logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[ECR6600 ] Teardown and OpenBeken Conversion of TNCE TUYA Smart Plug WiFi from AliExpress

djbios 4356 28

TL;DR

  • TNCE TUYA Smart Plug WiFi from AliExpress was torn down and converted from unstable Tuya firmware to OpenBeken.
  • The PCB uses an ECR6600 SoC with a BL0937CF measurement chip, and it has convenient back pads for UART flashing.
  • The plug cost 5 euros, and the flash used ESWIN_ECR6600_RDTool_v1.0.21 with OpenECR6600_1.18.62.bin.
  • After flashing, the device ran free firmware and started a Wi‑Fi hotspot, though syncing sometimes needed repeated power-on timing attempts.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • Laboratory power supply and prototype board on a glass desk.
    Hi all! Let me share my teardown of TNCE TUYA Smart Plug WiFi I recently bought on AliExpress for 5 euros. The original Tuya firmware was pretty unstable and I decided to covert it to OpenBeken. Luckily, OpenBeken supports ECR6600 platform so it was possible to flash it via UART. I'll show the flashing process here step by step.

    Here is the look of the device
    A person holding a white electrical adapter with a Schuko socket on a dark background.
    Electrical adapter held in a hand.
    Smart electric socket in gray with a visible power button.
    Travel adapter with two pins on a dark background.

    To open up the device without much damage I used a vice: slightly squeezing from both sides till the little crack sound allows to crack the glue and split the plastic into 2 parts

    Electrical socket adapter with an on/off switch.

    Then removing one little screw allows to extract the PCB


    Open plug with visible interior.
    A circuit board held in hand with various electronic components.
    Close-up of a blue printed circuit board with visible electronic components.
    Close-up photo of a blue circuit board with electronic components and the inscription ESWIN.
    A printed circuit board with electronic components held in a hand.
    Blue circuit board with a mounted relay.
    Blue circuit board with a lever switch on a black background.

    We can see that the socket is built on the basis of ECR6600, which OpenBeken recently supported. To measure the voltage/current they use BL0937CF.

    On the back of the PCB, there are convenient pads to solder the USB-UART adapter

    Electronic circuit with JIEYING relay and connected wires.

    Then we need an external 3.3V power source, I used an adjustable lab one

    Laboratory power supply and prototype board on a glass desk.

    I used this guide https://www.elektroda.com/rtvforum/topic4111822.html to flash the firmware, in a nutshell you need to:
    1) Download ESWIN_ECR6600_RDTool_v1.0.21.zip from here https://github.com/openshwprojects/FlashTools/tree/main/TransaSemi-ESWIN and use RDTool.exe
    2) In RDTool you double click "develop tool" tab, select the COM port, and on "all-in-one file path" select the firmware from latest release https://github.com/openshwprojects/OpenBK7231T_App/releases/ (ECR6600 UART Flash) - I used OpenECR6600_1.18.62.bin
    3) Then you need to click start and enable the power source of a device. You might not get in sync from the first attempt (there is some very specific timing, smth like 0.5 sec to power device after start clicked) - that's okay, you will succeed eventually.
    4) After the program finishes the flashing - you all set, the device runs free firmware now.

    Now you can unsolder the wires, put PCB back in a case and try to put it in the socket. WiFi hotspot should be running now.

    The pins configuration is:

    Code: JSON
    Log in, to see the code


    UPD: Attached the original firmware

    Enjoy!
    AI: Did you encounter any specific issues or challenges during the teardown or firmware conversion process?
    No, just needed to collect the info from different sources
    AI: How familiar are you with similar teardown and firmware flashing processes?
    A bit
    Attachments:
    • ECR6600_tuya_socket.bin (2 MB) You must be logged in to download this attachment.

    Cool? Ranking DIY
    About Author
    djbios
    Level 2  
    Offline 
    djbios wrote 2 posts with rating 8. Been with us since 2025 year.
  • ADVERTISEMENT
  • #2 21486307
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14440
    Help: 650
    Rate: 12410
    Thank you for sharing! It's good to see that ECR6600 support is being useful for our users. Did you see that, @divadiow @insmod ? You did good job with research and porting.

