Smart socket from AliExpress, no TX1/RX1 leads, BK7252N flashing

piotr.ino26 576 10

Treść została przetłumaczona

Zobacz oryginalną wersję tematu

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

» | Topic author Helpful post? (+3)

Post #1
21775192 08 Dec 2025 20:11

Good morning.
Socket smart from Ali cheap (£9.5) and a great mine, but probably the latest Under the T34 chip the TX1/RX1 signals are not routed anywhere, no approach from the side. Only pulling off the circuit or scraping. With the previous WB2S there was no problem. It's impossible to tell what you're buying from the chassis auction photos.

As I am doing this purely as a hobbyist, it looks like what it looks like.

I managed to rip the backup (below as someone would need) and upload the new firmware, but relied on soldering back in. With 2 I'll wait until it can be done over Wi-Fi.
Read/write as BK7231N
Spoiler:
{
"sel_pin_pin": "8",
"rl1_lv": "1",
"bt1_pin": "28",
"on_off_cnt": "10",
"onoff_rst_m": "0",
"onoff_clear_t":"10",
"rand_dpid": "42",
"net_trig": "4",
"netled1_lv": "1",
"jv": "110.0.3",
"onoff_rst_type":"2",
"ffc_select": "2",
"total_bt_pin": "26",
"key_rst_en": "1",
"nety_led": "1",
"vi_pin": "7",
"over_cur": "30000",
"resistor": "1",
"total_stat": "2",
"bt1_lv": "0",
"reset_t": "5",
"netled1_pin": "24",
"chip_type": "0",
"lose_vol": "90",
"remote_add_dp":"49",
"remote_list_dp":"50",
"net_type": "0",
"over_vol": "250",
"inch_dp": "44",
"module": "T34",
"ele_pin": "6",
"ch_cddpid1": "9",
"ble_pair_time":"30",
"init_conf": "38",
"zero_select": "0",
"onoff_type": "2",
"series_ctrl": "2",
"bt_self_type": "0",
"total_bt_lv": "0",
"cyc_dpid": "43",
"ch_num": "1",
"rl1_pin": "14",
"netn_led": "0",
"vol_def": "0",
"ch_dpid1": "1",
"sel_pin_lv": "1",
"crc": "55"
}

Device configuration, as extracted from Tuya:
- BL0937 SEL on P8
- Button (channel 1) on P28
- Pair/Toggle All Button on P26
- BL0937 VI (CF1) on P7
- WiFi LED on P24
- BL0937 ELE (CF) on P6
- Relay (channel 1) on P14
Device seems to be using T34 module,

Moderated By p.kaczmarek2:

One minor note - the T34 is a BK7231N, not a BK7252. It's important not to get this wrong, because if you load the wrong batch the module won't start.

Attachments:

BK7231N_QIO_BK7231N_T34_2025-08-12-17-24-08.bin Download (2 MB)

Cool? Ranking DIY
About Author
piotr.ino26 piotr.ino26

Level 11
Offline

Joined: 25 Dec 2006

Posts: 62

Posts rating: 6

Points: 209
piotr.ino26 wrote 62 posts with rating 6. Live in city Inowrocław. Been with us since 2006 year.
ADVERTISEMENT
#2 21775371 08 Dec 2025 22:30

gulson gulson

System Administrator

» | Helpful post? (0)

Post #2
21775371 08 Dec 2025 22:30

Thanks for the presentation. I also added this plug to my purchases by the way - it was supposed to be for Christmas tree lights, I opened it and threw it in the corner. Cool that you managed to upload, I'm not surprised that for 10£ you didn't want to finish. Send a Parcel Post to Private Message and I'll send a small gift.
ADVERTISEMENT
#3 21775485 09 Dec 2025 06:32

piotr.ino26 piotr.ino26

Level 11

» | Topic author Helpful post? (0)

Post #3
21775485 09 Dec 2025 06:32

Welcome. I now have a conundrum. Have I relied on soldering or uploaded the wrong batch?
I considered that it was left reading BK7252N (T4) is such a batch (OpenBK7252N_QIO_1.18.225) I uploaded BK7231Flasher. i lifted the chip 5 times and the plug remained dead.
The chip did not want to be read or written under any other option.
Maybe I need to delete the old batch and only upload BK7231N?
Once there something clicked and then I just started to change the readings.
The message from the program.
Spoiler:
Starting flash new (no backup)!
Now is: Monday, 8 December 2025 16:42:09.
Flasher mode: BK7231N
Going to open port: COM2.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus failed, will try again - 0/100!
Getting bus failed, will try again - 1/100!
Getting bus failed, will try again - 2/100!
Getting bus failed, will try again - 3/100!
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 15701C
Will now search for Flash def in out database...
Flash def found! For: 15701C
Flash information: mid: 15701C, icName: EN25QH16B, manufacturer: ESMT, szMem: 200000, szSR: 1, cwUnp: 0, cwEnp: 7, cwMsk: 3C, sb: 2, lb: 4, cwdRd: 05-FF-FF-FF, cwdWr: 01-FF-FF-FF
Flash size is 2MB
Entering SetProtectState(True)...
sr: 7c
final sr: 7c
msk: 3c
cw: 0, sb: 2, lb: 4
bfd: 0
sr: 40
final sr: 40
msk: 3c
cw: 0, sb: 2, lb: 4
bfd: 0
SetProtectState(True) success!
Going to read encryption key...
CheckRespond_FlashReadSR: bad value returned?
CheckRespond_WriteReg: ERROR
CheckRespond_FlashReadSR: bad value returned?
CheckRespond_FlashReadSR: bad value returned?
CheckRespond_FlashReadSR: bad value returned?
CheckRespond_WriteReg: ERROR
CheckRespond_FlashReadSR: bad value returned?
CheckRespond_FlashReadSR: bad value returned?
CheckRespond_FlashReadSR: bad value returned?
CheckRespond_WriteReg: ERROR
CheckRespond_FlashReadSR: bad value returned?
CheckRespond_FlashReadSR: bad value returned?
Encryption key read done!
Encryption key: 510fb093 a3cbeadc 5993a17e 00000003
^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
WARNING! Non-standard encryption key!
If it's all zero, it may also mean that read is disabled.
Please report to forum https://www.elektroda.com/rtvforum/forum51.html
Or just try using BK7231M mode[spoiler]
#4 21775598 09 Dec 2025 09:57

divadiow divadiow

Level 36

Helpful post? (0)

Post #4
21775598 09 Dec 2025 09:57

T34 should be flashed as BK7231N (T2)

Maybe the confusion came from 'T34' being the designation on the chip in your device?

T1, T2, T3, T4 are newer Tuya designations for various Beken chips.

I have flashed your backup to a Tuya CB3S (BK7231N) and it boots fine. I have also flashed my CB3S with the BK7252N (T4) OpenBeken app and then QIO and have been able to recover back to OpenBK7231N QIO without issue. Maybe you are now experiencing a cabling issue with length, grounding?

Also, maybe we should change Easy Flasher slightly to add T34 in the brackets beside BK7231N, alongside T2.

Something like this:
ADVERTISEMENT
#5 21775667 09 Dec 2025 16:40

piotr.ino26 piotr.ino26

Level 11

» | Topic author Helpful post? (0)

Post #5
21775667 09 Dec 2025 16:40

divadiow wrote:
Maybe you now have a problem with the length of the cabling, grounding?

1m USB extension cable, 15cm cable to the programmer, powering the chip from the power supply. Something to change?
#6 21776576 10 Dec 2025 09:32

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Helpful post? (0)

Post #6
21776576 10 Dec 2025 09:32

The error message looks a bit strange, the T34 has no other keys. Maybe it really is a communication error. I always shorten the wires as much as possible.

