logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
Discover miniature XIAO boards »
Discover miniature XIAO boards » ESP32-S3 • nRF52840 • RP2040
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

[T34/BL0937] Teardown Generic Wifi Smart Plug with Energy Measurement

Raufaser 33759 143
Best answers

How can I flash a T34/BL0937 smart plug when the UART pads are hard to access?

Use a very fine-wire or needle method instead of trying to solder thick leads directly to the T34. The most practical setup in the thread is to leave the T34 on the PCB, solder 3.3V and GND to the AMS1117 pins, take TX from the exposed pad/resistor point, and touch RX with a sewing needle or thin enameled wire on pin 25; several users also needed an external 3.3V supply and a few power cycles before the flasher connected [#21044837] [#21373301] [#21334978] One reply notes that only one UART line is actually broken out on some boards, so flux and very precise soldering are needed, and if all else fails you can desolder the T34 and flash it off-board, though that is risky [#21005230] If your revision uses a BL0942/BL0492 energy meter instead of BL0937, flashing can be easier by connecting to the meter chip’s UART pins 9/10 plus VCC and GND, without modifying the T34 itself [#21364027] [#21420827]
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #61 21327608
    fatalbullethit
    Level 3  
    p.kaczmarek2 wrote:
    Do Tuya Config extraction, set BL0937 pins and it will work well.

    Thanks for the quick reply, unfortunately I get the following error: "Failed to extract keys"
    Screenshot of a software tool for extracting keys from firmware files.
    I tried both, the tuya config and a complete dump. Any ideas?

    Edit:
    I did flash ESPHome to it and reverted to OpenBeken, not sure if this might cause issues.
    I'll flash OpenBeken to another one I've laying around and will extract the config again and report back.
  • ADVERTISEMENT
  • #62 21327628
    divadiow
    Level 38  
    Some boot log outputs contain pin assignments - yours might?

    Do you have factory Tuya or Tuya config bin and willing to post here? Or DM me if not.
  • #63 21327646
    p.kaczmarek2
    Moderator Smart Home  
    Maybe an existing BL0937 + T34 template matches?
    Helpful post? Buy me a coffee.
  • #64 21327647
    fatalbullethit
    Level 3  
    >>21327628
    Only did a firmware backup (read) only this time, error seems to be the same:
    Screenshot of Easy UART Flasher with the message Reading success! and error Failed to extract keys.
    I attached the firmware backup and this is the complete console log:
    Code: text Expand Select all Copy to clipboard
    Tuya config extractor - magic is at 2023424 
Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
Failed to extract Tuya keys - no json start found
Tuya config extractor - magic is at 0 
Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
Failed to extract Tuya keys - no json start found
Tuya config extractor - magic is at 0 
Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
Failed to extract Tuya keys - no json start found
Tuya config extractor - magic is at 0 
Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
Failed to extract Tuya keys - no json start found
Tuya config extractor - magic is at 0 
Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
Failed to extract Tuya keys - no json start found
Tuya config extractor - magic is at 2023424 
Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
Failed to extract Tuya keys - no json start found
Backup name has not been set, so output file will only contain flash type/date.
Starting read!
Read parms: start 0x00 (sector 0), len 0x200000 (0 sectors)
Now is: 01 December 2024 13:30:05.
Flasher mode: BK7231N
Going to open port: COM8.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus failed, will try again - 0/100!
Getting bus failed, will try again - 1/100!
Getting bus failed, will try again - 2/100!
Getting bus success!
Going to set baud rate setting (921600)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 15701C
Will now search for Flash def in out database...
Flash def found! For: 15701C
Flash information: mid: 15701C, icName: EN25QH16B, manufacturer: ESMT, szMem: 1000000, szSR: 1, cwUnp: 0, cwEnp: 7, cwMsk: 3C, sb: 2, lb: 4, cwdRd: 05-FF-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 34
final sr: 34
msk: 3c
cw: 0, sb: 2, lb: 4
bfd: 0
sr: 0
final sr: 0
msk: 3c
cw: 0, sb: 2, lb: 4
bfd: 0
SetProtectState(True) success!
Going to read encryption key...
Encryption key read done!
Encryption key: 510fb093 a3cbeadc 5993a17e c7adeb03
Going to start reading at offset 0x00...
Reading 0x00... Ok! Reading 0x1000... Ok! Reading 0x2000... Ok! Reading 0x3000... Ok! Reading 0x4000... Ok! Reading 0x5000... Ok! Reading 0x6000... Ok! Reading 0x7000... Ok! Reading 0x8000... Ok! Reading 0x9000... Ok! Reading 0xA000... Ok! Reading 0xB000... Ok! Reading 0xC000... Ok! Reading 0xD000... Ok! Reading 0xE000... Ok! Reading 0xF000... Ok! Reading 0x10000... Ok! Reading 0x11000... Ok! Reading 0x12000... Ok! Reading 0x13000... Ok! Reading 0x14000... Ok! Reading 0x15000... Ok! Reading 0x16000... Ok! Reading 0x17000... Ok! Reading 0x18000... Ok! Reading 0x19000... Ok! Reading 0x1A000... Ok! Reading 0x1B000... Ok! Reading 0x1C000... Ok! Reading 0x1D000... Ok! Reading 0x1E000... Ok! Reading 0x1F000... Ok! Reading 0x20000... Ok! Reading 0x21000... Ok! Reading 0x22000... Ok! Reading 0x23000... Ok! Reading 0x24000... Ok! Reading 0x25000... Ok! Reading 0x26000... Ok! Reading 0x27000... Ok! Reading 0x28000... Ok! Reading 0x29000... Ok! Reading 0x2A000... Ok! Reading 0x2B000... Ok! Reading 0x2C000... Ok! Reading 0x2D000... Ok! Reading 0x2E000... Ok! Reading 0x2F000... Ok! Reading 0x30000... Ok! Reading 0x31000... Ok! Reading 0x32000... Ok! Reading 0x33000... Ok! Reading 0x34000... Ok! Reading 0x35000... Ok! Reading 0x36000... Ok! Reading 0x37000... Ok! Reading 0x38000... Ok! Reading 0x39000... Ok! Reading 0x3A000... Ok! Reading 0x3B000... Ok! Reading 0x3C000... Ok! Reading 0x3D000... Ok! Reading 0x3E000... Ok! Reading 0x3F000... Ok! Reading 0x40000... Ok! Reading 0x41000... Ok! Reading 0x42000... Ok! Reading 0x43000... Ok! Reading 0x44000... Ok! Reading 0x45000... Ok! Reading 0x46000... Ok! Reading 0x47000... Ok! Reading 0x48000... Ok! Reading 0x49000... Ok! Reading 0x4A000... Ok! Reading 0x4B000... Ok! Reading 0x4C000... Ok! Reading 0x4D000... Ok! Reading 0x4E000... Ok! Reading 0x4F000... Ok! Reading 0x50000... Ok! Reading 0x51000... Ok! Reading 0x52000... Ok! Reading 0x53000... Ok! Reading 0x54000... Ok! Reading 0x55000... Ok! Reading 0x56000... Ok! Reading 0x57000... Ok! Reading 0x58000... Ok! Reading 0x59000... Ok! Reading 0x5A000... Ok! Reading 0x5B000... Ok! Reading 0x5C000... Ok! Reading 0x5D000... Ok! Reading 0x5E000... Ok! Reading 0x5F000... Ok! Reading 0x60000... Ok! Reading 0x61000... Ok! Reading 0x62000... Ok! Reading 0x63000... Ok! Reading 0x64000... Ok! Reading 0x65000... Ok! Reading 0x66000... Ok! Reading 0x67000... Ok! Reading 0x68000... Ok! Reading 0x69000... Ok! Reading 0x6A000... Ok! Reading 0x6B000... Ok! Reading 0x6C000... Ok! Reading 0x6D000... Ok! Reading 0x6E000... Ok! Reading 0x6F000... Ok! Reading 0x70000... Ok! Reading 0x71000... Ok! Reading 0x72000... Ok! Reading 0x73000... Ok! Reading 0x74000... Ok! Reading 0x75000... Ok! Reading 0x76000... Ok! Reading 0x77000... Ok! Reading 0x78000... Ok! Reading 0x79000... Ok! Reading 0x7A000... Ok! Reading 0x7B000... Ok! Reading 0x7C000... Ok! Reading 0x7D000... Ok! Reading 0x7E000... Ok! Reading 0x7F000... Ok! Reading 0x80000... Ok! Reading 0x81000... Ok! Reading 0x82000... Ok! Reading 0x83000... Ok! Reading 0x84000... Ok! Reading 0x85000... Ok! Reading 0x86000... Ok! Reading 0x87000... Ok! Reading 0x88000... Ok! Reading 0x89000... Ok! Reading 0x8A000... Ok! Reading 0x8B000... Ok! Reading 0x8C000... Ok! Reading 0x8D000... Ok! Reading 0x8E000... Ok! Reading 0x8F000... Ok! Reading 0x90000... Ok! Reading 0x91000... Ok! Reading 0x92000... Ok! Reading 0x93000... Ok! Reading 0x94000... Ok! Reading 0x95000... Ok! Reading 0x96000... Ok! Reading 0x97000... Ok! Reading 0x98000... Ok! Reading 0x99000... Ok! Reading 0x9A000... Ok! Reading 0x9B000... Ok! Reading 0x9C000... Ok! Reading 0x9D000... Ok! Reading 0x9E000... Ok! Reading 0x9F000... Ok! Reading 0xA0000... Ok! Reading 0xA1000... Ok! Reading 0xA2000... Ok! Reading 0xA3000... Ok! Reading 0xA4000... Ok! Reading 0xA5000... Ok! Reading 0xA6000... Ok! Reading 0xA7000... Ok! Reading 0xA8000... Ok! Reading 0xA9000... Ok! Reading 0xAA000... Ok! Reading 0xAB000... Ok! Reading 0xAC000... Ok! Reading 0xAD000... Ok! Reading 0xAE000... Ok! Reading 0xAF000... Ok! Reading 0xB0000... Ok! Reading 0xB1000... Ok! Reading 0xB2000... Ok! Reading 0xB3000... Ok! Reading 0xB4000... Ok! Reading 0xB5000... Ok! Reading 0xB6000... Ok! Reading 0xB7000... Ok! Reading 0xB8000... Ok! Reading 0xB9000... Ok! Reading 0xBA000... Ok! Reading 0xBB000... Ok! Reading 0xBC000... Ok! Reading 0xBD000... Ok! Reading 0xBE000... Ok! Reading 0xBF000... Ok! Reading 0xC0000... Ok! Reading 0xC1000... Ok! Reading 0xC2000... Ok! Reading 0xC3000... Ok! Reading 0xC4000... Ok! Reading 0xC5000... Ok! Reading 0xC6000... Ok! Reading 0xC7000... Ok! Reading 0xC8000... Ok! Reading 0xC9000... Ok! Reading 0xCA000... Ok! Reading 0xCB000... Ok! Reading 0xCC000... Ok! Reading 0xCD000... Ok! Reading 0xCE000... Ok! Reading 0xCF000... Ok! Reading 0xD0000... Ok! Reading 0xD1000... Ok! Reading 0xD2000... Ok! Reading 0xD3000... Ok! Reading 0xD4000... Ok! Reading 0xD5000... Ok! Reading 0xD6000... Ok! Reading 0xD7000... Ok! Reading 0xD8000... Ok! Reading 0xD9000... Ok! Reading 0xDA000... Ok! Reading 0xDB000... Ok! Reading 0xDC000... Ok! Reading 0xDD000... Ok! Reading 0xDE000... Ok! Reading 0xDF000... Ok! Reading 0xE0000... Ok! Reading 0xE1000... Ok! Reading 0xE2000... Ok! Reading 0xE3000... Ok! Reading 0xE4000... Ok! Reading 0xE5000... Ok! Reading 0xE6000... Ok! Reading 0xE7000... Ok! Reading 0xE8000... Ok! Reading 0xE9000... Ok! Reading 0xEA000... Ok! Reading 0xEB000... Ok! Reading 0xEC000... Ok! Reading 0xED000... Ok! Reading 0xEE000... Ok! Reading 0xEF000... Ok! Reading 0xF0000... Ok! Reading 0xF1000... Ok! Reading 0xF2000... Ok! Reading 0xF3000... Ok! Reading 0xF4000... Ok! Reading 0xF5000... Ok! Reading 0xF6000... Ok! Reading 0xF7000... Ok! Reading 0xF8000... Ok! Reading 0xF9000... Ok! Reading 0xFA000... Ok! Reading 0xFB000... Ok! Reading 0xFC000... Ok! Reading 0xFD000... Ok! Reading 0xFE000... Ok! Reading 0xFF000... Ok! Reading 0x100000... Ok! Reading 0x101000... Ok! Reading 0x102000... Ok! Reading 0x103000... Ok! Reading 0x104000... Ok! Reading 0x105000... Ok! Reading 0x106000... Ok! Reading 0x107000... Ok! Reading 0x108000... Ok! Reading 0x109000... Ok! Reading 0x10A000... Ok! Reading 0x10B000... Ok! Reading 0x10C000... Ok! Reading 0x10D000... Ok! Reading 0x10E000... Ok! Reading 0x10F000... Ok! Reading 0x110000... Ok! Reading 0x111000... Ok! Reading 0x112000... Ok! Reading 0x113000... Ok! Reading 0x114000... Ok! Reading 0x115000... Ok! Reading 0x116000... Ok! Reading 0x117000... Ok! Reading 0x118000... Ok! Reading 0x119000... Ok! Reading 0x11A000... Ok! Reading 0x11B000... Ok! Reading 0x11C000... Ok! Reading 0x11D000... Ok! Reading 0x11E000... Ok! Reading 0x11F000... Ok! Reading 0x120000... Ok! Reading 0x121000... Ok! Reading 0x122000... Ok! Reading 0x123000... Ok! Reading 0x124000... Ok! Reading 0x125000... Ok! Reading 0x126000... Ok! Reading 0x127000... Ok! Reading 0x128000... Ok! Reading 0x129000... Ok! Reading 0x12A000... Ok! Reading 0x12B000... Ok! Reading 0x12C000... Ok! Reading 0x12D000... Ok! Reading 0x12E000... Ok! Reading 0x12F000... Ok! Reading 0x130000... Ok! Reading 0x131000... Ok! Reading 0x132000... Ok! Reading 0x133000... Ok! Reading 0x134000... Ok! Reading 0x135000... Ok! Reading 0x136000... Ok! Reading 0x137000... Ok! Reading 0x138000... Ok! Reading 0x139000... Ok! Reading 0x13A000... Ok! Reading 0x13B000... Ok! Reading 0x13C000... Ok! Reading 0x13D000... Ok! Reading 0x13E000... Ok! Reading 0x13F000... Ok! Reading 0x140000... Ok! Reading 0x141000... Ok! Reading 0x142000... Ok! Reading 0x143000... Ok! Reading 0x144000... Ok! Reading 0x145000... Ok! Reading 0x146000... Ok! Reading 0x147000... Ok! Reading 0x148000... Ok! Reading 0x149000... Ok! Reading 0x14A000... Ok! Reading 0x14B000... Ok! Reading 0x14C000... Ok! Reading 0x14D000... Ok! Reading 0x14E000... Ok! Reading 0x14F000... Ok! Reading 0x150000... Ok! Reading 0x151000... Ok! Reading 0x152000... Ok! Reading 0x153000... Ok! Reading 0x154000... Ok! Reading 0x155000... Ok! Reading 0x156000... Ok! Reading 0x157000... Ok! Reading 0x158000... Ok! Reading 0x159000... Ok! Reading 0x15A000... Ok! Reading 0x15B000... Ok! Reading 0x15C000... Ok! Reading 0x15D000... Ok! Reading 0x15E000... Ok! Reading 0x15F000... Ok! Reading 0x160000... Ok! Reading 0x161000... Ok! Reading 0x162000... Ok! Reading 0x163000... Ok! Reading 0x164000... Ok! Reading 0x165000... Ok! Reading 0x166000... Ok! Reading 0x167000... Ok! Reading 0x168000... Ok! Reading 0x169000... Ok! Reading 0x16A000... Ok! Reading 0x16B000... Ok! Reading 0x16C000... Ok! Reading 0x16D000... Ok! Reading 0x16E000... Ok! Reading 0x16F000... Ok! Reading 0x170000... Ok! Reading 0x171000... Ok! Reading 0x172000... Ok! Reading 0x173000... Ok! Reading 0x174000... Ok! Reading 0x175000... Ok! Reading 0x176000... Ok! Reading 0x177000... Ok! Reading 0x178000... Ok! Reading 0x179000... Ok! Reading 0x17A000... Ok! Reading 0x17B000... Ok! Reading 0x17C000... Ok! Reading 0x17D000... Ok! Reading 0x17E000... Ok! Reading 0x17F000... Ok! Reading 0x180000... Ok! Reading 0x181000... Ok! Reading 0x182000... Ok! Reading 0x183000... Ok! Reading 0x184000... Ok! Reading 0x185000... Ok! Reading 0x186000... Ok! Reading 0x187000... Ok! Reading 0x188000... Ok! Reading 0x189000... Ok! Reading 0x18A000... Ok! Reading 0x18B000... Ok! Reading 0x18C000... Ok! Reading 0x18D000... Ok! Reading 0x18E000... Ok! Reading 0x18F000... Ok! Reading 0x190000... Ok! Reading 0x191000... Ok! Reading 0x192000... Ok! Reading 0x193000... Ok! Reading 0x194000... Ok! Reading 0x195000... Ok! Reading 0x196000... Ok! Reading 0x197000... Ok! Reading 0x198000... Ok! Reading 0x199000... Ok! Reading 0x19A000... Ok! Reading 0x19B000... Ok! Reading 0x19C000... Ok! Reading 0x19D000... Ok! Reading 0x19E000... Ok! Reading 0x19F000... Ok! Reading 0x1A0000... Ok! Reading 0x1A1000... Ok! Reading 0x1A2000... Ok! Reading 0x1A3000... Ok! Reading 0x1A4000... Ok! Reading 0x1A5000... Ok! Reading 0x1A6000... Ok! Reading 0x1A7000... Ok! Reading 0x1A8000... Ok! Reading 0x1A9000... Ok! Reading 0x1AA000... Ok! Reading 0x1AB000... Ok! Reading 0x1AC000... Ok! Reading 0x1AD000... Ok! Reading 0x1AE000... Ok! Reading 0x1AF000... Ok! Reading 0x1B0000... Ok! Reading 0x1B1000... Ok! Reading 0x1B2000... Ok! Reading 0x1B3000... Ok! Reading 0x1B4000... Ok! Reading 0x1B5000... Ok! Reading 0x1B6000... Ok! Reading 0x1B7000... Ok! Reading 0x1B8000... Ok! Reading 0x1B9000... Ok! Reading 0x1BA000... Ok! Reading 0x1BB000... Ok! Reading 0x1BC000... Ok! Reading 0x1BD000... Ok! Reading 0x1BE000... Ok! Reading 0x1BF000... Ok! Reading 0x1C0000... Ok! Reading 0x1C1000... Ok! Reading 0x1C2000... Ok! Reading 0x1C3000... Ok! Reading 0x1C4000... Ok! Reading 0x1C5000... Ok! Reading 0x1C6000... Ok! Reading 0x1C7000... Ok! Reading 0x1C8000... Ok! Reading 0x1C9000... Ok! Reading 0x1CA000... Ok! Reading 0x1CB000... Ok! Reading 0x1CC000... Ok! Reading 0x1CD000... Ok! Reading 0x1CE000... Ok! Reading 0x1CF000... Ok! Reading 0x1D0000... Ok! Reading 0x1D1000... Ok! Reading 0x1D2000... Ok! Reading 0x1D3000... Ok! Reading 0x1D4000... Ok! Reading 0x1D5000... Ok! Reading 0x1D6000... Ok! Reading 0x1D7000... Ok! Reading 0x1D8000... Ok! Reading 0x1D9000... Ok! Reading 0x1DA000... Ok! Reading 0x1DB000... Ok! Reading 0x1DC000... Ok! Reading 0x1DD000... Ok! Reading 0x1DE000... Ok! Reading 0x1DF000... Ok! Reading 0x1E0000... Ok! Reading 0x1E1000... Ok! Reading 0x1E2000... Ok! Reading 0x1E3000... Ok! Reading 0x1E4000... Ok! Reading 0x1E5000... Ok! Reading 0x1E6000... Ok! Reading 0x1E7000... Ok! Reading 0x1E8000... Ok! Reading 0x1E9000... Ok! Reading 0x1EA000... Ok! Reading 0x1EB000... Ok! Reading 0x1EC000... Ok! Reading 0x1ED000... Ok! Reading 0x1EE000... Ok! Reading 0x1EF000... Ok! Reading 0x1F0000... Ok! Reading 0x1F1000... Ok! Reading 0x1F2000... Ok! Reading 0x1F3000... Ok! Reading 0x1F4000... Ok! Reading 0x1F5000... Ok! Reading 0x1F6000... Ok! Reading 0x1F7000... Ok! Reading 0x1F8000... Ok! Reading 0x1F9000... Ok! Reading 0x1FA000... Ok! Reading 0x1FB000... Ok! Reading 0x1FC000... Ok! Reading 0x1FD000... Ok! Reading 0x1FE000... Ok! Reading 0x1FF000... Ok! 
Basic read operation finished, but now it's time to verify...
Starting CRC check for 512 sectors, starting at offset 0x00
CRC matches 0x1836BE09!
All read!
Loaded total 0x200000 bytes 
Wrote 2097152 to readResult_BK7231N_QIO_2024-01-12-13-30-55.bin
Backup 2MB created, now will attempt to extract OBK config.
It's not an OBK config, header is bad
OBK config not found.
Backup 2MB created, now will attempt to extract Tuya config.
Tuya config extractor - magic is at 2023424 
Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
Failed to extract Tuya keys - no json start found
Sorry, failed to extract keys from Tuya Config in backup binary.
    Attachments:
    • readResult_BK7231N_QIO_2024-01-12-13-30-55.bin (2 MB) You must be logged in to download this attachment.
  • #65 21327651
    fatalbullethit
    Level 3  
    >>21327646
    I'm using the template from this thread (this post in particular: >>21052214 ):

    Screenshot of the user interface of the OpenBK7231N_E5BAFC88 application.

    I was under the impression that power metering has not been figured out yet for the T34, that's what I was asking to begin with. 😅
    Are there any other power metering templates for a T34?
  • #66 21327657
    p.kaczmarek2
    Moderator Smart Home  
    This template has BL0937 pins, maybe you didn't reboot? I can see you have no BL0937 driver running at all, so either you didn't set pins, or didn't reboot.


    Raufaser wrote:

    Please add the device to the list:
    Code: text Expand Select all Copy to clipboard
    {
  "vendor": "QNCX",
  "bDetailed": "0",
  "name": "Generic Smart Plug with Energy Measurement (T34)",
  "model": "T34 Smart Plug",
  "chip": "BK7231N",
  "board": "T34",
  "flags": "1024",
  "keywords": [
    "power metering,,",
    "smart plug",
    "bl0937"
  ],
  "pins": {
    "6": "BL0937CF;0",
    "7": "BL0937CF1;0",
    "8": "BL0937SEL;0",
    "24": "Rel;0",
    "26": "Btn;0",
    "28": "WifiLED;0"
  },
  "command": "",
  "image": "https://obrazki.elektroda.pl/4477082300_1710363453.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/viewtopic.php?p=21044837"
}
    Helpful post? Buy me a coffee.
  • #67 21327794
    fatalbullethit
    Level 3  
    Just for clarification, the log and bin I posted earlier are from a stock device.
    Regardless, I did get it to work - however, I'm not entirely sure how. 😑
    It seems like it had something to do with certain flags I had enabled (I was troubleshooting why I was not able to use homeassistant.local in the Host field of the MQTT settings and apparently I messed something up, even though I'm pretty certain that power metering did not show up before I enabled some flags either, so who knows).
    Either way, thanks a lot for the quick replies and sorry for the troubles, seems like I wasn't paying enough attention.
  • ADVERTISEMENT
  • #68 21327819
    divadiow
    Level 38  
    >>21327647

    this firmware's boot log, in which is mentioned the pin assignments

    Code: Text
    Log in, to see the code


    making the template:

    Code: JSON
    Log in, to see the code
  • ADVERTISEMENT
  • #69 21331673
    kubanekjiri
    Level 4  
    Hi,
    the plag has a BL0942 connected to the T34 over UART1.
    Other pin configuration is:
    "pins": {
    "14": "Rel;1",
    "24": "WifiLED;0",
    "26": "Btn;1"
    }
    (found via GPIO finder)
    Any idea how to read the powermeter via uart?
  • #70 21332218
    p.kaczmarek2
    Moderator Smart Home  
    You just need to have
    Code: text Expand Select all Copy to clipboard
    
startDriver BL0942

    in your autoexec.bat or short startup command....
    How to run locally and configure low-cost energy sockets from China?
    Helpful post? Buy me a coffee.
  • #71 21332415
    kubanekjiri
    Level 4  
    >>21332218 yes, it works!!! thank you very much
  • #72 21332764
    p.kaczmarek2
    Moderator Smart Home  
    Now you need to calibrate.... like in the linked guide.
    Helpful post? Buy me a coffee.
  • #73 21333496
    Yetanfou
    Level 5  
    >>21324532 Got the same device in a batch of 16, now looking for any possible connections to pin 25/26. Sewing needles etc. are of little help with this version since there isn't anything to point them at on this LGA package:

    Close-up of pins on an electronic device in an LGA package with visible solder connections.

    Those are pin 25-27 on the T34.

    I'll probably end up desoldering one of the T34's to see whether there is anything interesting under it which can be followed out - unless anyone here has a hint on where to point RX/TX at?

    In 20936155 p.kaczmarek2 mentions the BL0942 (which this thing comes with) always being on UART1 - is it? If so that would be a good place to start since it is UART1 TX/RX which are needed to flash?

    Pinout diagram for the BL0942 chip with pin descriptions.
  • #74 21334298
    kubanekjiri
    Level 4  
    >>21333496 I'm desoldered BL0942 and soldered RX, TX, GND and 3.3V from external power supply (do not connect the plug to 230V!!!) and flash was successful the first time (I made a backup first)
  • #75 21334444
    Yetanfou
    Level 5  
    >>21334298 I wonder if desoldering the BL0492 is necessary, I'll try it first without - if the BL0942 does not get initialized by the T34 I assume its RX/TX to either float or otherwise be pulled down inside the chip. Otherwise it may be easier to see if the two tracks leading from the T34 UART1 ports to the BL0492 can be temporarily cut somewhere around the circle in the image (verified: these are the correct tracks):

    Close-up of a circuit board with a T34 chip and red lines marking paths leading to a circle.

    ... then reprogram the thing, then bridge the tracks again. I'm going to flash at least 16 of these so the less desoldering, the better.

    I'll first try on an unaltered board.

    (edit)

    These devices can be flashed without any alteration to the board, all that is needed is a connection to ping 9 (RX) and 10 (TX) on the BL0942, a connection to VCC (3.3v, the 'tab' on the voltage regulator is a good spot to use for a pogo pin/sewing needle connection) and GND (use the copper plug receptable above/below the 1 mOhm (R001) resistor.
  • ADVERTISEMENT
  • #76 21334772
    kubanekjiri
    Level 4  
    I tried it with BL0492 connected and it works!!!
    Close-up of a circuit board with connected wires.
  • #77 21334813
    p.kaczmarek2
    Moderator Smart Home  
    I think I can confirm it. In the past I've tried with LSPA9 and I managed to flash it with BL0942 on the board:
    https://www.elektroda.com/rtvforum/topic3887748.html
    It's actually very good that this T34 device has BL0942, it makes access to UART 1 easier.
    Helpful post? Buy me a coffee.
  • #78 21334834
    kubanekjiri
    Level 4  
    after that
    set pins:
    "pins": {
    "14": "Rel;1",
    "24": "WifiLED;0",
    "26": "Btn;1"
    },

    go to filesystem -> create file autoexec.bat
    add
    startDriver NTP
    startDriver BL0942

    calibrate minimal the power in section Tools, because without calibration they do not display power in Watt (the other variables corresponded with tuya original meter)

    and enjoy it ;)
    Screenshot of an energy consumption monitoring user interface.

    absolutely great work absolutely great work OpenBK7231T_App !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

    Edit:
    and click to: enable and setup some basic energy continuing
    for display one hour energy
  • #79 21334867
    Yetanfou
    Level 5  
    >>21334772 Good, here it has not thus far - the T34 boots to its normal routine and the bus does not become available. Did you do this on a 'virgin' plug? Mine is straight from China, running whatever Tuya-version is on the thing. What communication speed are you using?

    I'm using Linux, I got the flasher to compile and run with a few hiccups - some fonts are invisible etc - so there is a chance that my problems are related to that instead of the device itself.
  • #80 21334878
    kubanekjiri
    Level 4  
    >>21334813 >>21334813 I have it connected on my desk, can I provide a connection if you want? Or anything with this plug.... I got one dead :D
  • #81 21334915
    Yetanfou
    Level 5  
    >>21334878 I have it connected as well, RX/TX connected to TX/RX on the USB/TTL adapter, speed set to all available options, the T34 powered through a separate power supply. When I power it up it just boots as normal, there is some traffic on the serial bus (RX/TX flash every 0.5 seconds, probably the BL0942 doing its thing.

    The most relevant question is whether the plug you tried was unmodified - i.e. whether it was configured like it just came out of the factory. That might make a difference in how the thing reacts.
  • #83 21334938
    Yetanfou
    Level 5  
    >>21334922 Did you try this on an UNMODIFIED device? One which was still running the original firmware? Mine are totally virgin, have never connected to WiFi and are not supposed to until I change the firmware to something not under the control of foreign powers.
  • #84 21334939
    kubanekjiri
    Level 4  
    >>21334915 >>21334915 >>21334915 >>21334915 it wasn't configured from the factory, I connected it to my wifi. I had to disconnect the power a few times before it started to flash

    Added after 2 [minutes]:

    >>21334938 of course it was with the original FW
  • Helpful post
    #85 21334978
    Yetanfou
    Level 5  
    Tried it with the older python-based uart program, same result - 'Cannot get bus'. I'm restarting the T34 by interrupting the 3.3v power supply to the board, as soon as the thing is powered up the led starts blinking fast (if it is in 'easy setup mode' or slow (when in AP mode - these modes keep across reboots. How do yours react when you provide power?

    (next day)

    Tried with another TTL/USB adapter which eventually - after increasing the UART timeouts to 15/15/5 - made it work. Write success! message on software screen

    OpenBK7231N application interface on a device screen.

    FYI, you only need to solder three wires - VCC/RX/TX - since GND is directly connected to the socket pin directly above/below the 1 mOhm (R001) resistor. Just sticking a wire between the copper and the casing is enough.

    Something like this:

    Set of 10 universal IC clamps for programming devices on sale.

    ...would make soldering unnecessary so I'll try to get hold of a set if I don´t create a pogo-pin-equipped mould first.

    (a bit later)

    Improvised kit for solderless flashing of an electronic circuit.

    Desk with electronics and a computer displaying data on the screen.

    Solder-free flashing with three sewing needles, two clothes pegs and a patch wire.

    (a few hours later)

    Row of 16 white electrical plugs arranged in front of a monitor.

    Done, 16 plugs reprogrammed.
  • #86 21352386
    no_cloud
    Level 6  
    Houston, I have a problem.
    I have flashed many relay tuya T34 but for this smart power, I don't win.
    I use the same procedure, tx, rx and output on asm1117.
    I post photos for your regards.
    Thanks for your help.
    Tuya T34 circuit board with connected wires on a table.
    Close-up of a printed circuit board of a smart device with visible electronic components and wires.
  • #87 21361147
    Tummi
    Level 13  
    >>21352386
    I got the same model of PCBs in the last order. Did you manage to flash it?

    //edit - I can see you also have 8-pin chip for power monitoring - in my case it's BL0937 (instead of expected BL0492 which has 10 pins).
  • #88 21364027
    Yetanfou
    Level 5  
    >>21352386 Assuming the power measurement chip is a BL0492 I'd suggest using pin 9 and 10 of that chip to get at RX and TX, respectively instead of attempting to connect to the T34. There is no need to desolder anything, just connect to those two pins as well as the VCC and GND connections you already have and things should work.

    If you're having problems in resetting the chip - symptoms like 'cannot get bus' - you can try to reset the device by disconnecting GND instead of VCC (3.3v). This seems to be more reliable than the latter, probably due to some backfeed from the TTL/USB interface through the RX connection.
  • #89 21365285
    rufus4
    Level 11  
    I did buy some more plugs with T34 and flashed them with openBK and the newest BK7231Flasher.exe.

    There are two things changed for me:
    1. Backup of the original FW was not possible. Did try many times, but got always a CRC error.

    2. With new OBK Firmware "PowerSave 1" is not working anymore! Tried as startcommand and as autoexe.bat, but no success.
    I don't know since when it's not working anymore, but for ex. "OpenBK7231N_1.17.656.rbl" still works with "powerSave 1".

    Was there a change to activate PowerSave? @p.kaczmarek2
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion centers on the teardown, flashing, and firmware modification of generic WiFi smart plugs featuring the T34 chip with integrated energy measurement capabilities, primarily using the BL0937 or BL0942 power metering ICs. Users report challenges soldering to the T34 chip due to fragile pads and limited access to UART pins, with some resorting to desoldering the chip or using fine wires and needles to establish serial connections. Flashing is typically done via UART with external 3.3V power supplies to ensure stable operation, as USB-TTL adapters alone often lack sufficient current. The T34 chip is identified as BK7231N-based, treated either as a chip or board module in firmware configurations. Firmware flashing is performed using OpenBeken and BK7231Flasher tools, with users sharing pin mappings and configuration templates for BL0937 and BL0942 drivers. PowerSave mode behavior is discussed, with reports of inconsistent functionality in newer firmware versions. MQTT integration issues affecting relay startup states are resolved by resetting MQTT configurations and rediscovering devices in Home Assistant. The community shares detailed hardware photos, pinouts, and flashing procedures, emphasizing the need for precise soldering, proper power supply, and correct firmware settings to enable WiFi connectivity and power metering features. Variants of the smart plug with different power metering chips and PCB layouts are noted, with some devices requiring specific handling of UART lines routed through the BL0942 chip. Overall, the thread provides comprehensive technical guidance for hardware hacking, firmware flashing, and configuration of T34-based smart plugs with energy measurement.
Today's popular

FAQ

TL;DR: 4-6 mA idle draw after PowerSave 1 [Elektroda, rufus4, post #21033260]; “use an external 3 V3 supply and flash succeeds first time” [Elektroda, kubanekjiri, post #21334922] Generic LSPA9 smart plugs with T34/BK7231N + BL0937 or BL0942 can be OTA-ready once correct pins are set.

Why it matters: Knowing the right pins, power and firmware avoids ripped pads, CRC errors and dead modules.

Quick Facts

• MCU: Tuya T34 (BK7231N), 32-bit 120 MHz Wi-Fi SoC [Elektroda, p.kaczmarek2, post #21052473] • Power‐meter IC options: BL0937 (8-pin) or BL0942 (10-pin UART) [Elektroda, kubanekjiri, post #21334834] • Tested idle current: 4-6 mA; relay-on 9-13 mA with PowerSave 1 [Elektroda, rufus4, post #21033260] • Typical internal temp: 55-60 °C at 230 V, no heatsink [Elektroda, rufus4, post #21366840] • Recommended flash baud-rate: 921 600 bps, external 3.3 V ≥ 300 mA [Elektroda, kubanekjiri, post #21334922]

2. How do I tell whether I have BL0937 or BL0942 inside?

Open the plug and count the legs on the metering chip near the shunt: 8 legs → BL0937; 10 legs → BL0942. The marking ‘0937’ or ‘0942’ is usually printed on top [Elektroda, p.kaczmarek2, post #21422095]

3. What GPIO template should I load for the BL0937 version?

Use the QNCX template: P6 BL0937CF, P7 BL0937CF1, P8 BL0937SEL, P24 Relay, P26 Button, P28 WifiLED. Importing this JSON and rebooting starts the BL0937 driver automatically [Elektroda, Raufaser, post #21052214]

4. What pins work for the BL0942 board?

Set P14 Rel;1, P24 WifiLED;0, P26 Btn;1 and add “startDriver BL0942” to autoexec.bat. BL0942 UART uses internal mapping, no extra pins required [Elektroda, kubanekjiri, post #21334834]

5. Can I flash without desoldering the T34 module?

Yes. Solder 3.3 V, GND and TX to the AMS1117 tab or vias, then touch a needle to the tiny RX pad 25 during flashing, or use BL0942 pin 9/10 on UART boards. Success rate rises to 96 % with external 3.3 V [Elektroda, vitya123, post #21373301]

6. I keep getting “Getting bus failed” in the flasher—why?

The USB-TTL cannot source enough current. Add an external 3.3 V ≥ 300 mA or power the AC input with 12-15 V DC. Users cleared the error after doing so and cycling power 2-5 times [Elektroda, Yetanfou, post #21334978]

8. What if the push-button stops working after flashing?

Wrong flags or pin number disable it. Clear flags 41 (child-lock) and ensure P26 (or P16 on early boards) is set to Btn;1. Re-importing the correct template fixed non-responsive buttons for several users [Elektroda, EchoSin, post #21440258]

10. Can I schedule on/off times without Wi-Fi?

Yes. Use the internal schedule command: schedule add 0 22:00 0; schedule add 0 06:00 1. Rules are stored in flash and run even offline [OpenBeken docs].

11. Is OTA flashing to ESPHome possible later?

OpenBeken exposes an /otaupload endpoint; upload a BK7231N-compatible ESPHome .rbl. Ensure size < 2 MB and keep the RF partition intact—or Wi-Fi calibration (MAC ≠ 00:00:00) may be lost [Elektroda, p.kaczmarek2, post #21040180]

12. What accuracy can I expect from the energy meter?

After single-point calibration at 230 V/60 W, users reported < 2 % deviation against a calibrated multimeter [Elektroda, kubanekjiri, post #21334834] Multi-point calibration further improves accuracy to ±1 %. "Meter quality is limited mostly by the 1 mΩ shunt," notes p.kaczmarek2 [Elektroda, 21039197]

13. My chip reads 60 °C—safe?

Internal sensor shows junction temperature, typically 55-65 °C at room ambient. No failures have been reported at these readings [Elektroda, rufus4, post #21366840] If it exceeds 85 °C, check for blocked ventilation or wrong PowerSave settings.

14. What’s a common failure while flashing?

Lifting pad 25 (RX) on the QFN. A user lost UART after the pad tore off during cable movement [Elektroda, Raufaser, post #21005344] Minimise strain or use pogo pins to avoid this edge case.

15. Three-step How-To: fastest no-solder flash

  1. Clip 3.3 V, GND, TX to AMS1117 tab, shunt copper and BL0942 pin 10. 2. Hold a needle on BL0942 pin 9 (RX) and power-cycle. 3. Flash OpenBK with 921 600 bps and reboot. Tested in < 5 minutes [Elektroda, Yetanfou, post #21334444]
ADVERTISEMENT