    Did you try some other drivers as well, like NTP or SSDP?

    I think we also may need to look into powersave feature for such plugs, I've already seen one with broken capacitor due to the too high current consumption.

    Interestingly enough, I've received a very similar plug just yesterday, but it was T34-based and not ECR6600: https://www.elektroda.com/rtvforum/topic4112776.html
    Helpful post? Buy me a coffee.
  • #3 21486425
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    p.kaczmarek2 wrote:
    Did you see that, @divadiow @insmod ? You did good job with research and porting.

    😁😁

    are you finding wifi is OK @djbios?

    what's your RSSI shown in OBK? what's the distance from device to router/AP? what speed has it connected (if your router tells you)?

    Added after 14 [minutes]:

    I thought I'd submitted the previous one of these for the device list. I guess not. https://www.elektroda.com/rtvforum/topic4111822.html#21480857

    Also, did you miss the LED @djbios - P22?

    https://github.com/OpenBekenIOT/webapp/pull/187
  • #4 21486794
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14440
    Help: 650
    Rate: 12410
    @divadiow how many ECRs did you have with WiFi problems?
    Helpful post? Buy me a coffee.
  • #5 21486822
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    only the WG236 modules in testing. Same as @insmod. I don't have a real ECR6600 device yet.
  • ADVERTISEMENT
  • #6 21486846
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14440
    Help: 650
    Rate: 12410
    Did they come blank by default or with AT firmware? Is there a RF-calibration utility in the SDK?
    Helpful post? Buy me a coffee.
  • #7 21486856
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    They come with something on. It feels more likely it's a calib issue with the WG236 modules specifically, yes. I'll take a fresh look this evening. I have already transplanted RF nv partition from Tuya firmware to module to no effect.
  • #8 21503392
    jannie_doedel
    Level 2  
    Posts: 9
    Rate: 2
    works like a charme !!
    Tried to load NTP and worksfine too.
    Only chip temp is 0.0. Without config it showed 44 degrees.
    Display showing energy consumption data and parameters of the OpenECR6600 device.
    What is the pin for wifiled ?
  • #9 21503405
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    divadiow wrote:
    Also, did you miss the LED @djbios - P22?

    this one maybe?

    Added after 52 [seconds]:

    template in device list is

    Code: JSON
    Log in, to see the code
  • #10 21503446
    jannie_doedel
    Level 2  
    Posts: 9
    Rate: 2
    >>21503405
    Yes thats the one.
    Thx !

    Added after 2 [minutes]:

    >>21503392
    The temperature indication must have been a glitch as it is working now
  • #11 21503467
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    >>21503446 Not a glitch, on your screenshot there are 2 incomplete boots. If more than one - internal temperature readout is disabled.
  • #13 21637258
    mlb
    Level 12  
    Posts: 22
    Help: 1
    It worked! :)
    I've modified 3 plugs successfully. The small challenge is indeed to turn power supply in a blink of an eye after pressing the start button in RDTool. Another issue I've noticed with the current firmware version is the Home Assistant discovery does not recognize this Tasmota instance, while the messages in MQTT seem correct. Nevertheless, a success, thanks for your work to make it possible!
  • #14 21640559
    mlb
    Level 12  
    Posts: 22
    Help: 1
    After trying to use those plugs for a few days, unfortunately I've discovered recurring wifi issues.
    They existed before uploading the new firmware, so I guess this is related to faulty wifi in ECR6600 chip. I have many other smart plugs like that I've bought in the past, and they all work well, only the new with ECR6600 is problematic.
    Problems start if you have more than one of those plugs located close to each other. Then, only one smart plug will connect to wifi, others will keep trying forever. And, it is random which plug connects first... It was fun to play with those, but because of unreliable wifi - I would not recommend wasting your money on it.
  • #15 21640570
    divadiow
    Level 38  
    Posts: 4878
    Help: 427
    Rate: 868
    maybe they have the same mac address. Do they each connect fine, in turn, if only one is switched on at any one time?

    I flashed my EU ECR6600 smart plug last night and mac is generic/0s, but I did erase whole flash before flashing OpenECR6000

    Screenshot showing ECR6600 device info with MAC address 00:06:06:00:00:00

    Added after 9 [minutes]:

    seems manual mac address change feature works for ECR6600

    Network interface showing IP 192.168.1.114 and MAC 00:06:01:23:00:00
  • #16 21642454
    kennyyzm
    Level 2  
    Posts: 3
    Hi guys, I have the same smart plug but I was not able to either backup old firmware not flash a new one. I keep getting RECV_RSP: recv timeout: recv length is: 1 (sometimes it's 3).

    RDTool window showing RECV_RSP error during firmware flashing process.

    Can someone help please? I have no idea what's that error about...
  • ADVERTISEMENT
  • #17 21642461
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14440
    Help: 650
    Rate: 12410
    So, how do you connect UART to your plug? Can you share some photos?
    Helpful post? Buy me a coffee.
  • #18 21642470
    kennyyzm
    Level 2  
    Posts: 3
    Here's the photo, I broke both TX and RX pads and resorted to use the copper trace for both.

    Electronic boards connected with wires on a cluttered desk with tools, glasses, and paper notes.
  • #19 21642476
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14440
    Help: 650
    Rate: 12410
    Well, first of all, you need to have a common ground between power supply and the UART... if you use external power supply, GND must connect to both external power supply GND and USB to UART converter GND.
    Helpful post? Buy me a coffee.
  • #20 21642493
    kennyyzm
    Level 2  
    Posts: 3
    @p.kaczmarek2 Wow, it works right away. Thanks for your help. I thought it's not possible to flash it anymore since I broke the pads, hehe, Thanks again!
  • #21 21644658
    mlb
    Level 12  
    Posts: 22
    Help: 1
    divadiow wrote:
    maybe they have the same mac address. Do they each connect fine, in turn, if only one is switched on at any one time? 


    Yeah I've checked that too.... Nope, they have original, distinct MAC addresses. In my router logs I can just see them connecting sometimes, trying to authenticate (the network has WPA2 security), retrying a few times, then giving up. I do have pretty crowded wifi for IoT devices, with mesh/roaming and VLAN enabled, maybe that's why. Just other devices do not have such issues, it takes them a few seconds at most to connect successfully. Some of them are smart plugs too, a bit older generation, still working fine with Localtuya.
  • #22 21743995
    Tilator
    Level 12  
    Posts: 130
    Help: 2
    Rate: 13
    I got one more these devices. BK7231Flasher seems to have this now available. However backuping old FW did not work. I had to use Eswin tool.

    Flashing new FW went well with BK7231Flasher, but it was not able to extract Tuya settings from the old FW. Did I something wrong? I took bup starting with address 0x0. Should it be something else? I took it twice and got exactly same file.

    Here you have it:
    Attachments:
    • Eswin_6600.bin (2 MB) You must be logged in to download this attachment.
  • #23 21744010
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    >>21743995
    What exactly went wrong with backup via BK7231Flasher? Did it not sync, or was it something else?
    Regarding Tuya settings, they are always encrypted, and we know default keys for standard Tuya chips. But on some of them, either encryption keys are different (RTL8720D and RTL8711AM, both are known), or the method itself.
    It's not known how to decrypt config on ECR6600, TR6260, W800, RTL8720CM (not CF), BK7252.

    I tried brute-forcing the key on TR6260 (with 4 bytes only in ASCII range), but i did not succeed.
  • #24 21744012
    Tilator
    Level 12  
    Posts: 130
    Help: 2
    Rate: 13
    insmod wrote:
    What exactly went wrong with backup via BK7231Flasher? Did it not sync, or was it something else?


    I do not remember it fully any more, but it went well until it started to read address 0x0. Then it just waited a second or two and told it was not succesful.

    However I noticed just afterwards, I had TTL adapter set to 1,8V. I have a Snapdragon based other device I had used it before and forgot to check it. Even having this voltage setting flashing new FW with BKflasher went just OK. Also backup I made with Eswin tool at least starts same as the FW attached to the first message here.

    Added after 11 [hours] 21 [minutes]:

    insmod wrote:
    It's not known how to decrypt config on ECR6600, TR6260, W800, RTL8720CM (not CF), BK7252.


    Just afterwards I noticed, Eswin RDTool has tabs "download", "flash", "command" and "nv". Last one sounds like "non volatile" and some kind of tool to those settings. Unfortunately I already flashed the device with new FW and testing this would take reversing it back to original FW.

    Have you tested if this "nv" section can do the trick? And if it can, would it be possible to find the missing decrypt key from the RDTool itself?
  • ADVERTISEMENT
  • #25 21744765
    insmod
    Level 31  
    Posts: 1356
    Help: 161
    Rate: 426
    >>21744012
    No, nv is for things like config, flash vars, or partition table, not for tuya config.
  • #26 21745196
    Tilator
    Level 12  
    Posts: 130
    Help: 2
    Rate: 13
    One more thing considering this device. There seems to be a bit confusion on the config page.

    I suppose RX0 and TX0 are not ment to be there twice. See Pins 5,6,21 and 22.
    Microcontroller pin assignment screen with channel labels and options visible.
  • #27 21823082
    avgapon
    Level 2  
    Posts: 9
    IMO, it would have been good if you could update the instructions in this topic to include the firmware backup step.
    I followed the instructions, so I didn't backup and now I have a slight concern that I might have lost something.
  • #28 21894156
    kfpv
    Level 2  
    Posts: 2
    They seem to have updated the PCB and now use a T34 chip. Unlike the other T34 posts I've seen this one doesn't even have visible pins. It's a shame because it used to be one of the easiest to flash and now it's very complicated. Does anyone have ideas how to flash it without desoldering the chip?
    Attachments:
    • [ECR6600 ] Teardown and OpenBeken Conversion of TNCE TUYA Smart Plug WiFi from AliExpress d7ce3f77-8fb0-4de5-8bcc-6b402cfdae19.jpeg (740.86 KB) You must be logged in to download this attachment.
    • [ECR6600 ] Teardown and OpenBeken Conversion of TNCE TUYA Smart Plug WiFi from AliExpress bf358220-bc03-4aad-8590-c65d959192fa.jpeg (356.77 KB) You must be logged in to download this attachment.
    • [ECR6600 ] Teardown and OpenBeken Conversion of TNCE TUYA Smart Plug WiFi from AliExpress f5415dc6-fffa-4348-a29f-2aceb8c230db.jpeg (660.14 KB) You must be logged in to download this attachment.
  • #29 21894189
    avgapon
    Level 2  
    Posts: 9
    >>21894156
    That's a completely different product then and you should find the appropriate topic for it (T34 + BL0942).
    The device is quite easy to flash by connecting to pins of the power monitoring chip and the nearby voltage regulator.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ A teardown and firmware conversion of the TNCE TUYA Smart Plug WiFi purchased from AliExpress was performed, focusing on replacing the unstable original Tuya firmware with OpenBeken firmware. The device is based on the ECR6600 platform, which supports flashing via UART. The disassembly method involved carefully cracking the glued plastic casing using a vice and removing a single screw to access the internals. Discussion highlighted the successful use of OpenBeken on this platform, including loading additional drivers such as NTP and SSDP. WiFi performance metrics like RSSI and connection speed were queried, with mention of a WiFi LED connected to pin P22. Temperature sensor readings initially showed glitches due to incomplete boots but stabilized after multiple restarts. Some users noted power consumption concerns related to capacitor failures in similar plugs and compared the ECR6600-based device to a T34-based variant. Firmware details, boot logs, and product IDs were shared, with references to RF calibration challenges on WG236 modules and the transplantation of RF non-volatile partitions from Tuya firmware without improvement. A device template listing pin assignments for components such as BL0937 energy metering IC, WiFi LED, button, and relay was provided.
Generated by the language model.
Today's popular

FAQ

TL;DR: For users converting a €5 AliExpress TNCE smart plug, this FAQ shows how to open it, wire 3.3V UART, and flash OpenBeken on ECR6600. The key practical lesson is: "common ground" and fast power-on timing solve most RDTool failures. [#21642493]

Why it matters: This thread turns scattered teardown, flashing, and troubleshooting notes into a single reusable procedure for ECR6600-based Tuya plugs.

Option Flashing OpenBeken Backup old firmware Tuya settings extraction
ESWIN RDTool Works on this plug Works for multiple users Not shown to extract Tuya config
BK7231Flasher Works for flashing on some units Failed for at least one backup case Did not extract Tuya settings

Key insight: Most failures were not caused by OpenBeken itself. They came from wiring mistakes, missing shared ground, or the narrow timing window when RDTool waits for the ECR6600 bootloader.

Quick Facts

  • The original poster bought the TNCE Tuya Smart Plug on AliExpress for 5 euros and converted it from unstable Tuya firmware to OpenBeken. [#21485550]
  • The plug uses an ECR6600 Wi-Fi platform and a BL0937CF metering chip, with UART flashing powered from an external 3.3V supply. [#21485550]
  • A practical sync window exists: users reported the plug may only enter flashing mode if power is applied about 0.5 seconds after pressing Start in RDTool. [#21485550]
  • Temperature reporting showed 44 degrees before config on one unit, then 0.0 after incomplete boots, and later returned to normal. [#21503392]
  • One failed BK7231Flasher backup attempt happened with the USB-TTL adapter accidentally set to 1.8V, while flashing still succeeded afterward. [#21744012]

How do I open the TNCE Tuya Smart Plug from AliExpress without damaging the plastic case or PCB?

Open it by gently squeezing both sides in a vice until the glue cracks, then split the plastic shell into 2 halves. After that, remove the single small screw and lift out the PCB. This method was reported to open the case with little damage to either the enclosure or board. [#21485550]

What is the step-by-step process to flash OpenBeken onto an ECR6600-based Tuya smart plug using ESWIN_ECR6600_RDTool?

Use RDTool with UART Flash firmware for ECR6600. 1. Download ESWIN_ECR6600_RDTool_v1.0.21 and load the latest OpenECR6600 UART Flash .bin. 2. Select the correct COM port, double-click the develop tool tab, then press Start. 3. Apply external 3.3V power immediately after Start; if sync fails, retry the timing until flashing completes. [#21485550]

Why does RDTool show "RECV_RSP: recv timeout" when trying to back up or flash an ECR6600 plug, and how can I fix it?

RDTool usually times out because the UART wiring or power reference is wrong. One successful fix was adding a shared ground between the external power supply and the USB-UART adapter. Another common cause is boot timing; the plug may need power about 0.5 seconds after clicking Start. [#21642476]

How should I wire the USB-UART adapter and external 3.3V power supply to the ECR6600 smart plug, including the common ground connection?

Wire TX, RX, and GND to the PCB pads, then power the plug from an external 3.3V source. The critical rule is that the USB-UART adapter and the external supply must share the same ground. One user fixed instant failures only after connecting GND to both the power supply and the UART converter. [#21642476]

What pin configuration works for the TNCE Tuya Smart Plug with ECR6600, relay, button, BL0937CF power metering, and WiFi LED?

A working OpenBeken template is P14 BL0937CF, P15 BL0937SEL, P20 BL0937CF1, P22 WifiLED, P24 Btn, and P25 Rel. The first published template omitted the LED, but later replies confirmed P22 for the WiFi LED. That 6-pin mapping is the most complete config shown for this plug. [#21503405]

Where is the WiFi LED connected on this ECR6600 smart plug, and how should it be configured in OpenBeken?

The WiFi LED is on pin P22 and should be configured as WifiLED;0 in OpenBeken. A later reply corrected the earlier template and matched the device-list entry for this model. If the LED is missing after flashing, P22 is the first pin to check. [#21503405]

What is BL0937CF, and how does it measure voltage and current in Tuya smart plugs?

BL0937CF is a power-metering chip that measures the plug’s electrical values and exposes them through CF, CF1, and SEL pins. In this plug, the board uses BL0937CF for voltage and current measurement, and the published OpenBeken map assigns P14, P15, and P20 to those metering signals. [#21485550]

What is ESWIN RDTool, and when should I use it instead of BK7231Flasher for ECR6600 devices?

ESWIN RDTool is the vendor flashing utility used to communicate with ECR6600 devices over UART, load firmware images, and perform operations such as backup and flashing. Use it when BK7231Flasher cannot back up the chip or cannot recover Tuya data. In this thread, RDTool was the original working method and also succeeded where BK backup failed. [#21485550]

BK7231Flasher vs ESWIN RDTool for ECR6600 plugs: which one works better for backup, flashing, and extracting Tuya settings?

ESWIN RDTool worked better overall in this thread. Users flashed successfully with both tools, but one user could not back up old firmware with BK7231Flasher and had to switch to ESWIN. The same user also reported BK7231Flasher could not extract Tuya settings from the old firmware image. [#21743995]

Why does the ECR6600 plug sometimes fail to sync unless power is applied right after pressing Start in RDTool?

The bootloader appears to expose only a short entry window at power-up. The original guide says the correct timing is very specific, around 0.5 seconds after pressing Start, and repeated attempts may be needed before the tool syncs. Users later confirmed this narrow timing is a real flashing challenge on these plugs. [#21637258]

How does OpenBeken behave with NTP, SSDP, and chip temperature reporting on ECR6600 smart plugs?

NTP was confirmed working on this plug after conversion. SSDP was only suggested for testing in the discussion, so the thread does not confirm its result. Chip temperature can read normally, but one user saw 44 degrees before config and later 0.0 during abnormal boot behavior. [#21503392]

Why does chip temperature show 0.0 on OpenBeken after incomplete boots, and how can I restore the normal reading?

Chip temperature shows 0.0 because repeated incomplete boots disable the internal temperature readout. A developer explained that if there is more than one incomplete boot, the internal sensor is turned off. Restore normal reading by fixing the boot stability issue and letting the device complete a clean boot cycle. [#21503467]

What could cause recurring WiFi connection problems on multiple ECR6600 smart plugs placed close together, even when their MAC addresses are different?

The thread points to ECR6600 Wi-Fi instability under crowded conditions. One user reported that when several plugs were close together, only one would connect and the others kept retrying. Another check ruled out duplicate MAC addresses, and the failing network used WPA2, mesh roaming, VLANs, and many IoT clients. [#21644658]

How can I back up the original Tuya firmware from an ECR6600 smart plug before flashing OpenBeken, and which addresses or tools should I use?

Back up the original firmware before flashing, and prefer ESWIN RDTool if BK7231Flasher fails. One later user explicitly asked for the instructions to include backup because skipping it caused concern after flashing. Another user read from address 0x0, got a repeatable dump, and confirmed ESWIN backup matched the original firmware structure. [#21823082]

Why are RX0 and TX0 shown twice on the ECR6600 config page, and which UART pins are the correct ones to use?

The duplicate RX0 and TX0 entries appear to be a config-page labeling issue, not a second usable UART pair. A later post noted the duplication on pins 5, 6, 21, and 22 and questioned it directly. For flashing this plug, users relied on the actual PCB UART pads shown on the board back side, not the duplicated labels. [#21745196]
Generated by the language model.
ADVERTISEMENT