logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Freeing Tuya Device with BK7231N (T34) Any Hacks for Firmware 1.3.10?

zyklop 1329 6
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #1 21202742
    zyklop
    Level 2  
    Hello, I have a Tuya device with a new BK7231N (T34) chip as BGA!
    No chance to get it freed from cloud without soldering.
    Software is 1.3.10 so no cloud cutter works, or is there still a hack for this patched firms?
    Here is a photo......

    Image of an electronic module with a chip and screw terminals.

    Any idea with this?
    Tomorrow I will try to grep RX/TX pins on PCB if it's breaked out.
  • ADVERTISEMENT
  • #2 21202758
    p.kaczmarek2
    Moderator Smart Home  
    Only soldering method will work I guess.

    Here is one approach:
    https://www.elektroda.com/rtvforum/topic4036975.html#20968165
    This switch is similiar:
    https://www.elektroda.com/rtvforum/topic4036852.html
    Here is more related topics:
    https://www.elektroda.com/rtvforum/find.php?q=T34
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #3 21430198
    dipish
    Level 7  
    >>21202758
    I have the same one. I had to desolder the chip and flash it separately.
    It was really challenging, but I managed.
    However, the box in the photo has completely different GPIOs compared to the ones described in the forum posts. I partially mapped them out, but I still can’t find S1/S2 (S1 is neutral). I’ve checked all 26 pins using GPIO Finder.

    Now I’m wondering if one of the contacts didn’t solder properly when I reattached the chip.

    or maybe I just can’t find it

    additional info:
    Pin 8 is the LED,
    Pin 10 is the button
    Pin 26 controls the relay.

    But I still can’t locate S2 anywhere. Has anyone encountered this? Any help would be appreciated!

    Also, could someone clarify if PowerSave needs to be enabled on this chip? I’m unsure if it affects the relay or button functionality. Thanks in advance!
  • ADVERTISEMENT
  • #4 21430453
    divadiow
    Level 36  
    did you take a backup before conversion to OBK?
  • ADVERTISEMENT
  • #6 21436395
    divadiow
    Level 36  
    cool. Here is the boot log for your device

    Code: Text
    Log in, to see the code


    the pin assignments are buried in there too

    Code: Text
    Log in, to see the code


    pairs with Tuya as a Mini switch K601
    View of the mini switch K601 with specification details.

    storage info in fw after pairing

    Code: JSON
    Log in, to see the code
  • #7 21724452
    groove6j
    Level 9  
    I had the same switch, also flashed it successfully. So the S2 is pin 23 correct?
Reply | New topic
Report a violation of the law

Topic summary

The discussion focuses on freeing a Tuya device equipped with the BK7231N (T34) chip running firmware version 1.3.10, which is resistant to cloud-cutting hacks. The consensus is that soldering and desoldering the chip for direct flashing is currently the only viable method to bypass cloud restrictions. Attempts to locate GPIO pins such as S1 (neutral) and S2 on the PCB have been challenging due to differing pinouts from documented references. Partial pin mapping identified pin 8 as LED, pin 10 as button, and pin 26 controlling the relay, but S2 remains elusive. Questions were raised about the impact of PowerSave mode on relay and button functionality. Backup extraction from the flash was unsuccessful with available tools. A boot log snippet for the BK7231N device was shared, indicating firmware and system initialization details. Related forum links provide additional context on similar devices and soldering approaches.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT