[RTL8710CF] How to Reflash Firmware on Kasa HS103 WiFi Plug Mini

This is for a HS103V5 (Version 5)



The case is pretty difficult to open. First, you have to remove the cap with the clear plastic ring. Then the rest of the case can be pried open:







Then use these test points to flash OpenRTL:

TP1 Vcc 5 V
TP3 3.3 V
TP4 GND
TP6 UART2_OUT
TP5 UART2_IN
TP3 GPIOA0

Don't forget to short GPIOA0 to 3.3 V to enable bootloader mode.



I recommend removing the black foam pad to make things easier.

Here's my setup:



FLash using RTL87X0C UART Flash
https://github.com/openshwprojects/OpenBK7231T_App/releases

Here's the template I've come up with:

{
"vendor": "Kasa",
"bDetailed": "0",
"name": "Kasa Smart Wi-Fi Plug Mini (HS103)",
"model": "HS103",
"chip": "RTL87X0C",
"board": "TODO",
"flags": "1024",
"keywords": [
"TODO",
"TODO",
"TODO"
],
"pins": {
"12": "Rel;1",
"17": "Btn;1",
"18": "LED;1",
"19": "WifiLED_n;0"
},
"command": "setButtonTimes 50 1 5\r\naddEventHandler OnHold 17 SafeMode",
"image": "https://obrazki.elektroda.pl/3920204000_1746651639.png",
"wiki": "https://www.elektroda.com/rtvforum/topic4120893.html#21542702"
}

There's only one button, and it should control the relay and the blue led. The amber LED is tied to the wifi status.

Now the original firmware initiated a factory reset when the button was depressed for 20 seconds. Is there a way to reintroduce this feature?

nice one. template add: https://github.com/OpenBekenIOT/webapp/commit/5c976cc951b2590e2320594bc8380143a971e7d9

Jerther wrote:

Is there a way to reintroduce this feature?

would something like this in autoexec to get into safe mode do?



Added after 12 [minutes]:

I flashed the backup you sent and put into AP mode (P17 grounded for 5s). So it boots, but Kasa and Tapo apps could not finish pairing. No matter. Here's boot log to phone joining AP point

I'm not sure the Tapo app is compatible. Have you tried the Kasa app instead?

Added after 5 [hours] 44 [minutes]:

divadiow wrote:

would something like this in autoexec to get into safe mode do?

addEventHandler OnHold 17 SafeMode 20

SafeMode puts the controller in AP mode, but does it also reset the stored configuration?

Hmmm, I just found this:

https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/safeMode.md

And I think it means the configuration is not erased, but ignored, which would be enough because that's what the original firmware did for a 5s long press of the button.

Do I get this right?

yes. You could also do safe mode 10s button hold or maybe clearconfig for 20s, for example
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/commands-extended.md

Awesome!

So it should be

addEventHandler OnHold 17 SafeMode 5
addEventHandler OnHold 17 clearConfig 20

Will try this. We should also add this to https://www.elektroda.com/rtvforum/topic4098414.html. I'll have to double-check but I think the template does not handle the dedicated reset button...

hmm. I see safemode has optional delay before restart but clearconfig does not.



maybe



Added after 3 [minutes]:

that's wrong too I think. have you seen the examples? could try stuff out see what works https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/autoexecExamples.md

addEventHandler [EventName][EventArgument][CommandToRun]

so

addEventHandler OnHold 17 SafeMode 5

where

EventName is OnHold
EventArgument is 17 for IO 17
CommandToRun is SafeMode 5

And

SafeMode [OptionalDelayBeforeRestart]

where

OptionalDelayBeforeRestart is 5.

Can't find how to define the hold time of OnHold Doc on this looks sparse...

This works:



setButtonTimes sets the button hold time to 50x100ms = 5s. The other two values are for click time (default was 3), and repeat time (same as default). Apparently this applies to all buttons, but fortunately there's only one button on this device.

I guess I can't have another behavior for 20s long press... No big deal though. SafeMode should be enough.

Now this is nice, but there's one remaining problem. When the device is in SafeMode, is there a way to reboot it without having to power cycle it? A delay or a press of the button would be fine I think.