logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[BK7231N / T34 ] Teardown Tuya Generic Wifi Wall Light Switch 3 Gang

CameronDev 32775 115

TL;DR

  • A Tuya Generic WiFi Wall Light Switch 3 Gang with a BK7231N/T34 was torn down and prepared for OpenBeken flashing.
  • The front glass lifts off from the bottom opening, and the motherboard unclips easily, but the T34 QFN chip has no exposed programming pads.
  • It shipped from AliExpress with firmware 1.3.10 and was already patched against the CloudCutter exploit.
  • Hot-air desoldering, jumper wires, and bk7231flasher were needed to dump and reflash the chip, and the T34 was resoldered successfully.
  • OpenBeken and ESPHome pin maps are provided, but the dump could not extract Tuya config, so this is a difficult mod to attempt.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #61 21111773
    johnypean
    Level 5  
    Posts: 4
    Thanks for this thread. I have been successful, too.
    This is square 2-gang version.

    Code: JSON
    Log in, to see the code


    Square wall switch with two illuminated buttons on a wooden floor.
    Close-up of a blue circuit board with integrated circuits and yellow insulating tape.
    Prototype board next to a programmer with connecting wires.
  • ADVERTISEMENT
  • #62 21111776
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    Good job, but hey, is this Winbond memory chip? What's the purpose of that in the light switch?
    Helpful post? Buy me a coffee.
  • #63 21111928
    johnypean
    Level 5  
    Posts: 4
    WF480RA - 315/433MHz transceiver. It has its own antena on pcb opposite the T34s wifi antena. It seems to be connected to some of the T34 gpios. Haven't traced them. Looks like the device can be controlled by rf remote, but that wasn't mentioned in supplied manual.
  • #64 21111948
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    Ah, it makes sense, especially with that oscillator nearby... I also had sometimes smart devices coming with RF support unannounced.
    Helpful post? Buy me a coffee.
  • #65 21112115
    CameronDev
    Level 4  
    Posts: 12
    Help: 1
    Rate: 15
    >>21111928

    Mine did mention RF support on the box, but I have no idea how that was meant to be used.
  • #66 21112187
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    The image shows the technical documentation of the WF480RA integrated circuit.
    We will need to add WF480RA support.,
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #67 21117203
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    I've had the misfortune of receiving one of these. A challenge for another day perhaps

    Packaging of a touch light switch in green, featuring an image of a hand touching icons on a panel. Product packaging with technical specifications and a barcode. Close-up of a circuit board with visible integrated circuits and components.

    maybe some traces can be exposed instead of removing the whole chip

    Added after 1 [hours] 25 [minutes]:

    Couldn't resist starting

    Device update screen showing no updates available and auto upgrade option turned off. Close-up of a blue printed circuit board with electronic components and connected wires.

    Added after 2 [minutes]:

    Known as W601 BLE
    App interface showing W601 BLE device, currently offline.

    Added after 9 [minutes]:

    divadiow wrote:
    Known as W601 BLE

    Tying it in nicely with the Bingoelec brand
    https://templates.blakadder.com/bingoelec_W601.html
    https://www.elektroda.com/rtvforum/topic3974861.html#20911947

    Added after 7 [hours] 49 [minutes]:

    an educated pin stab for 28 P0/UART2_TXD gives us this boot output

    Code: Text
    Log in, to see the code


    Pin diagram of T34 LGA36 chip with UART lines highlighted.Image of a PCB with a microcontroller and soldered wires.

    Added after 12 [minutes]:

    interesting

    Code: Text
    Log in, to see the code
  • #68 21117870
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    At least I see no RT-Thread mentions, so the key should be as usual?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #69 21117908
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    it all looks like standard Tuya. The zipped dump in the first post gives this in Easy Flasher

    Error message stating Failed to extract keys with an OK button.

    but the user stuff is still decipherable. maybe a little tweak to Easy Flasher is all that's needed.

    Code: JSON
    Log in, to see the code


    I have not progressed to dump/flash my one yet

    Added after 2 [hours] 27 [minutes]:

    that was a mission. USB-TTL-> sewing needles to reach P11/P10.

    dumped and flashed without desoldering.

