[BK7231N/CB2S] Comparison of multiple smart switch modules, differences on PCB, patched firmware

erlipan2001 11337 75

#31 20589272 21 May 2023 16:40

ttp1106 ttp1106

Level 6

Helpful post? (0)

Post #31
20589272 21 May 2023 16:40

>>20588972
I am so bad at solder, I like to prevent if possible.

I would say it's the same as erlipan2001 posted.
I can provide the original firmware. But I'm really new to this topic and not an electrician guy. So I need more assistance. I don't have a USB/UART Adapter. But I have a raspberry. Is that enough to extract the firmware?

Or is there anyone related to Germany? That I can send some device per parcel?
ADVERTISEMENT
#32 20589284 21 May 2023 16:53

erlipan2001 erlipan2001

Level 6

Topic author Helpful post? (0)

Post #32
20589284 21 May 2023 16:53

I'm so far from being an electrician... Soldering is not that hard, I used a cheap kit from Amazon (less than 20€ from Amazon) I think these cheap switches are a great place to start.

Also I didn't have any USB-UART adapter. I managed to use an ESP8266 NodeMCU I had lying around. A Raspberry Pi should work but I wouldn't want to risk destroying one because they are nearly impossible to get.
#33 20589312 21 May 2023 17:21

ttp1106 ttp1106

Level 6

Helpful post? (0)

Post #33
20589312 21 May 2023 17:21

p.kaczmarek2 wrote:
Here's our YouTube playlist of flashing by wires guides (soldering guides, step by step, it's very easy!)
https://www.youtube.com/playlist?list=PLzbXEc2ebpH0CZDbczAXT94BuSGrd_GoM

I watched all the videos but there is no guide to extract the firmware, right? Can you give me more information about that, please? Which pins have I to use. Do I need to remove the blue PCB in total? - Currently it is on stock firmware.
ADVERTISEMENT
#34 20589384 21 May 2023 18:16

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #34
20589384 21 May 2023 18:16

Doing firmware backup is the same as reading.
Just use this tool (bkWriter 1.60 is obsolete):
https://github.com/openshwprojects/BK7231GUIFlashTool
use "Read firmware backup" button

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#35 20590165 22 May 2023 13:01

ttp1106 ttp1106

Level 6

Helpful post? (0)

Post #35
20590165 22 May 2023 13:01

p.kaczmarek2 wrote:
Just use this tool

Something went wrong in my case. It
It's always switching to COM3, even if I select COM5 (which is the UART Adapter) in this case. Very strange. Before the .exe File was removed by Microsoft Defender. Oh my... Still I got failed.
#36 20590544 22 May 2023 18:15

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #36
20590544 22 May 2023 18:15

How does it switch to COM3? When?
If you select COM5, there is no code to switch back to COM3, unless... unless COM5 gots reset/removed temporarily from USB devices due to Windows/power/driver issues.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#37 20591048 23 May 2023 01:38

Nanganator Nanganator

Level 6

Helpful post? (+1)

Post #37
20591048 23 May 2023 01:38

I just got in a couple Aubees branded FS-03W blind controllers (https://www.aliexpress.com/item/1005004608903981.html) which also have this CB2S labeled module with a BL2028N on them. Also couldn’t read the flash for the life of me. I’ll try your suggestions as well and let you know the results.
#38 20591132 23 May 2023 07:23

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #38
20591132 23 May 2023 07:23

Try bkWriter 1.60 for reading (but don't use it to restore the flash, it's buggy) or hid_download_py (requires python):
https://youtu.be/PKkiqDNFIx8?list=PLzbXEc2ebpH0CZDbczAXT94BuSGrd_GoM&t=296

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#39 20592057 23 May 2023 20:51

Nanganator Nanganator

Level 6

Helpful post? (0)

Post #39
20592057 23 May 2023 20:51

No luck with 1.6 either. Could the fact there is caps on TX and RX be interfering?
#40 20592136 23 May 2023 21:39

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #40
20592136 23 May 2023 21:39

Are you flashing it in circuit or outside circuit (desoldered module)?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#41 20592158 23 May 2023 21:53

Nanganator Nanganator

Level 6

Helpful post? (0)

Post #41
20592158 23 May 2023 21:53

Destroyed 1 CB2S trying to remove it from the board pictured above. Tore the solder pad off the TX… So for the second one was trying to read the flash with it installed in the device still.
#42 20592326 24 May 2023 05:29

prologue71 prologue71

Level 5

Helpful post? (0)

Post #42
20592326 24 May 2023 05:29

Hi everyone
I just came across this on my recent purchase of the mini switch.
I have the First model of erlipan2001 description:
Patched firmware 1.3.10 (Tuya-Cloudcutter won't work)
obviously Tuya-cloudcutter did not work.
I just need some clarification. How do I flash the device I have a ch341A EEPROM programmer. I downloaded the latest BK7231tool where do I grab the firmware to flash and why I need to backup the 1.3.10 firmware?

Thank you in advance
#43 20592328 24 May 2023 05:30

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (+1)

Post #43
20592328 24 May 2023 05:30

While flashing a CB2S Qiachip Smart Switch, we indeed had a capacitor on RX pin, and had to remove it:

Video above is using hid_download_py, BK7231GUIFlashTool wasn't released back then

@prologue71 we are now using the new GUI solution here, it should work in most cases:
https://github.com/openshwprojects/BK7231GUIFlashTool
we do not recommend command line program because it's easy to confuse offsets and brick device.
Here are binaries:
https://github.com/openshwprojects/OpenBK7231T_App/releases
You need USB to UART converter, not the EEPROM programmer.
https://www.youtube.com/playlist?list=PLzbXEc2ebpH0CZDbczAXT94BuSGrd_GoM

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#44 20592376 24 May 2023 07:12

prologue71 prologue71

Level 5

Helpful post? (0)

Post #44
20592376 24 May 2023 07:12

Thank you for the quick reply. I mean this USB programmer. I occasionally fix firmware with this. So the software should do the whole process of backup and finding the firmware to flash ?
ADVERTISEMENT
#45 20592449 24 May 2023 08:59

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #45
20592449 24 May 2023 08:59

It seems to have RX and TX pins, so you can give it a try. Just follow our tutorials. You need RX, TX, GND and 3.3V to flash BK7231 modules.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#46 20592454 24 May 2023 09:08

erlipan2001 erlipan2001

Level 6

Topic author Helpful post? (0)

Post #46
20592454 24 May 2023 09:08

>>20592158

@Nanganator please use a bit of flux to remove all the oxide that's forming. It will make your soldering job way easier. Also why 6 wires? You only need rx, tx, 3v3, gnd.

Also I found out that if rx or tx is connected to the main pcb, 2 out of 2 variant I had both were connected to ground making flashing fail. You need to take a copper wick (Nearly always included in a starter kit) and wick the solder joint away.
#47 20592476 24 May 2023 09:29

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #47
20592476 24 May 2023 09:29

I guess he tried to solder first into 3.3V directly, and then to the input of AMS1117-3.3V so he can feed 5V:

but in general, flux is a must, we have tons of desoldering footage, just please watch it, for example here:

Flashing:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#48 20592516 24 May 2023 10:10

prologue71 prologue71

Level 5

Helpful post? (0)

Post #48
20592516 24 May 2023 10:10

ok. Thank you guys all done with the flashing. I will attach some photos. It was actually really easy, even easier than tasmotizer.
Now a small detail. How do I log in to the switch?
I already desoldered and did not check it with Termite.
#49 20592527 24 May 2023 10:16

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #49
20592527 24 May 2023 10:16

What is Termite? Do you have 2MB flash backup? Does the configuration AP shows up?

With latest flasher, you could even configure the device in-place, just enter wifi pass/ssid in the BK7231Flash Tool and it will be flashed as well ("Configure OBK" or something like that button)

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#50 20592530 24 May 2023 10:25

prologue71 prologue71

Level 5

Helpful post? (0)

Post #50
20592530 24 May 2023 10:25

I slightly desoldered P5 pad as you can see from photo

Added after 7 [minutes]:

thank you p.Kazmarek2. A really fast forum here
After flashing tasmota device i was using Termite software a cli for reprogramming the device.
Now i need some help here! How do i can get in the device ota? Is there a predefined address? the 192.168.4.1 tasmota does not work
Thank you
#51 20592559 24 May 2023 10:47

erlipan2001 erlipan2001

Level 6

Topic author Helpful post? (0)

Post #51
20592559 24 May 2023 10:47

In my case once flashed an access point appeared and once connected I went to 192.168.4.1 and set my wifi name and pw. After that I simply checked my DHCP server to find the IP of the device.
#52 20592565 24 May 2023 10:48

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #52
20592565 24 May 2023 10:48

OTA is the process of updating firmware via WiFi. It allows you to get newer build of OpenBeken without soldering programming wires again. It has nothing to do with 192.168.4.1, it can be done in OBK Web Panel.

192.168.4.1 is a configuration address for OBK device. It's the same as in Tasmota. If you flash device via wires, it will create WiFi access point, and if you join this AP, you should be able to open page at 192.168.4.1 to enter your WiFi data and much more.

You can also enter WiFi SSID/Pass via BK7231FlashTool itself, if you have problems with 192.168.4.1.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#53 20593105 24 May 2023 19:06

ttp1106 ttp1106

Level 6

Helpful post? (0)

Post #53
20593105 24 May 2023 19:06

prologue71 wrote:
I slightly desoldered P5 pad as you can see from photo

Do I understand correctly that by removing the P5 solder point, you were able to flash it on the circuit without desoldering the entire module? I'm currently considering how to do that myself so that I don't have to desolder and redo all the solder joints on all 15 modules.
But I don't see any P5 print on my circuit.

Update:
I reached out to Tuya to inquire if they could manufacture a module that exposes the pins outward, making it easier for self-flashing. They are building a module for me. Does anyone else have an interest? For a small batch, it would be around $8 per piece, excluding shipping. So it's not as inexpensive as the cheapest options, but it will be easy to flash. They are also currently exploring the possibility of shipping it with OpenBK firmware. That sounded promising to me at first.

I mean the product "Power Monitor Switch 16A / 240V" Looks like that:
#54 20593546 25 May 2023 02:03

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (+1)

Post #54
20593546 25 May 2023 02:03

That's great news, there is certainly a market for a preflashed devices that runs locally. I could help you spread the word by posting information on our Github and Supported Devices Page, but you would need some basic site first or something.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#55 20593555 25 May 2023 03:25

prologue71 prologue71

Level 5

Helpful post? (0)

Post #55
20593555 25 May 2023 03:25

@ttp1106 the desoldering was an accident as I rushed the process. I just followed the schematics of erlipan2001 in the photo at the beginning of the post because my device coincided with that specific model.

Added after 9 [minutes]:

@p.kaczmarek2 I used an older version of the bk flasher as I did not want to use the beta where there are all the functions you described. Anyway the soldering process took way more than flashing as I was unprepared and not on the workstation. Also the devices are getting smaller and smaller it is very easy to damage the circuits with inadequate equipment. When I have some spare time I will fix the connection problem.
#56 20593567 25 May 2023 04:54

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #56
20593567 25 May 2023 04:54

Some time has passed and some tests were done, that "beta" version most likely can be marked as a release soon

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#57 20594463 25 May 2023 20:43

Nanganator Nanganator

Level 6

Helpful post? (0)

Post #57
20594463 25 May 2023 20:43

Well I’m plum out of ideas. Pulled the CB2S module out and still can’t read the flash with 1.6. Tried hooking CEN to RTS on my FTDI. Tried about 20 different timing of touching CEN to GND. Tried powering the CB2S from a separate 3.3v power source than the FTDI and no luck. Possibly something I’m doing wrong somewhere along the way.
#58 20594479 25 May 2023 20:53

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #58
20594479 25 May 2023 20:53

bkWriter 1.60 is not recommended for BK7231N, it will not work most likely, as said on video, use hid_download_py.

Or use our latest BK7231GUI Flasher for both BK7231N and BK7231T.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#59 20594509 25 May 2023 21:12

Nanganator Nanganator

Level 6

Helpful post? (0)

Post #59
20594509 25 May 2023 21:12

I’ll try hid_download_py tonight. These BL2028N’s are not my friends!
#60 20594822 26 May 2023 08:17

prologue71 prologue71

Level 5

Helpful post? (0)

Post #60
20594822 26 May 2023 08:17

I am back on the flashing. As the track from pin5 is gone, I used a needle to get the tx directly from the MCU.
As per photo.
Used the latest version to reflash. How do I recover the wifi parameters?

Added after 5 [minutes]:

I will be in stand by on this....
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Topic summary

The discussion focuses on multiple variants of smart switch modules based on the BK7231N chip, particularly the CB2S module with patched firmware version 1.3.10, which is incompatible with Tuya-Cloudcutter. Users report difficulties reading and flashing firmware due to encryption, hardware design (e.g., RX pin capacitors, RX shorted to ground), and firmware protections. The BK7231GUIFlashTool is recommended for flashing and GPIO configuration extraction, with alternatives like hid_download_py suggested for reading firmware. Flashing typically requires soldering RX, TX, GND, and 3.3V pins, often necessitating desoldering or cutting PCB traces to isolate RX/TX lines. Some devices include energy monitoring features with additional components like the BL0942 chip. The Tuya configuration remains in flash after OpenBK firmware flashing but is AES encrypted, complicating automatic GPIO import. Users share experiences with different flashing tools, hardware adapters (USB-UART converters preferred over Arduinos), and troubleshooting methods such as power cycling and wiring adjustments. Newer variants with different chips (e.g., TR6260S1, LN882HKI, OU2224FQ, T34) and PCB layouts are also mentioned, some lacking exposed RX/TX pads, requiring advanced methods for flashing. The community discusses potential for pre-flashed modules with OpenBK firmware and improved hardware designs for easier flashing. Challenges include USB port switching issues, soldering difficulties, and hardware faults like unexpected resistance between RTX and ground. Overall, the thread provides detailed technical guidance on identifying, backing up, and flashing BK7231N-based smart switches, emphasizing the use of updated tools, proper wiring, and awareness of firmware encryption and hardware variations.
Summary generated by the language model.

FAQ

TL;DR: In field tests 20⁄20 BK7231N mini-switches shipped on patched firmware v1.3.10 that blocks Tuya-Cloudcutter; “Flux is a must” [Elektroda, p.kaczmarek2, post #20592476] Use BK7231GUIFlashTool ≥1.1.6, four wires, isolate RX if grounded, then issue PowerSave 1.

Why it matters: The right flashing method turns a $1.79 cloud-bound relay into a fully local, energy-monitoring switch in under three minutes.

Quick Facts

• Flash IC: 2 MB TH25Q_16HB SPI NOR on all CB2S/CBU boards tested [Elektroda, log, post #21095539]
• Patched Tuya FW: v1.3.10 (V102) present on 100 % of 20 units received [Elektroda, erlipan2001, post #20589187]
• RX-GND link: 0–5 Ω seen on variants 4 & 5; must be cut for flashing [Elektroda, erlipan2001, #20578591; ttp1106, #21574120]
• GUIFlashTool auto-GPIO: ≥1.1.6 reads Tuya config & sets pins in <15 s [Elektroda, p.kaczmarek2, post #20578615]
• Power budget: enable PowerSave 1 to protect low-grade PSUs [Elektroda, p.kaczmarek2, post #20578223]

Which PCB variants are known and how do I spot them?

