Tuya USB Smart Adapter HC-S5050-WIFI - teardown, OpenBeken flashing guide for BK7231N

That's really something new. I haven't seen such device yet. Where did you buy it?

It doesn't seem to have much components, so I wonder how much it costs.

I got it from AliExpress for ~4 Euro. My listing does not exist anymore, but just search for "Tuya Smart Micro USB Adapter Switch".

Hey, I managed to "flash" it using the latest BK7231N_QIO firmware, but after flashing or after a power cycle, it goes back to its old firmware. Did you experience something similar?

How did you "flash" this device? The process must have failed.

I tried flashing it using BekenWriter V1.60 and BK7231 Easy UART Flasher with the latest BK7231N UART firmware. I have successfully used these programs to flash other Tuya devices in the past, so it should have worked.
Using BK7231 Easy UART Flasher, I was able to "successfully" flash the device on my first try. However, even though the software said flashing has been successful, the device was still running the default firmware and was even controllable through the Tuya smart app. But I was able to read the OBK / Tuya config, which is identical to the one posted above.
After trying this multiple times with different firmware versions and replugging it multiple times, I tried using Beken Writer V1.60. It managed to write the new firmware, but failed verifying it, and it was still running the default firmware and usable from the app.
I then used BK7231 Easy... to "Erase all", once again this software was able to "successfully" flash the device, and Beken Writer... now also successfully verifies the written binary. The device now finally doesn't load its default firmware, but sadly now does nothing when powered on.

I'd say it's impossible for original firmware to "come back", but maybe, just maybe, you had somehow something in the OTA partition and it had OTA'ed back to Tuya... who knows...
Did you pair it with Tuya before flashing?

Anyway, that's very strange.

Are you sure that you've chosen correct platform (N or T)?

What does the UART 2 (TX2) log say now? Can you capture the log data so we can tell where the firmware is failing?

Do you have original 2MB flash backup?

I've just received one of these. I'll try to flash it soon.

Flashed. Original firmware is 1.3.10 so can't be exploited via cloudcutter.

I tried flasher v 1.1.1 but it kept crashing. Went back to 1.0.6 which worked.
Took a few attempts at disconnecting and turning on/off to get it to flash but got there eventually.

Seems to have held its flash for me with no issue.

Integrated into Home Assistant with no issues.


The cover is glued on, but easy to removed without damage. When you put it back together be careful not to push the device out of the case when plugging in a USB device if you haven't put some glue back on the cover.

Can you please copy here the crash stack trace so I can fix the tracer?

I can't find any log. Where should it be located?

OpenBeken log can be viewed by going to:

The TP3 pin is CEN so you can reset and flash.

Hello!
I just bought one of this to try, for 2,99USD it is worth the risk.

I haven't managed to open this, I can't seem to understand how.

Anyway, I would prefer to flash it wirelessly, I am experienced in destroying things while trying to open it.

I can confirm it is 1.3.10 (first line, V101 second line).
Is it exploitable yet? In tuna cloud cutter it doesn't appear this version....

Thank you

Quote:

Are all devices supported by Tuya-cloudcutter?
Currently there are some patched BK7231N devices on the market, they can be recognized by firmware versions:
- 1.1.2 oem_bk7231n_garage_door (Tuya Generic QS-WIFI-C03 Gate Opener Switch)
- 1.1.12 oem_bk7231n_plug (Nous A1, Tuya Generic LSPA9 Smart Plugs)
- 1.1.15 oem_bk7231n_plug (various smart plugs)
- 1.3.3 oem_bk7231n_dctrl_switch (HomeMate 4 Node Smart Switch)
- 1.3.8 oem_bk7231n_control_switch (ColoRock CR-MINI-V2 Mini Smart Relay)
- 1.3.10 oem_bk7231n_control_switch (OXT_SWT10 240V 150W 5A Dry Contact Relay)
- 1.5.10 oem_bk7231n_light_ty (Tuya Generic Light, TuyaOS 3.3.2)
- 2.0.15 oem_bk7231n_strip_ty (Anko Sunset Light)

As far as I know, this is a patched version. You need to solder wires.

I always get the same answer...it's my destiny
At least I managed to open the device already, yupee!

So how your version looks like? Is it the same as the one in the first post?

What do you mean by version?
The firmware i already told.
What more information would you like about this usb relay?

What would be the right procedure to flash this with esphome?
I already opened it.

Hello,
So finally I am trying to mod this. I am using exactly the same device as this thread.
I am trying to follow this guide https://www.youtube.com/watch?v=t0o8nMbqOSA
I am trying to dump the firmware as described in the video in 8 min 44 s but for that I need the CEN or Chip Enable, to put the chip in download mode.

In this thread it is only described 4 pins, not using the CEN.

Can please someone help me and point where the CEN is in this board?

Thank you.

>>21182566

instead of rebooting with CEN though you can achieve the same by interrupting the power to the device itself. Often for USB powered devices I'll just plug the USB cable in or toggle the button on the relevant port if I'm using one of these

Thank you for your help, I have already thought in that option.
Have you seen the video?
I am doing the method with BDM Pins.

So I thought into tapping and untapping the 3.3v pin of the chip

Would you thing that woulde do the same?

Because to me it seems it is ifferent to power cycle and to put the enable pin to ground after powered on.

To do the procedure described in this thread, would I need the CEN pin?

I am without ideas here...

thx for pinout guide,works like a charm
flashed with no external power supply