logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[BK7231N/CB2S] Comparison of multiple smart switch modules, differences on PCB, patched firmware

erlipan2001 16542 78
Best answers LABEL_AI_GENERATED

How can I flash these patched BK7231N/CB2S smart switch modules and recover their GPIO pinout/config?

Use the latest BK7231GUIFlashTool/OpenBK tools: they can auto-configure the GPIOs, and even after OpenBeken is flashed you can still pull the Tuya GPIO config from flash because it is not overwritten; the web app has a "Download Tuya GPIO Config from 0x1EE000" action that generates a .bin you can drag back into the flasher [#20578223][#20578503][#20578615] If reading the firmware fails on firmware 1.3.10, that does not block flashing—flash-only works, and the maintainer asked for 2 MB dumps for analysis when possible [#20578297][#20578322][#20578356] On these cheap switches, enable PowerSave 1 in the startup command because the power supplies are weak [#20578223] For some variants, in-circuit flashing fails unless you remove the RX-to-GND solder bridge or an RX capacitor; one reply also notes that a USB-to-UART adapter is preferred over an EEPROM programmer [#20592328][#20592454]
AI summary based on the discussion. May contain errors.
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #61 20594831
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14771
    Help: 659
    Rate: 12914
    What do you mean by "WiFi parameters"? If you want to get Template from tuya config, you can do "Read 2MB backup", or use any approach from here:



    If you have entered wrong SSID/ETC, you can do quick 5 power on/off cycles of device, so it will return to AP mode.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT

  • CP210x adapter on port 5, writer 1.60 fails

    #62 20600888
    ttp1106
    Level 6  
    Posts: 9
    Hi Guys, I still need your help. I desoldered two chips of my devices and solder the 4 pins.
    It will not work.

    [BK7231N/CB2S] Comparison of multiple smart switch modules, differences on PCB, patched firmware

    If I put CEN to ground nothing happens. Also if I disconnected ground or VCC completely for a few seconds, nothing will happen.
    I don't get it what I'm doing wrong...

    [BK7231N/CB2S] Comparison of multiple smart switch modules, differences on PCB, patched firmware

    Now Port 5 is stable and it's my CP210x Adapter.

    Also Writer 1.60 fails
    [BK7231N/CB2S] Comparison of multiple smart switch modules, differences on PCB, patched firmware

  • BK7231N flashing reset and wiring checks

    #63 20600974
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14771
    Help: 659
    Rate: 12914
    You have white wire on ground and black on VDD? I hope you didn't swap them..
    bkWriter 1.60 won't work for BK7231N.

    How do you power the module? Maybe you haven't swapped RX to TX and TX to RX? Maybe wires are too long?
    Maybe try this method of resetting:
    1. start flashing process
    2. disconnect VDD
    3. temporary connectect VDD wire of BK7231 (NOT THE ONE of power supply! That would be short-circuit) to GND
    4. connect VDD of BK7231 to power supply VDD (3.3V)
    Helpful post? Buy me a coffee.
  • #64 20601283
    rakalexei
    Level 8  
    Posts: 21
    Rate: 4
    [BK7231N/CB2S] Comparison of multiple smart switch modules, differences on PCB, patched firmware [BK7231N/CB2S] Comparison of multiple smart switch modules, differences on PCB, patched firmware

    I also having issues, tried to put CEN to GND - nothing, tried your method above with VDD and GND, got this error message. Not sure what I'm doing wrong.
    Could you please help?

  • OU2224FQ variant with energy monitor chip identified

    #65 20833381
    RobertoD91
    Level 2  
    Posts: 2

    erlipan2001 wrote:
    Second one:
    Also patched firmware


    Device configuration, as extracted from Tuya:
    - Pair/Toggle All Pin on P23
    - WiFi LED on P26
    - TglChannelToggle (channel 1) on P6
    - Relay (channel 1) on P7
    Device seems to be using CB2S module, which is using BK7231N.


    Hi, I found this version. Is it similar to version 2, or is it different?

    The chip is OU2224FQ instead of NU2134FQ.
    There is an energy monitor chip.
    I'm a novice. Does someone think I can use the same pin for flashing?

    Close-up of a circuit board with an OU2224FQ chip. Image of an electronic circuit board with Fanhar FH17-1A2TLE DC5V components on a PCB. Device update screen showing the firmware is up to date. Phone screen showing the addition of a device WBP-1G.

  • T34 chip flashing via 3.3V pin break

    #66 21007006
    t2004dd
    Level 5  
    Posts: 11
    Rate: 9
    HI All! I have a lot of switches based on this chip, but with different PCB layouts. I have bought the next bundle of smart switches from AliExpress, and they are without RX TX pads at all, based on T34 chip.

    Close-up of a PCB fragment with electronic components and a T34 chip. Multilayer printed circuit board with T34 chip and electronic components.

    I blew off the chip. It seems that there is only one way to flash it. Pin 26 is not attached at all. According to the picture I have connected CEN ( pin 9) but it is not necessary. It is much easier to break the 3.3V (pin 8).

    Close-up of a chip with several connected wires placed on a white base.

    See also the topic here
    https://www.elektroda.pl/rtvforum/topic4033216.html#20942683

    Used ports:
    P26 pin 15
    P23 pin 17
    P6 pin 21
    P8 pin 23
  • ADVERTISEMENT
  • #67 21011366
    mawe22
    Level 4  
    Posts: 8
    Help: 1
    Rate: 2

    >>20589226
    I have a bunch of these Switches. No luck reading with bk7231flasher_1.1.6
    Can you provide me with some help (if possible) Writing works like a charm but reading gets stuck anytime at
    Attachments:
    • [BK7231N/CB2S] Comparison of multiple smart switch modules, differences on PCB, patched firmware Bildschirmfoto vom 2024-03-19 23-11-00.png (99.9 KB) You must be logged in to download this attachment.
  • #68 21011456
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14771
    Help: 659
    Rate: 12914
    @mawe22 which platform is that? I had reports about Linux instability with the flasher.
    Try this method:
    https://youtu.be/PKkiqDNFIx8?t=293
    Here is a link to hid_download_py:
    https://github.com/OpenBekenIOT/hid_download_py
    See the steps on the video. You can see there both read and flash commands.
    Helpful post? Buy me a coffee.

  • Linux flasher reads dump but fails CRC and key extraction

    #69 21011813
    mawe22
    Level 4  
    Posts: 8
    Help: 1
    Rate: 2

    p.kaczmarek2 wrote:
    @mawe22 which platform is that? I had reports about Linux instability with the flasher.
    [...]
    Here is a link to hid_download_py:
    https://github.com/OpenBekenIOT/hid_download_py


    this is what I did:

    Code: text Expand Select all Copy to clipboard
    ## installation according to the documentation
git clone https://github.com/OpenBekenIOT/hid_download_py.git
cd hid_download_py/
sudo apt install python3-hid python3-serial python3-tqdm
python3 setup.py install --user
## execute program
./uartprogram -r first.dump
UartDownloader....
Read Getting Bus...
Gotten Bus...
Set baudrate successful
len: 119000
startAddr: 11000
Reading 11000
ReadSector Success 11000 len 1000
4096
Reading 12000
ReadSector Success 12000 len 1000
8192
[...]
Reading 129000
ReadSector Success 129000 len 1000
1150976
CRC should be 602db5a9
CRC is 9d3b7c60
CRC check failed
Wrote 119000 bytes to 2.dump
## extract Dump
./uartprogram -p first.dump


    BK7231Flasher.exe -> Extract config from Tuya binary ->
    Neither first.dump nor first.dump.unpackage.bin can be read.

    Code: text Expand Select all Copy to clipboard
    Failed to extract Tuya keys - magic constant header not found in binary

  • #70 21012246
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14771
    Help: 659
    Rate: 12914
    hid_download_py CRC error can be ignored, but I can see that you are not using the command from the video. You need to use the command as we've shown on our video, it also specifies 2MB backup size.

    Futhermore, some devices just don't have Tuya keys. It happens from time to time. Then it's recommended to use GPIO Doctor from the OBK Web App to find out GPIO roles.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #72 21092514
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14771
    Help: 659
    Rate: 12914
    This may be the one that I also have. Just make sure to run it with PowerSave 1.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT

  • SoftwareSerial and Arduino still fail to set baud rate

    #73 21095539
    donut343
    Level 2  
    Posts: 18
    Rate: 1
    I have two of the switches OP listed, but can't manage to flash them, they also have firmware 1.3.10 v102. I wired them up like you showed in your first post.
    I get several errors during the flashing process after repeatedly clicking the "write only" button, I added them at the bottom of this post. Things I tried:

    - Swapped arduino nano for uno
    - Used SoftwareSerial (see added code)
    - Wiped arduinos and used Rx Tx pins with gnd and reset pins shorted (cant set baud rate with that setup)
    - Tried standalone psu @ 3.3v instead of arduino 3.3v pin
    - Tried hid_download_py and to flash through CMD, to no avail. It fails to set baud rate.
    - Tried different USB ports

    Does anyone have some advice? I'm about to order some USB to TTL uart bridge adapters to try instead of the arduinos..

