If you have entered wrong SSID/ETC, you can do quick 5 power on/off cycles of device, so it will return to AP mode.
If you have entered wrong SSID/ETC, you can do quick 5 power on/off cycles of device, so it will return to AP mode.
Czy wolisz polską wersję strony elektroda?
Nie, dziękuję Przekieruj mnie tamerlipan2001 wrote:Second one:
Also patched firmware
Device configuration, as extracted from Tuya:
- Pair/Toggle All Pin on P23
- WiFi LED on P26
- TglChannelToggle (channel 1) on P6
- Relay (channel 1) on P7
Device seems to be using CB2S module, which is using BK7231N.
p.kaczmarek2 wrote:@mawe22 which platform is that? I had reports about Linux instability with the flasher.
[...]
Here is a link to hid_download_py:
https://github.com/OpenBekenIOT/hid_download_py
## installation according to the documentation
git clone https://github.com/OpenBekenIOT/hid_download_py.git
cd hid_download_py/
sudo apt install python3-hid python3-serial python3-tqdm
python3 setup.py install --user
## execute program
./uartprogram -r first.dump
UartDownloader....
Read Getting Bus...
Gotten Bus...
Set baudrate successful
len: 119000
startAddr: 11000
Reading 11000
ReadSector Success 11000 len 1000
4096
Reading 12000
ReadSector Success 12000 len 1000
8192
[...]
Reading 129000
ReadSector Success 129000 len 1000
1150976
CRC should be 602db5a9
CRC is 9d3b7c60
CRC check failed
Wrote 119000 bytes to 2.dump
## extract Dump
./uartprogram -p first.dump
Failed to extract Tuya keys - magic constant header not found in binary
Starting flash new (no backup)!
Now is: Saturday, May 25, 2024 11:40:32 AM.
Flasher mode: BK7231N
Going to open port: COM7.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q_16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Reading file firmwares/OpenBK7231N_QIO_1.17.592.bin...
Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.17.592.bin...
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Failed to set baud rate!
Starting flash new (no backup)!
Now is: Saturday, May 25, 2024 11:40:39 AM.
Flasher mode: BK7231N
Going to open port: COM7.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q_16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Reading file firmwares/OpenBK7231N_QIO_1.17.592.bin...
Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.17.592.bin...
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q_16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to do erase, start 0, sec count 298!
Erasing sector 0... ok! Erasing sector 4096... ok! Erasing sector 8192... ok! Erasing sector 12288... ok! Erasing sector 16384... ok! Erasing sector 20480... ok! Erasing sector 24576... ok! Erasing sector 28672... ok! Erasing sector 32768... ok! Erasing sector 36864... ok! Erasing sector 40960... ok! Erasing sector 45056... Erasing sector 45056 failed!
Writing file data to chip failed.
Starting flash new (no backup)!
Now is: Saturday, May 25, 2024 11:41:35 AM.
Flasher mode: BK7231N
Going to open port: COM7.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
CheckRespond_FlashGetMID: bad value returned?
Failed to read device MID!
Reading file firmwares/OpenBK7231N_QIO_1.17.592.bin...
Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.17.592.bin...
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
CheckRespond_FlashGetMID: bad value returned?
Failed to read device MID!
Going to do erase, start 0, sec count 298!
Erasing sector 0... Erasing sector 0 failed!
Writing file data to chip failed.
Starting flash new (no backup)!
Now is: Saturday, May 25, 2024 11:42:06 AM.
Flasher mode: BK7231N
Going to open port: COM7.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
CheckRespond_FlashGetMID: bad value returned?
Failed to read device MID!
Reading file firmwares/OpenBK7231N_QIO_1.17.592.bin...
Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.17.592.bin...
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
CheckRespond_FlashGetMID: bad value returned?
Failed to read device MID!
Going to do erase, start 0, sec count 298!
Erasing sector 0... ok! Erasing sector 4096... ok! Erasing sector 8192... ok! Erasing sector 12288... ok! Erasing sector 16384... ok! Erasing sector 20480... ok! Erasing sector 24576... ok! Erasing sector 28672... ok! Erasing sector 32768... ok! Erasing sector 36864... ok! Erasing sector 40960... ok! Erasing sector 45056... ok! Erasing sector 49152... ok! Erasing sector 53248... ok! Erasing sector 57344... ok! Erasing sector 61440... ok! Erasing sector 65536... ok! Erasing sector 69632... ok! Erasing sector 73728... ok! Erasing sector 77824... ok! Erasing sector 81920... ok! Erasing sector 86016... ok! Erasing sector 90112... ok! Erasing sector 94208... ok! Erasing sector 98304... ok! Erasing sector 102400... ok! Erasing sector 106496... ok! Erasing sector 110592... ok! Erasing sector 114688... ok! Erasing sector 118784... ok! Erasing sector 122880... ok! Erasing sector 126976... ok! Erasing sector 131072... ok! Erasing sector 135168... ok! Erasing sector 139264... ok! Erasing sector 143360... ok! Erasing sector 147456... ok! Erasing sector 151552... ok! Erasing sector 155648... ok! Erasing sector 159744... ok! Erasing sector 163840... ok! Erasing sector 167936... ok! Erasing sector 172032... ok! Erasing sector 176128... ok! Erasing sector 180224... ok! Erasing sector 184320... ok! Erasing sector 188416... ok! Erasing sector 192512... ok! Erasing sector 196608... ok! Erasing sector 200704... ok! Erasing sector 204800... ok! Erasing sector 208896... ok! Erasing sector 212992... ok! Erasing sector 217088... ok! Erasing sector 221184... ok! Erasing sector 225280... ok! Erasing sector 229376... ok! Erasing sector 233472... Erasing sector 233472 failed!
Writing file data to chip failed.
TL;DR: In field tests 20⁄20 BK7231N mini-switches shipped on patched firmware v1.3.10 that blocks Tuya-Cloudcutter; “Flux is a must” [Elektroda, p.kaczmarek2, post #20592476] Use BK7231GUIFlashTool ≥1.1.6, four wires, isolate RX if grounded, then issue PowerSave 1.
Why it matters: The right flashing method turns a $1.79 cloud-bound relay into a fully local, energy-monitoring switch in under three minutes.
• Flash IC: 2 MB TH25Q_16HB SPI NOR on all CB2S/CBU boards tested [Elektroda, log, post #21095539] • Patched Tuya FW: v1.3.10 (V102) present on 100 % of 20 units received [Elektroda, erlipan2001, post #20589187] • RX-GND link: 0–5 Ω seen on variants 4 & 5; must be cut for flashing [Elektroda, erlipan2001, #20578591; ttp1106, #21574120] • GUIFlashTool auto-GPIO: ≥1.1.6 reads Tuya config & sets pins in <15 s [Elektroda, p.kaczmarek2, post #20578615] • Power budget: enable PowerSave 1 to protect low-grade PSUs [Elektroda, p.kaczmarek2, post #20578223]