[ECR6600][BL0937] Tuya Wifi Smart Plug With Energy Measurement

Bought another smart plug hoping for BL0942 as reported recently in the forum, but got something else...
From Here

Typical plug appearance, no markings on outside


Better polymer capacitors maybe, but no fusible resistor or MOV, but two LEDs


Usual BP2525, BL0937, and AMS1117 (hardly visible)



New ECR6600 chip, not supported, but already reported in this forum:


Might be easy to flash, 5 pads, could be VCC, GND, TX, RX, BOOT


Don't have much time to investigate further these days, maybe sometime in spring...

nice.

*instantly orders*

Is there a datecode on the PCB?

I wonder if it was produced after T34 batch or before.

PCB has no marking at all. BL0937 has date code 2439, so this must be made after week 39, 2024.

You don't have to wait until spring, here is some information from me about this plug

How did you take flash backup? Can you share boot log?

>>21444672

cool, thanks. another one for the ECR6600 collection

No flashback was attempted, there is no boot log. The power supply to the module had to be established separately, the voltage from the serial converter was not sufficient.

boot log from IO13 on WG236 after burning your backup





not getting to pairing mode I guess because I don't have BL0937 present. IO24 appears to be reset/btn

Added after 3 [hours] 36 [minutes]:

@Jamiwi have you traced out each pin/gpio to btn, rel, led, bl0937?

I didn't investigate anything further, for me the most important thing was to preserve the Flash content.
At the moment there is no ready-made alternative firmware for these plugs

Here is my backup, seems mostly the same as others with minor (data?) differences.
Looks like wifi performs good, RSSI is reported similar to bk7231n nearby, and gpio finder performs well.

No way to get boot log on TX0?

And here is full config:
Led for relay is hardwired, not controllable individually.

thanks for confirming assignments. we've seen a couple of these in recent weeks. The template was added from this thread not too long ago https://www.elektroda.com/rtvforum/topic4112667.html

Added after 7 [minutes]:

I've still to get lucky and get one of these for myself. I'm keen to see what the AT firmware/RDTool running on there will read from efuse, if anything. ref: https://www.elektroda.com/rtvforum/topic4097544-30.html#21488380

efuses appears to be not readable in my plug either. But why they are important? We already can read and write firmware, so that means there is no encryption anyway.

ah just in case there's anything in there that may relate to the encrypted Tuya config stuff from 0x1D5000

Added after 10 [minutes]:

miegapele wrote:

efuses appears to be not readable in my plug either.

but did you try with AT? https://www.elektroda.com/rtvforum/topic4097544-30.html#21488364

What is AT?

well, I assume the Skylab firmware that came on the WG236 modules can be used in conjunction with RDTool to read the efuse. @insmod could maybe elaborate...?

https://github.com/openshwprojects/FlashDumps/tree/main/IoT/ECR6600

My plan was to get one of these real Tuya devices using ECR6600, flash the WG236 firmware to it, then try reading efuse config in RDTool. Dunno if that's worth a try. Also, are the right UARTs even accessible on this plug with its limited number of test pads. Might not even be possible without a lot of effort I guess.

It seems you can read efuses by just modifying firmware to do that.
My plug has first 21 bytes set to something, others are 0.


It's hard to understand what this is. Looks like some chip config/calibration, not likely to be any sort of encryption keys

Oh cool. Nice. Can I ask what address(es) this was done at? If that's a valid question...

These are first 21 bytes as read by basically this.
So basically addresses 0x00 to 0x14 as I understand.

miegapele wrote:

Might be easy to flash, 5 pads, could be VCC, GND, TX, RX, BOOT

Hello, guys.
May I ask you is that fifth pad put aside of row of others really boot pad?
If yes, could you please advise how to use it to upload firmware to the chip?
If not then how put chip to program mode to upload new firmware? I read about "reset (ground CEN/RST) or power-on 3.3V to the device" but really do not understand it. Where is that cen/rst pin is or how can I power-on it when it is always under power. Sorry for dilettantish question. I'm really confused with this chip.
Thanks.

Quote:

May I ask you is that fifth pad put aside of row of others really boot pad?

I can trace it shortly, but it is not needed to backup and program the flash.

Quote:

If yes, could you please advise how to use it to upload firmware to the chip?

backup and flash procedure https://www.elektroda.com/rtvforum/topic4111822.html

Added after 18 [minutes]:

it's pin 26

Thank you for your info.
I checked by multimeter and mentioned pad is shorted to 26 pin of chip. So I used it to program flash. As described under link you provided I shortly connected that pad to GND right after programming start. I don't know was it the reason but now BurnTool gives errors sync failed and download failed (log below for two bin-files).

ECR6600F_standalone_allinone.bin
2025-04-12 21:53:03.341 INFO PARSE_AIO: find 5 bin in all-in-one file
2025-04-12 21:53:03.341 INFO PARSE_AIO: get file 0 info: dlType: 0 startAddr: 0x10000 len: 0x28e4
2025-04-12 21:53:03.341 INFO PARSE_AIO: get file 1 info: dlType: 2 startAddr: 0x00 len: 0x1000
2025-04-12 21:53:03.341 INFO PARSE_AIO: get file 2 info: dlType: 2 startAddr: 0x1000 len: 0x4dd0
2025-04-12 21:53:03.341 INFO PARSE_AIO: get file 3 info: dlType: 2 startAddr: 0x7000 len: 0xab1d4
2025-04-12 21:53:03.353 INFO PARSE_AIO: get file 4 info: dlType: 2 startAddr: 0x1fb000 len: 0x3000
2025-04-12 21:53:04.345 ERROR sync failed!
2025-04-12 21:53:04.463 ERROR download failed!

OpenECR6600_1.18.76.bin
2025-04-12 21:53:42.779 INFO PARSE_AIO: find 4 bin in all-in-one file
2025-04-12 21:53:42.779 INFO PARSE_AIO: get file 0 info: dlType: 0 startAddr: 0x10000 len: 0x3704
2025-04-12 21:53:42.780 INFO PARSE_AIO: get file 1 info: dlType: 2 startAddr: 0x00 len: 0x1000
2025-04-12 21:53:42.780 INFO PARSE_AIO: get file 2 info: dlType: 2 startAddr: 0x1000 len: 0x4fe8
2025-04-12 21:53:42.781 INFO PARSE_AIO: get file 3 info: dlType: 2 startAddr: 0x7000 len: 0xaf6c4
2025-04-12 21:53:43.800 ERROR sync failed!
2025-04-12 21:53:43.909 ERROR download failed!

Maybe someone met such situation and can advise how to overcome?

BTW. Before that I, seems, successfully uploaded file ECR6600F_standalone_allinone.bin to the chip without usage of RST pin. Just clicking "start" button in BurnTool.
I noted new wifi appeared instead of previous one. Now it has CMQLINK-590488-38ca. I'm able to connect to it. But don't know to which IP-address to go to open any site. Lan scan doesn't help.
Does anyone know is there any use for that change?
Thanks in advance.

>>21517031
No advice. So I moved forward alone and reached success.
Two secrets helped me in this.
1) I just clicked button "Start" of RDTool again and again
2) After click wait 1 second, connect RST to GND and disconnect immediately. When you will lucky download (as for me it is more upload than download but ok, let it be called download, what confused a lot nevertheless) file OpenECR6600_1.18.76.bin will start and finish successfully.
Btw. I found much more convenient location to touch RST to GND See picture below.

Hope all is clear.
Going that way I successfully reprogrammed the socket, connected to it via WiFi, configured its WiFi connection and accessed to it via my home lan. Thanks to all who helped me to reach this result.

Now the question, if you allow.
AFAIK this socket has power meter. Could anyone clarify me how to use it?
Thanks in advance.

Glad you got there in the end. BL0937 support was added in v1.18.61 so if you are on that version or higher simply importing the template or settings pin as below for this device and rebooting should be enough

>>21521656
Thank you. It works. Now I see status of electricity on socket site and MQTT messages.
Thank you.
I'm pretty sure more questions will happen. But later.
Thanks again.

How do these TNCE plugins from ECR660 vs the older ones on BK7321 perform with the original firmware on tuya cloud? How about the wifi coverage? Is it actually better on this Wifi 6. That antenna printed flat on the PCB somehow doesn't encourage The power consumption meter is reasonably accurate?
EDIT: The plug has now arrived. Looks like I got the same as the subject author. Bought a 16A plug but got a 20A one. The wattmeter seems to work ok , However, the wattmeter readings are worse than those on the Aubess and on such a normal meter without wifi.
The socket opens them very easily because they are only lightly glued. In the promos on aliexpress in the combined offers tab for about 9zł each were.
Wattmeter readings after 24 hours from the same socket
Silvercrest 1.41 kWh
TNCE 1.46kWh
Aubess 1.38kWh
This shows that after subtracting the consumption of the 2 smart sockets (approx. 0.03 kWh/24h) the Aubess has virtually identical readings with the Silvercrest wattmeter. It assumes an intake of about 0.7w per socket. The TNCE socket overestimates the consumption a little. It also shows a higher mains voltage than the Silvercrest and Aubess.

.
.
.
.

WiFi from tasmotized ECR6600 is not great. I have 3 plugs with uploaded Tasmota, and often they have issues with connect to my MikroTik routers after restart. I have also many older smart plugs, and multiple other IoT devices based on ESP32/8266, and they connect without any issues...

are you running latest release of OpenECR6600?

divadiow wrote:

are you running latest release of OpenECR6600?

Thanks, it seems the latest version 1.18.158 has fixed it