logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Flashing BK7231N Chip on GHome SP211 (Gosund SP211) Smart Plug

leonardocapone 1308 7
ADVERTISEMENT
Reply | New topic
  • #1 21098425
    leonardocapone
    Level 4  
    Gosund SP211 double smart socket with logo and colored channel indicators.
    simply the whole hardware did not changed that much with reference to what you guys can see here:

    https://templates.blakadder.com/gosund_SP211.html
    Quote:

    Smart plug SP211 in hand, with an annotation indicating the need to remove the cover to access screws.
    Close-up of two electrical sockets showing mounting screws.
    Gosund SP211 smart plug with highlighted case latches.
    Close-up of an open Gosund SP211 socket showing internal components. Interior of a smart plug showing the mainboard and attached wires.


    the opening process is already well described with all the necessary pictures in the link above.

    I managed to flash the "new" chip (BK7231N) getting access to TX, RX, GND/3.3V, and IO0 (..to GND);

    I've attached my current template for you to redistribute.

    I believe every original feature has been implemented:

    - status leds for each channel
    - built-in push buttons for each channel
    -voltage, current, power readings are available
    Attachments:
  • ADVERTISEMENT
  • #2 21099153
    divadiow
    Level 35  
    cool. did you manage to get any pics of the module and a factory firmware backup?
  • ADVERTISEMENT
  • #3 21099215
    leonardocapone
    Level 4  

    Hi there! I'm sorry but I did not.
    Have a good one!
  • ADVERTISEMENT
  • #4 21100346
    divadiow
    Level 35  
    ok. do you recall the module model? perhaps "CB2S"?
  • ADVERTISEMENT
  • #5 21100604
    leonardocapone
    Level 4  

    I do recall many digits on that chip.
    I went back into my google history as I do recall I was looking for info on the web.
    so my google history shows the following "94V-0 130 oleler F-M E351308 20-N-V1.2 C 2350".

    my personal idea is that chip is a CB2S or at least belongs to its family. Shape and general aspects are in line with it.
    that's pretty much all I have.
  • #7 21484297
    kvakulo
    Level 3  
    Sorry for hijacking this thread. I recently purchased a couple of Gosund SP211 plugs and there appears to be multiple versions of the plug. At least in my case, the chip inside the plug was an RTL8720CF on a CUCO Z0 R V1.2 board (there is a good close up photo of the board available here):

    CUCO Z0 R V1.2 electronic module mounted on a circuit board.

    To flash OBK, I connected wires to three pads on the back of the module: IO0, TXLOG, and RXLOG:

    Close-up of an electronic chip attached to a circuit board with connection labels.

    Additionally, I connected wires to the GND and 3.3V pins on the bottom of the board:

    Close-up of electronic components on a circuit board with labeled GND and 3.3V points.

    TXLOG should be connected to RX on the USB to UART adapter, and RXLOG to TX.

    To put the chip into flash mode, connect IO0 to 3.3V during power-up.

    I read the existing firmware using LTChipTool, but I encountered an error when attempting to flash OBK. To resolve this, I switched to the AmebaZ2 PG Tool, which worked successfully. (More info about how to flash RTL8720CF chips can be found in this thread)

    Below is a template for OBK similar to the one posted above:

    Code: text Expand Select all Copy to clipboard
    
{
  "vendor": "Gosund",
  "bDetailed": "0",
  "name": "Dual Smart Plug WiFi",
  "model": "SP211",
  "chip": "RTL87X0C",
  "board": "CUCO-ZO-R-V1.2",
  "flags": "2098180",
  "keywords": [
        "socket",
        "outlet"
  ],
  "pins": {
    "2": "Rel;2",
    "3": "Rel;1",
    "4": "Btn;1",
    "11": "LED_n;2",
    "12": "Btn;2",
    "13": "BL0937SEL;0",
    "14": "LED_n;3",
    "17": "BL0937CF;0",
    "18": "BL0937CF1;0",
    "19": "LED_n;1"
  },
  "command": "backlog startDriver BL0937; BL0937_VCPPrecision 2 2 2 2; BL0937_VCPPublishThreshold 0.5 0.3 0.3",
  "image": "https://obrazki.elektroda.pl/YOUR_IMAGE.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/topic_YOUR_TOPIC.html"
}


    When I powered on the board prior to flashing OBK, I could see the following output:
    Code: text Expand Select all Copy to clipboard
    
== Rtl8710c IoT Platform ==
Chip VID: 5, Ver: 3
ROM Version: v3.0

== Boot Loader ==
Dec  5 2019:14:02:18

fwx SELE[fffffffc]
fw SELE Bitidx 2, fw1 valid 1, sn 0, fw2 valid 1, sn 100
fw1 USE, return sn 0

Boot Loader <==

== RAM Start ==
Build @ 15:38:41, Jan 29 2023
interface 0 is initialized
interface 1 is initialized

Initializing [01-01 18:1WIFI ...2:15 TUYA I][lr:0x9b0610db] mqc app init ...
[01-01 18:12:15 TUYA I][lr:0x9b04171b] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:5
[01-01 18:12:15 TUYA I][lr:0x9b04171b] thread_create name:cmmod,stackDepth:4096,totalstackDepth:8192,priority:4
[01-01 18:12:15 TUYA D][lr:0x9b061059] mq_pro:5 cnt:1
[01-01 18:12:15 TUYA D][lr:0x9b061059] mq_pro:31 cnt:2
[01-01 18:12:15 TUYA D][lr:0x9b067a4f] svc online log init success
[01-01 18:12:15 TUYA D][lr:0x9b059827] read m:1 f:0 l:0
[01-01 18:12:15 TUYA I][lr:0x9b04171b] thread_create name:wk_th-0,stackDepth:5120,totalstackDepth:13312,priority:3
[01-01 18:12:15 TUYA E][lr:0x9b057f71] kvs_read fails gw_bi -23
[01-01 18:12:15 TUYA D][lr:0x9b044dd3] gw base read finish:-18
[01-01 18:12:15 TUYA D][lr:0x9b05e5f1] ty bt cmmod regist ok:1
[01-01 18:12:15 TUYA D][lr:0x9b05e8ff] upd adv para, send conn_req beacon.
dev id key: 16
d4 1d 8c d9 8f 00 b2 04 e9 80 09 98 ec f8 42 7e 
[BT NOTICE]tuya_os_adapt_param_init mode:1
[BT DEBUG]tuya_os_adapt_bt_stack_init
[BT DEBUG]current_bt_mode:255, new bt_param->mode:1
[BT DEBUG]###init ble slave###
[01-01 18:12:15 TUYA D][lr:0x9b0415a3] Thread:sys_timer Exec Start. Set to Running Stat
[01-01 18:12:15 TUYA D][lr:0x9b0415a3] Thread:cmmod Exec Start. Set to Running Stat
[01-01 18:12:15 TUYA D][lr:0x9b0415a3] Thread:wk_th-0 Exec Start. Set to Running Stat

WIFI initialized

init_thread(65), Available heap 0x16ff8BT BUILD Date: Jan 29 2023, 15:41:03 
BT RESET LOG...
read wifi mac:a8:80:55:e4:53:d2[BT NOTICE]BLE MAC: 0xa8-0x80-0x55-0xe4-0x53-0xd2
BT Reset ok
bt_iqk_efuse_valid: has data

hci_tp_phy_efuse[0]=0,
bt_dump_iqk:    DUMP,
the IQK_xx  data is 0xfc,
the IQK_yy  data is 0x2,
the QDAC   data is 0x1c,
the IDAC   data is 0x22,
the QDAC2  data is 0x1e,
the IDAC2  data is 0x23,
hci_read_rom_check: rom_version 0x0003, bt_hci_chip_id 0x0004

BT ADDRESS:
a8:80:55:e4:53:d2:

 WRITE  physical FLATK=tx_flatk=f000 

We use fw_buf=1002ebd0, fw_len = 1f2c, config_buf = 10010be0, config_len= 32
Set baudrate to 921600

hci_tp_config:BT INIT success 7
Start upperStack

[BLE peripheral] GAP stack ready
[BT DEBUG]###init ble slave succ###
[01-01 18:12:15 TUYA N][lr:0x9b05eecb] ble sdk re_inited
[01-01 18:12:15 TUYA D][lr:0x9b060bfd] bt active init
[01-01 18:12:15 TUYA N][lr:0x9b05e70d] ty bt sdk init success finish
[01-01 18:12:15 TUYA D][lr:0x9b01b6e3] < TUYA IOT SDK V:2.3.3 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.4_CD:1.0.0 >
< BUILD AT:2023_01_10_15_29_23 BY ci_manage FOR ty_iot_sdk AT rtl8720cf_ameba >
IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 SHUTDOWN_MODE:0 LITTLE_END:1 TLS_MODE:2 ENABLE_CLOUD_OPERATION:0 OPERATING_SYSTEM:2 ENABLE_SYS_RPC:0 RELIABLE_TRANSFER:0 ENABLE_LAN_ENCRYPTION:1 ENABLE_LAN_LINKAGE:0 ENABLE_LAN_DEV:0 >

[01-01 18:12:15 TUYA D][lr:0x9b01b6ed] cuco_plug_sp211_rtl_common:1.0.1
[01-01 18:12:15 TUYA N][lr:0x9b01b6f7] firmware compiled at Feb 17 2023 14:43:33
[01-01 18:12:15 TUYA N][lr:0x9b01b703] system reset reason:[(null)]
[01-01 18:12:15 TUYA N][lr:0x9b06d6d5] key_addr: 0x1d8000   block_sz 4096
[01-01 18:12:15 TUYA N][lr:0x9b06d761] get key:
0x84 0x64 0x29 0x92 0xd0 0xf6 0x2d 0x81 0x60 0x75 0x77 0x74 0x8d 0xb5 0xa0 0xec 
[01-01 18:12:16 TUYA N][lr:0x9b018963] mf_init succ
[01-01 18:12:16 TUYA N][lr:0x9b01b735] ---------app_init--------
[WIFI NOTICE]tuya_os_adapt_wifi_set_work_mode:2 now mode:2
[BT DEBUG]tuya_os_adapt_bt_stack_deinit
[BT DEBUG]###deinit ble slave###
[BT DEBUG]bt state.gap_init_state:1
[BT DEBUG]bte_deinit
[01-01 18:12:16 TUYA N][lr:0x9b05f34f] Ble Disonnected
[01-01 18:12:16 TUYA N][lr:0x9b05f6a9] ble reset sn
[01-01 18:12:16 TUYA N][lr:0x9b05f6cd] ble clear pair rand
[01-01 18:12:16 TUYA N][lr:0x9b05f369] ble set conn stat:2
[01-01 18:12:16 TUYA N][lr:0x9b05f34f] Ble Disonnected
[01-01 18:12:16 TUYA N][lr:0x9b05f6a9] ble reset sn
[01-01 18:12:16 TUYA N][lr:0x9b05f6cd] ble clear pair rand
[01-01 18:12:16 TUYA N][lr:0x9b05f369] ble set conn stat:2

LwIP_DHCP: dhcp stop.2
Deinitializing WIFI ...
WIFI deinitialized
Initializing WIFI ...
WIFI initialized
[BT DEBUG]tuya_os_adapt_bt_stack_init
[BT DEBUG]current_bt_mode:255, new bt_param->mode:1
[BT DEBUG]###init ble slave###
BT BUILD Date: Jan 29 2023, 15:41:03 
BT RESET LOG...
read wifi mac:a8:80:55:e4:53:d2[BT NOTICE]BLE MAC: 0xa8-0x80-0x55-0xe4-0x53-0xd2
BT Reset ok
bt_iqk_efuse_valid: has data

hci_tp_phy_efuse[0]=0,
bt_dump_iqk:    DUMP,
the IQK_xx  data is 0xfc,
the IQK_yy  data is 0x2,
the QDAC   data is 0x1c,
the IDAC   data is 0x22,
the QDAC2  data is 0x1e,
the IDAC2  data is 0x23,
hci_read_rom_check: rom_version 0x0003, bt_hci_chip_id 0x0004

BT ADDRESS:
a8:80:55:e4:53:d2:

 WRITE  physical FLATK=tx_flatk=f000 

We use fw_buf=1002ded0, fw_len = 1f2c, config_buf = 1002fe08, config_len= 32
Set baudrate to 921600

hci_tp_config:BT INIT success 7
Start upperStack

[BLE peripheral] GAP stack ready
[BT DEBUG]###init ble slave succ###
[01-01 18:12:17 TUYA N][lr:0x9b0189e9] current product ssid name:tuya_mdev_test3
[WIFI NOTICE]not find scan ssid (tuya_mdev_test3)
[01-01 18:12:18 TUYA N][lr:0x9b049c51] wifi soc init. pid:p2tjkvgdhvuadnlj firmwarekey:(null) ver:1.0.1
[01-01 18:12:18 TUYA N][lr:0x9b0442c7] Last reset reason: 0
read wifi mac:a8:80:55:e4:53:d2[01-01 18:12:18 TUYA N][lr:0x9b044399] serial_no:a88055e453d2
[01-01 18:12:18 TUYA N][lr:0x9b044515] gw_cntl.gw_wsm.stat:0
[01-01 18:12:18 TUYA N][lr:0x9b04866d] gw_cntl->gw_wsm.nc_tp:2
[01-01 18:12:18 TUYA N][lr:0x9b048677] gw_cntl->gw_wsm.md:0
[01-01 18:12:18 TUYA N][lr:0x9b0446d7] gw_cntl.gw_if.abi:0 input:0
[01-01 18:12:18 TUYA N][lr:0x9b0446e1] gw_cntl.gw_if.product_key:p2tjkvgdhvuadnlj, input:p2tjkvgdhvuadnlj
[01-01 18:12:18 TUYA N][lr:0x9b0446ed] gw_cntl.gw_if.tp:0, input:0
[01-01 18:12:18 TUYA N][lr:0x9b05e767] ty bt upd product:p2tjkvgdhvuadnlj 0
[01-01 18:12:18 TUYA N][lr:0x9b05ed4b] upd product_id type:0 p2tjkvgdhvuadnlj fd5f931af86b5224 xBgHKMyYZu5tBvkO8iIkDRruFJRrTG1G
read wifi mac:a8:80:55:e4:53:d2[01-01 18:12:18 TUYA N][lr:0x9b01c671] ele_coe have been set to cal value!
[01-01 18:12:18 TUYA E][lr:0x9b06a0fb] uf_open ele_save_key err 8
[01-01 18:12:18 TUYA E][lr:0x9b019879] cannot open file
[01-01 18:12:18 TUYA E][lr:0x9b06a0fb] uf_open tem_ele_save_key err 8
[01-01 18:12:18 TUYA E][lr:0x9b0199a7] cannot open file
[01-01 18:12:18 TUYA N][lr:0x9b01b7d7] app_switch_initapp_switch_init
[01-01 18:12:18 TUYA N][tuya_cyc_rand_timer.c:763] ty_tm_ctrl_init
[01-01 18:12:18 TUYA N][tuya_cyc_rand_timer.c:763] ty_tm_ctrl_init
[01-01 18:12:18 TUYA N][tuya_cyc_rand_timer.c:763] ty_tm_ctrl_init
[01-01 18:12:18 TUYA N][tuya_inch.c:371] inch_ctrl_init
[01-01 18:12:18 TUYA N][lr:0x9b01b7ef] system free heap:53568
[WIFI NOTICE]tuya_os_adapt_wifi_set_work_mode:3 now mode:2

[wifi_set_mode] WIFI Mode Change: STA-->AP[WIFI DEBUG]sta_max_conn:3
[WIFI DEBUG]hwl_wf_ap_start, cfg->chan:6
[WIFI DEBUG]ap start : ip       0x1afa8c0
[WIFI DEBUG]ap start : mask     0xffffff
[WIFI DEBUG]ap start : gateway  0x1afa8c0
[01-01 18:12:18 TUYA N][lr:0x9b05ede9] update bound stat:0
dev id key: 16
bc f4 c0 28 c8 39 e4 0e b0 a7 2c 58 12 4b 13 1d 
[BT DEBUG]already in stop
[BT DEBUG]tuya_bt_reset_adv ret:0
[BT NOTICE]le_adv_start(), start adv
[BT DEBUG]reset adv ok
[01-01 18:12:18 TUYA N][lr:0x9b05eb77] ble adv && resp changed
[01-01 18:12:19 TUYA N][lr:0x9b01b6a1] cur_wifi_stat:2
    Attachments:
Reply | New topic
Report a violation of the law

Topic summary

The discussion centers on flashing the BK7231N chip found in the Gosund SP211 (GHome SP211) smart plug. The hardware design remains largely unchanged compared to existing templates. The user successfully accessed the chip's UART interface via TX, RX, GND/3.3V, and IO0 pins (IO0 connected to GND for flashing). The custom firmware template includes original features such as status LEDs, push buttons per channel, and voltage, current, and power measurements. The chip is suspected to be a CB2S or related model based on markings and physical characteristics. Additional contributions mention multiple Gosund SP211 versions, including one with an RTL8720CF chip on a CUCO Z0 R V1.2 board. Flashing this variant involves connecting IO0, TXLOG, RXLOG, GND, and 3.3V pads, with IO0 tied to 3.3V during power-up to enter flash mode. Firmware backup and flashing tools like LTChipTool and AmebaZ2 PG Tool are referenced. Relevant open-source firmware repositories and pull requests for BK7231N and CB2S support are linked.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT