[BK7231N] AP-SMT-Breaker02-1CH EZB-WBZS1H16N-A - 16A Mini Smart Switch 1 Channel

Hello!
You can find it here

Other topic is closed, so I'll ask here. Why key and relay is set as "relay ID 1"? Why not 0? Is the unused "Relay 0" any special thing and shall not be used?

Hello!

I've purchased half a dozen of those, and i've confirmed they're the exact bacth, at least from the PCB printouts.
Could you provide me with the exact version of cloudcutter you were able to flash with? I've just cloned the last git version and it's failing to setup the A-* access point after sending the exploit.

I'm putting the device in AP mode, it finds the SmartLife AP, sends exploit but then, when i long press the button again for fast flash, and then again for slow flash, either straight away, or by actually power cycling the device, the SmartLife AP pops up again. I'm wondering if i'm doing anything wrong or i've just ran out of luck with some Aubess firmware upgrade.

Thanks in advance.

Hi, in batch of three I had one Smart Mini Switch that has the same pcb.

With one of them I had to pair it with "cloudcutterflash" AP with internet access by using Tuya/SmartLife App to enter WiFi credentials.
After that tuya-cloudcutter process continued.
For the "cloudcutterflash" AP i used second/spare router.

It is as stated in Note: of the INSTRUCTIONS.md

I hope this helps

Hi riskorja, thanks for your feedback.

I'm trying to flash the device and not just disconnect it from the internet. The procedure for that is at the bottom of the page you sent, in the "Flashing custom firmware" section.
The main difference is that the exploit will make the device associate with a custom AP, from where the new firmware will be sent OTA.
My guess about a new vendor firmware, not vulnerable to the exploit, is because i'm not observing any freezing of the LED light.
I have used that procedure on other devices and all i needed was my laptop (and some luck aparenty).

Regards,

Hugo.

Hi

my goal was also to upload new firmware.
As I observed the procedure, the first part changes the AP name of device SmartLife_mac to A_mac after that the light should freeze.
I successfully tried my luck on three smart mini switches with two setups:
- RPi with Raspberry OS an supervised HA on which tuya-cloudcutter script runs without warnings, but had to manually add "cloudcutterflash" AP WiFi credentials after first part. Tried only one device.
- Netbook with Debian on which tuya-cloudcutter script runs with some warnings, on one device manual restart was needed, on one device the light freeze was observed.
Luckily the script can be run multiple times, and only one device needed to add WiFi credentials manually, after that script successfully replaced the firmware to OpenBeken.

Best Regards
Rihard

Some new Tuya devices are not vulnerable to Cloudcutter. Please just use soldering method to flash OpenBeken then. We have a playlist of soldering guides for uploading new firmware to smart device:
https://www.youtube.com/playlist?list=PLzbXEc2ebpH0CZDbczAXT94BuSGrd_GoM

Hello p.kaczmarek2,

Thank you so much for all your work. It's been a game changer.
I was trying to avoid my poor soldering skills but i guess i'm out of luck on that.
Keep up the good work!

We are showing soldering process step by step on our channel, so it should be easy to replicate.

>>20507709
In my experience i found out it is enough 3 wires Gnd,Tx,Rx and lower baud rate to 115200 and i had success in over 10 boards flashing. Here is image of Aubess board with BK7321N onboard, With this revision cloud cutter didnt work for me, but luckily there is easy traceable test points Yellow is RX White Tx.

Pin 6: TglChanOnTgl on channel 1
Pin 7: Rel on channel 1
Pin 23: Btn on channel 1
Pin 26: LED_n on channel 1

@karrlsson are you saying that you do not connect 3.3V?

Well, most likely you are powering it through RX/TX then, thanks to the protection diodes of GPIO. EEVBlog had a video on that:
https://www.youtube.com/watch?v=2yFh7Vv0Paw

Yes i do not connect 3.3v and somehow the chip this way is in programming mode always... no CEN to ground needed. i connect 3.3v only after programming to do inital setup without mains...
But i just found CB2S module which i cant program at all, i need to check if it was working at all...

I also found some time ago, that because of this RX/TX powering module, I sometimes have to ground the VDD of module, just to make sure it's off, in order to do a power cycle correctly.

Still, powering without 3.3V is not recommended.

What kind of device do you have with that CB2S?

Here is a Polish/English review of a newer version of this switch, this time with CBU module:

https://www.elektroda.pl/rtvforum/topic3994713.html#20686595
https://www.elektroda.com/rtvforum/topic3994713.html#20686595

>>20507709
thank you for pin config.

Hi,

I have just received a different version of the AP-SMT-Breaker02-1CH from our favorite Chinese vendor.
Will not work with cloudcutter.
Unfortunately, they mounted all components (except LED and switch) on the top side of the PCB.
This means, the T34 chip is surrounded basically by all the components that are very high (relais, resistor, capacitor, coil).
Unfortunately, there is not a single pad for pogo pins.

Any idea on how to flash that? Due to the surrounding by 3D "high" components, it seems impossible to get directly to Pins 25/26 of the T34 for serial connection. I am lost!

That looks like a true challenge. It's a shame that I don't get that kind of devices myself.

Unfortunatelly the only viable solution I can see is the one described here:
[BK7231N / T34 ] Teardown Tuya Generic Wifi Wall Light Switch 3 Gang

CameronDev wrote:

Here is how you can flash a T34-based wall switch with OpenBeken. This switch has no programming pads available, so desoldering T34 in QFN case is required.

So you will need hot air and some basic soldering skills.

Alternatively, you could try just removing the high components... with some flux, extra Pb solder, and solder wick it should be easy.

Thanks for your suggestions! I have zero experience with soldering tiny SMD stuff - nor do I have the equipment to do any reflow soldering.
It might be one way to de-solder all the big components and try to attach tiny wires directly to the pins, since the solder of the pins is exposed on the PCB, just like someone wrote later on the page you linked:

karayoooo wrote:

Hello guys

it can be done directly without unsoldering T34.
Here in a tuya socket.
Yes It's tricky and yes a pcb pad is quite (but not) broken but it works !

But, even that would be very challenging for me since I do not have a microscope and just using the big lens I have is not good enough for the required precision.