[WBR3 RTL870CF] TruCool TC-1160 Portable Air Conditioner Teardown and OpenBeken Flash Questions

Bruno23 1287 3

TL;DR

A teardown of the TruCool TC-1160 portable air conditioner exposes a Tuya WBR3 Wi-Fi module alongside the main control board.
The AC still works with the WBR3 board unplugged, and the Wi-Fi module uses labeled RX/TX lines with a 5V-to-3.3V converter board.
The unit came apart with 13 rear screws, two hidden bottom screws, and panel screws, and the AC is marked 2023 while the Wi-Fi board is dated 2022.
Open questions focus on extracting Tuya dpIDs without an account, dumping the WBR3 firmware, and finding any solder-free exploit or OpenBeken workflow for custom firmware.

Generated by the language model.

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Topic author Helpful post? (+6)

Post #1
21603265 10 Jul 2025 20:55

This is the cheapest AC that was available on Amazon. When I saw it had Wi-Fi and was a Tuya device, I knew I had to at least tear it down.

(Eyes and tie are aftermarket upgrades)

Teardown:

The teardown itself isn’t too difficult but you have to remove all the plastic panels to get access to the microcontroller. I recommend making sure the water tank is empty before disassembly or the water outputs will drip. The AC should remain upright the whole time and it is designed to be disassembled this way.

First start by removing the 13 screws on the back panel. The second photo shows the two screws that are hidden under the device.

With these screws removed the back panel should be easy to just pop out.

With the back removed there are two screws at the bottom of the front and side panels. The photo shows the screws for one panel. They all work the same way just remove the two scews on each panel.

There is zip tie connecting the power cable to the side panel that needs to be removed before the panels can be pulled off. I cut the zip tie on mine before I took the photo so I’ve shown where it was.

Once all these screws are undone the top, front and side panels all come out as one unit. I found it is easiest to pull apart from the middle of the side panels to give you a bit more room when pulling the panels off. The panels pull upwards and there are a few wires connecting the control board to the rest of the unit. These wires are colour coded and easy to remove.
If you just want to access the WBR3 board you can pull avoid disconnecting any cables and just unscrew it from the top panel and disconnect it.

Here are the two main boards we care about. The smaller board is the WBR3 microcontroller that handles Wi-Fi. The bigger board handles all the actual functions of the device. If you don’t want the device to connect to Wi-Fi you can just unplug this board and the AC will still work just fine. Removing this board will also stop the Wi-Fi light from constantly flashing which is a bonus.

Here’s a close up of the WBR3 module. The board its sitting on seems to just convert 5v to 3.3v for the module. The RX and TX lines are nicely labelled for us. Annoyingly the back of the module is not accessible so hot air is needed to dump and flash this module.

Here’s a close up of the microcontroller that handles the actual AC functions. I think it is a BYD BF7615 microcontroller which is based on the 8-bit Intel 8051 architecture. The three resistors labelled JP1-3 are probably used to set some options on the microcontroller but I couldn’t find a full datasheet.

Here are some more photos of the rest of the unit.

Front
Back
Left Side
Right Side
It’s easy to see the compressor, evaporator and condenser in these photos.
I liked that they left a basic circuit diagram on the inside. Here is a close up of the diagram.

The white box that the diagram was on intrigued me so I popped it open. It just contains some relays, power supply components and a big capacitor for the compressor motor.

Questions:

I have flashed OpenBeken before but that was on a more basic device. I have a few questions about flashing this.
1. Since the device works without the Wi-Fi microcontroller installed it is probably a TuyaMCU device. Is there a way to extract the dpIDs without a Tuya account?
2. What tool should I use to dump the stock firmware of the WBR3 board? I don’t have access to hot air right now but I will post a dump once I get one.
3. The AC says it was manufactured in 2023 and the Wi-Fi board has a date of 2022 on it. Are there any solder free exploits I can use to try dump the firmware/flash new firmware? I know most of these have been patched but since the manufacture date is older maybe I'll get lucky.
4. What do I once I have a firmware dump and the dpIDs what do I do next? When I did this last time with a smart bulb I just fed the dumped firmware into one of the OpenBeken tools and it did all the hard work for me. Is there a tool I can feed the dpIDs into to generate a new custom firmware?
Sorry if some of these questions have already been answered. I have read through the following guides I just want to be sure before screwing with something more expensive.
https://www.elektroda.com/rtvforum/topic4038151.html
https://www.elektroda.com/rtvforum/topic3970199.html#20528459
https://www.elektroda.com/rtvforum/topic4021129.html
https://www.elektroda.com/rtvforum/topic4097185.html

Cool? Ranking DIY
About Author
Bruno23 Bruno23

Level 4
Offline

Joined: 31 Jul 2023

Posts: 4

Posts rating: 10

Points: 230
Bruno23 wrote 4 posts with rating 10. Been with us since 2023 year.
ADVERTISEMENT
#2 21603744 11 Jul 2025 12:28

DeDaMrAz DeDaMrAz

Level 22

Posts: 603

Help: 34

Rate: 129
Helpful post? (0)

Post #2
21603744 11 Jul 2025 12:28

Unfortunately reading and writing flash on that module will require disordering the module because the pins required for boot are on the bottom.

Good practice is always to do full backup first in case you want to revert back or something goes wrong - then we can experiment.

I am yet to find time to test that on my AC but you can read this thread - https://www.elektroda.com/rtvforum/topic4119999.html

Double check if that AC uses Tuya App or something else, if something else then there is a long road of figuring out what is going on on that UART

But we can sure try to help out.

If you like my work, support me at: https://paypal.me/openshwprojects
ADVERTISEMENT
#3 21603980 11 Jul 2025 17:01

Bruno23 Bruno23

Level 4

Posts: 4

Rate: 10
Topic author Helpful post? (0)

Post #3
21603980 11 Jul 2025 17:01

Sounds good. When I get the module removed I will take a firmware dump and post it here. I read that ltchiptool is best for firmware dumping. The box said that it uses the tuya app.
#4 21604094 11 Jul 2025 19:02

divadiow divadiow

Level 38

Posts: 5065

Help: 438

Rate: 893
Helpful post? (+1)

Post #4
21604094 11 Jul 2025 19:02

Bruno23 wrote:
I read that ltchiptool is best for firmware dumping.

I believe that is the only option currently. We just need to adapt the pvvx scripts a bit for Z2 I believe.

Z1 and D scripts can be found here under the _FlashTool subdirs https://github.com/openshwprojects/FlashTools/tree/main/Realtek
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

FAQ

TL;DR: With 13 back-panel screws and a 5 V to 3.3 V Wi‑Fi daughterboard, this teardown shows that “full backup first” is the safest path for owners who want OpenBeken on a TruCool TC-1160. It solves the core problem of reaching, identifying, and safely dumping the WBR3 RTL870CF before any flash attempt. [#21603744]

Why it matters: This thread maps the shortest safe path from physical teardown to firmware backup on a Tuya-based portable AC, while showing where the process stops without desoldering.

Option	What the thread says	Best use
Leave WBR3 connected	Stock Wi‑Fi stays active	Keep factory app control
Unplug WBR3	AC still works; flashing Wi‑Fi LED stops	Run the AC without Wi‑Fi
Desolder WBR3 and dump firmware	Needed for read/write flash because boot pins are on the bottom	Backup and custom firmware work
Use ltchiptool	Described as the current best or only option for dumping	First backup step before experiments

Key insight: The TruCool TC-1160 appears to behave like a TuyaMCU device: the main AC controller keeps the unit running, while the WBR3 handles Wi‑Fi and UART-side integration. That separation makes backup essential before any OpenBeken work. [#21603744]

Quick Facts

The teardown starts with 13 screws on the back panel, including 2 hidden underneath the unit before the rear cover pops free. [#21603265]
The WBR3 sits on a small board that appears to convert 5 V to 3.3 V, and its RX and TX lines are clearly labeled. [#21603265]
The main control MCU is identified in the post as a BYD BF7615, described as an 8-bit Intel 8051-based controller for core AC functions. [#21603265]
The AC is marked as manufactured in 2023, while the Wi‑Fi board carries a 2022 date, which is why older no-solder routes were considered worth checking first. [#21603265]
One reply states that reading and writing flash requires desoldering the module because the needed boot pins are located on the bottom of the WBR3 board. [#21603744]

How do I disassemble the TruCool TC-1160 portable air conditioner to reach the WBR3 Wi-Fi board without damaging the panels or wiring?

Remove the back first, then lift the top/front/side shell as one piece. 1. Empty the water tank, keep the AC upright, and remove the 13 rear screws, including 2 hidden underneath. 2. Remove 2 screws at the bottom of each front and side panel, then cut the zip tie holding the power cable. 3. Pull up from the middle of the side panels, unplug the color-coded wires if needed, and unscrew the WBR3 board from the top panel. [#21603265]

What is a TuyaMCU device, and how does that architecture affect flashing OpenBeken on a WBR3 RTL870CF module?

A TuyaMCU device uses one MCU for the appliance and a separate Wi‑Fi module for app connectivity. "TuyaMCU" is a device architecture that splits control between a main appliance controller and a Wi‑Fi module, with UART linking the two parts. In this AC, the big board runs the actual functions, while the smaller WBR3 handles Wi‑Fi. That means the AC can still operate with the WBR3 unplugged, but custom firmware work must still respect the UART link and function mapping. [#21603265]

Which tool is currently best for dumping the stock firmware from a WBR3 RTL870CF module, and how does ltchiptool fit into that process?

ltchiptool is the tool the thread points to as the best current choice for dumping the stock firmware. The owner specifically says they read it is best for firmware dumping, and another reply says it is currently the only option. In practice, ltchiptool is the first step because the thread recommends taking a full backup before any OpenBeken experiment or restore attempt. [#21604094]

Why does the WBR3 module in the TruCool TC-1160 need to be desoldered for reading or writing flash, and which boot pins are inaccessible on the bottom?

It needs desoldering because the required boot-related pins are on the underside of the module. The teardown shows RX and TX are visible and labeled, but the back of the WBR3 is not accessible in place. A reply states plainly that reading and writing flash requires desoldering because the pins needed for boot are on the bottom, which blocks in-circuit dump and flash work. [#21603744]

How can I extract Tuya dpIDs from a portable air conditioner without using a Tuya account?

The thread does not provide a confirmed no-account method for extracting dpIDs from this AC. It only asks whether dpIDs can be extracted without a Tuya account and does not answer that part directly. The practical takeaway from the discussion is to verify the unit uses the Tuya app, back up the WBR3 first, and then continue UART investigation if needed. [#21603265]

What should I do after I have a firmware dump and the dpIDs from a WBR3-based Tuya air conditioner?

Use the dump as your recovery point, then move to function mapping and firmware adaptation. The poster asks whether a tool can take a dump and dpIDs and generate custom firmware, but the thread does not give a finished automation path for this AC. One reply instead stresses full backup first, then says experimentation can start after that, which makes the dump the mandatory next-step foundation. [#21603744]

Which solder-free exploits, if any, are worth trying on a 2022-2023 Tuya WBR3 board before desoldering the module?

No solder-free exploit is confirmed in the thread for this 2022–2023 WBR3 board. The owner asks because the AC is marked 2023 and the Wi‑Fi board 2022, but no reply provides a working no-solder route. The only concrete guidance given is that read/write flash on this module requires desoldering, so time spent on old exploit hunting may not pay off here. [#21603744]

How do I make a full backup of the original WBR3 firmware before experimenting with OpenBeken or other custom firmware?

Desolder the WBR3 first, then dump the entire flash before changing anything. One reply gives the clearest rule: “full backup first” in case you want to revert or something goes wrong. Another reply says ltchiptool is currently the only option, so the backup workflow in this thread is module removal first, full dump second, experiments third. [#21604094]

What is ltchiptool, and why is it commonly recommended for backing up and flashing Realtek-based Tuya modules like the WBR3 RTL870CF?

ltchiptool is the backup and flashing tool the thread treats as the current standard for this module family. "ltchiptool" is a firmware utility that reads, backs up, and writes supported Wi‑Fi modules, with the key advantage here being current support for dumping a WBR3 before modification. It is recommended because one reply calls it the only option currently, which makes it the practical tool for safe recovery-first work on this Realtek-based board. [#21604094]

How can I tell whether a portable AC uses the Tuya app or a different UART protocol before I start reverse engineering it?

Check the box or product labeling first, then confirm what app the device expects. One reply says to double-check whether the AC uses the Tuya app, because a different app means a much longer UART reverse-engineering path. The owner later confirms the box says it uses the Tuya app, which strongly narrows the likely integration path before deeper UART analysis starts. [#21603980]

What is a dpID in the Tuya ecosystem, and why do I need dpIDs when mapping functions for OpenBeken on an air conditioner?

A dpID is the function identifier you need to connect Tuya-side commands to real device actions. "dpID" is a Tuya data-point identifier that maps one app-visible feature to one device function, with each identifier acting as the reference for control and status exchange. In this thread, dpIDs matter because the owner wants them before generating or adapting firmware, just as they did previously with a smart bulb workflow. [#21603265]

ltchiptool vs the Realtek FlashTools pvvx scripts: which is better for dumping and restoring firmware on WBR3 Z1, Z2, or D-family modules?

The thread presents ltchiptool as the current practical choice, while the pvvx scripts are useful references for some Realtek families. One reply says ltchiptool is currently the only option. The same reply adds that Z1 and D scripts exist under the Realtek FlashTools tree, and that Z2 likely needs adaptation, so script readiness is less complete than the ltchiptool path described here. [#21604094]

How do I identify the main control MCU in this AC, such as the BYD BF7615 8051-based chip, and what role does it play compared with the WBR3 Wi-Fi module?

Identify it by reading the larger control-board IC marking and comparing its job with the smaller Wi‑Fi board. The teardown identifies the big-board MCU as a BYD BF7615 and describes it as 8-bit Intel 8051-based. That chip handles the actual AC functions, while the WBR3 only handles Wi‑Fi. A strong clue is functional: unplugging the WBR3 leaves the AC working normally. [#21603265]

What safety precautions should I take when tearing down and probing a portable air conditioner, especially around the water tank, mains wiring, relays, and compressor capacitor?

Empty the tank, keep the unit upright, and avoid unnecessary probing inside the mains section. The teardown warns that water outputs will drip if the tank is not empty, and it specifically keeps the AC upright during disassembly. The post also identifies a white box containing relays, power-supply parts, and a large compressor motor capacitor, so careless contact there adds avoidable electrical risk during teardown. [#21603265]

How can I troubleshoot a Tuya-based portable AC that still works with the WBR3 unplugged but keeps flashing the Wi-Fi LED or behaves unexpectedly after the module is removed?

If the AC still cools and responds locally, the first fix is simply to unplug the WBR3 and confirm the Wi‑Fi LED stops flashing. The teardown states that removing the Wi‑Fi board leaves the AC working fine and also stops the constantly flashing Wi‑Fi light. If behavior still seems odd after removal, the thread’s next diagnostic step is to verify whether the protocol is really Tuya over UART before assuming a firmware issue. [#21603265]