logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[BK7231N / T34 ] Teardown Tuya Generic Wifi Wall Light Switch 3 Gang

CameronDev 32775 115

TL;DR

  • A Tuya Generic WiFi Wall Light Switch 3 Gang with a BK7231N/T34 was torn down and prepared for OpenBeken flashing.
  • The front glass lifts off from the bottom opening, and the motherboard unclips easily, but the T34 QFN chip has no exposed programming pads.
  • It shipped from AliExpress with firmware 1.3.10 and was already patched against the CloudCutter exploit.
  • Hot-air desoldering, jumper wires, and bk7231flasher were needed to dump and reflash the chip, and the T34 was resoldered successfully.
  • OpenBeken and ESPHome pin maps are provided, but the dump could not extract Tuya config, so this is a difficult mod to attempt.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #31 21031898
    rufus4
    Level 11  
    Posts: 65
    Rate: 8
    I have problems to readout original tuya fw from the T34.
    After a while it stops reading with error.
    Is there some special settings to manage readout?
    Screenshot of a firmware reading program with a Reading failed message.
  • ADVERTISEMENT
  • #32 21031906
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    You can try playing around with values in "UART timeouts" tab, you can also shorten your wires. Alternatively, you can use python solution for BK7231N, follow this tutorial:




    Added after 15 [seconds]:

    https://github.com/OpenBekenIOT/hid_download_py
    Helpful post? Buy me a coffee.
  • #33 21032083
    rufus4
    Level 11  
    Posts: 65
    Rate: 8
    Thanks again for your help!
    Playing arround with baud rate didn`t help. Somehow the problem was the lab power supply. Now with a cheap chinese one I could read out flash.

    Is the log entry "Failed to extract Tuya keys - no json start found" relevant?
    Could it be that Tuya json does not exist because it was not created while device is still "virgin" and never got configured before?[/code]
  • ADVERTISEMENT
  • #34 21032342
    CameronDev
    Level 4  
    Posts: 12
    Help: 1
    Rate: 15
    I got something similar when trying to extract the json from my firmware, I had to manually create the config. There is still a json config that can be found in the firmware dump, so you can try read it manually.
  • #35 21041208
    Tilator
    Level 12  
    Posts: 130
    Help: 2
    Rate: 13
    t2004dd wrote:
    I flashed T34 chip successfully.
    Bridge CEN is not needed. You can start flashing if you just interrupt 3.3V , attached to the PIN8.
    I flashed it with baud rate 921600.

    BK7231N chip with soldered wires on a white surface.     Electronic module with green screw terminal block and black relay on a PCB.


    Did you flash it using BK7231N flash file and procedure? Are T34 and BK7231N identical enough? Except different pinout.
  • ADVERTISEMENT
  • #36 21041261
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    Yes, you need to use BK7231N procedure.

    Please refer to the following videos to see details of BK7231 flashing:
    Using https://github.com/openshwprojects/BK7231GUIFlashTool




    Using https://github.com/OpenBekenIOT/hid_download_py


    Helpful post? Buy me a coffee.
  • #37 21043972
    aliexpress
    Level 4  
    Posts: 7
    @karayoooo : I have the same T34 based SmartPlug with Energy measurement. I was able to connect wires and flash it successfully. By the way, it was not necessary to remove the 10K resistor which connects to P26. It worked leaving it in.

    However, the .bin file analysis did not give me a JSON config from the original firmware (key error just like others experienced).
    @karayoooo : Can you please provide your JSON config for this device? I did not yet manage to reverse engineer the pin settings :-(

    Added after 1 [hours] 58 [minutes]:

    So far I found out:
    "pins": {
    "6": "BL0937CF;0",
    "7": "BL0937CF1;0",
    "8": "BL0937SEL;0",
    "24": "Rel;1",
    "26": "Btn;1"
    }

    There are several LEDs behind the Button. One is coupled directly with the Rel and turns on/off together with Relais.
    There is a 2nd less bright one. I guess this could be used for WiFiLED... Pin assignment yet unclear....
  • #39 21044684
    aliexpress
    Level 4  
    Posts: 7
    Thanks rufus, yes, it is exactly the device as in the link, and the additional WiFi Led is working on P28!
  • #40 21044802
    Tilator
    Level 12  
    Posts: 130
    Help: 2
    Rate: 13
    karayoooo wrote:
    Hello guys

    it can be done directly without unsoldering T34.
    Here in a tuya socket.
    Yes It's tricky and yes a pcb pad is quite (but not) broken but it works !

    Close-up of a circuit board with an integrated circuit and a missing capacitor marked as C1.


    It seems to lack one component (C1). Does it work without it or did you put it back?
  • #41 21049093
    dhanushkadx
    Level 5  
    Posts: 8
    Rate: 2
    The image shows a blue printed circuit board with a detached SMD component next to it. Close-up of a blue circuit board with an SMD chip mounted on it. Printed circuit board with mounted SMD components. Screenshot of BK7231N flashing software on a computer. Electronic tools and circuit board on a blue workbench. PCB with SMD components, BGA flux, and tweezers on a blue background. Touch switch with a visible circuit board and packaging. Computer screen displaying the OpenBK7231N configuration interface. Screen of OpenBK7231N_E1E779B1 configuration with module setting options.

    This is not impossible if you have some smd chip reworking skills. actually this is my second switch . pervious one also succeeded. I used little flux and 400C hot air, be careful if u heat it too much pcb will be fried .
  • #42 21049118
    Tilator
    Level 12  
    Posts: 130
    Help: 2
    Rate: 13
    What programmer do you use?
  • #43 21049681
    dhanushkadx
    Level 5  
    Posts: 8
    Rate: 2
    Blue electronic module with a USB plug and small integrated circuit. Red USB signal conversion module with labeled pins and a voltage selection jumper.

    I use the red module. blue module also ok. set vcc jumber to 3.3V . and do not connect vcc line to chip untill the programmer start to flash. first press flash button of itchip tool or what ever after that connect vcc to ic . you may have to do this a few times to get it on flash mode
  • #44 21049682
    ferbulous
    Level 18  
    Posts: 419
    Help: 8
    Rate: 56
    @dhanushkadx did you still need to apply some solder paste or is it just flux? Also, how long do you apply the hot air to the chip
  • #45 21049685
    dhanushkadx
    Level 5  
    Posts: 8
    Rate: 2
    its flux that is a chemical to prevent oxidation . I used 400 c air it took me less that a 60 seconds to lift the chip. there are technics to bring down the heating time much further . if u use a pre heating machine you can bring pcb temp to 150 so it will take about 20 seconds to lift the chip. watch some youtube videos if you haven't rework a smd chip ever. because if you apply hot air longer there is a risk of damage the chip or pcb. SMD chip reworking is a skill that u should improved . sometimes i also burn chips mistakenly . get some old pcb with smd chip and try to rework before you do that to the working pcb.
  • #46 21049686
    ferbulous
    Level 18  
    Posts: 419
    Help: 8
    Rate: 56
    @dhanushkadx sorry, i meant for when you’re soldering back the chip to the pcb.
    So should be around the same time (<60 seconds) with some solder paste?
  • #47 21049694
    dhanushkadx
    Level 5  
    Posts: 8
    Rate: 2
    approximal the same time(60 sec) . regardless of removing or reordering the chip, its very important to give some breathing time to the pcb like 2 seconds for every 5 seconds of hot air . it allows to spread the heat and the temperature across the area otherwise sudden over heating a small area may cause to pop the pcb ok.
  • #48 21049756
    Tilator
    Level 12  
    Posts: 130
    Help: 2
    Rate: 13
    dhanushkadx wrote:

    I use the red module.


    What chip does it have?

    I suppose most of the problems in flashing is related to voltage differencies. I have three different gears to to do it, but none of them do not do it. They are all old devices. I ordered a new one having CH340G chip on it. I hope it's the right one.
  • #49 21049770
    dhanushkadx
    Level 5  
    Posts: 8
    Rate: 2
    yes u need smooth DC without noise or ripples. sometimes AC load on/off in the house electrical appliances during the flashing may interrupt the process , if your pc is not grounded properly . The chip on the red module is FTDI232RL and there are some programmers that has ch430g . both are ok. FTDI chip is expensive relatively. But both modules should work without a problem.
  • ADVERTISEMENT
  • #51 21050033
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    ferbulous wrote:
    Also, how long do you apply the hot air to the chip

    @ferbulous , please take that kind of advice with a grain of salt. Each soldering station is different.
    Please check the current version of my hot air comparison:
    https://openshwprojects.github.io/hotair/350c.html
    It's all at 350 C setting, as you can clearly see, the heating time and the measured temperature varies a lot between stations.

    Btw, this doesn't look too good:
    Close-up of a circuit board with soldering wires and an electronic module.

    Added after 1 [minutes]:

    dhanushkadx wrote:
    yes u need smooth DC without noise or ripples

    you also need enough current for WiFi module. We've already had reports here saying that flashing works but device does not connect to WiFi and it turned out that users were trying to connect to WiFi while having module still powered from USB to UART converter, which did not provide enough current and device rebooted
    Helpful post? Buy me a coffee.
  • #52 21050056
    Tilator
    Level 12  
    Posts: 130
    Help: 2
    Rate: 13
    p.kaczmarek2 wrote:
    you also need enough current for WiFi module.


    Since I have more than one of these, I did try to take power from an other similar device. I suppose there is power enough to power two devices from power source of one.

    Even that did not work in my case. That's why I wait for a new TTL adapter now.

    Added after 8 [hours] 12 [minutes]:

    I wonder how does programming go through SPI? Which pins need to be connected and does it require power connected too?
  • #53 21050745
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    Here is a detailed BK7231 SPI flashing tutorial: https://www.elektroda.com/rtvforum/topic3931424.html
    Helpful post? Buy me a coffee.
  • #54 21060154
    Tilator
    Level 12  
    Posts: 130
    Help: 2
    Rate: 13
    I got all my four devices flashed. Needed to use old Cubietruck to do it. A couple of old USB TTL adapters did not work.

    Now I would like to add a temperature sensor in them. My plan is to use these to steer heating and then there would be measuring and relay to steer in same package.

    Is there any news about OpenBeken and DS18B20 sensor?
  • #55 21060852
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    What about DHT11 and similiar ones? That would also give you humidity:


    Helpful post? Buy me a coffee.
  • #56 21060941
    Tilator
    Level 12  
    Posts: 130
    Help: 2
    Rate: 13
    p.kaczmarek2 wrote:
    What about DHT11 and similiar ones? That would also give you humidity:


    Well - why not. I just have those Dallas sensors already. And they are small enough to fit there.

    Does this DHT11 use similar one-wire technology allowing multiple sensors to one connection?
  • #58 21073130
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    @Tilator I think you can't connect multiple DHTs on single wire
    @divadiow it seems that 858 is good
    Helpful post? Buy me a coffee.
  • #59 21083385
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    p.kaczmarek2 wrote:
    it seems that 858 is good


    well that was easy. should have got one months ago. I haven't gauged my lifting strength right, lifted a copper pad or two, but the CBU was dead anyway. my first removal with air gun

    Two circuit boards on a wooden surface, one is a small square module.

    went for super cheap basic

    Soldering station with a hot air gun on a carpet.
  • #60 21083513
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    I have tested similiar model but with different visuals:
    View of the power label on the 858D/858A model device. Packaging of Renew Force soldering station model 858D.
    I will be posting review soon, this or next month.
    Helpful post? Buy me a coffee.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion focuses on the teardown and flashing process of Tuya generic WiFi wall light switches based on the BK7231N chip and T34 board, particularly 3-gang and 2-gang variants. The T34 chip is in a QFN package with no accessible programming pads, requiring desoldering for flashing with OpenBeken firmware. Users share detailed methods for desoldering and resoldering the T34 chip using hot air guns (temperatures around 350-480°C), flux, and soldering techniques, emphasizing the difficulty due to tiny pads and risk of PCB damage. Alternatives like needle probes for direct serial connection are discussed but often limited by concealed pads. Flashing is done via UART or SPI using FTDI232RL or CH340G-based USB-TTL adapters, with baud rates up to 921600. Some users report success without grounding the CEN pin by interrupting 3.3V supply to enter flash mode. Firmware extraction challenges include missing or manually created JSON configs. The devices often include additional components like BL0937 power measurement chips and WF480RA RF transceivers for remote control, sometimes unadvertised. Community members provide pin mappings for relays, buttons, and LEDs, and share templates for OpenBeken configuration. PowerSave mode and local NTP server support in OpenBeken are also mentioned. The discussion includes warnings about the complexity of flashing T34 devices, recommending caution and skill in SMD rework. Some users note differences in PCB versions, with older white-box versions having accessible TX/RX pads. Overall, the thread serves as a comprehensive resource for hardware hacking and firmware replacement on T34-based Tuya switches.
Generated by the language model.
Today's popular

FAQ

TL;DR: 480 °C hot-air, 921 600 bps UART and a steady hand let users flash Tuya T34 wall switches; “This is the most pro way of flashing I’ve ever seen” [Elektroda, p.kaczmarek2, post #20968230] Success rate rises to 100 % once VCC is power-cycled during upload [Elektroda, t2004dd, post #21007722]

Why it matters: The right method turns a €1.87 cloud-locked switch into fully local Home-Assistant hardware.

