Tare down of LSPA7 tuya smart plug.
I purchased 2 of these things, they both lasted about a year before the stopped working. so before knowing about this site i started taking things apart and unfortunately broke a pad off the CB2S (BN7231N) module.
i've gathered all the info i can see the images of various steps along the way.
I have included a few of the programer i used the 'USB to UART Convert and USB to TTL RS485 RS232 3.3v 5v Output 3 Multifunctional Functions USB Serial Adapter Module CP2102' its able to provide enough power for the CB2S through the entire flashing process.
I used BK7231 GUI Flash Tool very easy to use i just spun up a vm of windows to flash the CB2S.
The LSPA7 smart plugs reports current use via the (BL0942) and also had a relay. The only other chip on the board is KP3210SG chip as I think the power supply. maybe 10vdc.
Here is a portion of the flashing process
I also have the binary backup of the device from the flashing process if any one needs it i may have to strip out some sata as i think it was still linked to my smartlife app.
I hope the all the pictures are good enough ?
I purchased 2 of these things, they both lasted about a year before the stopped working. so before knowing about this site i started taking things apart and unfortunately broke a pad off the CB2S (BN7231N) module.
i've gathered all the info i can see the images of various steps along the way.
I have included a few of the programer i used the 'USB to UART Convert and USB to TTL RS485 RS232 3.3v 5v Output 3 Multifunctional Functions USB Serial Adapter Module CP2102' its able to provide enough power for the CB2S through the entire flashing process.
I used BK7231 GUI Flash Tool very easy to use i just spun up a vm of windows to flash the CB2S.
The LSPA7 smart plugs reports current use via the (BL0942) and also had a relay. The only other chip on the board is KP3210SG chip as I think the power supply. maybe 10vdc.
Here is a portion of the flashing process
Spoiler:
Device configuration, as extracted from Tuya:
- Button (channel 1) on P6
- WiFi LED on P8
- Relay (channel 1) on P26
Device seems to be using CB2S module, which is using BK7231N.
And the Tuya section starts, as usual, at 2023424
json format
{
"rl1_lv":"1",
"bt1_pin":"6",
"net_trig":"2",
"jv":"1.0.3",
"netled1_lv":"0",
"netled_reuse":"0",
"bt1_type":"0",
"ffc_select":"0",
"nety_led":"1",
"over_cur":"16000",
"bt1_lv":"0",
"reset_t":"5",
"netled1_pin":"8",
"chip_type":"3",
"lose_vol":"70",
"over_vol":"300",
"module":"CB2S",
"ch_cddpid1":"9",
"ch1_stat":"2",
"rl1_type":"0",
"ch_num":"1",
"ele_fun_en":"1",
"rl1_pin":"26",
"netn_led":"0",
"vol_def":"0",
"ch_dpid1":"1",
"crc":"29",
"}hfX^Agw_dieAmf_test_close":"40.00",
"pv":"2.2",
"lpv":"3.3",
"pk":"<secret>",
"firmk":"<secret>",
"cadv":"true",
"cdv":"1.0.0",
"dev_swv":"1.1.7",
"s_id":"null",
"dtp":"0",
"sync":"0",
"attr_num":"0",
"mst_tp_0":"0",
"mst_ver_0":"null",
"mst_tp_1":"0",
"mst0dAtls_ca_cntpasswd":"<secret>",
"md":"0",
"random":"0",
"wfb64":"1",
"stat":"2",
"token":"<secret>",
"region":"null",
"reg_key":"null",
"dns_prio":"0^Atimer_arr08Atls_ca_cnt0fBastro_timer{abi",
"id":"<secret>",
"swv":"1.1.7",
"bv":"40.00",
"mst_ver_1":"null",
"mst_tp_2":"0",
"mst_ver_2":"null",
"mst_tp_3":"0",
"mst_ver_3":"null }<secret>",
"mode":"rw",
"property":"{type"
}
(True) success!
Going to do erase, start 1904640, sec count 1!
Erasing sector 1904640... ok!
All selected sectors erased!
Now will also write OBK config...
Long name from CFG: OpenBK_E2D100031
Short name from CFG: obk_E2D100031
Web Root from CFG: https://openbekeniot.github.io/webapp/
Writing config sector 0x1D1000...Writing file data to chip successs.
I also have the binary backup of the device from the flashing process if any one needs it i may have to strip out some sata as i think it was still linked to my smartlife app.
I hope the all the pictures are good enough ?
Cool? Ranking DIY