logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Teardown and Exploration of GHome Smart Plug EP2 [W701/BL0937] for OpenBeken Support

Raufaser 3867 19
ADVERTISEMENT
Cool? Ranking DIY | New topic
Notify about new articles

  • I bought a Smart Plug on Amazon before I even know things like OpenBeken even existed.
    I will post my teardown here in high hopes a clever mind can make the device supported :)
    The outside:
    (It is a little tricky to open this plug, that is why it looks so beaten up ...)
    White GHome Smart plug with a power button, placed against a white background. Close-up of the Smart Plug EP2 with visible technical specifications.
    After taking off the cover you have to unsolder the protective contact and unscrew some screws. (already done in the picture)
    View of the interior of a disassembled smart plug showing metal and plastic components.
    Then you can take out the internals. Here is the probably uninteresting bottom:
    Close-up of the PCB with the communication chip in a Smart Plug device.
    To get to the communication PCB you have to unplug the antenna U.FL connector.
    Interior of a smart plug with visible electronic components and a communication board.
    The front PCB where the communication board is connected to:
    Close-up of the internal PCB of a smart plug.
    Detail view on the communication PCB with W701 chip. Front and Back
    Close-up of a communication board with a W701 chip and U.FL connector. Close-up view of the smart plug communication board with chip W701.
    And here is how the comm PCB is soldered to the main PCB.
    Close-up of the internal components of a disassembled Smart Plug with visible electronic elements.

    Maybe someone can add support for this device?! :)

    Cool? Ranking DIY
    About Author
    Raufaser
    Level 10  
    Offline 
    Raufaser wrote 47 posts with rating 11, helped 3 times. Been with us since 2024 year.
  • ADVERTISEMENT
  • #2 21005224
    p.kaczmarek2
    Moderator Smart Home  
    I haven't seen that kind of W701 module before. Can you desolder it and show the high quality photos of the pad markings, where is VDD, GND, etc?
    Helpful post? Buy me a coffee.
  • #3 21005468
    Raufaser
    Level 10  

    Mmmhhh I am trying to desolder at the moment. It is difficult to reach the back side of the solder spots. The front side is pretty clean. Already tried hot air and soldering iron with desolder wire...
  • #4 21005526
    p.kaczmarek2
    Moderator Smart Home  
    I had a similiar device some time ago. It was based on ESP8266.
    Here you can see my teardown:
    https://www.elektroda.pl/rtvforum/topic3941251.html
    I just desoldered top board from the bottom board.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #5 21005786
    Raufaser
    Level 10  

    I managed to get this nasty little fella out.
    First the side with the W701
    Close-up of a PCB with various electronic components.
    And now the other side with the BL0937 and some labels. The PCB labeling machine seems to be a one from Wish ;) Hard to decipher.
    Close-up of a PCB with various electronic components and labels.

    My guesses:
    Pins Top to Bottom:
    1. ? (maybe it is the one under the 2 caps) AET (?)
    2. ? (maybe it is the one under my guess in number 1) ON (?)
    3. V1r
    4. V1N
    5. GND
    6. IO1

    And the main label on the board:
    CUCO-Z??-V4.0

    Now my eyes need a break :) What do you say, what are your guesses?
  • ADVERTISEMENT
  • #6 21005807
    divadiow
    Level 34  
    found elsewhere but looks to be a W701H, so maybe pins are diff

    Electronic module with pin labels and BL0937 chip. Electronic module labeled as W701H with marked pins A18, A17, RFIO, and 2xVCC.

    from a Gosund EP2 [RTL8720CF]
  • #7 21005817
    Raufaser
    Level 10  
    Nice find. Thanks a lot.
    What means 2x VCC ? 6,6V?

    Edit: I got it. Both pins are VCC. Sorry.

    I mean i could solder some wires and see if the thing draws current ...

    Added after 1 [minutes]:

    I found this github discussion where a plug from Blitzwolf seems to be the same plug.

    Added after 1 [hours] 7 [minutes]:

    I got something from the board.
    I hooked it up like that:
    Two electronic boards with labels 3.3 V, GND, TX, and RX.
    Listened to the COM-Port and got this:
    Code: text Expand Select all Copy to clipboard
    

== Rtl8710c IoT Platform ==
Chip VID: 5, Ver: 3
ROM Version: v3.0

== Boot Loader ==
Dec  5 2019:14:02:18

fwx SELE[fffffffc]
fw SELE Bitidx 2, fw1 valid 1, sn 0, fw2 valid 1, sn 100
fw1 USE, return sn 0

Boot Loader <==


== RAM Start ==

Build @ 15:38:41, Jan 29 2023

interface 0 is initialized

interface 1 is initialized



Initializing [01-01 18:1WIFI ...2:15 TUYA I][lr:0x9b060ffb] mqc app init ...

[01-01 18:12:15 TUYA I][lr:0x9b041637] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:5

[01-01 18:12:15 TUYA I][lr:0x9b041637] thread_create name:cmmod,stackDepth:4096,totalstackDepth:8192,priority:4

[01-01 18:12:15 TUYA D][lr:0x9b060f79] mq_pro:5 cnt:1

[01-01 18:12:15 TUYA D][lr:0x9b060f79] mq_pro:31 cnt:2

[01-01 18:12:15 TUYA D][lr:0x9b06796f] svc online log init success

[01-01 18:12:15 TUYA D][lr:0x9b059747] read m:0 f:0 l:0

[01-01 18:12:15 TUYA I][lr:0x9b041637] thread_create name:wk_th-0,stackDepth:5120,totalstackDepth:13312,priority:3

[01-01 18:12:15 TUYA E][lr:0x9b057e91] kvs_read fails gw_bi -23

[01-01 18:12:15 TUYA D][lr:0x9b044cf3] gw base read finish:-18

[01-01 18:12:15 TUYA D][lr:0x9b05e511] ty bt cmmod regist ok:1

[01-01 18:12:15 TUYA D][lr:0x9b05e81f] upd adv para, send conn_req beacon.

dev id key: 16

d4 1d 8c d9 8f 00 b2 04 e9 80 09 98 ec f8 42 7e 

[BT NOTICE]tuya_os_adapt_param_init mode:1

[BT DEBUG]tuya_os_adapt_bt_stack_init

[BT DEBUG]current_bt_mode:255, new bt_param->mode:1

[BT DEBUG]###init ble slave###

[01-01 18:12:15 TUYA D][lr:0x9b0414bf] Thread:sys_timer Exec Start. Set to Running Stat

[01-01 18:12:15 TUYA D][lr:0x9b0414bf] Thread:cmmod Exec Start. Set to Running Stat

[01-01 18:12:15 TUYA D][lr:0x9b0414bf] Thread:wk_th-0 Exec Start. Set to Running Stat



WIFI initialized



init_thread(65), Available heap 0x17018BT BUILD Date: Jan 29 2023, 15:41:03 

BT RESET LOG...

read wifi mac:c4:82:e1:a5:a4:09[BT NOTICE]BLE MAC: 0xc4-0x82-0xe1-0xa5-0xa4-0x09

BT Reset ok

bt_iqk_efuse_valid: has data



hci_tp_phy_efuse[0]=0,

bt_dump_iqk:    DUMP,

the IQK_xx  data is 0x119,

the IQK_yy  data is 0x1,

the QDAC   data is 0x23,

the IDAC   data is 0x20,

the QDAC2  data is 0x22,

the IDAC2  data is 0x22,

hci_read_rom_check: rom_version 0x0003, bt_hci_chip_id 0x0004



BT ADDRESS:

c4:82:e1:a5:a4:09:



