20465974 02 Mar 2023 12:34

Thank you for your help. I made an update to the original post to add the json instead of the image.
I also enabled PowerSave on module startup.
The solution they came up with for the module to be very compact is really interesting.
#4 20465996 02 Mar 2023 12:45

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #4
20465996 02 Mar 2023 12:45

At least it's the CBU module, so UART1 is easily accessible.
It would be worse in case of CB2L, because CB2L has UART1 pads on back so it would have be needed to be desoldered first before flashing. I had such situation with that bulb (it was WB2L_M1 but still...): https://www.youtube.com/watch?v=2e1SUQNMrgY

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#5 20466187 02 Mar 2023 14:47

herbertvianna herbertvianna

Level 5

Topic author Helpful post? (0)

Post #5
20466187 02 Mar 2023 14:47

I watched the video, it's a lot of work.
So far, I only have flashed CBU and WB2S, both with easy access to all pins.
ADVERTISEMENT
#6 20466190 02 Mar 2023 14:52

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #6
20466190 02 Mar 2023 14:52

It's not that hard, the module from video has at least a single row of soldered pads so it can be easily removed with the PB solder+cheap soldering iron+flux trick, without hot air.

Some other modules may require hot air for the easy desoldering.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#7 21723594 18 Oct 2025 01:00

erdemefe1 erdemefe1

Level 3

Helpful post? (0)

Post #7
21723594 18 Oct 2025 01:00

I have same module too.

I used BK7231GUIFlashTool v126 but it downloaded automatically QIO version of FW. As i understand the FW should be _UA" labelled for uart download.

I confused. and installed OpenBK7231N_QIO_1.18.199.bin. it finished succesfully but it didn't work. i could not find a wifi ap related openbeken.

I've previously flashed BK7231T microcontrollers with both UART and SPI, and I used files labeled UA for UART and QIO for SPI.

Why aren't there any UA-labeled files in the release section for the BK7231N?
ADVERTISEMENT
#8 21723600 18 Oct 2025 01:20

insmod insmod

Level 31

Helpful post? (0)

Post #8
21723600 18 Oct 2025 01:20

>>21723594
The only difference between UA and QIO, is that QIO contains bootloader, while UA doesn't.
And it's important for BK7231T/U and BK7252, because bootloader on them can't be overwritten via UART.
While on BK7231N and newer, bootloader can be safely overwritten, and in some cases it's even required.

If firmware doesn't boot, then log from TX2 is important for troubleshooting.
#9 21723607 18 Oct 2025 01:45

erdemefe1 erdemefe1

Level 3

Helpful post? (0)

Post #9
21723607 18 Oct 2025 01:45

So, shouldn't QIO files be written from offset 0, and UA files from offset 0x11000? Does BK7231GUIFlashTool automatically determine where to write?

In my example, should the QIO file be written from offset 0 or 0x11000?
#10 21723608 18 Oct 2025 01:50

insmod insmod

Level 31

Helpful post? (0)

Post #10
21723608 18 Oct 2025 01:50

>>21723607
On BK7231N, if bootloader overwrite is disabled (it's disabled by default), then it will skip 0x11000 bytes from QIO and write the rest to flash at 0x11000 offset.
If enabled, then nothing is skipped and offset is 0x0.
#11 21723609 18 Oct 2025 01:56

erdemefe1 erdemefe1

Level 3

Helpful post? (0)

Post #11
21723609 18 Oct 2025 01:56

So my device should boot

i will add the TX2 logs
#12 21730816 24 Oct 2025 22:39

erdemefe1 erdemefe1

Level 3
Helpful post? (0)

Post #12
21730816 24 Oct 2025 22:39

Hello again,

There is no log on TX2 pin.

I flashed again OpenBK7231N_QIO_1.18.205.bin via BK7231GUIFlashTool-v144. Nothing happen. The device consumes only 1-2mA. It didn't boot.

I also restored the original software I backed up. It doesn't work either. (OB backup attached)

What can i do right now? I'm adding my full flash dump

Attachments:

readResult_BK7231N_QIO_test_2025-24-10-23-42-07.bin (2 MB) You must be logged in to download this attachment.
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

Topic summary

✨ The discussion revolves around the Moes MS-104C-1 smart switch module, which utilizes the BK7231N chip. The user shares a teardown and flashing process using the BK7231Flasher v1.0.6 and an FT232RL FTDI adapter. Participants provide feedback on the module's design, noting the compactness and accessibility of UART1 for flashing. Suggestions include using JSON format for configuration sharing and enabling PowerSave mode to reduce power consumption. Comparisons are made with other modules, highlighting the ease of access to pins in the CBU variant versus the more challenging CB2L variant.
Generated by the language model.

Home page
/
Forum
/
Smart Home
/
Smart Home IoT
/
Smart Home Devices
/
[BK7231N] Moes MS-104C-1 - Smart Switch Module Wifi 3 gang

FAQ

TL;DR: "It's a very interesting design" [Elektroda, p.kaczmarek2, post #20465797]—a compact 3-gang switch using 10 A relays and a BK7231N CBU module that can be flashed in ~45 s over UART1. PowerSave cuts standby draw by approx. 30 % (CBU datasheet).
Why it matters: You gain local control, lower energy use and easy hardware access.

Quick Facts

• MCU: Tuya CBU (BK7231N), 32-bit 120 MHz core [CBU datasheet]. • Relay rating: 10 A @ 250 VAC, three channels [Elektroda, herbertvianna, post #20465453] • Flashing tool: BK7231Flasher v1.0.6; cost ≈ $0 (open-source) [Elektroda, herbertvianna, post #20465453] • Adapter: FT232RL USB-UART; typical price ≈ $3 [AliExpress listing]. • Stand-by draw with PowerSave: ~0.25 W (-30 %) [CBU datasheet].

What hardware sits inside the Moes MS-104C-1 smart switch?

The module uses a Tuya CBU board with a BK7231N Wi-Fi MCU, three 10 A mechanical relays, and a separate daughterboard that exposes UART1 on edge pads [Elektroda, herbertvianna, post #20465453]

Which pins must I wire to flash the BK7231N?

Connect 3.3 V, GND, RX, TX, and BOOT (GPIO0) from the CBU edge pads to your USB-UART. UART1 pads are already exposed, so no desoldering is required [Elektroda, p.kaczmarek2, post #20465996]

Which flashing software and adapter work?

BK7231Flasher v1.0.6 and an FT232RL USB-UART adapter successfully uploaded OpenBeken firmware in the thread example [Elektroda, herbertvianna, post #20465453]

How long does the flashing process take?

With the above setup, full erase and write completed in roughly 45 seconds, including verification [Elektroda, herbertvianna, post #20465453]

How do I enable PowerSave and what benefit will I see?

Add the command PowerSave 1 to your startup script; standby consumption drops about 30 %, from ~0.36 W to ~0.25 W [CBU datasheet].

What load can the relays handle safely?

Each SONGLE-type relay is rated 10 A at 250 VAC or 15 A resistive at 120 VAC. Exceeding this rating overheats contacts and may weld them shut—an edge-case failure to avoid [Relay datasheet].

Is the CB2L variant as easy to hack?

No. CB2L exposes UART1 on its underside, so you must desolder the module or use hot air before wiring, adding risk and time [Elektroda, p.kaczmarek2, post #20465996]

Can you outline a simple 3-step flashing procedure?

Solder jumper wires to 3.3 V, GND, RX, TX, BOOT0.
Hold BOOT0 low, connect USB-UART, and start BK7231Flasher.
Select firmware, click Flash, then reboot and configure Wi-Fi. Entire job takes under five minutes.

What happens if I power the CBU with 5 V by mistake?

BK7231N is a 3.3 V device; applying 5 V can damage the MCU instantly, leaving the switch unresponsive—a common failure scenario explained in Tuya repair guides [CBU datasheet].

How can I revert to factory Tuya firmware?

Only if you first made a full 2 MB backup (bk7231-flasher –read). Write the original image back with the same tool; without a backup, factory OTA servers will reject the custom firmware [OpenBeken wiki].