The second socket works? So it worked after all, congratulations. And the first one is also ok now? Just out of curiosity, which USB to UART converter did you use?

I have already touched on the topic of the T34 here:
Changing firmware getting harder? Smart Switch on T34 and LGA/QFN soldering

It's a shame that more and more of this T34 is out there, not everyone can cope with this LGA soldering....

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#7 21776644 10 Dec 2025 10:37

piotr.ino26 piotr.ino26

Level 11

» | Topic author Helpful post? (0)

Post #7
21776644 10 Dec 2025 10:37

CP2102 from Ali + 3.3 V from power supply, and it only gives 2.4 V from USB.
1 socket died from an impression after an encounter with a scalpel.
There is no TX/RX output anywhere on the board. The pads fell right off. The pad from the T34 from the CEN fell off when whittled, also I guess a faulty copy came along.
The second socket went express, as you can see on the logs. As you wrote, it is supposed to be BK7231N and it surprised after 1 power cut. No backup as I did this second socket out of the blue, to see if it would work.
Biggest problem is soldering it back on.
#8 21776655 10 Dec 2025 10:46

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Helpful post? (0)

Post #8
21776655 10 Dec 2025 10:46

I haven't even tested this CP2102 , good to know it works.

Keep that other socket, it might come in handy as a parts donor. The capacitors there wear out quickly. Turn on PowerSave 1 in the OBK to extend their life. Just enter this command in the startup command (in startup, so that it always turns on at startup).
How do you fix a smart device that crunches, squeaks and makes strange noises?
What method do you use to solder in the T34?

Since there's a BL0937 in there, it might still be worth doing a calibration, as in Tasmot, i.e. VoltageSet/CurrentSet/PowerSet at a known load (with a standard meter).

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#9 21776701 10 Dec 2025 11:17

piotr.ino26 piotr.ino26

Level 11

» | Topic author Helpful post? (0)

Post #9
21776701 10 Dec 2025 11:17

I did the calibrations because I have had such a socket for 3 years to control the boiler heater and I made an energy meter out of another one (the relay and pins came out). It counts one way consumption of the house - PV offgrid + storage. At the time it was the quickest and cheapest way to read consumption and integrate with HA.

I soldered in using a hota. It was the first time I did such a thing, 1 socket was an ordeal: cleaning the pads and low temperature paste and here I think I fell down, and 2 I didn't do anything, just a bit of flux on the board, set in the tags and hot and it worked out, so no need to fiddle too much.
p.kaczmarek2 wrote:
Enable PowerSave 1 in OBK to extend their life. Just enter this command in the startup command (in startup, so that it always turns on at startup).
I will do that, thank you.
ADVERTISEMENT
#10 21776705 10 Dec 2025 11:21

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Helpful post? (0)

Post #10
21776705 10 Dec 2025 11:21

Here someone presented an interesting firmware modification for the BL0937 - improving precision at the expense of longer sampling times:
OpenBeken BL0937 Mod: Improved accuracy/resolution for low power readings and monitoring e
but I don't know what you will use the socket for, so you may not need it.

I've come to exactly the same conclusion before - the easiest thing to do is solder and re-solder, I'm skipping collecting the binder with braid etc.

Added after 1 [minutes]:

PS: There is still such a tidbit:
Charts in OpenBeken - configurable measurement history hosted on IoT device

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#11 21776718 10 Dec 2025 11:36

piotr.ino26 piotr.ino26

Level 11

» | Topic author Helpful post? (0)

Post #11
21776718 10 Dec 2025 11:36

p.kaczmarek2 wrote:
I don't know what you would use the socket for

To run the air heater in the garage out of laziness All 60 watts. I reduced the RPM with the RO-12 controller because it was cooling down momentarily on the original control. I was going to do it on esp and relay, but the sockets came faster. Automation in HA from 6 and as I go in I already have the heat.
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

Home page
/
Forum
/
Smart Home
/
Smart Home IoT
/
Smart Home Devices
/
Smart socket from AliExpress, no TX1/RX1 leads, BK7252N flashing

FAQ

TL;DR: £9.5 AliExpress smart socket uses a T34/BK7252N module; "TX1/RX1 signals are not routed anywhere," so UART flashing needs scraping or lifting. [Elektroda, piotr.ino26, post #21775192]

Why it matters: This FAQ shows hobbyists how to identify pins and safely flash BK7252N-based T34 sockets lacking accessible UART.