    Screenshot of Easy UART Flasher program after successful flashing of BK7231N chip.

    position of needles from a few angles:

    Hands holding needles connected to a circuit board A hand holding tweezers over a circuit board with attached wires. Electronic circuit board with wires and sewing needles attached to points P11/P10. A person holding a needle touching a PCB with wiring. Needles connected to a printed circuit board

    Wi-Fi connection icon with network name OpenBK7231N_0D1DD417.

    getting the right thickness of needle was key for me. It turned out one of mine was slightly thicker than the other and wasn't making contact. If you can feel the bumps of the legs then you're OK.
    Attachments:
    • readResult_BK7231N_QIO_2024-13-6-16-26-01.bin (2 MB) You must be logged in to download this attachment.
  • #70 21118121
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    Do you have RF Remote? This device should still have RF working I guess. RF is connected to the SOIC chip.
    Helpful post? Buy me a coffee.
  • #71 21118224
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    I forgot to mention that I also lifted this pin on the MCU.

    Close-up of an integrated circuit mounted on a blue circuit board.

    it either traces to P1 or P11, not entirely sure. I'll drop it again then see if I can still dump firmware, now I have needles the right thickness.

    Close-up of a PCB with several integrated circuits and a pinout diagram.

    Added after 2 [minutes]:

    p.kaczmarek2 wrote:
    Do you have RF Remote? This device should still have RF working I guess. RF is connected to the SOIC chip.


    I have 1 RF remote. Not sure of frequency or pulse or whatever. will try it

    Added after 50 [minutes]:

    sadly none of the remote buttons have an effect. it's one those 4CH Qiachip types

    Remote control with four numeric buttons and two function buttons.

    Bought it to try on this https://www.elektroda.com/rtvforum/topic4042000.html

    Added after 1 [hours] 39 [minutes]:

    Code: JSON
    Log in, to see the code


    The box pix shows 3 buttons, but mine is single gang. The user data json sets these pins on import. I think I'd prefer the red ring show the switch to be off, but in this setup red=on. The red LED seems to be controlled by the MCU, not the T34.





    https://github.com/OpenBekenIOT/webapp/pull/125

    Added after 1 [hours] 40 [minutes]:

    oh look WiFi pairing instructions for an RF switch.
  • #72 21127058
    Pete0815
    Level 7  
    Posts: 34
    Help: 1
    Rate: 3
    Hi

    just received 4pcs. of 1 Gang Switches and I expected CB2S to be inside but now there is T34 :(

    Interior of an electrical switch with visible electronic components.

    I have 858 hot air gun and used it for replacing damaged USB-C ports and figured out not easy to take care of swiming SMD components.

    So far no special tape here to use.

    Can you advise if it´s worth givin it a try just using the Air gun for <60 sec. with some flux to desolder T34 but not damaging or displacing other components?
    T34 is looking very circled by other components in my case/ for this type of switch.
    Thx!
  • #73 21127062
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    those legs look nicely exposed, unlike some T34s. I'd go with the sewing needle method.
  • #74 21127139
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    I've just somehow got that switch, nice. Someone must have ordered one for me, do you know anything, @divadiow ? Thank you. I've briefly tested it with my RF remote and it indeed works, procedure is to hold the button and then click RF remote button. There is no audio signal when pairing.


    Helpful post? Buy me a coffee.
  • #75 21127146
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    p.kaczmarek2 wrote:
    do you know anything, @divadiow ?

    I may do ;)

    thanks for testing RF.
  • #76 21127163
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    Thanks again, this may be a good idea for a youtube video. Still, first I need to decide what kind of flashing method would be the best here? Probably just try soldering the tiny wires to the pads... or the needles. I don't think showing the hot air method is a good idea, not many people have access to that kind of equipment.
    Helpful post? Buy me a coffee.
  • #77 21127172
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    The T34 legs are so concealed though on these types for soldering, but I guess anything is possible.
  • #78 21127247
    Pete0815
    Level 7  
    Posts: 34
    Help: 1
    Rate: 3
    divadiow wrote:
    ... but I guess anything is possible.


    Even having a hot air solder station in place, makes me think about using it because many things can go wrong for an inexperienced user.

    Don´t want to make any advertisement but I don´t have needle probe jig nor a 3d printer.