 WRITE  physical FLATK=tx_flatk=fff0 


We use fw_buf=1002ebb0, fw_len = 1f2c, config_buf = 10010bc0, config_len= 32

Set baudrate to 921600



hci_tp_config:BT INIT success 7

Start upperStack



[BLE peripheral] GAP stack ready


[BT DEBUG]###init ble slave succ###

[01-01 18:12:15 TUYA N][lr:0x9b05edeb] ble sdk re_inited

[01-01 18:12:15 TUYA D][lr:0x9b060b1d] bt active init

[01-01 18:12:15 TUYA N][lr:0x9b05e62d] ty bt sdk init success finish

[01-01 18:12:15 TUYA D][lr:0x9b01b623] < TUYA IOT SDK V:2.3.3 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.4_CD:1.0.0 >

< BUILD AT:2023_01_10_15_29_23 BY ci_manage FOR ty_iot_sdk AT rtl8720cf_ameba >

IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 SHUTDOWN_MODE:0 LITTLE_END:1 TLS_MODE:2 ENABLE_CLOUD_OPERATION:0 OPERATING_SYSTEM:2 ENABLE_SYS_RPC:0 RELIABLE_TRANSFER:0 ENABLE_LAN_ENCRYPTION:1 ENABLE_LAN_LINKAGE:0 ENABLE_LAN_DEV:0 >



[01-01 18:12:15 TUYA D][lr:0x9b01b62d] cuco_plug_po02_rtl_common:1.0.7

[01-01 18:12:15 TUYA N][lr:0x9b01b637] firmware compiled at Apr 26 2023 09:36:44

[01-01 18:12:15 TUYA N][lr:0x9b01b643] system reset reason:[(null)]

[01-01 18:12:15 TUYA N][lr:0x9b06d5f5] key_addr: 0x1d8000   block_sz 4096

[01-01 18:12:15 TUYA N][lr:0x9b06d681] get key:

0x54 0xb3 0xf 0xaa 0xbf 0x86 0x69 0xcf 0x7c 0x5c 0xa 0xa6 0x4d 0xcf 0xc8 0xa8 

[01-01 18:12:15 TUYA N][lr:0x9b0375c7] have actived over 15 min, not enter mf_init

[01-01 18:12:15 TUYA N][lr:0x9b018963] mf_init succ

[01-01 18:12:15 TUYA N][lr:0x9b01b675] ---------app_init--------

[01-01 18:12:15 TUYA N][lr:0x9b018987] have actived over 15 min, not enter mf_init

[01-01 18:12:15 TUYA N][lr:0x9b049b71] wifi soc init. pid:tkn2s79mzedk6pwr firmwarekey:(null) ver:1.0.7

[01-01 18:12:15 TUYA N][lr:0x9b0441e7] Last reset reason: 0

read wifi mac:c4:82:e1:a5:a4:09[01-01 18:12:15 TUYA N][lr:0x9b0442b9] serial_no:c482e1a5a409

[01-01 18:12:15 TUYA N][lr:0x9b044435] gw_cntl.gw_wsm.stat:2

[01-01 18:12:15 TUYA N][lr:0x9b04858d] gw_cntl->gw_wsm.nc_tp:9

[01-01 18:12:15 TUYA N][lr:0x9b048597] gw_cntl->gw_wsm.md:0

[01-01 18:12:15 TUYA N][lr:0x9b0445f7] gw_cntl.gw_if.abi:0 input:0

[01-01 18:12:15 TUYA N][lr:0x9b044601] gw_cntl.gw_if.product_key:tkn2s79mzedk6pwr, input:tkn2s79mzedk6pwr

[01-01 18:12:15 TUYA N][lr:0x9b04460d] gw_cntl.gw_if.tp:0, input:0

[01-01 18:12:15 TUYA N][lr:0x9b05e687] ty bt upd product:tkn2s79mzedk6pwr 0

[01-01 18:12:15 TUYA N][lr:0x9b05ec6b] upd product_id type:0 tkn2s79mzedk6pwr 5d3d35c74ba5420e AHH43T1a4Juxdq2D0tNeOt7FL7xZmUUX

[01-01 18:12:15 TUYA N][lr:0x9b01c5b1] ele_coe have been set to cal value!

