Grabbed this from Ali as it's not one I've seen on the forums or played with myself. Comes in Zigbee and Wifi flavours.
As with the TH01s and the door sensors this takes 2x AAA batteries so some considered deep-sleep power management settings will be needed or the batteries will die within a day or two. Especially so considering there is no TuyaMCU.
The packaging contains only the device, a double-sided 3M spot sticker and a reset pin for the push button hole, situated under the battery cover. No manual or protective device sheath.
That factory firmware version is not suitable for Cloudcutter exploitation. LED behaviour is flashing when in pairing mode then off.
Inside the device we see a CBU (BK7231N) module with RF shield (which I later removed), an AHT20 - an i2c temperature and hygrometer sensor, an LCD display (not sure of resolution) and a Vinka Microelectronics VKL080. VKL060 is a dot-matrix memory-mapped LCD driver that can support an LCD screen with a maximum of 60 points (15SEGx4COM).
I emailed Vinka about this as their site only lists a VKL060, Googling VKL080 produces no results of meaning. I was impressed with the prompt response. I never usually get one.
Datasheet and driver attached though they are available from their site.
Inside the device:
I soldered pwr/gnd and used pogo pins on the RX2/TX2 to capture factory boot log
Interesting it mentions BK7231NL. It also does some of the work on pin assignments for us, which we'll need later
Easy Flasher had trouble setting a baud reliably to dump flash so I soldered RX1/TX1 and shortened cables direct to USB-TTL
Factory fw attached. This firmware appears to be custom so no GPIO extraction was successful
Full Tuya API response for this device
After flashing OBK the AP was oddly behaved. It would appear but my phone and PC could sometimes not connect or it would connect but not receive an IP from DHCP on the device. Once or twice it did let me bring up the web console but then died. I flashed it a few times and restored RF partition too. Back to factory firmware then to OBK again to fix mac address. I decided to forget AP mode and use the Easy Flash config setter. It's been fine connected to the router, so :shrug:
We know some pins from the boot log and that BAT_ADC must be P23
I tested the Btn and LED were correct. Not sure how or what dInput should be used for.
I looked through devicelist.json for a similar config that could be used to complete BAT_REL, AHT20 SCK, AHT20 SDA. The template for this device covered all the above known pins
"Generic Temperature and Humidity Sensor Battery Powered SHT30"
https://www.elektroda.com/rtvforum/topic3945688.html
Using that template produces this in the gui
Yes, while on external PSU, the battery level is correct, but I'm feeding it 3.35v not 3.85. The temp/hum is clearly wrong. This of course assumes the SHT3X driver is correct for the AHT20. I'm not sure OBK has a working driver for the AHT20 though or if the pins are just wrong at the moment. We could do with having a list of supported chips alongside the driver list here https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/drivers.md - for example, CHT8305 now supports CHT8310 too. Unfortunately I cannot get multimeter probes under the AHT20 to be able to trace SDA/SCL to the CBU.
I have however traced the pins for the VKL060
. Here's what we know for certain so far
though I have no way of using the display at present. The LCD is currently blank with OBK, as one would expect. I recall seeing something about SoftSDA and SoftaSCL in another post, so gave that a go on the pins for the LCD controller. With these set:
and after running:
we get a result:
But I'm yet sure what happens from here. I guess the driver needs sorting?
So, I think I've come to a pause before I investigate further. For now, an OBK template work-in-progress with known and unknown pins is
please post your thoughts/suggestions on any of the above!

As with the TH01s and the door sensors this takes 2x AAA batteries so some considered deep-sleep power management settings will be needed or the batteries will die within a day or two. Especially so considering there is no TuyaMCU.
The packaging contains only the device, a double-sided 3M spot sticker and a reset pin for the push button hole, situated under the battery cover. No manual or protective device sheath.









That factory firmware version is not suitable for Cloudcutter exploitation. LED behaviour is flashing when in pairing mode then off.
Inside the device we see a CBU (BK7231N) module with RF shield (which I later removed), an AHT20 - an i2c temperature and hygrometer sensor, an LCD display (not sure of resolution) and a Vinka Microelectronics VKL080. VKL060 is a dot-matrix memory-mapped LCD driver that can support an LCD screen with a maximum of 60 points (15SEGx4COM).
I emailed Vinka about this as their site only lists a VKL060, Googling VKL080 produces no results of meaning. I was impressed with the prompt response. I never usually get one.

Datasheet and driver attached though they are available from their site.
Inside the device:










I soldered pwr/gnd and used pogo pins on the RX2/TX2 to capture factory boot log
Code: JSON
Interesting it mentions BK7231NL. It also does some of the work on pin assignments for us, which we'll need later
Code: Text
Easy Flasher had trouble setting a baud reliably to dump flash so I soldered RX1/TX1 and shortened cables direct to USB-TTL


Factory fw attached. This firmware appears to be custom so no GPIO extraction was successful
Code: Text
Code: JSON
Full Tuya API response for this device
Code: JSON
After flashing OBK the AP was oddly behaved. It would appear but my phone and PC could sometimes not connect or it would connect but not receive an IP from DHCP on the device. Once or twice it did let me bring up the web console but then died. I flashed it a few times and restored RF partition too. Back to factory firmware then to OBK again to fix mac address. I decided to forget AP mode and use the Easy Flash config setter. It's been fine connected to the router, so :shrug:

We know some pins from the boot log and that BAT_ADC must be P23
Code: Text
I tested the Btn and LED were correct. Not sure how or what dInput should be used for.
I looked through devicelist.json for a similar config that could be used to complete BAT_REL, AHT20 SCK, AHT20 SDA. The template for this device covered all the above known pins
"Generic Temperature and Humidity Sensor Battery Powered SHT30"
https://www.elektroda.com/rtvforum/topic3945688.html

Using that template produces this in the gui

Yes, while on external PSU, the battery level is correct, but I'm feeding it 3.35v not 3.85. The temp/hum is clearly wrong. This of course assumes the SHT3X driver is correct for the AHT20. I'm not sure OBK has a working driver for the AHT20 though or if the pins are just wrong at the moment. We could do with having a list of supported chips alongside the driver list here https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/drivers.md - for example, CHT8305 now supports CHT8310 too. Unfortunately I cannot get multimeter probes under the AHT20 to be able to trace SDA/SCL to the CBU.
I have however traced the pins for the VKL060


though I have no way of using the display at present. The LCD is currently blank with OBK, as one would expect. I recall seeing something about SoftSDA and SoftaSCL in another post, so gave that a go on the pins for the LCD controller. With these set:
Code: Text
and after running:
Code: Text
we get a result:
Code: Text
But I'm yet sure what happens from here. I guess the driver needs sorting?
So, I think I've come to a pause before I investigate further. For now, an OBK template work-in-progress with known and unknown pins is
Code: JSON
please post your thoughts/suggestions on any of the above!