[WBR3 RTL870CF] TruCool TC-1160 Portable Air Conditioner Teardown and OpenBeken Flash Questions

This is the cheapest AC that was available on Amazon. When I saw it had Wi-Fi and was a Tuya device, I knew I had to at least tear it down.

(Eyes and tie are aftermarket upgrades)

Teardown:

The teardown itself isn’t too difficult but you have to remove all the plastic panels to get access to the microcontroller. I recommend making sure the water tank is empty before disassembly or the water outputs will drip. The AC should remain upright the whole time and it is designed to be disassembled this way.

First start by removing the 13 screws on the back panel. The second photo shows the two screws that are hidden under the device.



With these screws removed the back panel should be easy to just pop out.

With the back removed there are two screws at the bottom of the front and side panels. The photo shows the screws for one panel. They all work the same way just remove the two scews on each panel.

There is zip tie connecting the power cable to the side panel that needs to be removed before the panels can be pulled off. I cut the zip tie on mine before I took the photo so I’ve shown where it was.

Once all these screws are undone the top, front and side panels all come out as one unit. I found it is easiest to pull apart from the middle of the side panels to give you a bit more room when pulling the panels off. The panels pull upwards and there are a few wires connecting the control board to the rest of the unit. These wires are colour coded and easy to remove.
If you just want to access the WBR3 board you can pull avoid disconnecting any cables and just unscrew it from the top panel and disconnect it.

Here are the two main boards we care about. The smaller board is the WBR3 microcontroller that handles Wi-Fi. The bigger board handles all the actual functions of the device. If you don’t want the device to connect to Wi-Fi you can just unplug this board and the AC will still work just fine. Removing this board will also stop the Wi-Fi light from constantly flashing which is a bonus.

Here’s a close up of the WBR3 module. The board its sitting on seems to just convert 5v to 3.3v for the module. The RX and TX lines are nicely labelled for us. Annoyingly the back of the module is not accessible so hot air is needed to dump and flash this module.

Here’s a close up of the microcontroller that handles the actual AC functions. I think it is a BYD BF7615 microcontroller which is based on the 8-bit Intel 8051 architecture. The three resistors labelled JP1-3 are probably used to set some options on the microcontroller but I couldn’t find a full datasheet.

Here are some more photos of the rest of the unit.

Front
Back
Left Side
Right Side
It’s easy to see the compressor, evaporator and condenser in these photos.
I liked that they left a basic circuit diagram on the inside. Here is a close up of the diagram.

The white box that the diagram was on intrigued me so I popped it open. It just contains some relays, power supply components and a big capacitor for the compressor motor.


Questions:

I have flashed OpenBeken before but that was on a more basic device. I have a few questions about flashing this.
1. Since the device works without the Wi-Fi microcontroller installed it is probably a TuyaMCU device. Is there a way to extract the dpIDs without a Tuya account?
2. What tool should I use to dump the stock firmware of the WBR3 board? I don’t have access to hot air right now but I will post a dump once I get one.
3. The AC says it was manufactured in 2023 and the Wi-Fi board has a date of 2022 on it. Are there any solder free exploits I can use to try dump the firmware/flash new firmware? I know most of these have been patched but since the manufacture date is older maybe I'll get lucky.
4. What do I once I have a firmware dump and the dpIDs what do I do next? When I did this last time with a smart bulb I just fed the dumped firmware into one of the OpenBeken tools and it did all the hard work for me. Is there a tool I can feed the dpIDs into to generate a new custom firmware?
Sorry if some of these questions have already been answered. I have read through the following guides I just want to be sure before screwing with something more expensive.
https://www.elektroda.com/rtvforum/topic4038151.html
https://www.elektroda.com/rtvforum/topic3970199.html#20528459
https://www.elektroda.com/rtvforum/topic4021129.html
https://www.elektroda.com/rtvforum/topic4097185.html