One more Door Sensor
First Look
WiFi Chipset BK7231N/CB3S connected only to TuyaMCU via serial interface. Even LED connected to TuyaMCU.
TuyaMCU has power control for WiFi module.
There are two pins on the bottom of the board P3 and P2. Seems like this is for external sensor like a water leak sensor. To use it need Q2, R10, R9. But it use the same TuyaMCU pin that used for Magnetic Field Sensor now. So U3 needs to be dismounted in this case. (??? maybe they have a HighZ output and can work at the same time)
Firmware update
Firmware update possible only by desoldering chipset because TX-RX already connected to TuyaMCU .
Or maybe OTA?
OTA is probably possible via tuya-cloudcutter project https://github.com/tuya-cloudcutter/tuya-cloudcutter/tree/main
I found 2 similar sensors there:
- https://github.com/tuya-cloudcutter/tuya-clou...es/tuya-generic-cb3s-door-sensor-v1.0.10.json
- https://github.com/tuya-cloudcutter/tuya-clou...b/master/devices/avatto-ds06-door-sensor.json
Last one looks better.
Unfortunately, my unit has a new firmware version, so tuya-cloudcutter doen't work for it. No OTA update for today.
I conected it via serial inteface, and download original firmware. (You don't need to desolder WiFi chip, easy way to take of TuyaMCU. I has only 8 pins)
tuya-cloudcutter/profile-building/build_profile.py gaves me this:
OpenBK firmware was uploded via serial inteface and working good.
Draft config
Pins:
RX1 and TX1 connected to TuyaMCU.
TuyaMCU channels
#1 - Door Sensor (0-Closed, 1-Open)
#3 - Battery ( 2 -> 3V, 1-> ???, 0->??? )
Everything exactly like here Energy-saving (?) Battery-operated door / window sensor for WiFi DS06
Just a log of TuyaMCU communication:
Power consumption
~75..80mA - WiFi on and sending data to MQTT server
13uA - Sensor sleeping
For a test, I put BK7231N in to DeepSleep mode and all unit has ~20uA. So, It not so good as I was expected, and cutting power from WiFi chip is saving only ecreasing curent from 20uA to 13uA.
Cons of using TuyaMCU:
- no way to control main loop via BK7231N firmware (it will be power on only when TuyaMCU will do)
Pros:
- less power consumption
- TuyaMCU collect data (sensor status) while WiFi is booting. For example: door was opened, and closed several times during WiFi was booting. Tuya MCU will remember this, and will send this information to BK7231N.
Links
Aliexpress: https://www.aliexpress.us/item/3256805832136366.html
https://fccid.io/2ANK8-D06/Internal-Photos/09-D06-IntPho-4574559
https://www.elektroda.com/rtvforum/topic3866123-420.html#19982243
Energy-saving (?) Battery-operated door / window sensor for WiFi DS06
Door Sensor 19JWT-B (BK7231N)
More information to come...






First Look
WiFi Chipset BK7231N/CB3S connected only to TuyaMCU via serial interface. Even LED connected to TuyaMCU.
TuyaMCU has power control for WiFi module.
There are two pins on the bottom of the board P3 and P2. Seems like this is for external sensor like a water leak sensor. To use it need Q2, R10, R9. But it use the same TuyaMCU pin that used for Magnetic Field Sensor now. So U3 needs to be dismounted in this case. (??? maybe they have a HighZ output and can work at the same time)
Firmware update
Firmware update possible only by desoldering chipset because TX-RX already connected to TuyaMCU .
Or maybe OTA?

OTA is probably possible via tuya-cloudcutter project https://github.com/tuya-cloudcutter/tuya-cloudcutter/tree/main
I found 2 similar sensors there:
- https://github.com/tuya-cloudcutter/tuya-clou...es/tuya-generic-cb3s-door-sensor-v1.0.10.json
- https://github.com/tuya-cloudcutter/tuya-clou...b/master/devices/avatto-ds06-door-sensor.json
Last one looks better.
Unfortunately, my unit has a new firmware version, so tuya-cloudcutter doen't work for it. No OTA update for today.
I conected it via serial inteface, and download original firmware. (You don't need to desolder WiFi chip, easy way to take of TuyaMCU. I has only 8 pins)
tuya-cloudcutter/profile-building/build_profile.py gaves me this:
[+] Processing file='Tuya-Generic_DoorSensor-D06.bin' as Tuya-Generic_DoorSensor-D06
RBL containers:
0x10f9a: bootloader - [encoding_algorithm=NONE, size=0xea20]
extracted to Tuya-Generic_DoorSensor-D06
0x129f0a: app - [encoding_algorithm=NONE, size=0xe0820]
extracted to Tuya-Generic_DoorSensor-D06
Storage partition:
0x1ee000: 60 KiB - 7 keys
- 'gw_bi'
- 'gw_di'
- 'wf_start_md'
- 'gw_wsm'
- 'gw_ai'
- 'record_head'
- 'baud_cfg'
extracted all keys to Tuya-Generic_DoorSensor-D06/Tuya-Generic_DoorSensor-D06_storage.json
App code `user_param_key`:
- not found!
