[BK7231N] Feit Electric Triple Outlet Outdoor Smart Plug Teardown

Hello!

First post here, sorry if I am doing something wrong. This is a teardown of the "Triple Outlet Outdoor Smart Plugs" from Feit Electric. This is an outdoor smart plug with one relay that controls three US outlets. This smart outlet came in a two pack for roughly $10 USD and I purchased these outlets from Costco.

Packaging images:


Device appearance (there is one button and a blue LED which is lit when the outlets receive power. The LED can be disabled within the Tuya/SmartLife app):


The device can be disassembled by removing the 6 screws on the underside of the outlet(s). These are small, Phillips head screws. There is (what I presume to be) some hot glue by where the plug meets the main body of the outlet.
Here's an image of one of the screws holding the outlet together:


This outlet uses a BEKEN BK7231N chip. I was unable to flash this device using tuya-cloudcutter. The "Main Module" version within the Tuya/SmartLife app is V1.1.17, which may be patched? Let me know if there's a way to flash this device without soldering. Here are some images of the innards of the device:



I apologize in advance if some of the photos are a bit blurry. I did not end up flashing this device as I don't have a USB to serial adapter, so I'm not sure what each GPIO pin corresponds with.

I hope this helps!

interesting. The 2-plug version looks like it comes with (or did) a CB2S module, whereas this has the BK7231N soldered onto the PCB. Do you plan on freeing it from the cloud? Will you get a USB-TTL adaptor? Those test points on the underside of the PCB look like it'd be nice and easy.



Added after 2 [minutes]:

from top to bottom in my pic

UXTX?
CEN
CSN?
1ATX?
1ARX?
GND
3V3

please confirm

>>21277157
The letters are pretty smudged and hard to read. Here's my best guess of the labelling:
UXTX
CEN
CSN
UITX
U???
GND
3V3

No idea if I want to try flashing this one. I'm planning on using this one for Christmas lights, and I'm not sure if I'll need both outlets working quite just yet. I'm also not too confident in my soldering abilities...

Well. There'd definitely be a TX/RX pair. Anyway, it'd only matter if you decide to flash it.

I was able to do a teardown and confirmed functionality of the following:
U2TX - sends some debug messages at 115200 baud by default
CEN - reset by grounding
???
U1TX - uart loading (receive from here)
U1RX - uart loading (transmit into here)
GND
3V3

Successfully downloaded and flashed to OpenBeken via uartprogram of hid_download_py. CRC on download always fails.

Config:
P15 Rel
P17 LED_n
P26 Btn

Failed to write via BK7231 Easy UART Flasher although it does download (and do a good crc for the BK7231N) and erase (reading back has lots of 0xFF where there was data)

Traces are fairly fragile. Broke a U1TX trace clean off with the soldered wire before I got to freeing it from the cloud. I guess I should have just built myself a set of .08 in spaced contacts to clamp on and contact the pads.

P.S. I also confirmed that cloudcutter exploit fails (Main Module v1.1.17; Other type v1.0.0)