[BK7231N] [CB3S] [AHT20] TH01 Generic Temperature and Humidity Sensor Teardown

anthonythomas 33465 129

Reply | New topic

#121 21552031 17 May 2025 18:46

BAGZZlash BAGZZlash

Level 4

Post #121

21552031 17 May 2025 18:46

insmod wrote:
Add commands 'logfeature 12 1' and 'loglevel 6' to autoexec before starting tuyamcu driver.

Thanks. Well, that changed the log to this:

Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID [ZZ-Base]
Info:MAIN:Using Pass [**censored :-)**]
Error:HTTP:Created HTTP SV thread with (stack=2048)
Info:MQTT:MQTT_RegisterCallback called for bT / subT /+/set
Info:MQTT:MQTT_RegisterCallback called for bT bekens/ subT bekens/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd// subT cmnd//+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/bekens/ subT cmnd/bekens/+
Info:MQTT:MQTT_RegisterCallback called for bT / subT /+/get
Info:CMD:CMD_StartScript: started @startup at the beginning
Info:CMD:CMD_StartScript: started autoexec.bat at the beginning
Info:MAIN:Main_Init_After_Delay done
Debug:CMD:loglevel set 6
Debug:CMD:cmd [startDriver TuyaMCU]
Debug:CMD:Adding command tuyaMcu_testSendTime
Debug:CMD:Adding command tuyaMcu_sendCurTime
Debug:CMD:Adding command linkTuyaMCUOutputToChannel
Debug:CMD:Adding command tuyaMcu_setDimmerRange
Debug:CMD:Adding command tuyaMcu_sendHeartbeat
Debug:CMD:Adding command tuyaMcu_sendQueryState
Debug:CMD:Adding command tuyaMcu_sendProductInformation
Debug:CMD:Adding command tuyaMcu_sendState
Debug:CMD:Adding command tuyaMcu_sendMCUConf
Debug:CMD:Adding command tuyaMcu_sendCmd
Debug:CMD:Adding command fakeTuyaPacket
Debug:CMD:Adding command tuyaMcu_setBaudRate
Debug:CMD:Adding command tuyaMcu_sendRSSI
Debug:CMD:Adding command tuyaMcu_defWiFiState
Debug:CMD:Adding command tuyaMcu_sendColor
Debug:CMD:Adding command tuyaMcu_setupLED
Info:MAIN:Started TuyaMCU.
Debug:CMD:cmd [startDriver tmSensor]
Info:MAIN:Started tmSensor.
Info:MAIN:Time 1, idle 206358/s, free 78520, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 2, idle 190687/s, free 78520, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 3, idle 190958/s, free 78520, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 4, idle 191095/s, free 78520, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Boot complete time reached (3 seconds)
Info:CFG:####### Set Boot Complete #######
Debug:CFG:new offset 5188, boot_count 432, success count 432
Debug:CFG:new offset after read 5188, boot_count 432, success count 432
Debug:CFG:re-read - offset 5188, boot count 432, boot success 432, bootfailures 0
Info:MAIN:Time 5, idle 184261/s, free 78520, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Registered for wifi changes
Info:MAIN:Connecting to SSID [ZZ-Base]
Info:MAIN:Time 6, idle 183032/s, free 73240, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 7, idle 189049/s, free 73240, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 8, idle 86716/s, free 73552, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 9, idle 0/s, free 73552, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 10, idle 0/s, free 73552, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38 
Info:GEN:dhcp=0 ip=0.0.0.0 gate=0.0.0.0 mask=0.0.0.0 mac=f8:17:2d:e0:0d:c6
Info:GEN:sta: 0, softap: 0, b/g/n
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTING - 1
Info:MAIN:Time 11, idle 90576/s, free 73784, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 12, idle 190782/s, free 73824, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTED - 4
Info:MAIN:Time 13, idle 189394/s, free 73736, MQTT 0(0), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 14, idle 187900/s, free 73736, MQTT 0(0), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MQTT:mqtt_host empty, not starting mqtt
Info:MAIN:Time 15, idle 189536/s, free 73736, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 16, idle 190921/s, free 73736, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 17, idle 188902/s, free 73736, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 18, idle 192471/s, free 65128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 3/38 
Debug:API:GET of api/logconfig
Info:MAIN:Time 19, idle 192163/s, free 73520, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 3/38 
Debug:API:GET of api/pins
Debug:API:GET of api/channelTypes
Info:MAIN:Time 20, idle 187589/s, free 73736, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:GEN:dhcp=0 ip=192.168.1.178 gate=192.168.1.1 mask=255.255.255.0 mac=f8:17:2d:e0:0d:c6
Info:GEN:sta: 1, softap: 0, b/g/n
Info:GEN:sta:rssi=-66,ssid=ZZ-Base,bssid=1c:b0:44:b9:2c:65,channel=6,cipher_type:CCMP
Info:MAIN:Time 21, idle 187412/s, free 65128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 3/38 
Debug:API:GET of api/info
Info:MAIN:Time 22, idle 192579/s, free 73736, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 23, idle 188618/s, free 73736, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 24, idle 194184/s, free 73736, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 25, idle 192457/s, free 65128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 3/38 
Info:MAIN:Time 26, idle 199074/s, free 73736, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 27, idle 189465/s, free 73736, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 28, idle 194548/s, free 73736, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 29, idle 188955/s, free 73736, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 30, idle 190045/s, free 73736, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:GEN:dhcp=0 ip=192.168.1.178 gate=192.168.1.1 mask=255.255.255.0 mac=f8:17:2d:e0:0d:c6
Info:GEN:sta: 1, softap: 0, b/g/n
Info:GEN:sta:rssi=-66,ssid=ZZ-Base,bssid=1c:b0:44:b9:2c:65,channel=6,cipher_type:CCMP
Info:MQTT:mqtt_host empty, not starting mqtt
Info:MAIN:Time 31, idle 186520/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 32, idle 199828/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 33, idle 190026/s, free 65128, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 3/38 
Info:MAIN:Time 34, idle 195184/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 35, idle 189788/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 36, idle 195004/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 37, idle 193363/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 38, idle 191167/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 39, idle 196142/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 40, idle 190507/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:GEN:dhcp=0 ip=192.168.1.178 gate=192.168.1.1 mask=255.255.255.0 mac=f8:17:2d:e0:0d:c6
Info:GEN:sta: 1, softap: 0, b/g/n
Info:GEN:sta:rssi=-66,ssid=ZZ-Base,bssid=1c:b0:44:b9:2c:65,channel=6,cipher_type:CCMP
Info:MAIN:Time 41, idle 186854/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 42, idle 194252/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 43, idle 194819/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 44, idle 193699/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 45, idle 195020/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 46, idle 195854/s, free 73736, MQTT 0(2), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MQTT:mqtt_host empty, not starting mqtt
Info:MAIN:Time 47, idle 191318/s, free 73736, MQTT 0(3), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 48, idle 191262/s, free 73736, MQTT 0(3), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 49, idle 196766/s, free 73736, MQTT 0(3), bWifi 1, secondsWithNoPing -1, socks 2/38 
Info:MAIN:Time 50, idle 191330/s, free 73520, MQTT 0(3), bWifi 1, secondsWithNoPing -1, socks 3/38 
Info:GEN:dhcp=0 ip=192.168.1.178 gate=192.168.1.1 mask=255.255.255.0 mac=f8:17:2d:e0:0d:c6
Info:GEN:sta: 1, softap: 0, b/g/n
Info:GEN:sta:rssi=-66,ssid=ZZ-Base,bssid=1c:b0:44:b9:2c:65,channel=6,cipher_type:CCMP
Info:MAIN:Time 51, idle 187670/s, free 73736, MQTT 0(3), bWifi 1, secondsWithNoPing -1, socks 2/38

More info, but still no "Info:TuyaMCU:TUYAMCU" messages... Autoexec.bat now is

logfeature 12 1
loglevel 6
startDriver TuyaMCU
startDriver tmSensor

ADVERTISEMENT
#122 21552042 17 May 2025 19:00

insmod insmod

Level 22

Helpful post? (0)

Post #122
21552042 17 May 2025 19:00

So if there are still no messages, then that means either you don't have a mcu, or connection between the module and the mcu is somehow damaged.
Are you sure that your device is the same as in pictures shared at the start of this thread?
Another possibility, but less chance of it working that you have enabled flag 26 and mcu uart is connected to module uart1 or flag 26 is disabled and mcu uart is connected to uart2.
ADVERTISEMENT
#123 21552415 18 May 2025 08:13

BAGZZlash BAGZZlash

Level 4

Helpful post? (0)

Post #123
21552415 18 May 2025 08:13

Thanks. Well, flag 26 wasn't set. I tried checking it, but to no avail.

My device looks like this:

It's from Aliexpress, this one, to be specific: Link
#124 21552482 18 May 2025 09:53

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #124
21552482 18 May 2025 09:53

Out of curiosity, I ran the same in the self test system, with hardcoded responsens from the MCU. Here is how log looks like:

Maybe I could add a debug log print to the point where OBK sends product info query (55 AA 00 01 00 00 00 ) ?

Added after 26 [seconds]:

Maybe wrong baud? Maybe you need to try 115200?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#125 21552797 18 May 2025 15:25

BAGZZlash BAGZZlash

Level 4

Helpful post? (0)

Post #125
21552797 18 May 2025 15:25

p.kaczmarek2 wrote:

Maybe wrong baud? Maybe you need to try 115200?

That did the trick! Wow, thanks! I remember that during tests I had experimented with setting the baud rate to 9600 manually, but that didn't work. It never occurred to me that a higher rate may be required.
ADVERTISEMENT
#126 21552818 18 May 2025 15:48

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #126
21552818 18 May 2025 15:48

I'm glad to hear that it works now. I've suspected it because it matched the symptons. I'm just now wondering if we could have figured it earlier - do you have 2MB factory dump of your firmware? It think the baud settings may be present in Tuya partition if you do config extraction with our flasher: https://github.com/openshwprojects/BK7231GUIFlashTool

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#127 21552888 18 May 2025 17:19

BAGZZlash BAGZZlash

Level 4

Helpful post? (0)

Post #127
21552888 18 May 2025 17:19

p.kaczmarek2 wrote:
I'm glad to hear that it works now. I've suspected it because it matched the symptoms. I'm just now wondering if we could have figured it earlier - do you have 2MB factory dump of your firmware? It think the baud settings may be present in Tuya partition if you do config extraction with our flasher: https://github.com/openshwprojects/BK7231GUIFlashTool

I'm afraid that I don't have that. I tried several times to extract the original firmware, but kept getting read errors. So I flashed OBK without a backup. I had problems doing that, too (write errors and even erase errors). I talked to ChatGPT about that (indeed!) and "he" told me to also overwrite the bootloader. Didn't make sense to me and I still got errors, but after several more tries it succeeded.

I regret that now. I might have succeeded backing up the original firmware with more patience and I certainly would have succeeded without overwriting the bootloader. The way things are now, I have nothing to help you with. I'm sorry.
#128 21552909 18 May 2025 17:31

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #128
21552909 18 May 2025 17:31

Actually you should still be able to get Tuya Config partition from OBK, here's tutorial: https://www.youtube.com/watch?v=WunlqIMAdgw

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#129 21552919 18 May 2025 17:42

insmod insmod

Level 22

Helpful post? (0)

Post #129
21552919 18 May 2025 17:42

You should still endeavor to take a backup, even if you flashed OBK (but don't share it, as it contains your wifi/mqtt credentials).
I don't know if TuyaMCU devices are affected, but common devices without it, like door/temperature sensors, can 'die' if batteries are too low (like 1.8v and lower).
If it dies, then only a full reflash would recover it. Just flashing OpenBeken is not enough. It can probably be recovered if a full flash erase is performed, but then you would lose MAC address and wifi calibration.
Since you've already flashed OpenBeken, connecting via uart might not be necessary. Look at the guide above, but instead of downloading Tuya GPIO Config, press 'Download full 2MB dump'.
You might need to temporarily disable mqtt and wake your device several times for it to be completed.
But like i said earlier, i don't know if TuyaMCU devices are affected, so it might not be needed.
#130 21552984 18 May 2025 18:22

BAGZZlash BAGZZlash

Level 4

Helpful post? (0)

Post #130
21552984 18 May 2025 18:22

Okay, great. I downloaded the 2 MB dump file. Yes, there were my Wifi credentials in there, so I changed it using a hex editor (might result in a bad checksum). MQTT is not configured anyway, so nothing to hide here.

BK7231N_QI...F12996.bin Download (2 MB)
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Reply | New topic

Report a violation of the law

Topic summary

The discussion revolves around the teardown and firmware flashing of the TH01 Generic Temperature and Humidity Sensor, specifically using OpenBK7231N firmware. Users share their experiences with flashing the device, configuring it for WiFi and MQTT, and troubleshooting issues related to data reporting and connectivity. Key points include the necessity of severing RX/TX connections to the MCU for successful flashing, configuring autoexec.bat for driver initialization, and addressing problems with data values being reported as zero. Users also discuss the impact of power supply configurations on device performance and the importance of correctly setting up MQTT for data transmission. Various solutions and configurations are proposed to enhance device functionality and battery life.
Summary generated by the language model.