logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[BK7231N / T34 ] Teardown Tuya Generic Wifi Wall Light Switch 3 Gang

CameronDev 34770 124

TL;DR

  • A Tuya Generic WiFi Wall Light Switch 3 Gang with a BK7231N/T34 was torn down and prepared for OpenBeken flashing.
  • The front glass lifts off from the bottom opening, and the motherboard unclips easily, but the T34 QFN chip has no exposed programming pads.
  • It shipped from AliExpress with firmware 1.3.10 and was already patched against the CloudCutter exploit.
  • Hot-air desoldering, jumper wires, and bk7231flasher were needed to dump and reflash the chip, and the T34 was resoldered successfully.
  • OpenBeken and ESPHome pin maps are provided, but the dump could not extract Tuya config, so this is a difficult mod to attempt.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #31 21031898
    rufus4
    Level 11  
    Posts: 65
    Rate: 9
    I have problems to readout original tuya fw from the T34.
    After a while it stops reading with error.
    Is there some special settings to manage readout?
    Screenshot of a firmware reading program with a Reading failed message.
  • ADVERTISEMENT
  • #32 21031906
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14612
    Help: 655
    Rate: 12630
    You can try playing around with values in "UART timeouts" tab, you can also shorten your wires. Alternatively, you can use python solution for BK7231N, follow this tutorial:




    Added after 15 [seconds]:

    https://github.com/OpenBekenIOT/hid_download_py
    Helpful post? Buy me a coffee.
  • #33 21032083
    rufus4
    Level 11  
    Posts: 65
    Rate: 9
    Thanks again for your help!
    Playing arround with baud rate didn`t help. Somehow the problem was the lab power supply. Now with a cheap chinese one I could read out flash.

    Is the log entry "Failed to extract Tuya keys - no json start found" relevant?
    Could it be that Tuya json does not exist because it was not created while device is still "virgin" and never got configured before?[/code]
  • #34 21032342
    CameronDev
    Level 4  
    Posts: 12
    Help: 1
    Rate: 15
    I got something similar when trying to extract the json from my firmware, I had to manually create the config. There is still a json config that can be found in the firmware dump, so you can try read it manually.
  • #35 21041208
    Tilator
    Level 12  
    Posts: 133
    Help: 2
    Rate: 13
    t2004dd wrote:
    I flashed T34 chip successfully.
    Bridge CEN is not needed. You can start flashing if you just interrupt 3.3V , attached to the PIN8.
    I flashed it with baud rate 921600.

    BK7231N chip with soldered wires on a white surface.     Electronic module with green screw terminal block and black relay on a PCB.


    Did you flash it using BK7231N flash file and procedure? Are T34 and BK7231N identical enough? Except different pinout.
  • ADVERTISEMENT
  • #36 21041261
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14612
    Help: 655
    Rate: 12630
    Yes, you need to use BK7231N procedure.

    Please refer to the following videos to see details of BK7231 flashing:
    Using https://github.com/openshwprojects/BK7231GUIFlashTool




    Using https://github.com/OpenBekenIOT/hid_download_py


    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #37 21043972
    aliexpress
    Level 4  
    Posts: 7
    @karayoooo : I have the same T34 based SmartPlug with Energy measurement. I was able to connect wires and flash it successfully. By the way, it was not necessary to remove the 10K resistor which connects to P26. It worked leaving it in.

