logo elektroda
logo elektroda
X
logo elektroda

Disassembling and Flashing [BL2028N] 2CH Mini Smart Switch Spectrum WOJ+14632 Without Tools

leśny_ziutek 2151 9
ADVERTISEMENT
  • Helpful post
    #1 20816274
    leśny_ziutek
    Level 12  
    2CH Mini Smart Switch Spectrum WOJ+14632
    Two-channel mini relay for boxing 60mm, shown on the Spectrum LED store page with a price of 39.99 zł.
    https://sklep.spectrumled.pl/pl/p/Dwustrefowy...znik-do-puszkowy-60mm-Wi-FiBluetooth-Tuya/320
    It is also available on allegro.com.

    Two-zone mini relay Spectrum WOJ+14632 with packaging.

    Disassembly is very easy. You don't need any tools. Just use your nails.

    Close-up of a circuit board with electronic components.

    Close-up of CB2S module with BK7231N chip.

    PCB of a 2CH mini relay with electronic components.

    As you can see the board and elements are identical as described in the another topic. However, I managed to flash it without disassembling and soldering so I decided to describe this process here.

    Most of the sellers/distributors rate this device as 16 A. And it even agrees with what is printed on the relays:

    Close-up of a FANHAR FH17-1A2TLE DC5V relay module mounted on a circuit board.

    But this device is rated 2 x 5 A which is probably closer to reality.

    Dodano po 36 [minuty]:

    Flashing OpenBeken using tuya-claudcutter

    All things described here were done on the laptop with Ubuntu Linux. I don't known is it possible on Windows.

    Your WiFi interface must support AP mode. I tried two USB WiFi dongles on desktop and they don't work because of lack of AP support.

    tuya-cloudcutter requires Docker to be installed. If you don't have it, install it: apt install docker.io.

    1. Install tuya-claudcutter.

    2. Run it:

    
    $ cd tuya-cloudcutter
    $ sudo ./tuya-cloudcutter.sh
    


    While running tuya-cloudcutter asks you a few questions. Choose the answers as below:

    
    1) Detach from the cloud and run Tuya firmware locally
    2) Flash 3rd Party Firmware
    [?] Select your desired operation [1/2]: 2
    


    
    [?] How do you want to choose the device?:
      By manufacturer/device name
    > By firmware version and name
      From device-profiles (i.e. custom profile)
    


    The following step requires to check the firmware version installed on the device. The process requires connecting the device to the Tuya cloud and is described here. In my case the firmware version is 1.2.1.

    Sometimes Tuya / Smart Life app doesn't display the firmware version and asks you to upgrade your device. In such case do not upgrade it! It's better to try different versions without knowing the right one.

    
    [?] Select the firmware version and name:
      1.1.9 - BK7231T / oem_bk7231s_ceiling_light_ty
      1.1.9 - BK7231T / oem_bk7231s_strip_ir_daybetter
    > 1.2.1 - BK7231N / oem_bk7231n_control_switch
      1.2.1 - BK7231N / oem_bk7231n_dctrl_switch
      1.2.16 - BK7231N / oem_bk7231n_light_ty
    


    
    [?] Select your custom firmware file for BK7231N chip:
       ESPHome-Kickstart-v23.08.29_bk7231n_app.ota.ug.bin
     > OpenBeken-v1.17.262_bk7231n.ug.bin
    


    You will then be asked to put your device into slow blink mode.

    
    ================================================================================
    Place your device in AP (slow blink) mode.  This can usually be accomplished by either:
    Power cycling off/on - 3 times and wait for the device to fast-blink, then repeat 3 more times.  Some devices need 4 or 5 times on each side of the pause
    Long press the power/reset button on the device until it starts fast-blinking, then releasing, and then holding the power/reset button again until the device starts slow-blinking.
    See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
    ================================================================================
    


    Long press the builtin button to enter the fast blink mode and next long press it again to enter the slow blik mode.

    Bellow is the log of the rest of the flashing process. You will be asked one more time to restart the device and enter the slow blink mode.

    
    Scanning for open Tuya SmartLife AP
    ......
    Found access point name: "A-5359", trying to connect...
    Device 'wlo1' successfully activated with 'da2b8a4f-6cc4-4d48-800e-5bda3b16fa3c'.
    Connected to access point.
    Waiting 1 sec to allow device to set itself up...
    Running initial exploit toolchain...
    Exploit run, saved device config too!
    output=/work/configured-devices/ybQPpedKP84X.deviceconfig
    Saved device config in /work/configured-devices/ybQPpedKP84X.deviceconfig
    
    ================================================================================
    Power cycle and place your device in AP (slow blink) mode again.  This can usually be accomplished by either:
    Power cycling off/on - 3 times and wait for the device to fast-blink, then repeat 3 more times.  Some devices need 4 or 5 times on each side of the pause
    Long press the power/reset button on the device until it starts fast-blinking, then releasing, and then holding the power/reset button again until the device starts slow-blinking.
    See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
    ================================================================================
    
    Scanning for open Tuya SmartLife AP
    ........
    Found access point name: "A-5359", trying to connect...
    Device 'wlo1' successfully activated with 'da2b8a4f-6cc4-4d48-800e-5bda3b16fa3c'.
    Connected to access point.
    Configured device to connect to 'cloudcutterflash'
    Device is connecting to 'cloudcutterflash' access point. Passphrase for the AP is 'abcdabcd' (without ')
    Flashing custom firmware...
    
    ================================================================================
    Wait for up to 10-120 seconds for the device to connect to 'cloudcutterflash'. This script will then show the firmware upgrade requests sent by the device.
    ================================================================================
    Using WLAN adapter: wlo1
    Configuration file: /dev/stdin
    Using interface wlo1 with hwaddr 60:67:xx:xx:xx:xx and ssid "cloudcutterflash"
    wlo1: interface state UNINITIALIZED->ENABLED
    wlo1: AP-ENABLED 
    Using PSK v1 - Received PSK ID version 01
    Processing endpoint /v2/url_config
    Processing endpoint tuya.device.active
    Processing endpoint tuya.device.beacon.key.fetch
    !!! Endpoint response not found, using default response - tuya.device.beacon.key.fetch (This is usually okay and safe to ignore unless something isn't working)
    Processing endpoint tuya.device.dynamic.config.get
    Processing endpoint tuya.device.upgrade.get
    Processing endpoint tuya.device.upgrade.status.update
    Processing endpoint /files/OpenBeken-v1.17.262_bk7231n.ug.bin
    Firmware update progress: 10%
    Firmware update progress: 10%
    Firmware update progress: 10%
    Firmware update progress: 10%
    Processing endpoint tuya.device.uuid.pskkey.get
    Firmware update progress: 25%
    Processing endpoint atop.online.debug.log
    Processing endpoint tuya.device.dynamic.config.get
    Firmware update progress: 30%
    Processing endpoint tuya.device.dynamic.config.ack
    Firmware update progress: 45%
    Firmware update progress: 60%
    Firmware update progress: 90%
    [Firmware Upload] /files/OpenBeken-v1.17.262_bk7231n.ug.bin send complete, request range: bytes=0-636847/636848
    Firmware update progress: 98%
    Firmware file has been sent and MQTT reported a progress of nearly complete.  Waiting 15 seconds to ensure flashing completes.
    Flashing should be complete.  It takes about 15 seconds for the device to reboot and verify the flash was valid.
    Please wait about 30 seconds then look for signs of activity from the firmware you supplied (either watch for AP mode or check if it joined your network).
    Device MAC address: c8:47:xx:xx:xx:xx
    


    Dodano po 2 [godziny] 16 [minuty]:

    Configuration:

    P6: Rel 1
    P7: Rel 2
    P10: TglChanOnTgl 1
    P11: TglChanOnTgl 2
    P24: WifiLED
    P26: Btn_Tgl_All

    Device template:

    Code: JSON
    Log in, to see the code


    Information extracted from Tuya binary:

    
    Device configuration, as extracted from Tuya: 
    - Pair/Toggle All Button on P26
    - WiFi LED on P24
    - TglChannelToggle (channel 1) on P10
    - TglChannelToggle (channel 2) on P11
    - Relay (channel 2) on P7
    - Relay (channel 1) on P6
    Device seems to be using CB2S module, which is using BK7231N.
    And the Tuya section starts at UNCOMMON POSITION 0
    


    
    {
    	"rl1_lv":"1",
    	"onoff_rst_m":"1",
    	"rand_dpid":"42",
    	"net_trig":"2",
    	"onoff_n":"10",
    	"netled1_lv":"0",
    	"jv":"101",
    	"onoff_rst_type":"0",
    	"total_bt_pin":"26",
    	"nety_led":"2",
    	"total_stat":"2",
    	"reset_t":"5",
    	"netled1_pin":"24",
    	"rl2_lv":"1",
    	"remote_add_dp":"49",
    	"remote_list_dp":"50",
    	"net_type":"0",
    	"inch_dp":"44",
    	"module":"CB2S",
    	"ch_cddpid1":"9",
    	"onoff1":"10",
    	"onoff2":"11",
    	"clean_t":"3",
    	"init_conf":"38",
    	"rl2_pin":"7",
    	"zero_select":"0",
    	"onoff_type":"0",
    	"series_ctrl":"0",
    	"ch_cddpid2":"10",
    	"total_bt_lv":"0",
    	"cyc_dpid":"43",
    	"remote_select":"0",
    	"ch_num":"2",
    	"rl1_pin":"6",
    	"netn_led":"2",
    	"ch_dpid1":"1",
    	"ch_dpid2":"2",
    	"crc":"121",
    	"}QhgHJAgw_diwYAwd_channel_mem":"40.00",
    	"pv":"2.2",
    	"lpv":"3.4",
    	"pk":"keyjnuy4s3kre7m7",
    	"firmk":"keyjnuy4s3kre7m7",
    	"cadv":"{abi",
    	"id":"null",
    	"swv":"1.2.1",
    	"bv":"40.00",
    	"cdv":"1.0.0",
    	"dev_swv":"1.2.1",
    	"s_id":"null",
    	"dtp":"0",
    	"sync":"0",
    	"attr_num":"1",
    	"mst_tp_0":"9",
    	"mst_ver_0":"1.2.1",
    	"mst_tp_1":"0",
    	"mst_ver_1":"null",
    	"mst_tp_2":"0",
    	"mst_ver_2":"null",
    	"mst_tp_3":"0",
    	"mst_ver_3":"null }",
    	"0EAtls_ca_cnt_ver_2":"null"
    }
    
  • ADVERTISEMENT
  • #2 20823198
    p.kaczmarek2
    Moderator Smart Home
    Remote flashing may be useful for people who don't want to solder, but it may not be reliable and futher batches of Tuya devices are already patched, so they have to be flashed by wires.

    In case of devices like the one in first post, I always suggest to use PowerSave 1 command in OBK, because the power supplies inside are very low quality and cheap, they might not last long if you don't enable dynamic power saving in OBK firmware.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #3 20825473
    leśny_ziutek
    Level 12  

    Regarding PowerSave mode. Is there any reason to not enable it by default on all supported devices?

    Regarding remote flashing. I think, it's crucial, to popularize OpenBeken among a wider range of users. In my subjective observations most people are either afraid of soldering or don't like to break their device in any way even if the "damage" is cosmetic. I personally have no such objections but if there is a non-invasive way to flash a device, I'm always more likely to choose this way.
  • ADVERTISEMENT
  • #4 20825503
    p.kaczmarek2
    Moderator Smart Home
    leśny_ziutek wrote:
    Regarding PowerSave mode. Is there any reason to not enable it by default on all supported devices?

    There are two reasons why PowerSave 1 isn't default:
    1. I had once report saying that PowerSave 1 made device unresponsive, but I never managed to reproduce it
    2. I had few reports saying that PowerSave 1 + BL0937 energy meter (the one that depends on counting interrupts) causes low precision measurements in BL0937
    Maybe I will decide soon to make PowerSave 1 default but I am still hesitant, especially due to the issue 1.

    leśny_ziutek wrote:

    Regarding remote flashing. I think, it's crucial, to popularize OpenBeken among a wider range of users. In my subjective observations most of people are either afraid of soldering or don't like to broke their device in any way even if the "damage" is cosmetic. I personally have no such objections but if there is a non-invasive way to flash a device, I'm always more likely to choose this way.

    The problem is that the only possible way to flash remotely depends on per-Tuya-build offsets and futhermote Tuya already patched its firmware in newer versions. So most of the people end up trying multiple profiles for remote flashing and they fail anyway, because Tuya has just did a rebuild of their firmware and offsets are different again.
    I am slightly more leaning towards making more soldering tutorial and guides for beginners, something like "how to solder UART wires with cheapest soldering iron".
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #5 20825849
    leśny_ziutek
    Level 12  

    p.kaczmarek2 wrote:
    I am slightly more leaning towards making more soldering tutorial and guides for beginners, something like "how to solder UART wires with cheapest soldering iron".


    A noble idea, but rather unattainable.

    I wish success for the OpenBeken project. In my opinion you should pay more attention to show people that there is still possible a non-invasive way to flash devices. I think that one successfully flashed device (in any way) that can be used for some time can make people love OpenBeken to the point that they want more of them and many will decide to overcome their aversion to opening newly purchased devices and start (de)soldering. At this point your soldering tutorials will be very appreciated by them.
  • #6 20825866
    p.kaczmarek2
    Moderator Smart Home
    leśny_ziutek wrote:
    to show people that there is still possible a non-invasive way to flash devices.

    Ok, then tell me this - as I said above, the OTA hack is per-device build (per compilation), so when Tuya changes the build version (from 1.1.0 to 1.1.7) the OTA hack may no longer work. Then, how can I advertise this OTA hack? Add a tiny disclaimer "this will only work if your device is from the same batch as mine"? That seems like very... temporary solution. I don't want people reading my posts saying "You can OTA by profile", then buying devices, and then getting disappointed because Tuya has just recompiled the build and OTA hack is no longer working.

    The positive thing about soldering method it that it just works, and it will (most likely) in 5 years from now, just assuming they will still be using Bekens.
    Helpful post? Buy me a coffee.
  • #7 20825949
    leśny_ziutek
    Level 12  

    I presented to you my impressions as a person who has recently entered this subject. You'll do what you want with this.

    I can only tell you that it was this video that encouraged me to try OpenBeken, even though I had seen Elektroda.com videos before. What's more, I was very surprised that this method wasn't presented on the official channel (now I know why).

    Even though I didn't want to, I ended up disassembling my first smart bulb, and flashed it using your tutorial. But what drew me to this point in the first place was the above video, not the soldering tutorials.
  • #8 20938393
    Rafal_olb
    Level 11  

    Unfortunately, it didn't work for me, maybe the purchased systems already have a new version of the software from Tuya :(

    The software upload ends at:
    (...)
    wlan0: interface state UNINITIALIZED -> ENABLED
    wlan0: AP-ENABLED


    I've been waiting in this place for a long time and nothing happens :(

    Which method should I use when it fails?
  • #9 20938409
    p.kaczmarek2
    Moderator Smart Home
    Well, I don`t know if this is another error, but I don`t know this method very well....

    As for uploading via UART, I recommend using our new flasher:
    https://github.com/openshwprojects/BK7231GUIFlashTool
    Here you can see from the hardware side how to do it:






    NOTE: The above videos may use hid_download_py or bkWriter 1.60, but these are outdated solutions. Now we upload via BK7231GUIFlashTool

    Added after 2 [minutes]:

    EDIT: If you don`t have time to watch the whole movie, here`s an important frame:
    Circuit diagram and photo of a setup for UART programming with reset instructions.
    Helpful post? Buy me a coffee.

Topic summary

The discussion revolves around the disassembly and flashing of the 2CH Mini Smart Switch Spectrum WOJ+14632 without tools. Users share experiences regarding remote flashing methods, highlighting the ease of disassembly using nails. Concerns are raised about the reliability of remote flashing due to firmware updates from Tuya, which may render previous methods ineffective. The importance of enabling PowerSave mode in OpenBeken firmware is emphasized to prolong device lifespan, although it is not set as default due to past issues. Users express a desire for more non-invasive flashing methods and tutorials for beginners, while also discussing the challenges of flashing devices with updated firmware. Recommendations for using the BK7231GUIFlashTool for UART flashing are provided, along with personal success stories in flashing the device.
Summary generated by the language model.
ADVERTISEMENT