[01-01 18:12:15 TUYA E][lr:0x9b06a01b] uf_open ele_save_key err 8

[01-01 18:12:15 TUYA E][lr:0x9b0197dd] cannot open file

[01-01 18:12:15 TUYA N][lr:0x9b01b717] app_switch_initapp_switch_init

[01-01 18:12:15 TUYA N][tuya_cyc_rand_timer.c:763] ty_tm_ctrl_init

[01-01 18:12:15 TUYA N][tuya_cyc_rand_timer.c:763] ty_tm_ctrl_init

[01-01 18:12:15 TUYA N][tuya_cyc_rand_timer.c:763] ty_tm_ctrl_init

[01-01 18:12:15 TUYA N][tuya_inch.c:371] inch_ctrl_init

[01-01 18:12:15 TUYA N][lr:0x9b01b72f] system free heap:52960

[WIFI NOTICE]tuya_os_adapt_wifi_set_work_mode:2 now mode:2

[BT DEBUG]tuya_os_adapt_bt_stack_deinit

[BT DEBUG]###deinit ble slave###

[BT DEBUG]bt state.gap_init_state:1

[BT DEBUG]bte_deinit

[01-01 18:12:15 TUYA N][lr:0x9b05f26f] Ble Disonnected

[01-01 18:12:15 TUYA N][lr:0x9b05f5c9] ble reset sn

[01-01 18:12:15 TUYA N][lr:0x9b05f5ed] ble clear pair rand

[01-01 18:12:15 TUYA N][lr:0x9b05f289] ble set conn stat:2

[01-01 18:12:16 TUYA N][lr:0x9b05f26f] Ble Disonnected

[01-01 18:12:16 TUYA N][lr:0x9b05f5c9] ble reset sn

[01-01 18:12:16 TUYA N][lr:0x9b05f5ed] ble clear pair rand

[01-01 18:12:16 TUYA N][lr:0x9b05f289] ble set conn stat:2



LwIP_DHCP: dhcp stop.2


Deinitializing WIFI ...


WIFI deinitialized


Initializing WIFI ...


WIFI initialized

[BT DEBUG]tuya_os_adapt_bt_stack_init

[BT DEBUG]current_bt_mode:255, new bt_param->mode:1

[BT DEBUG]###init ble slave###

BT BUILD Date: Jan 29 2023, 15:41:03 

BT RESET LOG...

read wifi mac:c4:82:e1:a5:a4:09[BT NOTICE]BLE MAC: 0xc4-0x82-0xe1-0xa5-0xa4-0x09

BT Reset ok

bt_iqk_efuse_valid: has data



hci_tp_phy_efuse[0]=0,

bt_dump_iqk:    DUMP,

the IQK_xx  data is 0x119,

the IQK_yy  data is 0x1,

the QDAC   data is 0x23,

the IDAC   data is 0x20,

the QDAC2  data is 0x22,

the IDAC2  data is 0x22,

hci_read_rom_check: rom_version 0x0003, bt_hci_chip_id 0x0004



BT ADDRESS:

c4:82:e1:a5:a4:09:



 WRITE  physical FLATK=tx_flatk=fff0 


We use fw_buf=1002cb68, fw_len = 1f2c, config_buf = 1002eaa0, config_len= 32

Set baudrate to 921600



hci_tp_config:BT INIT success 7

Start upperStack



[BLE peripheral] GAP stack ready


[BT DEBUG]###init ble slave succ###

fast connect ssid ***REDACTED_WIFI_SSID***,passwd:***REDACTED_WIFI_PASSWORD***,sec_type:400004,chan:8



[Driver]: set ssid [***REDACTED_WIFI_SSID***] 

WPA2 join!!!


[Driver]: start auth to 74:da:88:ef:3d:79



[Driver]: auth success, start assoc



[Driver]: association success(res=3)



[Driver]: set pairwise key to hw: alg:4(WEP40-1 WEP104-5 TKIP-2 AES-4)



[Driver]: set group key to hw: alg:4(WEP40-1 WEP104-5 TKIP-2 AES-4) keyid:2

[01-01 18:12:18 TUYA N][lr:0x9b01b5e1] cur_wifi_stat:5

[01-01 18:12:18 TUYA N][lr:0x9b01b579] status_changed_cb is status:3

[01-01 18:12:18 TUYA E][lr:0x9b01b3a9] dev_report_dp_json_async relay_config data error,err_num

[01-01 18:12:18 TUYA N][lr:0x9b05e6b7] ty bt upd localkey

[01-01 18:12:18 TUYA N][lr:0x9b05ecbf] upd login key len:6

dev id key: 16

52 0f b4 73 51 23 58 bc 82 ff 6f ee 24 15 e0 56 

[BT DEBUG]already in stop

[BT DEBUG]tuya_bt_reset_adv ret:0

[BT NOTICE]le_adv_start(), start adv

[BT DEBUG]reset adv ok

[01-01 01:00:03 TUYA N][lr:0x9b05ea97] ble adv && resp changed



Interface 0 IP address : 192.168.2.210[WIFI DEBUG]__dhcp_thread delete********

[WIFI DEBUG]__hwl_enter_powersave********

[01-01 01:00:04 TUYA N][lr:0x9b01b5e1] cur_wifi_stat:6

[01-01 01:00:04 TUYA E][lr:0x9b01b3a9] dev_report_dp_json_async relay_config data error,err_num

[01-01 01:00:04 TUYA E][lr:0x9b01afa5] dev_report_dp_json_async relay_config data error,err_num

[01-01 01:00:04 TUYA N][lr:0x9b0664c3] mqtt get serve ip success

[01-01 01:00:04 TUYA N][lr:0x9b039a23] ret = 0

[01-01 01:00:04 TUYA N][lr:0x9b0664c3] mqtt create success, begin to connect

ssid ***REDACTED_WIFI_SSID***,passwd:***REDACTED_WIFI_PASSWORD***,sec_type:400004,chan:8

[01-01 01:00:05 TUYA E][lr:0x9b06a01b] uf_open netcfg_log err 8

[01-01 01:00:05 TUYA N][lr:0x9b01b5e1] cur_wifi_stat:7

[01-01 01:00:05 TUYA E][lr:0x9b05283b] dparr[0] type not match:1 4

[01-01 01:00:05 TUYA E][lr:0x9b0194cb] dev_report_dp_json_async relay_config data error,err_num

[01-01 01:00:06 TUYA N][lr:0x9b05f393] ble_sdk_send skip, no connect:2

[BT NOTICE]le_adv_stop(), stop adv

[01-01 01:00:13 TUYA N][lr:0x9b039a23] ret = 0

[03-15 23:09:24 TUYA E][lr:0x9b04035b] result null

[03-15 23:09:24 TUYA N][lr:0x9b0650af] Update Timer from cloud

[03-15 23:10:02 TUYA N][lr:0x9b01afeb] --NUM(0)--dpid-----:1

[03-15 23:10:04 TUYA N][lr:0x9b01afeb] --NUM(0)--dpid-----:1


    The two lines at the end is me switching on and off in the Gosund APP.

    So, what next? :)
  • #8 21006070
    divadiow
    Level 34  
    Excellent and exciting!! I'm not sure what's next tbh. Ideally I'd be a developer and I'd help with OBK expansion, but I'm not at that point just yet.
  • #9 21006660
    p.kaczmarek2
    Moderator Smart Home  
    This is a very rare chip. You need to wait a bit for us to add support for this platform. How many pieces of this plug do you have?
    Helpful post? Buy me a coffee.
  • #10 21006736
    Raufaser
    Level 10  

    So i inspected the PCB a little further and traced the outer pads to the W701.
    That is what i got:
    Close-up of two printed circuit boards with pin markings.

    So it seems to have the same pin out as this little fella:
    Pin diagram of RTL8720CF-VA1 chip

    I read some tutorials on how to flash Realtek AmebaZ2 chips and decided to pull A0 and CEN (both on the same outer pin) to 3.3V.
    Et voila. Now i get this via UART:

    Code: text Expand Select all Copy to clipboard
    == Rtl8710c IoT Platform ==
Chip VID: 5, Ver: 3
ROM Version: v3.0
Test Mode: boot_cfg1=0x20
Download Image over UART2[tx=16,rx=15] baud=115200


    Since i am already hooked up to pin 16 and 15 i guess i just need something to download ...

    I discovered something called LibreTiny. Looks promising...

    Added after 5 [minutes]:

    >>21006660
    I have 2

    Do you want the link to the amazon item?
  • #11 21010645
    lars4
    Level 5  

    >>21006660
    I have 8-10 of that model. I'd be happy to send you one if you want to give it a try
  • #12 21010747
    p.kaczmarek2
    Moderator Smart Home  
    Thanks, are you somewhere near Poland? I don't know how high the shipping ratio would be if you're outside EU.
    Helpful post? Buy me a coffee.
  • #13 21010795
    lars4
    Level 5  

    I live in Sweden so I don't think shipping will be that expensive
  • #14 21277836
    Hilgude
    Level 2  
    Got some EP2-A recently in a pack of 4 explictly advertised as runnning an ESP8285.

    The full teardown will be exactly the same.

    The internal and external is the same device, except the module, is yes, based on ESP8285 and is soldered on the other side of the PCB...
    (Didnt find any similar one anywhere on Google).

    Managed to convert the 3 other one of the pack easily with Tuya-Convert (running Tasmota now).
    (One theses 3, recently died unexpectedly and is waiting a Forensic).


    ESP8285 module with visible electronic components on a PCB. ESP8285 module on a PCB with labels and connectors.
  • ADVERTISEMENT
  • #16 21279586
    p.kaczmarek2
    Moderator Smart Home  
    Interesting, so you've got a different or older batch? When are they using W701, and when ESP?

    Do you have Tasmota template?
    Helpful post? Buy me a coffee.
  • #17 21280776
    Hilgude
    Level 2  
    >>21279586

    Hard to say why there is two versions of these plugs ...

    The Amazon vendor explicitly advertised it as it can be Tasmota converted with Tuya-Convert.
    See this : https://amzn.eu/d/4jDsu5C

    Here is the template i made for it :

    {"NAME":"EP2-A","GPIO":[576,1,320,1,2656,2720,1,1,2624,32,1,224,1,1],"FLAG":0,"BASE":18}

    Added after 30 [minutes]:

    Some news about the "dead plug", my problem occured with a wall socket where there was a bad contact.
    Thus the power was going quickly up and down randomly as you touch it...

    It appear that the BP2525 regulator inside the EP2, didnt like it very much...

    I'am waiting some replacement part to check if the plug will be back alive after a replacement

    Close-up of a circuit board with a marked component.
  • #18 21284538
    p.kaczmarek2
    Moderator Smart Home  
    This sounds very interesting. Once you finish your repair, can you consider posting it as step by step tutorial in our Smart Home Tutorials section?

    I would like to make some more repairs too, but so far all my sockets are working.
    Helpful post? Buy me a coffee.
  • #20 21379253
    p.kaczmarek2
    Moderator Smart Home  
    New guide for those WBR3 chips:
    WBR2, WBR3, WBRU, W701-VA2-CG pinout, datasheet, flashing for Home Assistant
    Helpful post? Buy me a coffee.
Cool? Ranking DIY | New topic
Notify about new articles
Report a violation of the law

Topic summary

The discussion revolves around the teardown and exploration of the GHome Smart Plug EP2 [W701/BL0937] to enable OpenBeken support. The user shares detailed images and insights from their teardown process, highlighting challenges in desoldering components and identifying pin configurations on the W701 module. Other participants contribute by sharing their experiences with similar devices, including the Gosund EP2 and devices based on the ESP8266 and ESP8285 chips. The conversation includes technical details about the communication PCB, UART connections, and firmware information. Users express interest in developing support for the device and share templates for Tasmota conversion. The discussion also touches on the existence of different versions of the plug and troubleshooting issues related to power supply irregularities.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT