logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

How To Flash T34-Based Smart Switch from Aliexpress With Tasmota/Esphome style firmware OBK

Mati Crawn 25302 78
Best answers

How can I access the hidden UART pins and flash this T34/BK7231N AliExpress smart switch with OpenBeken firmware?

You flash it by reaching the BK7231N/T34 UART on pins 25 (RX) and 26 (TX), powering the board from a solid 3.3V source, and then using BK7231Flasher or hid_download_py to write OpenBeken [#21264891][#21327748][#21528802] The easiest access on this board is often pin 25 directly on the chip and TX via the BR4 resistor pad; if your revision hides the pads, very short probes or microsoldering may be required, and one user even had to remove the 10k resistor and capacitor on pin 25 to make it work [#21264891][#21523814] If BK7231Flasher can read but fails while writing, shorten the wires, improve the 3.3V supply, and try a different baud rate; one user fixed the issue by switching tools and flashing successfully with hid_download_py [#21357215][#21528802] After flashing, the working OBK pin map shared for this board was P14 = external S1-S2, P24 = internal button, P15 = relay, and P16 = LED negative [#21195371] If you accidentally erased the bootloader and the device no longer boots, restore the original 2MB dump or use OBK with the overwrite-bootloader option [#21323010][#21323031]
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #61 21355560
    divadiow
    Level 38  
    Posts: 5027
    Help: 438
    Rate: 891
    your RX/TX cables look quite long. I tend to keep mine <10cm.

    So your primary source of power is the 3V3 from the USB-TTL adaptor going to here on this component?

    Close-up of a circuit board with various electronic components and a red marker.
  • ADVERTISEMENT
  • #63 21355587
    divadiow
    Level 38  
    Posts: 5027
    Help: 438
    Rate: 891
    well, my success is always with soldering short cables and using an external 3.3v PSU, not the USB-TTL power. Common grounds PSU<->USB-TTL
  • #64 21355634
    no_cloud
    Level 6  
    Posts: 20
    Rate: 1
    >>21355587 ok I try, thanks

    Added after 10 [hours] 16 [minutes]:

    @divadiow Big thanks for your help.
    I have change TX and RX, i have short wire and add a other 3V3 power and soldering the TX and RX on circle.
    But flash don't run :-\

    I have make a video of complete installation.... i have no idea.


  • #65 21357215
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14580
    Help: 654
    Rate: 12604
    I would say your circut have no chances to work. You've made at least two mistakes:
    - your wires are way too long, it has been proved many times on this forum that shortening the wires helps a lot
    - you seem to be powering your device from 3.3V directly from USB to TTL, it does not have enough current to power WiFi module well
    If you really don't want to use external LDO like I do on my videos https://www.youtube.com/@elektrodacom , you can consider taking 5V from USB and connecting it to the INPUT of AMS1117-3.3V on the board, so the WiFi module still gets 3.3V from AMS1117-3.3V output. This method may or not may work, depending on the capacitors on the board...
    Helpful post? Buy me a coffee.
  • #66 21357381
    no_cloud
    Level 6  
    Posts: 20
    Rate: 1
    >>21357215
    Hello, thank you for your recommendation.
    I have tested with a little wire of 15 cm and I have made an external power by esp32 but nothing.
    I'm lost.... I don't understand.
    I have made flashing with your help for T34, perfectly but with this board, I don't understand ...
  • ADVERTISEMENT
  • #68 21423820
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14580
    Help: 654
    Rate: 12604
    So how is this RF chip connect? It sounds like we need to have RF driver...
    Helpful post? Buy me a coffee.
  • #69 21423826
    divadiow
    Level 38  
    Posts: 5027
    Help: 438
    Rate: 891
    p.kaczmarek2 wrote:
    So how is this RF chip connect? It sounds like we need to have RF driver...

    I've yet to explore further. RF remotes are added through the app with this device, unlike some, so there must be some comms to work out

    Added after 11 [minutes]:

    App interface for managing a WiFi and RF switch. App settings screen with relay status and RF remote control setup options. RF remote control setup screen with countdown timer and cat icon. App screen for RF remote control setup with two entries. Device update screen showing no available updates.

    Added after 9 [minutes]:

    any interesting driver clues?

    Screenshot showing a section of code with various file paths and functions related to RF drivers.
    Attachments:
    • bk7231_2025-02-03_18-02-14_app_1.00_decrypted.bin (951.44 KB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #70 21423938
    divadiow
    Level 38  
    Posts: 5027
    Help: 438
    Rate: 891
    Close-up of an integrated circuit labeled H3308 H0744 with the date 2024/08/20. Close-up of a circuit board with visible electronic components and an integrated circuit. Close-up of a circuit board with an electronic component marked H3308 H0744.Close-up of a green circuit board with various electronic components and labels.

    can't find any info on that RF chip - H3308 H0744
  • #71 21424393
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14580
    Help: 654
    Rate: 12604
    So it's a receiver?
    This is probably something like that:
    https://tasmota.github.io/docs/RF-Protocol/#receiving-rf-codes

    Added after 2 [minutes]:

    This is probably something like SYN531R C77785
    Circuit diagram of SYN531R application for RF signal reception.
    Attachments:
    • 2410121855_Synoxo-SYN531R_C77785.pdf (1.05 MB) You must be logged in to download this attachment.
    Helpful post? Buy me a coffee.
  • #72 21424407
    divadiow
    Level 38  
    Posts: 5027
    Help: 438
    Rate: 891
    interesting. I have one of the cheapie logic analysers but not really engaged with it properly. Is that the next step? to sniff what it's up to?
  • #73 21424420
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14580
    Help: 654
    Rate: 12604
    You can try, later we could compare it with Tasmota RF receiver code and check if it 's the same protocol.

    Maybe that's it ?
    https://github.com/arendst/Tasmota/blob/0ba22.../tasmota_xdrv_driver/xdrv_17_rcswitch.ino#L86
    Would that mean that we need to port this?
    https://github.com/sui77/rc-switch/
    Helpful post? Buy me a coffee.
  • #74 21427559
    divadiow
    Level 38  
    Posts: 5027
    Help: 438
    Rate: 891
    seems I need to watch some basic Sigrok YouTube vids again.

    Screenshot from PulseView software displaying a logic analyzer with visible digital signals on multiple channels.
  • #75 21427880
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14580
    Help: 654
    Rate: 12604
    I'd say change the sampling rate, 20kHz in the dropdown, change it to higher frequency, maybe?
    Helpful post? Buy me a coffee.
  • #76 21468393
    iot_blanken
    Level 1  
    Posts: 1
    I received a different version of the mini smart switch. I was unable to flash the board over the air with tuya cloudcutter. As you can see the T34 pins are hidden. I understand that I can get 3.3V and ground pins from the AMS1117 chip but I have no idea where to get TX and RX from. Does anyone have the same board and was successful in flashing it?

    Mini smart switch with visible components held in hand. Mini smart switch PCB with hidden T34 pins.
  • #77 21523814
    viniciusvbf
    Level 1  
    Posts: 1
    Rate: 5
    For the new chips, it's almost impossible to do it without microsoldering. The pad for the pin 25 is pulled up with a 10k resistor and a capacitor, I don't know why. I had to remove both. Also, the pad for the pin 26 is not connected to anything. I had to remove the chip, add a fake pad, resolder the chip and finally flash firmware.
    Images for reference. I'll only buy modules from the "brand" Avatto from now on. They're much simpler to flash and to work with, and the build quality is better than the Tuyas. If you're buying modules to flash new firmware, I highly recommend buying from this brand. Cheers!
    Macro photo of a PCB fragment with SMD components and an empty spot for an integrated circuit.
    Close-up of a blue printed circuit board with SMD components and an empty socket for an integrated circuit.
    Close-up of a PCB with two thin wires soldered to specific pads and secured with glue.
  • Helpful post
    #78 21528802
    pppp73
    Level 11  
    Posts: 4
    Help: 1
    Rate: 1
    Hello,
    I also have Smart switches like the one described at the beginning of the topic and I also have problems with them like many of the writers, except that I have found a workaround for the problem.
    In a nutshell:
    - layout, connection as in this post
    - problem with reading and writing via BK7231Flasher (Ubuntu 24, wine), the program reads keys and efuse and crashes on reading memory, writing erases memory and reports an error.

    I am using cables about 20cm, power was from a USB adapter, later I changed to a power bank saute biting directly 3.2V (e.g. https://pl.aliexpress.com/item/1005006403572331.html) but it did not help much.

    In the end instead of BK7231Flasher I used hid_download_py for both read and write memory. As a batch I used OpenBK7231N_QIO_1.18.92.bin downloaded on previous attempts by BK7231Flasher. The module started, it works, it integrates with the HA without any problem, even the pin configuration loaded automagically.

    I attach a snapshot of the clean (unconfigured) module and cobbled together logs from my failed attempts to use BK7231Flasher.
  • ADVERTISEMENT
  • #79 21534712
    ausalex
    Level 3  
    Posts: 5
    >>21468393

    Did you find a solution, just had the same delivered today and trying to find how to get esphome on it?
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion focuses on flashing T34-based smart switches purchased from AliExpress, which use the BK7231N chip, with custom firmware such as OpenBeken (OBK), Tasmota, or ESPHome-style firmware. Two hardware variants were identified: one with the pushbutton on the back and another on the front, both sharing the same baseboard design. Users encountered challenges flashing these devices using the Tuya Cloudcutter due to firmware version 1.3.10 being non-flashable via cloud methods. Successful flashing requires direct UART access, often achieved by soldering or using needle pins on test pads or chip pins 25 (RX) and 26 (TX). A pull-down resistor labeled BR4 on the PCB aids in accessing the TX pin. Power supply stability is critical; USB-TTL adapters often lack sufficient current, so external 3.3V power supplies or powering through the AMS1117-3.3V regulator input are recommended. Short, direct wiring and proper connection of RX/TX lines (crossed correctly) are essential to avoid communication errors. Flashing tools like BK7231Flasher sometimes fail due to power or connection issues; alternatives like hid_download_py have proven more reliable. Some users reported needing to overwrite the bootloader to restore UART functionality. For newer or different board revisions, microsoldering and hardware modifications (removing resistors/capacitors) may be necessary. The community shared various soldering techniques, including solder-less needle pin methods and glue gun fixtures for stable connections. MQTT integration with Home Assistant works well after flashing, though some configuration flags may need adjustment to enable full telemetry. Additionally, a variant with an unmarked RF chip (possibly SYN531R) was discussed, with suggestions to analyze its protocol for remote control support. Overall, the thread provides detailed practical advice on hardware identification, wiring, power considerations, flashing procedures, and firmware configuration for T34/BK7231N smart switches from AliExpress.
Generated by the language model.
Today's popular

FAQ

TL;DR: 4 switches were flashed, and after the first success the next 3 took about 10 minutes; as one expert put it, "it's fiddly but totally doable." This FAQ helps anyone replacing unsupported Tuya 1.3.10 firmware on T34 mini switches with OpenBeken over UART, using needle contacts or the BR4 test-point workaround. [#21062328]

Why it matters: These AliExpress mini switches often ship in mixed hardware revisions, so a repeatable UART method saves hours of failed Cloudcutter attempts.

Method Works on Tuya 1.3.10 in thread Physical difficulty Main risk Best use case
Tuya Cloudcutter No Low Unsupported firmware Quick check before opening
UART with needles Yes High Slipping and shorting pins 25/26 Glued T34 modules
UART via BR4 for TX Yes Medium Still need RX on pin 25 Easier access to pin 26
hid_download_py Yes Medium Extra setup When BK7231Flasher reads but fails to write

Key insight: The hard part is not firmware selection. It is stable electrical access: short wires, solid 3.3 V power, and the right RX/TX contact points decide whether flashing works.

Quick Facts

  • The board mapping reported for the original T34 switch is relay on P15, external S1/S2 on P14, onboard button on P24, and an active-low LED on P6. [#21062328]
  • Multiple users reported that 115200 baud helped unstable reads, but one successful write completed only after switching back to 921600 baud after erase. [#21310912]
  • Power stability matters more than tool version: one failed setup triggered a Windows USB unplug sound every time 3.3 V was reconnected, pointing to inrush or overload. [#21224931]
  • The device backup size shown in the thread is 0x200000 bytes, and a full dump was saved as 2 MB before recovery work. [#21321496]
  • A later hidden-pin board revision may require removing a 10 kΩ pull-up network near pin 25 and microsoldering because pin 26 had no usable pad. [#21523814]

How do I flash a T34-based Tuya mini smart switch from AliExpress with OpenBeken using UART when Tuya Cloudcutter does not support firmware 1.3.10?

Use UART flashing instead of Cloudcutter. 1. Open the case and power the board from 3.3 V and GND. 2. Contact T34 pin 25 with UART TX and pin 26 with UART RX, often using needle probes. 3. Flash OpenBeken with BK7231Flasher; after the first successful unit, three more were flashed in about 10 minutes. The original poster confirmed Tuya firmware 1.3.10 was not supported by Cloudcutter on this switch. [#21062328]

What is the T34 module in these Tuya smart switches, and how does it relate to the BK7231N chip?

T34 is the Tuya Wi-Fi module built around the BK7231N chip. "T34" is a Tuya radio module that provides Wi‑Fi control, and its key characteristic in this thread is a BK7231N-based design hidden or glued onto the switch PCB. Users repeatedly identified these mini switches as T34 boards and selected BK7231N firmware when flashing them. One reply even corrected a failed setup by noting that T34 is BK7231N, not BK7231T. [#21323333]

What is OpenBeken (OBK), and how is it used on T34 smart switches instead of Tasmota or ESPHome-style firmware?

OpenBeken is the replacement firmware used here to run the T34 switch locally after UART flashing. "OpenBeken" is device firmware that replaces Tuya software, exposes a web app and MQTT features, and is used on BK7231N hardware where ESP-style local control is wanted without the original cloud stack. In this thread, users flashed OBK, imported a JSON pin map, paired it with Wi‑Fi, and integrated it with Home Assistant through MQTT. [#21324762]

Which pins on this T34 smart switch board should be mapped for relay, LED, external S1/S2 input, and the onboard button?

Map relay to P15, LED to P6, external S1/S2 input to P14, and the onboard button to P24. The original JSON used LED_n on pin 6, Rel on pin 15, and toggle functions on pins 14 and 24. A later refinement changed P24 from a hold-style toggle to Btn_Tgl_All;0, so each press toggled the relay without needing a long hold. [#21195371]

Where can I access RX and TX on glued-down T34 modules, including the BR4 resistor trick for pin 26?

Access RX directly on T34 pin 25 and access TX either on pin 26 or at resistor BR4. The useful shortcut is that BR4 exposes the TX line on the side marked “4,” while the other side is GND. That leaves only pin 25 to touch on the module itself, which is easier because it sits on the outer corner. Several later users confirmed the BR4 method made contact much easier. [#21264891]

Why does BK7231Flasher read the chip successfully but fail during erase or write on these T34 switches?

It usually fails because the wiring or power is marginal under write load. One user read the full 2 MB dump successfully, including the encryption key, but erase failed at sector 69632 with a serial buffer error. After changing the UART converter, shortening wires, and stabilizing power, the same board erased and wrote normally. Read operations can succeed even when write current spikes expose a weak setup. [#21321513]

What is the best way to power a T34 board during flashing: USB-TTL 3.3V, an external 3.3V supply, or feeding 5V into the AMS1117 input?

Use a solid external 3.3 V supply first; use USB-TTL 3.3 V only as a last resort. Several failures were traced to weak adapter power, while stable external power or a better regulator fixed them. If you avoid a separate LDO, one thread expert suggested feeding 5 V into the board’s AMS1117 input so the onboard regulator still produces 3.3 V, though success depends on the board’s capacitors. [#21357215]

Why does reconnecting the 3.3V wire make Windows play the USB disconnect sound during flashing attempts?

That sound usually means your power setup is overloading the USB port. The thread diagnosis was inrush current from the board’s capacitors or an accidental 3.3 V-to-GND short. In the reported case, reconnecting only the 3.3 V wire still made Windows play the plug/unplug sound, which pointed to a power problem rather than a flasher bug. A stronger supply or separate device power was the recommended fix. [#21224931]

How should I put a BK7231N/T34 device into flashing mode: power cycling VDD, using CEN, or holding the onboard push button?

Power cycling only the device VDD is the most reliable method in this thread. One expert explicitly said he no longer uses CEN because disconnecting and reconnecting VDD works better, while keeping the USB-UART adapter powered the whole time. Another user reported that holding the small onboard push button also made entry easier than cycling power on some units. Use CEN only if VDD cycling is impractical. [#21335520]

When flashing fails on a T34 switch, what troubleshooting steps help most with wire length, baud rate, UART adapters, and contact quality?

Shorter wires, lower initial baud, better probes, and a stronger adapter help most. 1. Keep RX/TX leads under about 10 cm if possible and inspect for bridges under magnification. 2. Try 115200 baud first, then test higher speeds if write fails. 3. Swap the USB-UART converter and verify RX/TX contact with a meter. One expert summarized the process: “it’s fiddly but totally doable.” [#21121760]

How do I restore a T34/BK7231N switch that no longer boots, shows no AP, and appears to have lost its bootloader after flashing?

Restore the original 2 MB dump if you have it, then flash OpenBeken again. If you do not have a dump, flash a full 2 MB BK7231N image with bootloader included. In the thread, a board showed no AP and no useful UART output until the user used the overwrite-bootloader path; after that, TX2 output returned and the device booted normally. Missing TX2 activity was treated as the key sign of a lost bootloader. [#21323031]

What does the 'overwrite bootloader' option do in BK7231Flasher, and when is it appropriate on BK7231N devices?

It rewrites the bootloader area, and you should use it only to recover a board that already lost its bootloader. The maintainer said you should not use overwrite bootloader in normal BK7231N flashing. He recommended it only after symptoms showed the bootloader had already been erased, such as no TX2 startup output and no AP after flashing. In that recovery case, the option brought the device back to life. [#21323046]

BK7231Flasher vs hid_download_py for T34 switches: which tool works better when reading succeeds but writing keeps failing?

hid_download_py is the better fallback when BK7231Flasher can read but repeatedly fails to write. A later user on Ubuntu 24 reported that BK7231Flasher read keys and efuse, then failed on memory operations, while hid_download_py successfully read and wrote the same T34 board. He flashed OpenBK7231N_QIO_1.18.92.bin, the module booted, and Home Assistant integration worked, with the pin configuration loading automatically. [#21528802]

How do I import the JSON device configuration into the OpenBeken web app after flashing a T34 smart switch?

Import the JSON in the OpenBeken web application after the firmware is already running. One user asked exactly how to load the posted T34 JSON, and the response pointed him to the web-app workflow video. He then confirmed the web application was simple and worked well. In practice on this thread, users flashed OBK first, then applied the JSON mapping so relay, LED, and switch pins matched the hardware. [#21324762]

What is the flashing method for the newer T34/BK7231N board revision with hidden pins, altered pull-up components on pin 25, and no obvious TX pad for pin 26?

Use microsoldering, and expect the newer revision to be much harder than the original board. One report said pin 25 was tied through a 10 kΩ pull-up resistor and a capacitor, both had to be removed, and pin 26 had no usable connection at all. The successful method was to remove the chip, create a fake pad, resolder the chip, and only then flash it. This is the edge case where needle probes stop being practical. [#21523814]
Generated by the language model.
ADVERTISEMENT