I purchased bunch of 4 Gang Smart Switches from Aliexpress: The device has CB3S module: Tuya app recognized the device as W604-BLE. There has been a cloudcutter profile for this device: Unfortunately the new devices come with FW V1.3.5 which has been patched. So the only way now is to flash...

this is the TuyaMCU. You'll probably find RX1/TX1 on the CB3S trace to two of the legs on the TuyaMCU. I think you only have to interrupt the CB3S RX to be get the MCU out of the way so you can backup/flash. I delicately lifted the leg of a similar Bingoelec T34 touch switch MCU before to achieve this. Your MCU legs might differ though Added after 8 [minutes]: you may want to analyse the communications between the module and the MCU first though

>>21225880 This isn't a TuyaMCU device, RX/TX pins from CB3S aren't routed anywhere. And cloudcutter profile clearly specifies relay and button pins.

Then why does the cloudcutter profile contain the following: Code: text Expand Select all Copy to clipboard ch_cddpid1: 7, ch_cddpid2: 8, ch_cddpid3: 9, ch_cddpid4: 10, ch_dpid1: 1, ch_dpid2: 2, ch_dpid3: 3, ch_dpid4: 4, ch_flag1: 1, ch_flag3: 1, ch_flag4: 1, ch_num: 4,

>>21226430 For RF433, or some other leftovers. Doesn't matter anyway, since those are the most important: Code: text Expand Select all Copy to clipboard bt1_pin: 9, bt2_pin: 8, bt3_pin: 7, bt4_pin: 10, rl1_pin: 26, rl2_pin: 24, rl3_pin: 14, rl4_pin: 6, netled_pin: 11,

[CB3S} BK7231N W604-BLE (DS-W604) 4 Gang Smart Switch from Aliexpress

jkwim 879 5

Reply | New topic

#1 21225864 14 Sep 2024 10:13

jkwim jkwim

Level 12

Post #1
21225864 14 Sep 2024 10:13

I purchased bunch of 4 Gang Smart Switches from Aliexpress:

https://vi.aliexpress.com/item/1005005859040019.html?

The device has CB3S module:

Tuya app recognized the device as W604-BLE.

There has been a cloudcutter profile for this device:
https://github.com/tuya-cloudcutter/tuya-clou...es/tuya-generic-ds-w604-ble-light-switch.json

Unfortunately the new devices come with FW V1.3.5 which has been patched.

So the only way now is to flash directly.

When you inspect the PCB I discovered that the RX pin is connected to the pin number 3 of the 14-pin chip. I do not know whether this is a simple button controller or a Tuya MCU device. The above cloudcutter profile indicates that the old device was a Tuya MCU based.

Unfortunately the PCB does not show any tracks that can be broken temporarlily to disconnect the RX pin.

Since I have a bunch of these switches to work on, I do not want to de-solder the modules completely.

I am wondering whether I can just heat up the pads and lift the module a little bit because not all the pins are actually soldered.

Any better suggestions?

ADVERTISEMENT
#2 21225880 14 Sep 2024 10:38

divadiow divadiow

Level 34

Helpful post? (0)

Post #2
21225880 14 Sep 2024 10:38

~~this is the TuyaMCU. You'll probably find RX1/TX1 on the CB3S trace to two of the legs on the TuyaMCU.~~

I think you only have to interrupt the CB3S RX to be get the MCU out of the way so you can backup/flash. I delicately lifted the leg of a similar Bingoelec T34 touch switch MCU before to achieve this. Your MCU legs might differ though

Added after 8 [minutes]:

~~you may want to analyse the communications between the module and the MCU first though~~
https://github.com/openshwprojects/TuyaMCUAnalyzer
https://www.elektroda.com/rtvforum/topic3970199.html#20528459
ADVERTISEMENT
#3 21225911 14 Sep 2024 11:03

insmod insmod

Level 25

Helpful post? (+1)

Post #3
21225911 14 Sep 2024 11:03

>>21225880 This isn't a TuyaMCU device, RX/TX pins from CB3S aren't routed anywhere. And cloudcutter profile clearly specifies relay and button pins.
ADVERTISEMENT
#4 21225917 14 Sep 2024 11:11

divadiow divadiow

Level 34

Helpful post? (0)

Post #4
21225917 14 Sep 2024 11:11

eek. ok. sorry
ADVERTISEMENT
#5 21226430 14 Sep 2024 19:33

jkwim jkwim

Level 12
Topic author Helpful post? (0)

Post #5
21226430 14 Sep 2024 19:33

insmod wrote:
>>21225880 This isn't a TuyaMCU device, RX/TX pins from CB3S aren't routed anywhere. And cloudcutter profile clearly specifies relay and button pins.

Then why does the cloudcutter profile contain the following:

Code: text Expand Select all Copy to clipboard
"ch_cddpid1": 7, "ch_cddpid2": 8, "ch_cddpid3": 9, "ch_cddpid4": 10, "ch_dpid1": 1, "ch_dpid2": 2, "ch_dpid3": 3, "ch_dpid4": 4, "ch_flag1": 1, "ch_flag3": 1, "ch_flag4": 1, "ch_num": 4,
#6 21227307 15 Sep 2024 15:22

insmod insmod

Level 25
Helpful post? (0)

Post #6
21227307 15 Sep 2024 15:22

>>21226430 For RF433, or some other leftovers. Doesn't matter anyway, since those are the most important:
Code: text Expand Select all Copy to clipboard
"bt1_pin": 9, "bt2_pin": 8, "bt3_pin": 7, "bt4_pin": 10, "rl1_pin": 26, "rl2_pin": 24, "rl3_pin": 14, "rl4_pin": 6, "netled_pin": 11,
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply | New topic

Report a violation of the law

Home page
/
Forum
/
Smart Home
/
Smart Home IoT
/
[CB3S} BK7231N W604-BLE (DS-W604) 4 Gang Smart Switch from Aliexpress

[CB3S} BK7231N W604-BLE (DS-W604) 4 Gang Smart Switch from Aliexpress

Didn't find an answer? Ask Artificial Intelligence