logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Carro Beer Bottle Pendant Light Teardown: OpenBK7231N OTA Flash, Pin Mapping

paulp 288 7
ADVERTISEMENT
Reply | New topic
  • Helpful post
    #1 21582183
    paulp
    Level 6  
    Today, we are going to decloud a nice pendant light in the shape of beer bottles Link
    Carro Beer Bottle Pendant Light Teardown: OpenBK7231N OTA Flash, Pin Mapping.

    According to the manual, it is made by Carro. Obviously, I didn't want to install their stinky app, so here we go. Inside the lamp, we see a 24V PS and an LED controller. The LED driver is powered by a CB3S IC, therefore, you'd need the BK7231N FW (I know it says it is for WB3S, but nonetheless) . Since we will be doing the upgrade OTA, you need the UG FW, I used OpenBK7231N_UG_1.15.597.bin
    Carro Beer Bottle Pendant Light Teardown: OpenBK7231N OTA Flash, Pin Mapping Carro Beer Bottle Pendant Light Teardown: OpenBK7231N OTA Flash, Pin Mapping
    As before, I used the Tuya Cloud Cutter (CC henceforth). However, unlike the previous LED lamp, CC knew neither the lamp nor the controller (HTY5-24-CV24-60W) manufacturers.
    After some experiments with CC, this setup worked for me:
    Code: text Expand Select all Copy to clipboard
    
[?] How do you want to choose the device?: By firmware version and name
   By manufacturer/device name
 > By firmware version and name
   From device-profiles (i.e. custom profile)

[?] Select the firmware version and name: 1.3.21 - BK7231N / oem_bk7231n_light_ty
   1.3.1 - BK7231N / oem_bk7231n_light_ty
  ...
   1.3.20 - BK7231N / oem_bk7231n_light_ty
 > 1.3.21 - BK7231N / oem_bk7231n_light_ty
   1.3.22 - BK7231N / oem_bk7231n_light_ty
...
   1.6.0 - BK7231T / oem_bk7231s_curtain_switch

[?] Select the brand of your device: Tuya Generic
   Immax
 ...
   Treatlife
 > Tuya Generic
   UltraPro

[?] Select the article number of your device: SWWFD1C412 RGBCT Downlight
   1947Z5R W509Z1 RGBCT Bulb
 > SWWFD1C412 RGBCT Downlight

Selected Device Slug: tuya-generic-swwfd1c412-rgbct-downlight
Selected Profile: oem-bk7231n-light-ty-1.3.21-sdk-2.3.3-40.00
Selected Firmware: /work/custom-firmware/OpenBK7231N_UG_1.15.597.bin


    Before CC can start declouding the controller, you need to put it into the AP mode. About 5 ON-OFF cycles with a one-second interval will do the trick. The manual says three cycles - it's a lie. After the CC is done, you should see a wifi network with SSID OpenBK7231T_XXXXX. Follow the setup instructions from OpenBeken: connect to Wi-Fi, open 192.168.4.1, enter your SSID and password, and enter your MQTT server details.

    Now comes the fun part, matching the pins. After some experiments, it turned out that PWM0 is cold white, PWM1 is not connected, PWM2 is warm white, PWM3 is green, PWM4 is red, and PWM5 is blue. You need to set your channels to PWM0 - 3, PWM2 - 4, PWM3 - 1, PWM4 - 0, PWM5 - 2, and check Flags 4, 10, and 12. Once this is all set, you can provision it with Home Assistant, and it will correctly set the colors. This was relatively easy and required minimal teardown, even though no documentation seems to be available for the LED controller.
    AI: Just to clarify, are you looking for help with a specific issue you encountered during the declouding and flashing process, or are you just sharing your experience?
    Sharing my experience
    AI: If you did run into any problems or unexpected behavior (like errors, connectivity issues, or pin mapping oddities), could you describe what happened?
    Not really, just a bunch of trial and error
  • ADVERTISEMENT
  • #2 21582523
    divadiow
    Level 35  
    interesting device. please extract and post the Tuya config info to file from the web app
    Carro Beer Bottle Pendant Light Teardown: OpenBK7231N OTA Flash, Pin Mapping

    Added after 5 [minutes]:

    paulp wrote:
    Selected Firmware: /work/custom-firmware/OpenBK7231N_UG_1.15.597.bin


    also, how come such an old release?
  • ADVERTISEMENT
  • #3 21583340
    p.kaczmarek2
    Moderator Smart Home  
    They probably ship their tool with old binary of ours...

    Very nice lamp, thanks for sharing! How it looks during the night with other lamps turned off?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #5 21583349
    p.kaczmarek2
    Moderator Smart Home  
    Oh, nice to see you keep them updated.

    Do they even get much use these days? I was living under assumption that all new devices are patched...
    Helpful post? Buy me a coffee.
  • #6 21583408
    divadiow
    Level 35  
    my general feeling is that there are fewer but there's still a steady stream of new profiles going into CC. @piotrszulc1 and I have hoovered up most of the previously-posted exploitable dumps on Elektroda and flagged them for possible template creation on Discord. Some devices that get posted here now are still exploitable. eg - https://www.elektroda.com/rtvforum/topic4126366.html#21580356

    I guess it's inevitable that eventually very few or nothing new will be added or available for purchase that CC can be used against.
  • ADVERTISEMENT
  • #7 21583962
    paulp
    Level 6  
    @divadiow , Here is the template:

    Code: text Expand Select all Copy to clipboard
    
{
  "vendor": "Tuya",
  "bDetailed": "0",
  "name": "Full Device Name Here",
  "model": "enter short model name here",
  "chip": "BK7231N",
  "board": "HTY5-24-CV24-60W",
  "keywords": [
    "TODO",
    "TODO",
    "TODO"
  ],
  "pins": {
    "6": "PWM;3",
    "8": "PWM;4",
    "9": "PWM;1",
    "24": "PWM;0",
    "26": "PWM;2"
  },
  "image": "https://obrazki.elektroda.pl/YOUR_IMAGE.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/viewtopic.php?p=21582523"
}
    and the binary BK7231N_Tu...nnamed.bin Download (72 kB)
    I just used the same FW that I used for my other lamp declouding. I'm somewhat wary to fix what ain't broken. Granted, this lamp was purchased about three years ago, but it is still sold on eBay. I find CC a far less intrusive way to decloud devices. When I hack ESP chips, I tend to resort to the ordinary soldering method; however, with the new trend of making the ESP or WBS an integral part of the board with no RX, TX pins exposed, this becomes progressively more difficult, so cloud cutting is the only option. I talked a bit about massive DNS and destination address spoofing in my post about the water heater. This is, of course, more difficult than the prescribed use of CC, but it is still a viable way.

    @p.kaczmarek2 Thank you :) This is how it looks at night

    Carro Beer Bottle Pendant Light Teardown: OpenBK7231N OTA Flash, Pin Mapping
Reply | New topic
Report a violation of the law

Topic summary

The discussion focuses on declouding a Carro Beer Bottle Pendant Light by extracting and flashing the BK7231N firmware OTA using OpenBK7231N_UG_1.15.597.bin. The lamp contains a 24V power supply and an LED controller driven by a CB3S IC, requiring BK7231N firmware despite references to WB3S. The Tuya Cloud Cutter (CC) tool was used for firmware extraction and modification, although it initially lacked support for the lamp and its LED driver board (HTY5-24-CV24-60W). A device template was created with pin mappings for PWM control on pins 6, 8, 9, 24, and 26. The firmware and device profile were shared on GitHub and Elektroda forums, enabling OTA upgrades without using the original Carro app. The lamp, purchased about three years ago but still available on eBay, benefits from this less intrusive declouding method compared to soldering. The community noted ongoing updates to CC and the gradual decline in exploitable new devices, but some remain accessible for firmware modification.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT