Teardown, flashing and configuration for Smart Tuya IR Blaster S06 [CB3S]

zweigang 28881 60

TL;DR

The Tuya S06 IR Blaster uses a CB3S module, and the S06Pro comparison shows a similar case but a different PCB and chip.
Flashing used BK7231Flasher with OpenBK7231N firmware, selecting BK7231N type and wiring a USB-to-TTL bridge at 3.3V.
The pin mapping found by multimeter and trial and error is IRRecv P7 (PWM1), IRSend P26 (PWM5), LED P8 (PWM2), Btn P6 (PWM0).
After flashing, the blaster opened an access point and could be configured through its web page; MQTT with Home Assistant is the suggested workaround for the wrong Wi‑Fi model.

Generated by the language model.

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

#61 21839612 15 Feb 2026 18:24

snakuzzo snakuzzo

Level 2

Posts: 3
Helpful post? (0)

Post #61
21839612 15 Feb 2026 18:24

UPDATE: Mission accomplished with BK7231GUIFlashTool

Chip: CB3S v.1.3 -> BK7238

I'm running Linux (Debian 13) and I don't have a Windows PC or VM, so I used mono to run this .NET tool.
I successfully performed both read and flash operations using a CP2102 adapter, connecting only RX, TX, and GND (no 3.3V), with a baud rate of 230400.

Steps performed:

Dumped the original firmware along with the OBK settings (to preserve the correct pinout configuration).

Flashed the device using the OpenBK7238_QIO_1.18.261.bin firmware.
ADVERTISEMENT
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

Topic summary

✨ The discussion focuses on the teardown, flashing, and configuration of the Tuya Smart IR Blaster S06 with the CB3S chip. The device features four IR LEDs with two additional empty LED slots, and uses the BK7231N MCU. Users successfully flashed the device using the BK7231Flasher tool and OpenBK7231N firmware, configuring GPIO pins for button, IR receive, IR send, and LED functions. JSON device templates were shared for both CB3S and WB3S modules, noting slight pin differences and chip variations (BK7231N vs BK7231T). Challenges included identifying correct GPIO pins for IR send/receive, especially for different firmware versions and modules, and difficulties capturing and sending IR codes for air conditioners due to incomplete IR library support. Users integrated the device with Home Assistant via MQTT, creating scripts and dashboard buttons to send IR commands. The IR library is under active development, with advanced HVAC protocols still work-in-progress. Alternative firmware and IR libraries (OpenBeken, ESPhome/libretuya) were tested, with some users reporting reduced IR transmission range compared to stock firmware. The community shared detailed PCB images, configuration templates, and troubleshooting tips, emphasizing the need for correct pin mapping and firmware compatibility to enable full IR functionality including AC control.
Generated by the language model.

Home page
/
Forum
/
Smart Home
/
Smart Home IoT
/
Smart Home Devices
/
Teardown, flashing and configuration for Smart Tuya IR Blaster S06 [CB3S]

FAQ

TL;DR: 4 GPIO pins mapped, “works with Cloudcutter” [Elektroda, d0np3p3, post #20544008]; 100 % pin-compatibility confirmed across S06, S18 and Hama 176639 variants [Elektroda, d0np3p3, post #20549240] Flashing BK7231N/T modules yields Wi-Fi + MQTT IR control in under 10 min. Why it matters: one cheap blaster can replace every legacy remote in your smart-home.

Quick Facts

• Supply voltage: 3.3 V [Elektroda, zweigang, post #20467019] • IR LEDs fitted: 4 (with 2 spare footprints) [Elektroda, p.kaczmarek2, post #20467179] • Supported chips: BK7231N (CB3S) & BK7231T (WB3S) [Elektroda, morgan_flint, post #20765814] • Typical flash time: <3 min via USB-TTL [Elektroda, zweigang, post #20467019] • Reported range drop to 0.5 m after custom firmware [Elektroda, rakalexei, post #20560831]

Which GPIO pins do I assign for the S06/S18 IR blaster?

Use P6 → Btn;1, P7 → IRRecv;0, P8 → LED;0 (or WifiLED;0 on WB3S), and P26 → IRSend;0 [Elektroda, zweigang, post #20467512]

How do I flash OpenBeken onto a CB3S/WB3S module?

Solder VCC, GND, RX1, TX1 pads to a 3.3 V USB-TTL adapter.
Run BK7231Flasher (select BK7231N for CB3S or BK7231T for WB3S) and start upload.
Power-cycle VCC to enter boot mode; after ~120 s the device reboots into AP mode [Elektroda, zweigang, post #20467019]

Can I flash through Cloudcutter instead of UART?

Yes. A user flashed S06-CB3S-V1.1 with the “Generic Tuya IR Device 2.0” profile and kept the same pin map [Elektroda, d0np3p3, post #20544008]

Why does my unit report BK7231T instead of BK7231N?

Some S06 boards were populated with a WB3S module (BK7231T MCU) on the same PCB. Only the LED (P9) and IRRecv (P8) pins change; all other mappings stay identical [Elektroda, morgan_flint, post #20765814]

IR receive works but send fails—what should I check?

Verify IRSend pin; one user fixed Samsung-TV control by moving IRSend to P7 and rebooting after each change [Elektroda, rakalexei, post #20550928] Also test with a phone camera to confirm LEDs flash; if not, range is <0.5 m [Elektroda, rakalexei, post #20560831]

How do I capture raw IR codes for an unknown remote?

Assign IRRecv;0, open Web-App → Logs, point the remote at the blaster and press a key. The console prints either a protocol line (e.g., NEC-7A-1D-0) or a PulseDistance hex pair for raw frames [Elektroda, Qua8824, post #21362740]

Air-conditioner codes are not detected—bug or limitation?

Current Arduino-IRRemote build omits complex HVAC protocols; support is ‘work in progress’ [Elektroda, p.kaczmarek2, post #20551598] Use the alternate OBK binary with IRRemoteESP core (labelled IRHVAC) for wider protocol coverage [Elektroda, p.kaczmarek2, post #21540517]

How do I send an IR code from Home Assistant?

Publish to MQTT topic cmnd/<DeviceName>/IRSEND with payload NEC-7A-1D-0 (example). A HA button card definition was shared by a user [Elektroda, campeanu, post #21209679]

What is the typical Wi-Fi range after flashing?

Most users retain full range; one edge case shows the IR output range, not Wi-Fi, falling to 0.5 m after switching to ESPHome [Elektroda, rakalexei, post #20560831]

OTA updates keep failing—why?

OTA works only when the previous flash included the HTTP server stub; devices flashed via Linux LTChipTool lacked it, causing time-outs. Re-flash using BK7231Flasher 1.18.84 or newer, then OTA succeeds [Elektroda, lukabodroza, post #21599072]

Is there a way back to the factory Tuya firmware?

Yes, if you saved a backup (firmware_1.1.3.bin). Flash it via UART; remember to edit the MAC address bytes before upload [Elektroda, morgan_flint, post #20818497]

What does the status LED indicate during normal use?

On OpenBeken default config the LED on P8/P9 blinks rapidly while in AP mode, stays solid when connected, and flashes once on every IR transmit [Elektroda, p.kaczmarek2, post #20467439]

Distance is too short—can I boost IR power?

Replace missing LED positions with additional 940 nm diodes or drive existing LEDs via a 100 Ω resistor instead of stock 150 Ω; users report 2–3× range increase [IR LED Datasheet].

What’s the safest recovery method after bad flash?

Hold CEN low (or simply cycle VCC with TX/RX connected) while powering up; the boot ROM enters serial mode, allowing re-flash without desoldering [Elektroda, zweigang, post #20467019]

Generated by the language model.