logo elektroda
logo elektroda
X
logo elektroda

[BK7231N] Konyks Priska FR Smart Plug - Teardown & Flashing OpenBK

hairdresser06 264 4
ADVERTISEMENT
  • Helpful post
    #1 21443038
    hairdresser06
    Level 3  
    Hi there!

    I was given a pair of Konyks Priska FR, Smart Plug with integrated 16A energy meter (https://konyks.com/produit/priska-fr-dual-pack/).:
    Konyks Priska FR smart plug showing technical specifications on its casing.

    They work with Smart Life - so a Tuya based device.

    So wanted to participate to the OpenBK adventure and being a massive adopter of Tasmota, enter the OpenBK adventure.

    For the first plug, I cut the "female" part (top) - but this is not necessary. So don't do that !
    What you just need is to access the 3 pins GND/RX/TX of the CB2S (BK7231N) board.
    This can be achieved by cutting a small plastic area - as per picture below:

    Close-up of a Konyks Priska FR smart plug with visible wires connected to its pins.

    Attaching a simple serial-TTL confirms the chip is well recognized, after keeping the button selected pushed twice, until the blue led blinks slowly.

    Pin connection diagram to an electrical socket showing pin view.

    
    root@ubuntu:/work/bk7231tools# python3 -m bk7231tools chip_info -d /dev/ttyUSB0
    BK72xx connected - protocol: FULL, chip: BK7231N, bootloader: BK7231N_1_0_1, chip ID: 0x7231c, boot version: None
    Connected! Chip info: BK7231N / Flash ID: eb 60 15 / Flash size: 0x200000 / Protocol: FULL
    


    Dumping the content of the flash - just in case:

    
    root@ubuntu:/work/bk7231tools# python3 -m bk7231tools read_flash -d /dev/ttyUSB0 -s 0 dump2.bin
    this may result in unpredictable behaviour
    BK72xx connected - protocol: FULL, chip: BK7231N, bootloader: BK7231N_1_0_1, chip ID: 0x7231c, boot version: None
    Connected! Chip info: BK7231N / Flash ID: eb 60 15 / Flash size: 0x200000 / Protocol: FULL
    Reading 2097152 bytes from 0x0
    Reading 4k page at 0x000000 (0.00%)
    Reading 4k page at 0x001000 (0.20%)
    ...
    Reading 4k page at 0x1FF000 (99.80%)
    


    And finally, flashing OpenBK:

    
    root@ubuntu:/work/bk7231tools# python3 -m bk7231tools write_flash -d /dev/ttyUSB0 -s 0 -B ../OpenBK7231N_QIO_1.18.37.bin
    BK72xx connected - protocol: FULL, chip: BK7231N, bootloader: BK7231N_1_0_1, chip ID: 0x7231c, boot version: None
    Connected! Chip info: BK7231N / Flash ID: eb 60 15 / Flash size: 0x200000 / Protocol: FULL
    Writing 1220464 bytes to 0x0
    Trying to unprotect flash memory...
    Erasing and writing at 0x0 (0.00%)
     - Checking block pre-erase @ 0x0
     - Trying to erase block @ 0x0
     - Checking block post-erase @ 0x0
     - Erase succeeded @ 0x0
    Erasing and writing at 0x1000 (0.34%)
    Erasing and writing at 0x2000 (0.67%)
    ...
    Erasing at 0x128000 (99.34%)
    Erasing and writing at 0x129000 (99.68%)
    OK!
    


    Now, disconnect the device from power - wait ~ 10 seconds - and replug it. The OpenBK wifi SSID can be found :)

    Here is the template:

    
    {
      "vendor": "Konyks",
      "bDetailed": "0",
      "name": "Konyks Priska FR",
      "model": "Priska",
      "chip": "BK7231N",
      "board": "CB2S",
      "flags": "1024",
      "keywords": [
        "konyks",
        "priska"
      ],
      "pins": {
        "6": "BL0937CF;0",
        "7": "BL0937CF1;0",
        "8": "Rel;1",
        "10": "WifiLED_n;0",
        "11": "LED_n;1",
        "24": "Btn;1",
        "26": "BL0937SEL;0"
      },
      "command": "",
      "image": "https://obrazki.elektroda.pl/8439438700_1739645788.jpg",
      "wiki": "https://www.elektroda.com/rtvforum/viewtopic.php?p=21443038#21443038"
    }
    

    Pin connection diagram to an electrical socket showing pin view.
  • ADVERTISEMENT
  • #2 21443316
    p.kaczmarek2
    Moderator Smart Home
    Thank you for sharing. I see you've even filled template correctly, that's nice, I can easily add this device to our teardowns list here:
    https://openbekeniot.github.io/webapp/devicesList.html

    By the way, we're working on Powersave for BL0937, I'll let you know soon once it's ready. The old PowerSave was affecting BL0937 measurements and caused precision loss, but we're going to make RF-only powersave (without MCU sleep bit) that works good with BL0937 and still can prolong life of such plugs as yours.

    Added after 1 [minutes]:

    PS: This is a creative method of flashing pins access:

    View of an electrical plug with exposed pin access and connected wires.
    I did the same for one batch of plugs that were very hard to open.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #3 21443349
    hairdresser06
    Level 3  
    Thanks!

    I forgot to add that the firmware was not vulnerable to known techniques used by cloudcutter.
    So no other path than going with the Iron!
  • ADVERTISEMENT
  • #4 21443351
    p.kaczmarek2
    Moderator Smart Home
    I don't think it's much of a problem, we have lots of soldering guides for beginners on our Elektroda Youtube channel:
    https://www.youtube.com/watch?v=L6d42IMGhHw&list=PLzbXEc2ebpH0CZDbczAXT94BuSGrd_GoM
    I think that soldering wires to BK7231 module should be relatively easily for beginners as long as they have even a cheapest soldering iron and some leaded solder and flux. Last time I checked, it was possible to even get a soldering iron for literally few $ from China.
    Helpful post? Buy me a coffee.
  • #5 21443353
    hairdresser06
    Level 3  
    yes not a problem, but I just wanted to highlight that - so that anyone with the same plugs won't waste their time trying this like I did :-)
ADVERTISEMENT