[+] Searching for known exploit patterns
[+] Matched pattern for BK7231N version SDK 2.3.1, payload type ssid
[!] The binary supplied appears to be patched and no longer vulnerable to the tuya-cloudcutter exploit.
OpenBK firmware was uploded via serial inteface and working good.
Draft config
Code: JSON
Pins:
RX1 and TX1 connected to TuyaMCU.
TuyaMCU channels
#1 - Door Sensor (0-Closed, 1-Open)
#3 - Battery ( 2 -> 3V, 1-> ???, 0->??? )
Everything exactly like here Energy-saving (?) Battery-operated door / window sensor for WiFi DS06
Just a log of TuyaMCU communication:
Info:CMD:[WebApp Cmd 'uartSendHex 55 AA 00 01 00 00 00' Result] OK
Info:TuyaMCU:TUYAMCU received: 55 AA 00 01 00 24 7B 22 70 22 3A 22 6E 79 77 72 76 67 68 7A 30 6F 32 74 71 32 67 34 22 2C 22 76 22 3A 22 31 2E 30 2E 30 22 7D B1
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 1 (QueryProductInformation) with 43 bytes
Info:TuyaMCU:TuyaMCU_ParseQueryProductInformation: received {"p":"nywrvghz0o2tq2g4","v":"1.0.0"}
Info:CMD:[WebApp Cmd 'uartSendHex 55 AA 00 02 00 01 04 06' Result] OK
Info:TuyaMCU:TUYAMCU received: 55 AA 00 02 00 00 01
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 2 (MCUconf) with 7 bytes
Info:TuyaMCU:TuyaMCU_ProcessIncoming: TUYA_CMD_MCU_CONF, TODO!
Info:TuyaMCU:TUYAMCU received: 55 AA 00 08 00 0C 00 02 02 02 02 02 02 01 01 00 01 00 22
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 8 (QueryState) with 19 bytes
Info:TuyaMCU:TuyaMCU_V0_ParseRealTimeWithRecordStorage: processing dpId 1, dataType 1-bool and 1 data bytes
Info:TuyaMCU:TuyaMCU_V0_ParseRealTimeWithRecordStorage: raw data 1 byte: 0
Info:TuyaMCU:TUYAMCU received: 55 AA 00 08 00 0C 00 02 02 02 02 02 02 01 01 00 01 01 23
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 8 (QueryState) with 19 bytes
Info:TuyaMCU:TuyaMCU_V0_ParseRealTimeWithRecordStorage: processing dpId 1, dataType 1-bool and 1 data bytes
Info:TuyaMCU:TuyaMCU_V0_ParseRealTimeWithRecordStorage: raw data 1 byte: 1
Info:TuyaMCU:TUYAMCU received: 55 AA 00 08 00 0C 00 01 01 01 01 01 01 03 04 00 01 02 23
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 8 (QueryState) with 19 bytes
Info:TuyaMCU:TuyaMCU_V0_ParseRealTimeWithRecordStorage: processing dpId 3, dataType 4-enum and 1 data bytes
Info:TuyaMCU:TuyaMCU_V0_ParseRealTimeWithRecordStorage: raw data 1 byte: 2
Power consumption
~75..80mA - WiFi on and sending data to MQTT server
13uA - Sensor sleeping
For a test, I put BK7231N in to DeepSleep mode and all unit has ~20uA. So, It not so good as I was expected, and cutting power from WiFi chip is saving only ecreasing curent from 20uA to 13uA.
Cons of using TuyaMCU:
- no way to control main loop via BK7231N firmware (it will be power on only when TuyaMCU will do)
Pros:
- less power consumption
- TuyaMCU collect data (sensor status) while WiFi is booting. For example: door was opened, and closed several times during WiFi was booting. Tuya MCU will remember this, and will send this information to BK7231N.
Links
Aliexpress: https://www.aliexpress.us/item/3256805832136366.html
https://fccid.io/2ANK8-D06/Internal-Photos/09-D06-IntPho-4574559
https://www.elektroda.com/rtvforum/topic3866123-420.html#19982243
Energy-saving (?) Battery-operated door / window sensor for WiFi DS06
Door Sensor 19JWT-B (BK7231N)
More information to come...
Cool? Ranking DIY