Flashing ZY_HPS01_V1.2 Presence Sensor with CB3S Module: TX/RX Connection Issues

Hi, first time posting here. I have a presence sensor bought on AliExpress by mistake (Click bait?) and I would like to flash it but this is more a test run for something else since I already have a few of these in Zigbee. So, I flashed a couple of 8266 a while back and it was pretty easy, but this looks like a more daunting task.



On the board there is the name ZY_HPS01_V1.2, the module is a cb3s and I think I got the pin right. Even if there is no Tuya Mcu on the board is it possible that the motion sensor chip is connected on the TX RX? And preventing me from flashing it? I added picture of the board and chips, and a portion of the log of the flasher. It did output another key than Encryption key: 00000000 00000000 00000000 00000000
on one try: 510fb093 a3cbeadc 5993a17e c7adeb03
Getting bus success!
Going to set baud rate setting (921600)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to read encryption key...
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000270000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000270000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000270000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000270000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000270000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
failed with serial.BytesToRead 8 (expected 15)
The beginning of buffer in UART contains 103E050378008000 data.
failed with serial.BytesToRead 8 (expected 15)
The beginning of buffer in UART contains 103E050374008000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 8 (expected 15)
The beginning of buffer in UART contains 303C050374008000 data.
failed with serial.BytesToRead 8 (expected 15)
The beginning of buffer in UART contains 303C050378008000 data.
failed with serial.BytesToRead 8 (expected 15)
The beginning of buffer in UART contains 303C050374008000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 8 (expected 15)
The beginning of buffer in UART contains 181E050374008000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000270000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000270000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000270000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000270000000 data.
failed with serial.BytesToRead 8 (expected 15)
The beginning of buffer in UART contains 103E050374008000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 8 (expected 15)
The beginning of buffer in UART contains 103E050374008000 data.
failed with serial.BytesToRead 8 (expected 15)
The beginning of buffer in UART contains 181E050378008000 data.
failed with serial.BytesToRead 8 (expected 15)
The beginning of buffer in UART contains 303C050374008000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 207C7F4120171030E0 data.
failed with serial.BytesToRead 8 (expected 15)
The beginning of buffer in UART contains 303C050378008000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000270000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000270000000 data.
failed with serial.BytesToRead 9 (expected 15)
The beginning of buffer in UART contains 00C0F8000260000000 data.
CheckRespond_WriteReg: ERROR
failed with serial.BytesToRead 8 (expected 15)
The beginning of buffer in UART contains 181E050374008000 data.
failed with serial.BytesToRead 8 (expected 15)
The beginning of buffer in UART contains 103E050378008000 data.
Encryption key read done!
Encryption key: 00000000 00000000 00000000 00000000
^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
WARNING! Non-standard encryption key!
If it's all zero, it may also mean that read is disabled.
Please report to forum https://www.elektroda.com/rtvforum/forum51.html
Or just try using BK7231M mode
^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
There was no result to save.
AI: Can you share exactly how you’re connecting the CB3S module for flashing (e.g., which USB-to-serial adapter you’re using, wiring details, and whether you’re powering the board separately or through the adapter)?
I am using a USB FTDI FT232RL, I did try powering the device through an external source but got the same results.
AI: Did you put the CB3S module into flashing mode before trying to flash it? If so, how did you do it (e.g., holding a button, grounding a pin, etc.)?
There is a reset button and I tried holding it, pressing it a couple of second, at intervals (~2sec). The only thing that made me have some kind of information out of the chip was power off/on and cen to ground.

It looks like your device has something connected to UART port.

Try disconnecting it (desoldering those two resistors or desoldering CB3S entirely).

Hi, thanks for the quick answer, that's what I expected but hope that was not the case. Is the log consistent with a blocked/occupied UART? On my side I am not equipped for desoldering, so I hoped that someone would say that you just don't press the button hard enough. When I did the 8266 there was spot on the board directly linked to the chip. In this device case the obvious ones are linked to the sensor chip if I am not mistaken. I might give desoldering a try but that won't be today, is it easier to just remove the cb3s (heat gun) or unsolder the resistors?

You can still try different baud rates, but for reliable operation, clearing UART lines is always recommended.

What kind of sensor is that? I don't recognize it. Have you seen it, @divadiow ?

These are Tuya compatible Wifi MmWave Human Presence Motion Sensor With Luminance/Distance Detection. They are not very good, but good enough. And they are very cheap, I bought a couple zigbee ones but got one wifi. They get the presence of a person even if there is no movement, small movements is enough to to get a an event. Better than PIR but like I said they are just good enough for me. 90 degrees cone and enough range for use in a house.
I hope this link works
https://www.aliexpress.com/item/1005005935585...tpp_buckets:668#2846#8107#1934&pdp_ext_f={"order":"1799","eval":"1","sceneId":"30050"}&pdp_npi=4@dis!CAD!14.61!13.38!!!10.31!9.44!@210318e817450368281498825ecd38!12000034928101604!rec!CA!3228470409!X&utparam-url=scene:pcDetailTopMoreOtherSeller|query_from:

same device here: https://www.elektroda.com/rtvforum/topic4094577.html

I have 1 human presence sensor https://www.elektroda.com/rtvforum/topic4108806.html#21470593
not yet even de-soldered WBR3 to dump firmware :o

Added after 18 [minutes]:

sensor module itself looks to be an MS58-2020D20M4-LIVE from MoreSense / Migan

https://www.moresense-tech.com/product_details/70.html
https://miganiot.com/product/ms58-2020d20m4-live/

any info on protocol? i got this so far

I have made contact asking for a full datasheet

hmm. got supplied with this. not any help

When I have the time I will desolder the cb3s. I hoped that I'll get the device running with esphome but at this point any solution that works with home assistant is fine with me.

It seems the protocol is not known yet, so probably the first thing we need now is the data packets capture. If it's UART, then guess baud and capture with Realterm, both RX->TX and TX->RX traffic. It can be also captured more easily with Sigrok clone:
Salae 24MHz logic analyzer for 10$ - analysis of an unknown LED display protocol

I was also sent this after requesting more info, but it still doesn't contain what's needed

Included ATRadarSettingTool_V1.4 seem to be able to use UART to communicate with that, so maybe we could use it for testing, but I still can't see protocol documentation.