    Can you say if for the T34 these needel/clamps can work?

    https://de.aliexpress.com/item/10050059364367...pcDetailBottomMoreOtherSeller%7Cquery_from%3A

    Because based on my picture I can see each pin and have access to it when it´s solderes at the pcb.
  • #80 21127398
    rufus4
    Level 11  
    Posts: 65
    Rate: 8
    Pete0815 wrote:
    Can you say if for the T34 these needel/clamps can work?

    There is no free part of the legs on a T34 to hook in with anything.
    The needle technique from @divadiow would be the way to go.
    With the heatgun I would desolder the relay, the big resistor and the two condensators with a soldering iron first. And the clamp bar maybe better as well. Otherwise you have to use a to hight temperature or heat up for a to long time. Results in risk of damage the chip or risk of melting the parts arround.
  • #81 21127454
    Pete0815
    Level 7  
    Posts: 34
    Help: 1
    Rate: 3
    rufus4 wrote:
    Pete0815 wrote:
    Can you say if for the T34 these needel/clamps can work?

    There is no free part of the legs on a T34 to hook in with anything.
    The needle technique from @divadiow would be the way to go.


    Thanks. Now also found this topic which is exactly my device.
    https://www.elektroda.com/rtvforum/topic4051203.html
    VCC and GND are soldered but as expected I´m struggeling to place the needels.
    Just when I thought they are in place, I used some glue to hold them in place. So far this did not work and I got red messages in the flashing tool (1.1.6
    ) or it completly crashed. Guess the needles (RX/TX) are not well positioned but lost some glue on the pcb which is now similar to an isolation :(

    Guess I´ll give the hot air station a try.
  • #82 21127461
    Dave_S
    Level 1  
    Posts: 1
    I received two of these Tuya 2 gang touch switches with a nasty T34 chip inside recently.
    Thanks to the good information on this thread I have openbeken running on it.
    Thanks to @johnypean for the template that works on my 2 gang switch even though the board layout is slightly different to his,my board looks exactly like @divadiow 3 gang.
    Thanks also to the devs,without this firmware I would be forced to use Chinese servers !
    Is there a way to point openbeken to a local NTP server on my network ?
    None of my IOT devices have internet access but would like to sync their time with my private NTP server.
  • #83 21135586
    gregmarfaing
    Level 7  
    Posts: 16
    Help: 2
    Rate: 3
    I bought a similar one from ali to replace an esp8285 variant and it came with a t34 but i was pretty lucky and the pcb got easy flashing points
    Green PCB module with white plastic buttons labeled WIFI-W6B on a wooden surface. PCB board with marked TX and RX points.
    flashed it and it works flawlessly , here is the template :
    Code: text Expand Select all Copy to clipboard
    {
  "vendor": "Tuya",
  "bDetailed": "0",
  "name": "wifi 2 Gang Wall switch ",
  "model": "Wifi-W6B",
  "chip": "BK7231N",
  "board": "T34",
  "flags": "0",
  "keywords": [
    "T34",
    "W6B"
  ],
  "pins": {
    "7": "WifiLED_n;56",
    "8": "Btn;1",
    "9": "Rel;2",
    "16": "Btn;2",
    "17": "Rel;1"
  },
  "command": "powersave 1",
  "image": "https://obrazki.elektroda.pl/1549683800_1719574436.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/topic_YOUR_TOPIC.html"
}
  • ADVERTISEMENT
  • #84 21135629
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    Dave_S wrote:

    Is there a way to point openbeken to a local NTP server on my network ?

    Of course, you can set any server with ntp_setServer command.
    https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/commands.md
    Helpful post? Buy me a coffee.
  • #85 21326143
    dgel27
    Level 8  
    Posts: 19
    >>21117908 Hi, i have board most similar lake yours, but different component placement.
    In my board the Rx from T34 connected to resistor, so 1 needle is less :) The 4 pads also have different positions. the 2 of them - VCC and GND, the 2 others come to "unmarked" MCU, that i think served RF encodings touch buttons, and maybe T34 programming.

    I think it have be way to program T34 via these pads, at least for production. The chineese guys have to change at least their config for 1,2 or 3 gangs in the switch. I don't belive they program T34 for different configurations before assembly.

    Edit:
    My board seems exactlly as @dhanushkadx , the pads plased on the buttons side.
    I found, that in both modules, my, @dhanushkadx , @CameronDev and @divadiow have pins, that in regular works connected to buttons via some MCU,
    the 2 "special" pads, connected to same MCU's legs (in my case the pins 5 and 6 of MCU).
    But in some "special" modes, the buttons used P22,P23 that is JTAG TDO and TDI of T34.

    @p.kaczmarek2 maybe you know some way to program chip via JTAG? At least, it will be easier to connect to MCU's pins, instead with needles to T34.
    And if found way to program via 4 PCB points (i think it JTAG via MCU) it will be exellent.

    Other ways it seems Tuya go to produce more smaller and smaller modules with harder to connect to it..

    Is any way to found how to use these pins for programming? Or impossible?

    Thanks!
  • #86 21351950
    dwygaming
    Level 1  
    Posts: 1
    >>21135586 Hello :)

    How did you shorten with CEN ? I got the module connected, 3.3 and GND ok, But I can t pass the "reboot device" step, when I disconnect 3.3 from uart the COM3 disappear/ flasher sends an error.

    Any help appreciated :)
  • #87 21351976
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    What do you mean by "3.3V from UART"? 3.3V pin from UART can't provide enough current, check out our flashing tutorials here:
    https://www.youtube.com/@elektrodacom
    for example, that one:



    Here is a screen capture from this vid:
    Connection schematic with USB to TTL converter and 3.3V LDO with reset instructions.
    Helpful post? Buy me a coffee.
  • #88 21486220
    kalikum
    Level 5  
    Posts: 9
    Rate: 1
    Thanks for the thread, it has been very helpful.

    A few days ago I install tasmota on several wifi smart sockets bought in Aliexpress with ID T34 2132K9RQT X00LHC directly welding according to the information of this thread.

    Smart plug and box with Works with Amazon Alexa and Google Assistant information.

    Here the photo of how I did:

    Close-up of a circuit board with labeled 3.3V, GND, RX, and TX ports and connected wires.

    It is a very simple device, these are the details to be able to use the relay and the external button:

    Code: text Expand Select all Copy to clipboard
    pins
24: Rel;1
26: Btn;1
28: WifiLED;0

command: startDriver NTP


    Thank you very much for the information and for sharing it with everyone. <3

    PD: I hope my post is not at the wrong place
  • #89 21486299
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14395
    Help: 650
    Rate: 12319
    Thank you and good job on flashing that!

    I've also received this plug and decided to create a separate guide: https://www.elektroda.com/rtvforum/forum51.html
    Helpful post? Buy me a coffee.
  • #90 21486326
    kalikum
    Level 5  
    Posts: 9
    Rate: 1
    Thank you!!!!

    I had not seen it before, everything is very well documented, awesome.

    Mine has no consumption chip.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion focuses on the teardown and flashing process of Tuya generic WiFi wall light switches based on the BK7231N chip and T34 board, particularly 3-gang and 2-gang variants. The T34 chip is in a QFN package with no accessible programming pads, requiring desoldering for flashing with OpenBeken firmware. Users share detailed methods for desoldering and resoldering the T34 chip using hot air guns (temperatures around 350-480°C), flux, and soldering techniques, emphasizing the difficulty due to tiny pads and risk of PCB damage. Alternatives like needle probes for direct serial connection are discussed but often limited by concealed pads. Flashing is done via UART or SPI using FTDI232RL or CH340G-based USB-TTL adapters, with baud rates up to 921600. Some users report success without grounding the CEN pin by interrupting 3.3V supply to enter flash mode. Firmware extraction challenges include missing or manually created JSON configs. The devices often include additional components like BL0937 power measurement chips and WF480RA RF transceivers for remote control, sometimes unadvertised. Community members provide pin mappings for relays, buttons, and LEDs, and share templates for OpenBeken configuration. PowerSave mode and local NTP server support in OpenBeken are also mentioned. The discussion includes warnings about the complexity of flashing T34 devices, recommending caution and skill in SMD rework. Some users note differences in PCB versions, with older white-box versions having accessible TX/RX pads. Overall, the thread serves as a comprehensive resource for hardware hacking and firmware replacement on T34-based Tuya switches.
Generated by the language model.
Today's popular

FAQ

TL;DR: 480 °C hot-air, 921 600 bps UART and a steady hand let users flash Tuya T34 wall switches; “This is the most pro way of flashing I’ve ever seen” [Elektroda, p.kaczmarek2, post #20968230] Success rate rises to 100 % once VCC is power-cycled during upload [Elektroda, t2004dd, post #21007722]

Why it matters: The right method turns a €1.87 cloud-locked switch into fully local Home-Assistant hardware.

Quick Facts

• Chipset: BK7231N / T34, QFN32, 0.6 mm pitch [Elektroda, CameronDev, post #20968165] • Stock firmware: Tuya 1.3.10 (Cloudcutter-patched) [Elektroda, CameronDev, post #20968165] • Reliable upload speed: 921 600 bps HID-Download or BK7231GUI [Elektroda, t2004dd, post #21007722] • Reflow window: 400–480 °C, <60 s with narrow nozzle [Elektroda, CameronDev, post #20985028] • Typical cost: €1.87 per switch on AliExpress [Elektroda, t2004dd, post #21008716]

What makes the T34 wall switch harder to flash than older Tuya models?

All UART pins are hidden under the QFN-package and the four test pads carry only 3 V3 and ground; TX/RX are not routed out, so access requires chip removal or micro-probes [Elektroda, CameronDev, post #20968165]

Do I have to ground the CEN pin to enter boot mode?

No. Multiple users flashed successfully by simply interrupting 3 V3 on pin 8; CEN left floating works [Elektroda, t2004dd, post #21007722]

Which pads are safe for power connection?

On the 3-gang PCB the far-right pad is 3 V3 and the next one is GND [Elektroda, CameronDev, post #20968165] Measure before soldering because board revs vary.

What baud rate and software give the best results?

921 600 bps with BK7231GUIFlashTool or hid_download_py completes in ≈10 s [Elektroda, t2004dd, post #21007722] Lower rates work but increase timeout risk.

Can I flash without desoldering the T34?

Yes. Two dress-maker needles pressed against pins P10/P11 (RX/TX) plus soldered VCC/GND let users dump and write firmware without lifting the IC [Elektroda, divadiow, post #21117908]

Recommended hot-air settings for full removal?

Pre-heat optional; 400 °C melts the solder in ≈40 s, 480 °C in ≈25 s. Shield neighbouring parts with Kapton to stop them “flying off” [Elektroda, CameronDev, #20985028; jkwim, #20983797].

I get “Failed to extract Tuya keys – no json start found”. What now?

The key block is often absent on brand-new units; open the binary in a hex editor or copy a community template and edit pins manually [Elektroda, CameronDev, post #21032342]

Does the switch still accept RF remotes after conversion?

Yes. The WF480RA transceiver and its MCU remain untouched; pairing is done by holding the touch button, then pressing the RF remote key [Elektroda, p.kaczmarek2, post #21127139]

How can I lower idle temperature and power draw?

Enable PowerSave with “powersave 1”; users saw PCB temperature drop >10 °C and no automation issues [Elektroda, kalikum, post #21486484]

Is there a JTAG method for this MCU?

No documented JTAG routine exists for BK7231N/T34; only UART (PIO8 boot strap) and SPI NOR reflashing are supported officially [Elektroda, p.kaczmarek2, post #21050745]

Where can I find ready OpenBeken or ESPHome configs?

Templates for 1-, 2- and 3-gang variants are posted in the thread; import JSON starting with vendor “Tuya” and adjust pin list (e.g., P14/P26/P28 for relays) [Elektroda, johnypean, post #21111773]

Can I add a temperature sensor inside the switch?

Yes. DHT11 works on any free GPIO; run startDriver DHT11 Pxx. DS18B20 is not yet merged into OpenBeken codebase [Elektroda, p.kaczmarek2, post #21060852]

3-Step: Needle-flash without desoldering

  1. Solder thin wires to 3 V3 and GND test pads. 2. Hold two sewing needles on pins P10 (RX) and P11 (TX); tape them in place. 3. Power-cycle 3 V3, click “Upload” in BK7231GUI, release after “Sync OK”.[Elektroda, divadiow, post #21117908]
Generated by the language model.
ADVERTISEMENT