    However, the .bin file analysis did not give me a JSON config from the original firmware (key error just like others experienced).
    @karayoooo : Can you please provide your JSON config for this device? I did not yet manage to reverse engineer the pin settings :-(

    Added after 1 [hours] 58 [minutes]:

    So far I found out:
    "pins": {
    "6": "BL0937CF;0",
    "7": "BL0937CF1;0",
    "8": "BL0937SEL;0",
    "24": "Rel;1",
    "26": "Btn;1"
    }

    There are several LEDs behind the Button. One is coupled directly with the Rel and turns on/off together with Relais.
    There is a 2nd less bright one. I guess this could be used for WiFiLED... Pin assignment yet unclear....
  • ADVERTISEMENT
  • #39 21044684
    aliexpress
    Level 4  
    Posts: 7
    Thanks rufus, yes, it is exactly the device as in the link, and the additional WiFi Led is working on P28!
  • #40 21044802
    Tilator
    Level 12  
    Posts: 133
    Help: 2
    Rate: 13
    karayoooo wrote:
    Hello guys

    it can be done directly without unsoldering T34.
    Here in a tuya socket.
    Yes It's tricky and yes a pcb pad is quite (but not) broken but it works !

    Close-up of a circuit board with an integrated circuit and a missing capacitor marked as C1.


    It seems to lack one component (C1). Does it work without it or did you put it back?
  • #41 21049093
    dhanushkadx
    Level 5  
    Posts: 8
    Rate: 2
    The image shows a blue printed circuit board with a detached SMD component next to it. Close-up of a blue circuit board with an SMD chip mounted on it. Printed circuit board with mounted SMD components. Screenshot of BK7231N flashing software on a computer. Electronic tools and circuit board on a blue workbench. PCB with SMD components, BGA flux, and tweezers on a blue background. Touch switch with a visible circuit board and packaging. Computer screen displaying the OpenBK7231N configuration interface. Screen of OpenBK7231N_E1E779B1 configuration with module setting options.

    This is not impossible if you have some smd chip reworking skills. actually this is my second switch . pervious one also succeeded. I used little flux and 400C hot air, be careful if u heat it too much pcb will be fried .
  • #42 21049118
    Tilator
    Level 12  
    Posts: 133
    Help: 2
    Rate: 13
    What programmer do you use?
  • #43 21049681
    dhanushkadx
    Level 5  
    Posts: 8
    Rate: 2
    Blue electronic module with a USB plug and small integrated circuit. Red USB signal conversion module with labeled pins and a voltage selection jumper.

    I use the red module. blue module also ok. set vcc jumber to 3.3V . and do not connect vcc line to chip untill the programmer start to flash. first press flash button of itchip tool or what ever after that connect vcc to ic . you may have to do this a few times to get it on flash mode
  • #44 21049682
    ferbulous
    Level 18  
    Posts: 419
    Help: 8
    Rate: 56
    @dhanushkadx did you still need to apply some solder paste or is it just flux? Also, how long do you apply the hot air to the chip
  • #45 21049685
    dhanushkadx
    Level 5  
    Posts: 8
    Rate: 2
    its flux that is a chemical to prevent oxidation . I used 400 c air it took me less that a 60 seconds to lift the chip. there are technics to bring down the heating time much further . if u use a pre heating machine you can bring pcb temp to 150 so it will take about 20 seconds to lift the chip. watch some youtube videos if you haven't rework a smd chip ever. because if you apply hot air longer there is a risk of damage the chip or pcb. SMD chip reworking is a skill that u should improved . sometimes i also burn chips mistakenly . get some old pcb with smd chip and try to rework before you do that to the working pcb.
  • #46 21049686
    ferbulous
    Level 18  
    Posts: 419
    Help: 8
    Rate: 56
    @dhanushkadx sorry, i meant for when you’re soldering back the chip to the pcb.
    So should be around the same time (<60 seconds) with some solder paste?
  • #47 21049694
    dhanushkadx
    Level 5  
    Posts: 8
    Rate: 2
    approximal the same time(60 sec) . regardless of removing or reordering the chip, its very important to give some breathing time to the pcb like 2 seconds for every 5 seconds of hot air . it allows to spread the heat and the temperature across the area otherwise sudden over heating a small area may cause to pop the pcb ok.
  • #48 21049756
    Tilator
    Level 12  
    Posts: 133
    Help: 2
    Rate: 13
    dhanushkadx wrote:

    I use the red module.


    What chip does it have?

    I suppose most of the problems in flashing is related to voltage differencies. I have three different gears to to do it, but none of them do not do it. They are all old devices. I ordered a new one having CH340G chip on it. I hope it's the right one.
  • #49 21049770
    dhanushkadx
    Level 5  
    Posts: 8
    Rate: 2
    yes u need smooth DC without noise or ripples. sometimes AC load on/off in the house electrical appliances during the flashing may interrupt the process , if your pc is not grounded properly . The chip on the red module is FTDI232RL and there are some programmers that has ch430g . both are ok. FTDI chip is expensive relatively. But both modules should work without a problem.
  • #51 21050033
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14612
    Help: 655
    Rate: 12630
    ferbulous wrote:
    Also, how long do you apply the hot air to the chip

    @ferbulous , please take that kind of advice with a grain of salt. Each soldering station is different.
    Please check the current version of my hot air comparison:
    https://openshwprojects.github.io/hotair/350c.html
    It's all at 350 C setting, as you can clearly see, the heating time and the measured temperature varies a lot between stations.

    Btw, this doesn't look too good:
    Close-up of a circuit board with soldering wires and an electronic module.

    Added after 1 [minutes]:

    dhanushkadx wrote:
    yes u need smooth DC without noise or ripples

    you also need enough current for WiFi module. We've already had reports here saying that flashing works but device does not connect to WiFi and it turned out that users were trying to connect to WiFi while having module still powered from USB to UART converter, which did not provide enough current and device rebooted
    Helpful post? Buy me a coffee.
  • #52 21050056
    Tilator
    Level 12  
    Posts: 133
    Help: 2
    Rate: 13
    p.kaczmarek2 wrote:
    you also need enough current for WiFi module.


    Since I have more than one of these, I did try to take power from an other similar device. I suppose there is power enough to power two devices from power source of one.

    Even that did not work in my case. That's why I wait for a new TTL adapter now.

    Added after 8 [hours] 12 [minutes]:

    I wonder how does programming go through SPI? Which pins need to be connected and does it require power connected too?
  • #53 21050745
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14612
    Help: 655
    Rate: 12630
    Here is a detailed BK7231 SPI flashing tutorial: https://www.elektroda.com/rtvforum/topic3931424.html
    Helpful post? Buy me a coffee.
  • #54 21060154
    Tilator
    Level 12  
    Posts: 133
    Help: 2
    Rate: 13
    I got all my four devices flashed. Needed to use old Cubietruck to do it. A couple of old USB TTL adapters did not work.

    Now I would like to add a temperature sensor in them. My plan is to use these to steer heating and then there would be measuring and relay to steer in same package.

    Is there any news about OpenBeken and DS18B20 sensor?
  • #55 21060852
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14612
    Help: 655
    Rate: 12630
    What about DHT11 and similiar ones? That would also give you humidity:


    Helpful post? Buy me a coffee.
  • #56 21060941
    Tilator
    Level 12  
    Posts: 133
    Help: 2
    Rate: 13
    p.kaczmarek2 wrote:
    What about DHT11 and similiar ones? That would also give you humidity:


    Well - why not. I just have those Dallas sensors already. And they are small enough to fit there.

    Does this DHT11 use similar one-wire technology allowing multiple sensors to one connection?
  • #58 21073130
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14612
    Help: 655
    Rate: 12630
    @Tilator I think you can't connect multiple DHTs on single wire
    @divadiow it seems that 858 is good
    Helpful post? Buy me a coffee.
  • #59 21083385
    divadiow
    Level 38  
    Posts: 5059
    Help: 438
    Rate: 893
    p.kaczmarek2 wrote:
    it seems that 858 is good


    well that was easy. should have got one months ago. I haven't gauged my lifting strength right, lifted a copper pad or two, but the CBU was dead anyway. my first removal with air gun

    Two circuit boards on a wooden surface, one is a small square module.