Quick Facts

• Chipset: BK7231N / T34, QFN32, 0.6 mm pitch [Elektroda, CameronDev, post #20968165] • Stock firmware: Tuya 1.3.10 (Cloudcutter-patched) [Elektroda, CameronDev, post #20968165] • Reliable upload speed: 921 600 bps HID-Download or BK7231GUI [Elektroda, t2004dd, post #21007722] • Reflow window: 400–480 °C, <60 s with narrow nozzle [Elektroda, CameronDev, post #20985028] • Typical cost: €1.87 per switch on AliExpress [Elektroda, t2004dd, post #21008716]

What makes the T34 wall switch harder to flash than older Tuya models?

All UART pins are hidden under the QFN-package and the four test pads carry only 3 V3 and ground; TX/RX are not routed out, so access requires chip removal or micro-probes [Elektroda, CameronDev, post #20968165]

Do I have to ground the CEN pin to enter boot mode?

No. Multiple users flashed successfully by simply interrupting 3 V3 on pin 8; CEN left floating works [Elektroda, t2004dd, post #21007722]

Which pads are safe for power connection?

On the 3-gang PCB the far-right pad is 3 V3 and the next one is GND [Elektroda, CameronDev, post #20968165] Measure before soldering because board revs vary.

What baud rate and software give the best results?

921 600 bps with BK7231GUIFlashTool or hid_download_py completes in ≈10 s [Elektroda, t2004dd, post #21007722] Lower rates work but increase timeout risk.

Can I flash without desoldering the T34?

Yes. Two dress-maker needles pressed against pins P10/P11 (RX/TX) plus soldered VCC/GND let users dump and write firmware without lifting the IC [Elektroda, divadiow, post #21117908]

Recommended hot-air settings for full removal?

Pre-heat optional; 400 °C melts the solder in ≈40 s, 480 °C in ≈25 s. Shield neighbouring parts with Kapton to stop them “flying off” [Elektroda, CameronDev, #20985028; jkwim, #20983797].

I get “Failed to extract Tuya keys – no json start found”. What now?

The key block is often absent on brand-new units; open the binary in a hex editor or copy a community template and edit pins manually [Elektroda, CameronDev, post #21032342]

Does the switch still accept RF remotes after conversion?

Yes. The WF480RA transceiver and its MCU remain untouched; pairing is done by holding the touch button, then pressing the RF remote key [Elektroda, p.kaczmarek2, post #21127139]

How can I lower idle temperature and power draw?

Enable PowerSave with “powersave 1”; users saw PCB temperature drop >10 °C and no automation issues [Elektroda, kalikum, post #21486484]

Is there a JTAG method for this MCU?

No documented JTAG routine exists for BK7231N/T34; only UART (PIO8 boot strap) and SPI NOR reflashing are supported officially [Elektroda, p.kaczmarek2, post #21050745]

Where can I find ready OpenBeken or ESPHome configs?

Templates for 1-, 2- and 3-gang variants are posted in the thread; import JSON starting with vendor “Tuya” and adjust pin list (e.g., P14/P26/P28 for relays) [Elektroda, johnypean, post #21111773]

Can I add a temperature sensor inside the switch?

Yes. DHT11 works on any free GPIO; run startDriver DHT11 Pxx. DS18B20 is not yet merged into OpenBeken codebase [Elektroda, p.kaczmarek2, post #21060852]

3-Step: Needle-flash without desoldering

  1. Solder thin wires to 3 V3 and GND test pads. 2. Hold two sewing needles on pins P10 (RX) and P11 (TX); tape them in place. 3. Power-cycle 3 V3, click “Upload” in BK7231GUI, release after “Sync OK”.[Elektroda, divadiow, post #21117908]
Generated by the language model.
ADVERTISEMENT