    Arduino Nano connected to a PCB on a breadboard.
    Code: Arduino
    Log in, to see the code


    Code: text Expand Select all Copy to clipboard
    
Starting flash new (no backup)!
Now is: Saturday, May 25, 2024 11:40:32 AM.
Flasher mode: BK7231N
Going to open port: COM7.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q_16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Reading file firmwares/OpenBK7231N_QIO_1.17.592.bin...
Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.17.592.bin...
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Failed to set baud rate!

Starting flash new (no backup)!
Now is: Saturday, May 25, 2024 11:40:39 AM.
Flasher mode: BK7231N
Going to open port: COM7.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q_16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Reading file firmwares/OpenBK7231N_QIO_1.17.592.bin...
Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.17.592.bin...
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q_16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to do erase, start 0, sec count 298!
Erasing sector 0... ok! Erasing sector 4096... ok! Erasing sector 8192... ok! Erasing sector 12288... ok! Erasing sector 16384... ok! Erasing sector 20480... ok! Erasing sector 24576... ok! Erasing sector 28672... ok! Erasing sector 32768... ok! Erasing sector 36864... ok! Erasing sector 40960... ok! Erasing sector 45056... Erasing sector 45056 failed!
Writing file data to chip failed.

Starting flash new (no backup)!
Now is: Saturday, May 25, 2024 11:41:35 AM.
Flasher mode: BK7231N
Going to open port: COM7.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
CheckRespond_FlashGetMID: bad value returned?
Failed to read device MID!
Reading file firmwares/OpenBK7231N_QIO_1.17.592.bin...
Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.17.592.bin...
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
CheckRespond_FlashGetMID: bad value returned?
Failed to read device MID!
Going to do erase, start 0, sec count 298!
Erasing sector 0... Erasing sector 0 failed!
Writing file data to chip failed.

Starting flash new (no backup)!
Now is: Saturday, May 25, 2024 11:42:06 AM.
Flasher mode: BK7231N
Going to open port: COM7.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
CheckRespond_FlashGetMID: bad value returned?
Failed to read device MID!
Reading file firmwares/OpenBK7231N_QIO_1.17.592.bin...
Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.17.592.bin...
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
CheckRespond_FlashGetMID: bad value returned?
Failed to read device MID!
Going to do erase, start 0, sec count 298!
Erasing sector 0... ok! Erasing sector 4096... ok! Erasing sector 8192... ok! Erasing sector 12288... ok! Erasing sector 16384... ok! Erasing sector 20480... ok! Erasing sector 24576... ok! Erasing sector 28672... ok! Erasing sector 32768... ok! Erasing sector 36864... ok! Erasing sector 40960... ok! Erasing sector 45056... ok! Erasing sector 49152... ok! Erasing sector 53248... ok! Erasing sector 57344... ok! Erasing sector 61440... ok! Erasing sector 65536... ok! Erasing sector 69632... ok! Erasing sector 73728... ok! Erasing sector 77824... ok! Erasing sector 81920... ok! Erasing sector 86016... ok! Erasing sector 90112... ok! Erasing sector 94208... ok! Erasing sector 98304... ok! Erasing sector 102400... ok! Erasing sector 106496... ok! Erasing sector 110592... ok! Erasing sector 114688... ok! Erasing sector 118784... ok! Erasing sector 122880... ok! Erasing sector 126976... ok! Erasing sector 131072... ok! Erasing sector 135168... ok! Erasing sector 139264... ok! Erasing sector 143360... ok! Erasing sector 147456... ok! Erasing sector 151552... ok! Erasing sector 155648... ok! Erasing sector 159744... ok! Erasing sector 163840... ok! Erasing sector 167936... ok! Erasing sector 172032... ok! Erasing sector 176128... ok! Erasing sector 180224... ok! Erasing sector 184320... ok! Erasing sector 188416... ok! Erasing sector 192512... ok! Erasing sector 196608... ok! Erasing sector 200704... ok! Erasing sector 204800... ok! Erasing sector 208896... ok! Erasing sector 212992... ok! Erasing sector 217088... ok! Erasing sector 221184... ok! Erasing sector 225280... ok! Erasing sector 229376... ok! Erasing sector 233472... Erasing sector 233472 failed!
Writing file data to chip failed.
  • #74 21109310
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14771
    Help: 659
    Rate: 12914
    I will just add for clarity that @donut343 issue has been solved in :
    Reading/writing errors on tuya mini switches - issues with arduinos?
    Helpful post? Buy me a coffee.
  • #75 21109485
    donut343
    Level 2  
    Posts: 18
    Rate: 1

    >>21109310 Sorry, I should have mentioned! Indeed, turns out my Arduinos all resulted in poor communication with the chips. After using a USB TTL-UART converter I managed to work it out. Thanks @ OP for the information of soldering + pin layout though!
  • #76 21574120
    ttp1106
    Level 6  
    Posts: 9
    >>20600974

    I found out that I have 5 Ohms between RTX and GRD on this board.

    Electronic module with connected wires on a wooden table.
    A blue electronic module with connected wires, held in hand, on a wooden table background.

    I think that is causing the issue while I cannot flash it. Do you know how I can heal that?

  • 3.3 V USB-TTL was insufficient for flashing

    #77 21762958
    cstadach
    Level 2  
    Posts: 2
    Thanks to you, I was able to solder-flash my first OpenBeken device (so far I only dared OTA).
    It's a Nedis WIFIWMS10WT bought in Finland. It looked a lot like number 3 from the first post, but had a little different writing on it.
    It ran FW 1.3.10, so only soldering worked

    Nedis WIFIWMS10WT switch module with label showing technical specifications

    Close-up of Nedis device PCB with button, labeled pins, and soldered components visibleClose-up of a PCB with UART header pins and a black relay module on the rightQLRELAY relay module on PCB with capacitors and a Wi-Fi control module

    I was able to dump the firmware before the flash. I attached it to this post.

    readResult...-49-14.bin (2 MB)You must be logged in to download this attachment.

    Takeaways from this:
    Check if your solder job actually connected.
    3.3 V on a USB-TTL stick is not enough; I used the 3.3 V and GND pins of an ESP NodeMCU to make it work. (This one took me a while to figure out, because the device was turning on and the blue LED was blinking, so I thought everything was alright. I just need to time my reboots better...)
  • #78 21762988
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14771
    Help: 659
    Rate: 12914
    Good job. Sure, you can share your original firmware copy, just make sure it was not paired - otherwise it can contain your WiFi data.

    Don't forget about PowerSave 1 in startup command, those things come with weak power supplies.
    Helpful post? Buy me a coffee.
  • #79 21763084
    cstadach
    Level 2  
    Posts: 2
    >>21762988
    Thanks for the tip.
    I added the missing information to my post.
Reply | New topic
Report a violation of the law

Topic summary

LABEL_AI_GENERATED
Discussion of several visually identical smart switch modules based on BK7231N/CB2S, including patched Tuya firmware 1.3.10 that blocks Tuya-Cloudcutter. The thread compares PCB variants, pin mappings, and flashing behavior, with emphasis on extracting GPIO configuration and Tuya data from 2 MB flash backups. OpenBK7231/OBK tools are recommended, especially BK7231GUIFlashTool, hid_download_py, and the OBK web app for reading flash, downloading Tuya GPIO config, and configuring devices after flashing. Multiple users report read failures with some USB-UART adapters, Arduino-based setups, and certain firmware revisions, while solutions include using the latest flasher, proper RX/TX wiring, removing pull-down/capacitor interference, and enabling PowerSave 1. The discussion also covers CB2S modules marked with BL2028N, a TR6260S1 “non-hackable” variant, energy-monitoring versions, and alternative chips such as T34 and LN882HKI.
AI summary based on the discussion. May contain errors.
Today's popular

FAQ LABEL_AI_GENERATED

TL;DR: 5 switch variants and “PowerSave 1” are the core findings for OpenBeken users flashing patched BK7231N/CB2S Tuya 1.3.10 devices when Tuya-Cloudcutter fails. Use wired UART, save a 2MB dump when possible, and watch for RX-to-ground faults. [#20578056]

Why it matters: These cheap Aubess/Tuya mini switches can look identical outside but use different PCB layouts, GPIO maps, chips, and flashing constraints.

Alternative Thread result Key detail
Tuya-Cloudcutter Works only on some stock firmware BL2028N firmware 1.2.1 worked
BK7231GUIFlashTool Main recommended GUI tool Flashes patched 1.3.10 by UART
hid_download_py Recovery/CLI option Used when GUI reading fails
bkWriter 1.60 Read-only fallback Buggy; not recommended for restore
Arduino as UART Unreliable case reported USB TTL-UART fixed errors

Key insight: Do not trust the enclosure or seller listing. Identify the module and GPIO map, then flash by wired UART if firmware 1.3.10/V102 blocks OTA methods.

Quick Facts

  • The original batch summary counted x20 16A smart switches: 7 variant 2, 6 variant 1, 3 variant 3, 2 variant 4, 1 power-monitoring variant, and 1 non-hackable unit. [#20589187]
  • The practical flashing interface is 4 wires: RX, TX, GND, and 3.3V; CEN or power cycling enters the BK7231 boot process. [#20592449]
  • Patched Tuya firmware 1.3.10 blocked Tuya-Cloudcutter on multiple BK7231N/CB2S devices, while one BL2028N firmware 1.2.1 unit worked. [#20578056]
  • Some power-monitoring boards showed RX tied to ground; the workaround was removing the module-to-main-PCB solder bridge rather than desoldering the whole module. [#20589187]
  • One successful later case used a Nedis WIFIWMS10WT on firmware 1.3.10; the user needed stronger 3.3V power than a USB-TTL stick provided. [#21762958]

How do I flash OpenBeken on BK7231N or CB2S smart switches with patched Tuya firmware 1.3.10 when Tuya-Cloudcutter does not work?

Flash OpenBeken by wired UART when Tuya firmware 1.3.10 blocks Tuya-Cloudcutter.
  1. Connect RX, TX, GND, and 3.3V to the CB2S, CBU, or BK7231N module.
  2. Start BK7231GUIFlashTool and reboot by CEN or power cycling.
  3. Use “flash only” or the normal write flow with OpenBK7231N_QIO firmware.
One user flashed every 1.3.10 switch successfully, although firmware reading failed. Always check solder bridges with a multimeter before powering the board. [#20578056]

What is Tuya-Cloudcutter and why does it fail on some BK7231N devices with firmware 1.3.10 or V102?

Tuya-Cloudcutter fails because some newer BK7231N firmware builds are patched against that OTA method. "Tuya-Cloudcutter" is a flashing approach that replaces selected Tuya firmware without opening the device, but it depends on vulnerable firmware and supported profiles. In this thread, firmware 1.3.10 and V102 with energy monitoring did not work. A BL2028N unit on firmware 1.2.1 did work. [#20588972]

What is OpenBeken and how is it different from Tasmota for Tuya BK7231N, CB2S, CBU, BL2028N, and ESP8265 smart switches?

OpenBeken targets Beken-family Tuya devices, while Tasmota was used here on ESP8265 switches. "OpenBeken" is alternative smart-device firmware that runs locally on Beken and related Tuya modules, replacing cloud firmware and exposing configuration through its own web panel. The thread uses OpenBeken for BK7231N, CB2S, CBU, BL2028N, T34, and LN882HKI cases. The same batch also contained 13 ESP8265 relays flashed with Tasmota. [#20589187]

How do I use BK7231GUIFlashTool to read a 2MB firmware backup and flash OpenBK7231N_QIO firmware?

Use BK7231GUIFlashTool for backup first, then write the OpenBK7231N_QIO binary. Select BK7231N mode, choose the correct COM port, and press “Read firmware backup” for a 2MB dump. Then flash the OpenBK7231N_QIO release binary through the GUI. If backup fails on patched devices, “flash only” can still work. The developer recommended the GUI over command-line tools because wrong offsets can brick devices. [#20592328]

Which RX, TX, 3.3V, GND, and CEN pins should I use when wiring a CB2S or CBU BK7231N module for flashing?

Use RX, TX, GND, and 3.3V on the module, and reset with CEN or power cycling. The thread repeatedly states that RX and TX must cross between adapter and module. CEN can be pulled to GND to reboot into flashing flow. If CEN does not work, disconnect 3.3V, briefly discharge the module VDD to GND, then reconnect 3.3V. Do not short the power-supply 3.3V directly to GND. [#20600974]

Why does BK7231GUIFlashTool fail to read flash with errors like expected 4111 bytes, failed to set baud rate, failed to read MID, or erase sector failed?

These errors usually come from unstable UART communication, weak power, wrong wiring, or unsuitable adapters. Reported failures included “expected 4111 bytes,” “failed to set baud rate,” “failed to read MID,” and “erase sector failed.” Arduino-based serial bridges caused poor communication in one case. A USB TTL-UART converter solved that user’s repeated writing errors. Linux instability and specific USB-UART dongles were also mentioned as reading problems. [#21109485]

What should I do when the RX pin on a Tuya smart switch module is shorted or nearly shorted to ground during flashing?

Remove the RX connection to the main PCB before flashing. Several boards had RX shorted, or nearly shorted, to ground through the main PCB. The practical fix was to wick away the solder bridge between the module RX pad and the carrier PCB. One later measurement showed 5 Ohms between RTX and GND, which explains flashing failures. Check with a multimeter before retrying UART. [#21574120]

Can I flash a BK7231N smart switch without desoldering the whole module, and when is it enough to wick away the RX or TX solder joint?

Yes, you can flash in-circuit when RX and TX are isolated enough for clean UART communication. For two variants, RX or TX remained connected to the main PCB and was tied to ground. The user fixed this by using copper wick to remove the solder joint, without removing the entire module. Desoldering the full CB2S module risks torn pads, especially TX pads on small boards. [#20592454]

How can I extract the Tuya GPIO configuration from an OpenBeken device after it has already been flashed?

Use the OpenBeken web app flash tab to download the Tuya GPIO config sector. The thread gives the button text: “Download Tuya GPIO Config from 0x1EE000.” That file can then be dragged into BK7231GUIFlashTool for GPIO extraction. The reason this works is that OpenBeken does not overwrite the Tuya config stored at the end of the 2MB flash. [#20578615]

What are the GPIO pinouts for the different Aubess or Tuya 16A mini smart switch variants using CBU, CB2S, BK7231N, or BL2028N modules?

The variants use different GPIO maps, so configure each board by its extracted Tuya template. Variant 1 CBU: button P8, LED P6, toggle P14, relay P15. Variant 2 CB2S: button P23, LED P26, toggle P6, relay P7. Variant 3 CB2S: button P8, LED P7, toggle P26, relay P24. Variant 4 BL2028N/CB2S: button P10, LED P7, toggle P26, relay P8. [#20578056]

Why should I add PowerSave 1 to the OpenBeken startup command on cheap Tuya mini smart switches?

Add PowerSave 1 because these low-cost switches have weak power supplies. The OpenBeken developer explicitly wrote: “Please remember to use PowerSave 1 in short startup command on those devices!” He cited very cheap construction and low-quality power supplies, and said he had already needed to repair one device. The advice was repeated for LN882HKI and other small switch variants. [#20578223]

What is a 2MB flash dump, and why is it useful before flashing OpenBeken over the original Tuya firmware?

A 2MB flash dump is a complete backup of the device flash before overwriting Tuya firmware. "2MB flash dump" is a binary copy of the full external flash that preserves firmware, RF calibration, MAC data, and Tuya configuration areas for analysis or recovery. The developer requested original 2MB Tuya dumps because web-downloaded GPIO config files are useful, but not enough for full analysis. [#20589243]

BK7231GUIFlashTool vs hid_download_py vs bkWriter 1.60 — which tool is best for reading and flashing BK7231N devices?

BK7231GUIFlashTool is the preferred tool for BK7231N flashing and normal backups. Use hid_download_py when the GUI fails or when following the documented Python workflow. Use bkWriter 1.60 only as a read fallback, and do not restore with it because it was called buggy. The developer also stated that bkWriter 1.60 is not recommended for BK7231N and likely will not work. [#20594479]

Can I use an ESP8266 NodeMCU, Arduino, Raspberry Pi, CH341A, or CP210x adapter as a USB-to-UART programmer for BK7231N flashing?

Use a real 3.3V USB-to-UART adapter when possible. An ESP8266 NodeMCU worked when the ESP chip was disabled by grounding ENABLE. CP210x adapters were discussed for normal UART use. A CH341A-style device can work only if it exposes RX, TX, GND, and 3.3V UART pins. Arduino bridges caused failed flashing until replaced with USB TTL-UART. Raspberry Pi GPIO may work, but one user avoided risking it. [#20589284]

Which Tuya smart switch chips are supported by OpenBeken, and what should I know about TR6260S1, T34, LN882HKI, ESP8265, and BL2028N variants?

OpenBeken covered the Beken-like variants discussed, but TR6260S1 was treated as unsupported in this thread. BL2028N appeared on CB2S-labeled modules and flashed as a BK7231 variant. T34 and LN882HKI variants were later discussed in the same hardware family. ESP8265 units were flashed with Tasmota instead. TR6260S1 had 1MB flash and was called a “black sheep”; no tool or OpenBeken path was confirmed there. [#20579068]
AI summary based on the discussion. May contain errors.
ADVERTISEMENT