    went for super cheap basic

    Soldering station with a hot air gun on a carpet.
  • #60 21083513
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14612
    Help: 655
    Rate: 12630
    I have tested similiar model but with different visuals:
    View of the power label on the 858D/858A model device. Packaging of Renew Force soldering station model 858D.
    I will be posting review soon, this or next month.
    Helpful post? Buy me a coffee.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion focuses on the teardown and flashing process of Tuya generic WiFi wall light switches based on the BK7231N chip and T34 board, particularly 3-gang and 2-gang variants. The T34 chip is in a QFN package with no accessible programming pads, requiring desoldering for flashing with OpenBeken firmware. Users share detailed methods for desoldering and resoldering the T34 chip using hot air guns (temperatures around 350-480°C), flux, and soldering techniques, emphasizing the difficulty due to tiny pads and risk of PCB damage. Alternatives like needle probes for direct serial connection are discussed but often limited by concealed pads. Flashing is done via UART or SPI using FTDI232RL or CH340G-based USB-TTL adapters, with baud rates up to 921600. Some users report success without grounding the CEN pin by interrupting 3.3V supply to enter flash mode. Firmware extraction challenges include missing or manually created JSON configs. The devices often include additional components like BL0937 power measurement chips and WF480RA RF transceivers for remote control, sometimes unadvertised. Community members provide pin mappings for relays, buttons, and LEDs, and share templates for OpenBeken configuration. PowerSave mode and local NTP server support in OpenBeken are also mentioned. The discussion includes warnings about the complexity of flashing T34 devices, recommending caution and skill in SMD rework. Some users note differences in PCB versions, with older white-box versions having accessible TX/RX pads. Overall, the thread serves as a comprehensive resource for hardware hacking and firmware replacement on T34-based Tuya switches.
Generated by the language model.
Today's popular

FAQ

TL;DR: At 480°C and 921600 baud, one expert conclusion was: "Bridge CEN is not needed." This FAQ helps OpenBeken users flash hard-to-access Tuya T34/BK7231N wall switches, recover pin maps when config extraction fails, and avoid common UART, power, and LED pitfalls on 1–3 gang boards. [#21007722]

Why it matters: These Tuya switches can look identical at purchase time, yet one version may flash from exposed pads while another requires chip removal, needles, or pogo-pin probing.

Method Hardware access Risk level Proven result in thread
Hot-air chip removal Full T34 desolder High Worked, but described as "not for the faint of heart"
Needle / sewing-needle UART Touch hidden pins in-circuit Medium Successful dump and flash without desoldering
Pogo-pin probe rig Weighted vertical probes Medium Used to flash multiple T34 devices quickly
Exposed factory pads Direct board pads Low Some later boards flashed easily from pads

Key insight: The hardest part is usually not OpenBeken itself. It is gaining stable electrical access to T34 UART, then keeping power, contact pressure, and baud rate stable long enough to read or write flash.

Quick Facts

  • One 3-gang T34 switch shipped with Tuya firmware 1.3.10, blocked Cloudcutter, and had four board pads where only 3.3 V and GND were identified as useful for power, not direct flashing. [#20968165]
  • Reported hot-air settings ranged from 400°C to 480°C, with one successful T34 removal taking under 60 seconds and another user running the fan at maximum speed. [#21049685]
  • Successful direct flashing reports used 921600 baud and also 230400 baud on similar T34 boards, but unstable setups produced read or write failures even after a nominally successful erase. [#21007722]
  • One buyer paid 1.87 euro per switch on 2024-03-18, which explains why some users still accepted the extra rework needed for T34 packages. [#21008716]
  • A cheap $50 hot-air station could fail at 450°C, while a $400 station removed the same part at 350°C; the temperature number alone was not a reliable benchmark. [#20975908]

How do you flash a Tuya T34/BK7231N wall light switch with OpenBeken when the module has no exposed programming pads?

You flash it by either removing the T34 or reaching its hidden UART pins in-circuit. 1. Open the switch by prying off the glass front and unclipping the board. 2. Expose UART by hot-air desoldering the QFN T34 or by touching RX/TX with needles or pogo probes. 3. Dump first, then write OpenBeken with a BK7231N-compatible tool and restore the board carefully. One successful 3-gang case needed full T34 removal because no programming pads reached the chip. [#20968165]

Why does Tuya config extraction sometimes fail on T34 firmware dumps with 'no json start found', and how can you recover the pin mapping manually?

It fails because the dump can contain Tuya data that the extractor does not parse cleanly, even though the configuration still exists in flash. You can recover the mapping by reading decrypted strings or boot logs and matching relay, button, and LED pins manually. On one 3-gang dump, the author rebuilt the map by inspection and published P8 as WiFi LED, P14/P26/P28 as relays, and P22/P23/P24 as buttons. That gives a working template even when automatic extraction fails. [#20968165]

What is the CEN pin on a T34 or BK7231N, and how is it used during flashing?

CEN is a control pin used to reset or enable the chip during entry to flashing mode. Early attempts grounded it because that was thought necessary, but later successful T34 flashes showed it was not required. A direct report stated, "Bridge CEN is not needed," and flashing started by interrupting 3.3 V on pin 8 instead. That makes CEN optional in this thread’s T34 cases, not a mandatory wire for every setup. [#21007722]

What is the BL0937 chip in Tuya smart plugs and switches, and why does it matter for OpenBeken PowerSave settings?

"BL0937 is an energy-measurement IC that reads electrical parameters, uses timing-sensitive signals, and appears in some Tuya plugs and switches, which makes aggressive MCU sleep settings more sensitive than on simple relay-only boards." It matters because one OpenBeken maintainer said PowerSave is fine on devices without BL0937, but BL0937 devices may need a different PowerSave approach. A 2025 plug example without BL0937 ran cooler after PowerSave, while BL0937 cases were called out as exceptions. [#21486413]

Which hot air settings work best for desoldering and resoldering a T34 QFN chip without frying the PCB or blowing away nearby SMD parts?

No single temperature works best; station behavior matters more than the number on the display. The safest thread-backed practice was: 1. Use Kapton tape on nearby parts. 2. Use a narrow nozzle and the lowest setting that actually melts solder on your station. 3. Verify on scrap boards before touching T34. Reported successful settings ranged from 400°C to 480°C, but a maintainer showed that 350°C on different stations produced very different real temperatures and heating times. [#21050033]

When flashing a T34, why might interrupting 3.3V or briefly making and breaking the TX connection work better than grounding CEN?

It can work better because the chip often enters the bootloader on a power-state transition or a momentary valid UART event, not from a permanent CEN short. One T34 user flashed successfully by interrupting 3.3 V on pin 8, and another later discovered that briefly lifting and re-touching the TX probe triggered communication. Those reports point to timing and contact quality as the real issue on hidden-pin T34 boards. [#21636218]

What OpenBeken pin configuration works for the Tuya Generic Touch Light Switch 3 Gang with T34 and BK7231N?

A proven 3-gang OpenBeken mapping is P8 = WifiLED;55, P14 = Rel;1, P22 = Btn;3, P23 = Btn;2, P24 = Btn;1, P26 = Rel;2, and P28 = Rel;3. The same thread also shared an ESPHome layout using P22/P23/P24 for buttons, P28/P26/P14 for relays, and P8 as an inverted status LED. That configuration came from a firmware dump and manual reverse-mapping after extractor failure. [#20968165]

How can you flash a T34 directly in-circuit with needles, pogo pins, or trace access instead of removing the chip?

You can do it by contacting the hidden UART points mechanically and avoiding full chip removal. 1. Solder stable 3.3 V and GND first. 2. Touch RX and TX with sewing needles, pogo probes, or accessible traces. 3. Start the flasher, then adjust contact pressure or re-touch TX until the bus syncs. One user dumped and flashed a concealed-leg T34 entirely in-circuit with sewing needles, and another later flashed multiple boards using vertical pogo-pin rods resting by weight. [#21117908]

BK7231GUIFlashTool vs hid_download_py: which is better for backing up and flashing T34/BK7231N devices?

