logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
UV printer on your desk?
UV printer on your desk? Discover eufyMake E1 »
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

Manhot Store's BK7231N / CB3S Tuya Smart 4 Gang Switch: WiFi not Zigbee, CB3S Chip Inside

celulari 2856 14

TL;DR

  • Manhot Store’s AliExpress 4-gang Tuya wall switch, advertised as Zigbee, is actually a WiFi switch with a CB3S chip inside.
  • Soldering a wire to the CEN pin puts the module into bootloader mode, allowing new firmware to be flashed.
  • The usable flashing pins are CEN, 3VCC, GND, RX1, and TX1, and the OpenBK pin map assigns P6 to the WiFi LED and P7–P14 to relays/buttons.
  • OpenBK7231N_QIO_1.17.308.bin flashed successfully with BK7231GuiFlashTool on Windows, while Ubuntu flashing failed; the orange relay indicator works, but the blue LED does not.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • I've bought a wall switch from Manhot Store in aliexpress with 4 "clicky" buttons.

    AliExpress link: https://www.aliexpress.com/item/1005005901971631.html
    Four white wall switches with varying numbers of buttons are shown on an online store page.

    Manhot Store's BK7231N / CB3S Tuya Smart 4 Gang Switch: WiFi not Zigbee, CB3S Chip Inside

    The device is listed as a Zigbee Smart switch, but it's actually a WiFi switch!! with a CB3S chip inside.

    Smart wall switch packaging with Wi-Fi and Zigbee features. Cardboard packaging of a Smart Light Switch with compatibility information for Google Assistant and Amazon Alexa printed on it. Orange box with a QR code and information about app availability on the App Store and Google Play.

    Now the fun part!

    White wall switch with four buttons and an LED indicator.
    Wall switch with four buttons and visible electrical connections. Interior view of a wall switch housing with five buttons and LEDs on a circuit board.

    Circuit board with visible buttons and Made in China labeling. Wall switch module with CB3S chip on a printed circuit board. CB3S module on a circuit board with visible traces and components.

    Regarding functionality, when a button is pressed, the corresponding relay is triggered.
    The button has a light that shows whether the relay is open or closed - it will show up as orange when the relay is ON and blue when the relay is OFF.

    The device is powered by a CB3S chip, although not all of its pins are soldered on the PCB. Upon checking the datasheet for the MCU, we can determine the required pins to flash the device:

    Datasheet: https://developer.tuya.com/en/docs/iot/cb3s?id=Kai94mec0s076

    Soldered a small wire to the CEN pin to put the device into bootloader mode in order to flash a new firmware.
    Pin Name Pin Number
    CEN 3
    VCC 8
    GND 9
    RX1 15
    TX1 16



    Circuit board with a CB3S module connected by wires to an adapter on a computer mat background.     Close-up of a CB3S module on a circuit board with connected wires. Electronic module with connected wires on a blue background. Back view of a red circuit board with soldered wires.

    I was able to flash OpenBK using the new BK7231GuiFlashTool and the OpenBK7231N_QIO_1.17.308.bin firmware under windows, but no luck using the flash tool under linux (ubuntu).
    I've attached the original .json device template.

    This is the actual OpenBK pin configuration of the module.
    PinTypeChannel
    P6WifiLED_n-
    P7Relay4
    P8Relay3
    P9Relay2
    P10Button4
    P14Relay1
    P23Button3
    P24Button2
    P26Button1

    Now only the orange led turn on when the relay is on, but the blue light doesn't work. it's fine...
    Screenshot of the OpenBK7231N interface with toggle switch buttons.
    Screenshot of OpenBK module pin configuration for a Wi-Fi switch.
    Attachments:
    • smart switch 4 gang.zip (674 Bytes) You must be logged in to download this attachment.

    Cool? Ranking DIY
    About Author
    celulari
    Level 2  
    Offline 
    celulari wrote 3 posts with rating 1. Been with us since 2023 year.
  • ADVERTISEMENT
  • Helpful post
    #2 20842494
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14649
    Help: 655
    Rate: 12660
    Thanks for the review. That's very strange, you got a WiFi version instead of Zigbee, you should get a refund!

    Regarding the template, can you also add GPIO in a form of OBK template from the Web App?

    EDIT: I converted your attachment from Tuya to OBK format with https://openbekeniot.github.io/webapp/templateImporter.html and I got:
    Code: JSON
    Log in, to see the code


    Added after 55 [minutes]:

    Ok I have all I need, device should be now live at https://openbekeniot.github.io/webapp/devicesList.html , thank you!
    Helpful post? Buy me a coffee.
  • #3 20843825
    celulari
    Level 2  
    Posts: 3
    Rate: 1
    Hi!

    Playing a bit with the GPIO finder i've dicovered that PIN 11 controls the BLUE LEDS. Selecting "LED" for pin 11 turns on the blue LEDs when the relay is off. when the relay is on, le blue leds are off and the orange ones are on. Selecting "LED_n" on pin 11 the BLUE LEDs are off al lthe time, the orange ones only turn on when the relay is on. Is better that way so it doesn't looks like a christmas tree :)

    Code: JSON
    Log in, to see the code


    PS: already asked for the refund before tinkering with the switch
  • ADVERTISEMENT
  • #4 20843872
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14649
    Help: 655
    Rate: 12660
    That's interesting and very useful. By the way, If you want a permanent setting, you can change LED_n to AlwaysHigh or AlwaysAll.
    Helpful post? Buy me a coffee.
  • #5 20844726
    celulari
    Level 2  
    Posts: 3
    Rate: 1
    p.kaczmarek2 wrote:
    That's interesting and very useful. By the way, If you want a permanent setting, you can change LED_n to AlwaysHigh or AlwaysAll.


    Thanks for the tip!! I'm trying to find the way to get the opposite behaviour of the leds. blue when the relay is on and orange when is off. my other light switches work that way and is more intuitive, because the blue light is brighter than the orange one, so gives the impression that the switch is activated but it's actually off. I don't know if that's even possible.
  • #6 21131603
    chabalalasmike
    Level 6  
    Posts: 7
    Rate: 1
    >>20843825
    What about the reset button at the top, what is the pin number?
  • ADVERTISEMENT
  • #7 21131676
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14649
    Help: 655
    Rate: 12660
    Whoa, very good question! It seems that we've missed one pin:
    Screenshot showing OpenBeken configuration tool with highlighted backlit_io_pin element.
    It seems I need to add backlit_io_pin to our flasher soon.
    Helpful post? Buy me a coffee.
  • #8 21136227
    chabalalasmike
    Level 6  
    Posts: 7
    Rate: 1
    >>21131676
    Any progress on finding that missing pin?
  • #9 21136409
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14649
    Help: 655
    Rate: 12660
    As I said, have you tried P11?
    Helpful post? Buy me a coffee.
  • #10 21136946
    chabalalasmike
    Level 6  
    Posts: 7
    Rate: 1
    GPI013
  • ADVERTISEMENT
  • #11 21140242
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14649
    Help: 655
    Rate: 12660
    I can't see this particular GPIO in the JSON. Can you try getting Tuya binary (Web App -> Flash tab) and attach it here so I can investigate if it was correctly extracted?
    Helpful post? Buy me a coffee.
  • #12 21310683
    divadiow
    Level 38  
    Posts: 5089
    Help: 441
    Rate: 900
    p.kaczmarek2 wrote:
    It seems I need to add backlit_io_pin to our flasher soon

    yes. I have a Tuya device with 3 LEDs and this in the keys.

    "backlit_io_pin": 23

    Code: Text
    Log in, to see the code
  • #13 21310971
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14649
    Help: 655
    Rate: 12660
    Isn't it already added?
    https://github.com/search?q=repo%3Aopenshwpro...31GUIFlashTool%20backlit_io_pin&type=code
    Or maybe I need to add a build...
    Helpful post? Buy me a coffee.
  • #14 21310982
    divadiow
    Level 38  
    Posts: 5089
    Help: 441
    Rate: 900
    ah yes. a few commits not in June 5th build it seems
  • #15 21317010
    divadiow
    Level 38  
    Posts: 5089
    Help: 441
    Rate: 900
    Screenshot of Tuya device configuration with highlighted elements.
    Device configuration with OneWire IO marked on P26.

    cool
    I've rather presumptuously given it a version of 1.3.4
    Attachments:
    • bk7231flasher_1.3.4.zip (2.76 MB) You must be logged in to download this attachment.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ A 4-gang wall switch purchased from Manhot Store on AliExpress, advertised as a Zigbee device, was found to be a WiFi switch based on the BK7231N chip and CB3S board. The device's GPIO pinout was reverse-engineered and converted into an OpenBeken (OBK) template for firmware customization, revealing relay and button assignments along with LED control pins. Pin 11 was identified as controlling blue LEDs with configurable behavior to avoid excessive lighting effects. Discussions included modifying LED behavior to invert the relay indication colors and inquiries about the reset button pin, suspected to be GPIO13. The backlit_io_pin feature was noted as missing initially but later confirmed added in recent firmware builds. Users shared device configurations and firmware extraction methods to improve support and integration with custom firmware tools.
Today's popular

FAQ

TL;DR: This FAQ explains why a 4-gang Manhot wall switch sold as Zigbee was identified as WiFi, with one expert calling it "very strange" after finding a CB3S / BK7231N module inside. It helps buyers, flashers, and OpenBK users confirm the real radio, wire the correct pins, and restore LED behavior after flashing. [#20842494]

Why it matters: If a listing promises Zigbee but ships WiFi hardware, it changes pairing, flashing, local-control options, and whether you should request a refund.

Aspect Listed product Hardware found in teardown
Wireless type Zigbee smart switch WiFi smart switch
Main module Not confirmed in listing CB3S
Platform Expected Zigbee stack BK7231N-based Tuya module
Channels 4-gang 4 relays + 4 buttons mapped in OpenBK

Key insight: The most valuable finding is that GPIO11 controls the blue backlight LEDs. Without configuring P11, OpenBK can switch all 4 relays, but the blue LED behavior looks broken or incomplete. [#20843825]

Quick Facts

  • The switch is a 4-gang wall model with 4 clicky buttons, and each button directly triggers its matching relay. Orange indicates relay ON, while blue indicates relay OFF in the stock behavior. [#20842321]
  • The confirmed flashing pads on the CB3S module are CEN pin 3, VCC pin 8, GND pin 9, RX1 pin 15, and TX1 pin 16. [#20842321]
  • One successful flash used BK7231GuiFlashTool on Windows with firmware OpenBK7231N_QIO_1.17.308.bin; the same user reported no luck under Linux Ubuntu. [#20842321]
  • The initial OpenBK map exposed 4 relays on P7, P8, P9, P14 and 4 buttons on P10, P23, P24, P26, which was later extended by finding the blue LED function on P11. [#20843825]
  • Support for Tuya's backlit_io_pin was discussed later, and a participant noted the feature existed in code but not in the June 5th build, explaining why some extra LED GPIOs could stay hidden. [#21310982]

1. Why is the Manhot Store 4 gang switch sold as Zigbee actually showing up as a WiFi device with a CB3S module inside?

Because the teardown showed a CB3S module on the board, and CB3S is the WiFi-based hardware used in this unit, not a Zigbee radio. The buyer explicitly reported that the AliExpress listing called it a Zigbee smart switch, but the opened device contained a CB3S chip and behaved as a WiFi switch instead. [#20842321]

2. How do I flash OpenBK on a Tuya CB3S / BK7231N smart wall switch using BK7231GuiFlashTool?

You flash it by wiring the CB3S serial pins and forcing bootloader mode with CEN. 1. Solder wires to CEN, VCC, GND, RX1, and TX1. 2. Pull CEN as needed to enter bootloader mode, then connect the UART flasher. 3. Use BK7231GuiFlashTool and write OpenBK7231N_QIO_1.17.308.bin; this worked on Windows in the thread. [#20842321]

3. What pins on the CB3S module do I need for flashing, including CEN, VCC, GND, RX1, and TX1?

You need five pins for the flashing setup shown in the thread: CEN pin 3, VCC pin 8, GND pin 9, RX1 pin 15, and TX1 pin 16. Those are the exact CB3S pad numbers the user identified from the datasheet and then used for flashing. [#20842321]

4. What is the CEN pin on a CB3S module, and how does it help put the BK7231N into bootloader mode?

CEN is the control pin the user wired to force bootloader entry for flashing. "CEN" is a module control pin that enables or resets the chip for startup, and in this case the user soldered a wire to it specifically to place the BK7231N-based CB3S into bootloader mode. [#20842321]

5. What is a CB3S chip in Tuya devices, and how is it related to the BK7231N platform?

CB3S is the Tuya module board used in this switch, and it is built on the BK7231N platform. "CB3S" is a Tuya WiFi module that provides the radio and MCU section for smart devices, and in this thread it is explicitly identified as the board carrying the BK7231N chip. [#20842494]

6. Why does the blue backlight LED not work after flashing OpenBK on this Tuya 4 gang switch until GPIO11 is configured?

Because the first OpenBK mapping did not include the GPIO that drives the blue backlight. The user initially flashed a working relay and button setup, but later discovered that P11 controls the blue LEDs, so blue light behavior stayed missing until GPIO11 was assigned. [#20843825]

7. How should I configure the OpenBK pin mapping for the Manhot / Tuya 4 gang BK7231N switch with relays on P7, P8, P9, and P14 and buttons on P10, P23, P24, and P26?

Use the mapping published in the thread: P6 WifiLED_n, P7 Relay 4, P8 Relay 3, P9 Relay 2, P10 Button 4, P14 Relay 1, P23 Button 3, P24 Button 2, and P26 Button 1. A later revision also added P11 = LED_n;52 for the blue backlight line. [#20843825]

8. Which GPIO controls the blue LEDs or backlight on this Tuya 4 gang switch, and how do LED vs LED_n settings change the behavior?

GPIO P11 controls the blue LEDs on this switch. The user found that setting P11 as LED turned the blue LEDs on when the relay was off, while setting P11 as LED_n kept the blue LEDs off all the time and left only the orange LEDs active when the relay turned on. [#20843825]

9. What is backlit_io_pin in a Tuya device configuration, and why can missing support for it hide an extra LED or button GPIO?

backlit_io_pin is a Tuya configuration key for a separate backlight control line that may not appear in a simple relay/button template. "backlit_io_pin" is a Tuya device-configuration field that identifies a dedicated backlight GPIO, separate from the main relay or button pins, and missing parser support can leave that extra LED-related pin undiscovered. [#21310683]

10. How can I keep the blue LEDs permanently off on this BK7231N switch using AlwaysHigh or AlwaysAll in OpenBK?

You can keep the blue LEDs permanently off by changing the P11 role from LED_n to a fixed-state output such as AlwaysHigh or AlwaysAll. That tip was given directly in the thread as the way to make the setting persistent instead of relying on the default LED behavior. [#20843872]

11. Is there a way to invert the LED behavior so the blue light is on when the relay is on and the orange light is on when it is off?

The thread does not provide a confirmed working method to invert the colors that way on this switch. The user asked for blue-on when the relay is on and orange-on when it is off, but no later post in the thread gave a tested OpenBK mapping or command that achieved that result. [#20844726]

12. What is the pin number for the small reset or top button on this Tuya CB3S 4 gang switch?

The later follow-up says the small top or reset button is GPIO13. That value appeared after the missing extra pin was discussed, so the thread's final stated answer for that button is GPI013 / GPIO13. [#21136946]

13. Why might BK7231GuiFlashTool work under Windows for this CB3S switch but fail under Linux Ubuntu?

The thread only confirms the outcome, not the exact root cause: Windows succeeded, while Linux Ubuntu failed in that user's setup. This is a real edge case for this device, because the same user reported a successful Windows flash with OpenBK7231N_QIO_1.17.308.bin but no luck using the Linux flasher. [#20842321]

14. How do I convert a Tuya JSON device template into an OpenBK template with the OpenBeken web app template importer?

Use the OpenBeken web app's templateImporter to convert the extracted Tuya JSON into OBK format. In the thread, the converted output produced an OpenBK template naming the device as a Tuya 4-gang WiFi switch, with BK7231N, CB3S, and the detected GPIO pin map already filled in. [#20842494]

15. WiFi smart switch vs Zigbee smart switch for wall controls like this Tuya 4 gang model — what are the practical differences for flashing, local control, and refunds when the listing is wrong?

For this device, the practical difference is simple: WiFi hardware let the owner flash OpenBK on a CB3S/BK7231N board, while the Zigbee listing was wrong enough that a refund was recommended. One reply even said, "you should get a refund!" That makes radio type a buying, flashing, and dispute issue, not just a naming issue. [#20842494]
ADVERTISEMENT