Yet another LSPA9-type EU smart plug, but this one's a little more interesting, so worthy of a post I thought. Bought from the Farylink (of FL-xx module and device fame) store on Ali Express, this variant has a BL0937 metering chip and was advertised as being capable of handling 20A at 100-240V.
https://www.aliexpress.com/item/1005007992846991.html
Initial observations are that is comes in very familiar generic product boxing and that the glue holding this one together was not very strong or was used sparingly, requiring only mild spudger attack techniques to break open.
one screw holds the main PCB to the chassis and a blob of glue stabilises one corner. Will the screw removed, the whole inside will slide out with a little downward force on the main power prongs while holding the case.
We see our Belling BL0937, a Yongwei Y3F-105DM 16A @28/125/250VAC relay (even though I ordered the 20A), Bright Power BP2525 step down 85Vac~265Vac to 3.3v converter chip and a WR2E Realtek RTL8710BX module. 2mb flash on the rear of the module courtesy of a GigaDevice 25Q16CSJG SOP8 flash IC.
Module de-soldered
Boot log from TX2/PA30
Soldered ready for dumping/flashing. PA29 and PA30 are very small so require a little care. I also opted for some flexible copper jumper wires to allow for a little more give when under any pressure while being moved/connected up. I've torn off a few pads before with rigid dupont ends.
The needle is my handy ground, required on TX2 at power-on get RTL8710B into correct boot mode.
Using our AmebaZ family rtltool (credits to pvvx) from the Flashtools repo we can dump the whole factory firmware to file
and then flash OpenRTL to the OTA1 address 0x00B000
and on next boot
thankfully the boot log already lists our pin assignments
It even contains the BL0937 calibration but we'll need to manually calibrate OpenRTL from the web app GUI later.
So the OpenBeken/RTL template is
(power not calibrated yet)
Module soldered back ready for complete reassembly
firmware backup will land at https://github.com/openshwprojects/FlashDumps/tree/main/IoT/RTL8710BX as Tuya_Generic_EU_Plug_(schemaID-e1kt0gdk)_keydnqmh87c8ajv4_d182tgb7if9myzx9_WR2E_1.1.6.bin
https://github.com/OpenBekenIOT/webapp/commit/66961cb30c9de8c5b408dc0e4727dfc6260aed35
https://www.aliexpress.com/item/1005007992846991.html
Initial observations are that is comes in very familiar generic product boxing and that the glue holding this one together was not very strong or was used sparingly, requiring only mild spudger attack techniques to break open.
one screw holds the main PCB to the chassis and a blob of glue stabilises one corner. Will the screw removed, the whole inside will slide out with a little downward force on the main power prongs while holding the case.
We see our Belling BL0937, a Yongwei Y3F-105DM 16A @28/125/250VAC relay (even though I ordered the 20A), Bright Power BP2525 step down 85Vac~265Vac to 3.3v converter chip and a WR2E Realtek RTL8710BX module. 2mb flash on the rear of the module courtesy of a GigaDevice 25Q16CSJG SOP8 flash IC.
Module de-soldered
Boot log from TX2/PA30
Code: Text
Log in, to see the code
Soldered ready for dumping/flashing. PA29 and PA30 are very small so require a little care. I also opted for some flexible copper jumper wires to allow for a little more give when under any pressure while being moved/connected up. I've torn off a few pads before with rigid dupont ends.
The needle is my handy ground, required on TX2 at power-on get RTL8710B into correct boot mode.
Using our AmebaZ family rtltool (credits to pvvx) from the Flashtools repo we can dump the whole factory firmware to file
and then flash OpenRTL to the OTA1 address 0x00B000
and on next boot
thankfully the boot log already lists our pin assignments
Code: Text
Log in, to see the code
It even contains the BL0937 calibration but we'll need to manually calibrate OpenRTL from the web app GUI later.
So the OpenBeken/RTL template is
Code: JSON
Log in, to see the code
(power not calibrated yet)
Module soldered back ready for complete reassembly
firmware backup will land at https://github.com/openshwprojects/FlashDumps/tree/main/IoT/RTL8710BX as Tuya_Generic_EU_Plug_(schemaID-e1kt0gdk)_keydnqmh87c8ajv4_d182tgb7if9myzx9_WR2E_1.1.6.bin
https://github.com/OpenBekenIOT/webapp/commit/66961cb30c9de8c5b408dc0e4727dfc6260aed35
