![[ZIGBEE] 20A Zigbee socket with energy metering (Tuya TS011F_plug_3)](https://obrazki.elektroda.pl/1000454900_1749493372_thumb.jpg)
Purchase from Amazon under the brand of Topeler, but also available under the brand of junlit. The model I recieved is YSW102, but it looks like there is also a YSW101, likely very similar.
Teardown Pics:
At this point I realized there were no easy access points and I didn't want to have to de-solder to remove the plastic backing to gain access to the pins of the CB2s module, so I decided to try tuya-cloudcutter. I paired the outlet to Tuya to find the firmware version was 1.1.8 (which was vulnerable to tuya-cloudcutter), reset the device, and started the process. This outlet didn't appear to be on the list of available dev ices, so I started tuya-cloudcutter without any parameters, used the 'By firmware version and name' option, and selected an item from the list that had a version of 1.1.8 and the name started with oem- (don't remember the full name). This worked without issue and was able to flash openBeken.
From there, I used the web UI to pull the GPIO config and the BK7231 East UART Flasher to extract the config.
Config was uploaded, and everything seems to be working fine.
Here is the openBeken config:
Teardown Pics:
At this point I realized there were no easy access points and I didn't want to have to de-solder to remove the plastic backing to gain access to the pins of the CB2s module, so I decided to try tuya-cloudcutter. I paired the outlet to Tuya to find the firmware version was 1.1.8 (which was vulnerable to tuya-cloudcutter), reset the device, and started the process. This outlet didn't appear to be on the list of available dev ices, so I started tuya-cloudcutter without any parameters, used the 'By firmware version and name' option, and selected an item from the list that had a version of 1.1.8 and the name started with oem- (don't remember the full name). This worked without issue and was able to flash openBeken.
From there, I used the web UI to pull the GPIO config and the BK7231 East UART Flasher to extract the config.
{
"reset_t":"3",
"netled1_pin":"11",
"rl1_lv":"1",
"bt_type":"0",
"rl2_lv":"1",
"module":"CB2S",
"net_trig":"2",
"ch_cddpid1":"9",
"jv":"1.0.2",
"netled1_lv":"1",
"netled_reuse":"0",
"rl2_pin":"26",
"ffc_select":"0",
"total_bt_pin":"10",
"nety_led":"1",
"ch_cddpid2":"10",
"total_bt_lv":"0",
"ch_num":"2",
"total_stat":"0",
"rl1_pin":"8",
"netn_led":"0",
"ch_dpid1":"1",
"ch_dpid2":"2",
"crc":"65",
"}MidpAgw_di0Atls_ca_cntbv":"40.00",
"pv":"2.2",
"lpv":"3.3",
"pk":"keyjup78v54myhan",
"firmk":"keyjup78v54myhan",
"cadv":"0",
"cdv":"1.0.0",
"dev_swv":"1.1.8",
"s_id":"null",
"dtp":"0",
"sync":"0",
"attr_num":"0",
"mst_tp_0":"0",
"mst_ver_0":"null",
"mst_tp_1":"0",
"mst0er_1":"null",
"mst_tp_2":"0",
"mst_ver_2":"null",
"mst_tp_3":"0",
"mst_ver_3":"null "
}
Device configuration, as extracted from Tuya:
- WiFi LED on P11
- Relay (channel 2) on P26
- Pair/Toggle All Button on P10
- Relay (channel 1) on P8
Device seems to be using CB2S module, which is using BK7231N.
And the Tuya section starts at UNCOMMON POSITION 0
Config was uploaded, and everything seems to be working fine.
Here is the openBeken config:
{
"vendor": "Topeler/Junlit",
"bDetailed": "0",
"name": "YSW102 WiFi Smart Socket with Independent Outlets",
"model": "YSW102",
"chip": "BK7231N",
"board": "TODO",
"flags": "5120",
"keywords": [
"socket",
"smart outlet",
"plug"
],
"pins": {
"8": "Rel;1",
"10": "Btn_Tgl_All;0",
"11": "WifiLED_n;0",
"26": "Rel;2"
},
"command": "",
"image": "https://obrazki.elektroda.pl/8517688900_1711976288.png",
"wiki": "https://www.elektroda.com/rtvforum/viewtopic.php?p=21027911"
}
