[TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown

nihildiximus 1236 7
This content has been translated flag-pl » flag-en View the original version here.
  • Producer: Ezvis
    Model: CS T30 10A

    Socket with FW dedicated to the Ezviz application, but it is also sold by other manufacturers as WiFi socket WG08 Tuya and then it can be added directly to the Tuya application. I decided to do a teardown because I don't see anyone looking at the Ezvizes anywhere...

    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown


    To remove the top plug at the socket, just pry it up. Unfortunately, removing the PCB without destroying the housing seems impossible. An attempt to knock out and unscrew the pins gave nothing, so they were probably sunk in the plastic of the housing. Unfortunately, even heating them with hot air did not help. Desoldering them and removing them from the PCB is also not an easy task - I managed to collect tin from the outside, but a lot of it was left on the bottom of the board and there was no way to melt it. Trying to remove the plastic in the middle holding the socket plates, one of them fell off. The only way to disassemble was to cut the casing. I've done it so that it can be easily glued if needed...

    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown
    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown

    Microcontroller: TYWE2S (ESP8285)
    PCB: WG08(10)V1.4 7/20/29

    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown

    Inside there is a quite popular TYWE2S microcontroller, compatible with ESP, so theoretically you can throw FW Tasmota and EspHome.
    In practice, this involves either destroying the device's housing and soldering it to the board, or you could make a small PCB (or some wire structure on a piece of tape or something similar) to size with the corresponding pin spacing, try to stick it to the TYWE2S board, or catch on a magnet and then program. However, this is a daunting task.

    Tuya-convert over Wifi turned out to be ineffective. I wanted to check if it will start after shorting GPIO0 to GND, but after inserting the plug there was some short circuit and gray smoke went. Probably during heating and trying to pull out the pins some tin poured where it shouldn't, but fortunately the strip, UPS and fuses passed the test positively. ;) In the face of this fact, I decided to finish the work and it turned out that some layout was fried from the bottom ...

    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown
    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown

    To sum up: Although programming the TYWE2S itself should not be a problem, I advise against buying these sockets due to the construction, which makes it extremely difficult to do anything with them. There is so much talk about ecology and recycling, and devices are allowed for sale that are apparently specially designed to make it as difficult or even impossible to dismantle and repair them...

    Cool? Ranking DIY
    About Author
    Level 8  
    nihildiximus wrote 30 posts with rating 18, helped 1 times. Live in city Wrocław. Been with us since 2018 year.
  • #2
    System Administrator
    As always, a great publication! The plugin is quite popular in Poland. It is, for example, in Media Markt. Sometimes there are interesting promotions on the plug.
    You're right, they make it more and more difficult to update the firmware.
  • #3
    Moderator Smart Home
    Interesting material, thank you for posting it, here are some comments from me:
    - if we want something easy to change the firmware and to open, it is worth considering Blitzwolf products. I think I even described the BW-SHP6 on the forum. They can be dismantled without spoiling. As far as I know, Blitzwolf has never been reported to have anything other than ESP8266/ESP8285 inside, but I could be wrong.
    - the date on the PCB is interesting, according to my observations, the BK versions appeared a bit after 7/20/29, so your socket is still from older batches
    - if you want something easy to open or at least proven, you can look for it on this list: https://openbekeniot.github.io/webapp/devicesList.html -WR01W I came up with this:
    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown
    I described the NEO/NAS shown above in both the BK and ESP versions. Here is a link to the ESP version (older):
  • #4
    Level 8  
    I have several Neo NAS-WR01W, but I approached the matter a little differently. After unscrewing the triangular screw (I sawed off the star bit to unscrew it) and ejecting the electronics by pushing out the pins, you can desolder the P25D80H visible next to the ESP, solder it to the SOP base on DIP and throw the FW through the programmer. I used XGecu T48, but even CH341A should be enough. This is probably the fastest and least invasive way. ;)
    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown

    Added after 2 [minutes]:

    I'm going to add this info in the linked entry about Neo, because maybe someone will find it useful. ;)
  • #5
    Level 7  
    very nice such a plugin, I have it myself, it's a revelation!
  • #6
    Level 11  

    I repeated the brute-fore teardown done by my colleague @nihildiximus, and I confirm his opinion that disassembly without destroying the case is practically impossible - maybe if someone had a desoldering / desoldier-gun and stripped all the tin from the socket pins.

    However, I would like to add an alternative cause of shorting and burning of the U1 chip.
    @nihildiximus in his post suggested that his circuit probably burned up due to attempts to pull out the pins, heating and finally spilled tin.
    In my case, the exact same circuit (converter?) is damaged (although not so spectacularly), and the only thing I did was remove the top plug and without it I connected the device to the socket.
    In my opinion, the way of mounting the ground plate is to blame for this situation - without the upper cap, it has no support point, and when plugging the device into the socket, there is a risk that the socket pin will move this plate towards the PCB, and this will cause a short circuit - I think that was my case.
    To my eye, there is about 5mm between the default location of this plate and the surface of the PCB. This plate is arranged in such a way that it runs in the vicinity of the L-In, L-Out, U1, C8 and L2 solder pads. If to

    The U1 circuit on my board - you can try to read some markings; I couldn't find anything.
    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown

    The method of arranging the ground plate in relation to the mentioned U1, L2, C8 and L-In/L-Out:
    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown
    I apologize for the quality of my descriptions in the image - the vertical fields on the left, closer to the U1 system, are C8, while the fields slightly to the right and diagonally are L2.

    Conclusion: Before plugging the device into the socket, assemble it so that the ground plates have support points and cannot move.

    Additionally: Despite the damaged U1 chip, I successfully soldered it to TYWE2S, and with the 3V3 power supplied from the outside, the original firmware started: the button and the LEDs worked. I uploaded the tasmota, and again - with the 3V3 power supplied from the outside, the module started. So you can try to replace the U1 and restore the board to full efficiency, or get a TYWE2S for DIY purposes.
  • #8
    Level 11  
    Unfortunately, I did not check tuya-connect - I suggested the entry of @nihildiximus, who wrote that he tried, and in my case the PCB is exactly the same version.
    Learning sometimes requires sacrifices - this time small, because these sockets are currently on sale (PLN 10) in one of the French grocery stores with the letter "C".
    I still have a few of these sockets, so when I finish playing with the corpse of the current one, I will definitely try the tuya-connect method on the next one.

    In the case of these corpses, I can send you some additional information:
    1. between the soldering points of the plug pins there is a 105 degrees Celsius thermal fuse - in my case everything indicates that the heating around the pins in order to release them blew the fuse - for me it is another proof that the device is constructed as non- serviceable.
    2. The name of the U1 chip was finally deciphered: KP3210BSGA - unfortunately it is not available in our country, and in a popular store with CN on "A" the price exceeds PLN 10 I paid for the entire socket.