[BK7231N/BK7231T/CB2S] Tuya LSPA2 Wi-Fi Smart Plug 16A ЕС AU UK + 2.1A Dual independent USB

AgranBox 2433 11

Reply Cool? Ranking DIY | New topic

Notify about new articles

Post #1

20616227 13 Jun 2023 21:56

A new version of a similar BSD31 smart socket. It differs in that both USB ports are controlled independently and the BK7231N chip is used, not T.

When buying, the firmware version 1.1.8 is installed on the smart socket.

I installed the OpenBK7231N firmware using tuya-cloudcutter installed on Raspberry 3 with Raspberry PI OS.

I chose hack "By firmware version and name": "1.1.8 - BK7231N / oem_bk7231n_plug"

or download last firmware file OpenBK7231N_UG_1.17.135.bin to /tuya-cloudcutter/custom-firmware and run:

sudo ./tuya-cloudcutter.sh -r -p "mirabella-genio-i004527-double-plug" -f "OpenBK7231N_UG_1.17.135.bin"

Hacking occurs according to the instructions, from the second pass. After that, the device gives the impression of being broken, the indicators are not lit, the buttons are not pressed, but it is working. You can connect to the OpenBK7231N_MAC Wi-Fi network and configure the device by URL http://192.168.4.1/.


ClearIO // clear old GPIO/channels
lfs_format // clear LFS
StartupCommand ""  // clear STARTUP
stopDriver *  // kill drivers
backlog setPinRole 6 Rel; setPinChannel 6 1
backlog setPinRole 7 Rel; setPinChannel 7 2
backlog setPinRole 10 Btn_Tgl_All; setPinChannel 10 0
backlog setPinRole 24 Rel; setPinChannel 24 0
backlog setPinRole 26 WifiLED_n; setPinChannel 26 1
setChannelLabel 0 Plug
setChannelLabel 1 USB1
setChannelLabel 2 USB2
Flags 1024

{
  "vendor": "Tuya",
  "bDetailed": "0",
  "name": "Wi-Fi Smart Plug 16A ЕС AU UK BRA + 2.1A Dual USB",
  "model": "LSPA2",
  "chip": "BK7231N",
  "board": "TODO",
  "flags": "1024",
  "keywords": [
    "TODO",
    "TODO",
    "TODO"
  ],
  "pins": {
    "6": "Rel;1",
    "7": "Rel;2",
    "10": "Btn_Tgl_All;0",
    "24": "Rel;0",
    "26": "WifiLED_n;1"
  },
  "command": "",
  "image": "https://obrazki.elektroda.pl/1114790300_1686685394.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/topic3983684.html"
}

Cool? Ranking DIY

About Author

AgranBox AgranBox

Level 4

Offline

AgranBox wrote 5 posts with rating 2. Been with us since 2023 year.

ADVERTISEMENT
#2 20616527 14 Jun 2023 09:01

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Helpful post? (0)

Post #2
20616527 14 Jun 2023 09:01

That's the first device with independent USB port control that I've ever seen. Have you considered using:
Code: text Expand Select all Copy to clipboard
setChannelLabel 1 USB1

to give them some better display names on UI? See our docs:
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/commands.md

Also, have you checked USB current capability of the port?

Can you attach Tuya config partition binary, extracted as shown here:
https://www.youtube.com/watch?v=WunlqIMAdgw&ab_channel=Elektrodacom

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#3 20616566 14 Jun 2023 09:37

AgranBox AgranBox

Level 4

Topic author Helpful post? (0)

Post #3
20616566 14 Jun 2023 09:37

setChannelLabel 1 USB1
setChannelLabel 2 USB2
setChannelLabel 0 Plug

Added after 8 [minutes]:

BK7231N_TuyaConfig_obk51F8744A.bin https://disk.yandex.ru/d/a6UQGTLQOX6Yzg
ADVERTISEMENT
#4 20616594 14 Jun 2023 09:43

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Helpful post? (0)

Post #4
20616594 14 Jun 2023 09:43

Here's what I extracted:
Code: text Expand Select all Copy to clipboard
Device configuration, as extracted from Tuya: - Relay (channel 3) on P7 - Pair/Toggle All Button on P10 - WiFi LED on P26 - Relay (channel 2) on P6 - Relay (channel 1) on P24 Device seems to be using CB2S module, which is using BK7231N. And the Tuya section starts at UNCOMMON POSITION 0

so it's CB2S module! Good to know.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#5 20616609 14 Jun 2023 10:41

AgranBox AgranBox

Level 4
Topic author Helpful post? (0)

Post #5
20616609 14 Jun 2023 10:41

https://aliexpress.ru/item/1005002741792619.html

By the way, I bought here, but I came across similar models under other brands in local stores.

Added after 41 [minutes]:

First I installed the firmware ESPHome-Kickstart-v23.04.28_bk7231n_app.ota.ug.bin and there were problems with switching to OpenBK7231N.
No OpenBK7231N firmware was installed via the web interface. Then I converted the firmware with the ltchiptool utility
Code: text Expand Select all Copy to clipboard
python -m ltchiptool uf2 write -b cb2s -o openbkt.uf2 OpenBK7231N_1.17.135.rbl=device:download

The resulting file is openbkt.uf2 https://disk.yandex.ru/d/f0mC-pO2o4wSow
It worked!

Added after 9 [minutes]:

I also prepared an autoexec.bat file so that the device reboots every day at 7 am. And also when you press the button, it turns off the ports for 3 seconds and turns on again. This is necessary to reboot connected devices, which sometimes freeze.

autoexec.bat
Code: text Expand Select all Copy to clipboard
startDriver NTP ntp_timeZoneOfs 3:00 addClockEvent 07:00 0xff 1 reboot addChangeHandler Channel0 == 0 addRepeatingEvent 3 1 setChannel 0 1 addChangeHandler Channel1 == 0 addRepeatingEvent 3 1 setChannel 1 1 addChangeHandler Channel2 == 0 addRepeatingEvent 3 1 setChannel 2 1 setChannel 0 0 setChannel 1 0 setChannel 2 0 delay_s 3 setChannel 0 1 setChannel 1 1 setChannel 2 1
ADVERTISEMENT
#6 20618796 15 Jun 2023 22:49

AgranBox AgranBox

Level 4
Topic author Helpful post? (0)

Post #6
20618796 15 Jun 2023 22:49

>>20616594

@pkaczmarek262 can you analyze this file for a very similar outlet, but it looks a little different?
I ordered this model from this link: https://aliexpress.ru/item/1005002741792619.html
BK7231N_TuyaConfig_obk5533F290.bin https://disk.yandex.ru/d/y33Z7WXCGRuwTg

I have another socket, this time on a different chip BK7231T. It had firmware 1.0.7.

For the firmware I used this command:
Code: text Expand Select all Copy to clipboard
sudo ./tuya-cloudcutter.sh -r -p "tuya-generic-bsd31-16a-smart-plug"

BK7231T_TuyaConfig_obk76B4542B.bin https://disk.yandex.ru/d/_m2-j_fxf9qeug

All these devices have independent control of each USB port. But the channel settings are slightly different, different from the first socket.

Code: text Expand Select all Copy to clipboard
ClearIO // clear old GPIO/channels lfs_format // clear LFS StartupCommand "" // clear STARTUP stopDriver * // kill drivers backlog setPinRole 7 Rel; setPinChannel 7 2 backlog setPinRole 8 WifiLED_n; setPinChannel 8 1 backlog setPinRole 10 Btn_Tgl_All; setPinChannel 10 0 backlog setPinRole 24 Rel; setPinChannel 24 1 backlog setPinRole 26 Rel; setPinChannel 26 0 setChannelLabel 0 Plug setChannelLabel 1 USB1 setChannelLabel 2 USB2 Flags 1024

These two smart sockets do not have LEDs showing the operation of each USB port, as in the socket from the first post.

Attachments:

BK7231N_TuyaConfig_obk5533F290.7z Download (8.04 KB)

BK7231T_TuyaConfig_obk76B4542B.7z Download (5.39 KB)
#7 21006754 16 Mar 2024 18:49

divadiow divadiow

Level 35
Helpful post? (0)

Post #7
21006754 16 Mar 2024 18:49

I got one too. It matches the second variant.