Neither was presented as universally better; the thread treats them as complementary. BK7231GUIFlashTool is convenient for guided UART flashing, while hid_download_py was suggested when readout problems persisted and users needed an alternative path. One maintainer explicitly recommended trying the Python tool after UART read issues, alongside timeout tuning and shorter wires. In practice, the better choice in this thread was the one that matched your adapter, wire quality, and board behavior on that specific T34. [#21031906]

Why does a freshly flashed T34 switch sometimes fail to start the OpenBeken WiFi AP even though the write process reports success?

The usual cause is not the firmware file alone; it is unstable flashing, bad contact, or a partial write that still looked successful during the session. One 2025 case erased and wrote sectors, but the switch never entered AP mode after five power cycles, the WiFi LED flashed weakly once, then stayed bright blue, and even writing the original backup back failed at sector 0x11000. That pattern points to corrupted flash contents or unreliable electrical access during programming. [#21619518]

What causes UART flashing read or write errors on T34 boards, and how do wire length, baud rate, power supply quality, and USB-TTL adapters affect reliability?

Long wires, unstable 3.3 V, noisy supplies, weak USB-TTL adapters, and mismatched baud rates all cause failures. The thread gave concrete fixes: shorten wires, tune UART timeouts, try 115200 to 921600 baud, and avoid relying on the UART adapter’s 3.3 V pin for full module power. One user fixed repeated read errors simply by changing the lab supply, while others reported old adapters failing and FTDI232RL or CH340G working better. Enough current matters, especially once Wi-Fi starts. [#21032083]

How do you configure the WiFi LED on T34-based wall switches so it turns off after connecting instead of staying bright blue all the time?

Set the LED pin to the opposite WiFi LED polarity. A 2026 report solved the always-on blue LED by changing the original setting from WifiLED_n to WifiLED. Another 2025 ESPHome example used an inverted GPIO output on P7, but that could also change button backlight behavior. The simplest OpenBeken fix in this thread was to try WifiLED versus WifiLED_n on the same LED pin until the post-connect state matches your hardware. [#21810549]

What’s the difference between T34, CB2S, and CB3S Tuya modules when choosing a smart switch that is easier to reflash?

T34 is the risky choice when the board hides UART and exposes no usable pads. The thread repeatedly warned against buying T34-based switches because flashing often required chip removal, needles, or rework. By contrast, older stock in white boxes and some CB2S-based units were reported with accessible TX/RX pads, making them much easier to reflash. One buyer even advised looking for white-box stock specifically to avoid T34 trouble. [#21009070]

Which USB-to-UART adapter is more reliable for T34 flashing, CH340G or FTDI232RL, and why do some adapters fail on these boards?

Both CH340G and FTDI232RL can work, but the thread gave FTDI232RL a slight edge for stability on difficult boards. One user used an FTDI232RL-based red adapter successfully and said CH340G also works, while another failed with older adapters and had to switch hardware before flashing succeeded. Adapters fail when they provide noisy power, insufficient current, or marginal UART timing. The chip choice matters less than clean 3.3 V, solid contact, and a converter that handles the board reliably. [#21049770]

How could you program or access a T34 through alternative pins like JTAG or board-side MCU pads when RX and TX are hard to reach?

The thread did not provide a confirmed JTAG flashing method for T34. One later analysis noted that some board-side pads appear to reach a small companion MCU and that T34 pins P22 and P23 map to JTAG TDO and TDI in normal operation, but this stayed a hypothesis. The only proven alternatives in the thread were UART through hidden legs, exposed traces, removed companion parts, or board pads that happened to break out power and serial. Treat JTAG access here as unverified. [#21326143]
Generated by the language model.
ADVERTISEMENT