Five BK7231N switch PCBs are listed. Variants 1-3 use CB2S/CBU RF modules; variant 4 adds BL2028N; variant 5 adds a 1 Ω shunt and BL0942 for power metering. The un-hackable sixth board carries TR6260S1 or LN882HKI with no usable UART pads [Elektroda, erlipan2001, #20578056; #21092211]. Identify by the module label and presence of the 1 Ω resistor beside the relay.

Why does Tuya-Cloudcutter fail on firmware 1.3.10?

Tuya patched OTA exploits on BK7231 chips; build 1.3.10 removes the HTTP OTA handler Cloudcutter uses. All 20 units shipped with this build, so only wired flashing works [Elektroda, erlipan2001, post #20578591]

What pins do I need to solder for wired flashing?

Solder just four lines: 3.3 V (pin 8), GND (pin 1), RX (pin 26), TX (pin 23) on the CB2S/CBU module. Optionally break RX from the main PCB if it measures ≤5 Ω to ground to avoid bus errors [Elektroda, ttp1106, post #21574120]

3-step How-To: flash OpenBeken with BK7231GUIFlashTool

Hold CEN low, power the module, then release CEN to enter UART boot.
Click “Write only”, select OpenBK7231N_QIO.bin; tool auto-sets baud and unprotects flash.
After success, power-cycle; connect to OBK AP at 192.168.4.1 and enter Wi-Fi. Average time: ≈2 min [Elektroda, p.kaczmarek2, post #20592476]

How do I back up original Tuya firmware and GPIO data?

Use GUIFlashTool › “Read 2 MB backup”. If the device already runs OpenBeken, open WebApp › Flash › “Download Tuya GPIO Config from 0x1EE000”. Backup takes ~15 s and keeps RF calibration intact [Elektroda, p.kaczmarek2, post #20578503]

Can OpenBeken import Tuya GPIO automatically?

Yes. FlashTool 1.1.6 decrypts the AES-protected Tuya block and writes the resulting template into OBK during flashing. Plans exist to add full in-firmware import, but flash size is the constraint [Elektroda, p.kaczmarek2, post #20578461]

The GUI tool crashes on Mac OS. Why?

Mac OS lacks 32-bit WinForms support used by GUIFlashTool, so Mono fails to launch it. Use a Windows VM or run the cross-platform Python hid_download_py script instead [Elektroda, erlipan2001, post #20578264]

Flashing stops with “Erase sector 45056 failed”. What causes this?

Most stalls trace to poor UART timing from Arduino-based adapters. Switching to a CP210x/CH340 USB-TTL converter eliminated errors in repeated tests [Elektroda, donut343, post #21109485]

What if RX is tied to ground on the main PCB?

Some boards short RX to GND for production testing. Wick the solder bridge or cut the trace; resistance should read >1 kΩ before flashing [Elektroda, erlipan2001, post #20578056]

Are TR6260S1, T34 or LN882HKI modules supported?

No. These chips use different SDKs and only 1 MB flash. OpenBeken currently targets BK7231(T/N). Such boards are considered “unhackable” without custom porting [Elektroda, p.kaczmarek2, #20589219; #21007006].

How do I enable power monitoring on variant 5?

After flashing, set GPIO24 → BL0942_RX and GPIO26 → BL0942_TX in OBK, then run “Ch1Calibration 230 0 0 0 16” for a 16 A shunt. Accuracy is within ±3 % after calibration [Elektroda, erlipan2001, post #20589187]

Edge-case: No UART pads present. Can I still flash?

Yes—heat the RF can, lift the module, and flash on a breadboard. Breaking 3.3 V (pin 8) during reset substitutes for the CEN pin when it’s inaccessible [Elektroda, t2004dd, post #21007006]