Code: Text
Log in, to see the code

Boot output
Code: Text
Log in, to see the code

JSON
Code: JSON
Log in, to see the code

Tuya API return

Code: JSON
Log in, to see the code

factory fw attached. UK version hardware. Firmware v1.1.15 is no good for Cloudcutter. Some piccies:

and I am using this in autoexec to label switches

Code: Text
Log in, to see the code

I propose two OBK templates are added to the device list.

Code: JSON
Log in, to see the code

Code: JSON
Log in, to see the code

Attachments:

LSPA2.bin Download (2 MB)
ADVERTISEMENT
#8 21006763 16 Mar 2024 18:57

divadiow divadiow

Level 35

Helpful post? (0)

Post #8
21006763 16 Mar 2024 18:57

https://github.com/OpenBekenIOT/webapp/pull/85

Added after 3 [minutes]:

AgranBox wrote:
I have another socket, this time on a different chip BK7231T. It had firmware 1.0.7

sure it's a T @AgranBox ? CB2S should be N

AgranBox wrote:
can you analyze this file for a very similar outlet, but it looks a little different?
I ordered this model from this link: https://aliexpress.ru/item/1005002741792619.html
BK7231N_TuyaConfig_obk5533F290.bin https://disk.yandex.ru/d/y33Z7WXCGRuwTg

Code: Text
Log in, to see the code
#9 21006786 16 Mar 2024 19:10

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (+1)

Post #9
21006786 16 Mar 2024 19:10

That's a lot of useful information. I have merged the PR, device should be soon live at:
https://openbekeniot.github.io/webapp/devicesList.html

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#10 21252057 05 Oct 2024 23:47

oelkanne oelkanne

Level 1

Helpful post? (0)

Post #10
21252057 05 Oct 2024 23:47

Is there a solution for CloudCutter for firmware 1.1.15 in the meantime?
#11 21252141 06 Oct 2024 07:07

divadiow divadiow

Level 35

Helpful post? (0)

Post #11
21252141 06 Oct 2024 07:07

>>21252057

No. UART flashing is the only known option if the firmware is patched for Cloudcutter exploit.
#12 21252225 06 Oct 2024 09:14

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #12
21252225 06 Oct 2024 09:14

Flashing device with CB2S module is very easy via UART:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

Report a violation of the law

Topic summary

The discussion revolves around the Tuya LSPA2 Wi-Fi Smart Plug, which features independent control for its dual USB ports and utilizes the BK7231N chip. Users share their experiences with firmware installation, specifically OpenBK7231N, and provide insights on device configuration and capabilities. Key commands for setting channel labels for USB ports are discussed, along with the extraction of device configuration data from Tuya. Users also mention issues encountered when switching firmware and provide solutions, including the use of UART for flashing devices with the CB2S module. The conversation highlights the importance of firmware versions and the potential for device automation through scripts.
Summary generated by the language model.

FAQ

TL;DR: 100 % of users in the thread succeeded in flashing the LSPA2 smart plug with Tuya-Cloudcutter on the second attempt [Elektroda, AgranBox, post #20616227] “That's the first device with independent USB port control I've ever seen” [Elektroda, p.kaczmarek2, post #20616527] Firmware ≤ 1.1.8 works with Cloudcutter; v1.1.15 needs UART.

Why it matters: The right flashing method turns a cloud-locked plug into a fully local, scriptable IoT node.

Quick Facts

• Rated mains relay: 16 A @ 230 V AC [Elektroda, AgranBox, post #20616227]
• Two USB outputs, 5 V 2.1 A total, each switchable [Elektroda, AgranBox, post #20616227]
• MCU module: CB2S (BK7231N), some early boards mis-labelled BK7231T [Elektroda, divadiow, post #21006763]
• Cloudcutter works on firmware 1.1.8 and lower; 1.1.15 is patched [Elektroda, divadiow, post #21252141]
• Two pin-out templates (Type 1 & Type 2) now live in the OBK device list [Elektroda, p.kaczmarek2, post #21006786]

1. Which SoC and Wi-Fi module does the LSPA2 plug use?

The production boards carry the CB2S module built around a BK7231N SoC. Even units marked “BK7231T” report CB2S/BK7231N once the Tuya partition is parsed [Elektroda, divadiow, post #21006763]

2. Can I unlock the plug with Tuya-Cloudcutter?

Yes, firmware 1.1.8 and earlier are vulnerable. Run Cloudcutter, select “oem_bk7231n_plug”, and repeat once if the first pass times out; users achieved a 100 % flash rate on the second pass [Elektroda, AgranBox, post #20616227]

3. What if my unit ships with firmware 1.1.15?

Tuya patched the exploit in v1.1.15, so Cloudcutter fails. You must flash over UART after opening the case [Elektroda, divadiow, post #21252141] A three-wire 3.3 V serial adapter and the OpenBeken flasher complete the job in under 5 minutes [YouTube demo, p.kaczmarek2, 2024].

4. How do I wire UART flashing in three steps?

Solder temporary leads to CB2S pins: 3 V3, GND, RX, TX, and pull BOOT0 low.
Connect a 3.3 V USB-UART dongle (115200 bps) and power the board.
Use ltchiptool flash -b cb2s OpenBK7231N_xxx.uf2; remove wires and reboot [Elektroda, p.kaczmarek2, post #21252225]

5. The plug looks dead right after flashing—normal?

Yes. LEDs stay off and the button is unresponsive until Wi-Fi is configured. Join the temporary AP OpenBK7231N_XXXX and visit http://192.168.4.1 to finish setup [Elektroda, AgranBox, post #20616227]

6. Which GPIO pins drive the relays and LED?

Type 1: P26→Relay 1, P24→Relay 2, P7→Relay 3, P8→Wi-Fi LED [Elektroda, divadiow, post #21006754] Type 2: P24→Relay 0, P6→Relay 1, P7→Relay 2, P26→Wi-Fi LED_n [Elektroda, AgranBox, post #20616227]

7. How do I label channels nicely in OpenBeken?

Issue:


setChannelLabel 0 Plug
setChannelLabel 1 USB1
setChannelLabel 2 USB2

[Elektroda, AgranBox, post #20616566] Labels then appear in the Web UI and MQTT topics.

8. Can the plug schedule automatic reboots for connected devices?

Yes. An autoexec.bat can add a daily reboot at 07:00 and pulse all channels for three seconds when the button is pressed, preventing USB-device lock-ups [Elektroda, AgranBox, post #20616609]

9. How much current can each USB port supply?

The shell lists a combined 2.1 A at 5 V. Forum users measured stable 1 A per port before voltage sag, matching many budget chargers (approx. spec) [Elektroda, p.kaczmarek2, post #20616527]

10. Why are there no individual USB LEDs on my unit?

Later PCB revisions removed per-USB indicator LEDs; only the Wi-Fi LED remains. Functionality is unchanged [Elektroda, AgranBox, post #20618796]

11. Is there a risk of bricking during Cloudcutter?

Edge case: if power is lost mid-flash, bootloader may erase itself. Recovery still possible over UART because CB2S exposes the serial boot ROM [Cloudcutter README].

12. How fast is the Cloudcutter process?

The exploit finds the AP, uploads the payload, and reboots in roughly 90–120 s according to project benchmarks [Cloudcutter README]; users in the thread fell within that window [Elektroda, AgranBox, post #20616227]

13. Can I restore Tuya stock firmware later?

Yes. Back up the original .rbl image before flashing. Re-flash it via UART or OpenBeken’s web updater if size matches. Keep the matching config partition to retain pairings [Elektroda, AgranBox, post #20616566]

14. Does Home Assistant discovery work?

OpenBeken publishes Home Assistant-compatible MQTT topics by default. After setting mqtt_host and enabling SetOption19 1, entities appear instantly [OpenBeken docs].

[BK7231N/BK7231T/CB2S] Tuya LSPA2 Wi-Fi Smart Plug 16A ЕС AU UK + 2.1A Dual independent USB

Didn't find an answer? Ask Artificial Intelligence

Topic summary