Quick-Facts

Module: T34 with BK7252N; recognized and read/write as BK7252N. [Elektroda, piotr.ino26, post #21775192]
Price paid: £9.5; enclosure photos show single‑relay design. [Elektroda, piotr.ino26, post #21775192]
UART pads: TX1/RX1 not broken out; requires trace scraping or module removal. [Elektroda, piotr.ino26, post #21775192]
Tuya-extracted pin map: Relay P14, Wi‑Fi LED P24, Button P28, Pair P26, BL0937 CF P6, CF1 P7, SEL P8. [Elektroda, piotr.ino26, post #21775192]
Firmware/config snippet indicates jv 110.0.3 and on_off_cnt 10. [Elektroda, piotr.ino26, post #21775192]

Quick Facts

What module is inside this AliExpress smart socket?

It uses a T34 Wi‑Fi module based on the BK7252N SoC. The device reads and writes as BK7252N during backup and flashing. [Elektroda, piotr.ino26, post #21775192]

Are TX1/RX1 pads available for easy flashing?

No. The poster confirms "TX1/RX1 signals are not routed anywhere." Access requires scraping traces or lifting the module to reach UART. [Elektroda, piotr.ino26, post #21775192]

What are the key pin mappings for relay, LED, and buttons?

From Tuya extraction: Relay P14, Wi‑Fi LED P24, Button (CH1) P28, Pair/Toggle‑All P26. Energy chip BL0937: CF P6, CF1 (VI) P7, SEL P8. [Elektroda, piotr.ino26, post #21775192]

Does this socket support energy monitoring, and which IC is used?

Yes. It uses the BL0937 metering IC. The extracted config shows CF on P6, CF1 on P7, and SEL on P8. [Elektroda, piotr.ino26, post #21775192]

Can I back up and flash firmware on the BK7252N?

Yes. The author backed up the original image and flashed new firmware after soldering to the module. It enumerates as BK7252N. [Elektroda, piotr.ino26, post #21775192]

Is over‑the‑air (OTA) flashing possible right now?

The author plans to wait for a Wi‑Fi method on additional units. For now, physical access was required for flashing. [Elektroda, piotr.ino26, post #21775192]

What quick statistic tells me about reset behavior on this device?

The Tuya config shows on_off_cnt set to 10, indicating a 10‑toggle reset threshold in its firmware logic. [Elektroda, piotr.ino26, post #21775192]

How do I identify the energy and control pins before integrating with custom firmware?

Use the extracted mapping: BL0937 SEL P8, VI/CF1 P7, ELE/CF P6; Relay P14; Wi‑Fi LED P24. Confirm continuity before flashing. [Elektroda, piotr.ino26, post #21775192]

What is Tuya in this context?

Tuya is the OEM cloud platform whose device profile revealed the socket’s pin mapping and parameters like jv 110.0.3. [Elektroda, piotr.ino26, post #21775192]

What is BK7252N?

BK7252N is a Bouffalo/Beken‑class Wi‑Fi SoC used here in the T34 module and targeted for read/write operations. [Elektroda, piotr.ino26, post #21775192]

What is BL0937?

BL0937 is a single‑phase metering chip. In this socket, CF, CF1, and SEL connect to P6, P7, and P8 respectively. [Elektroda, piotr.ino26, post #21775192]

How do I flash if there are no UART pads? (3 steps)

Expose TX1/RX1 by carefully scraping traces or lifting the T34 module.
Solder temporary leads, back up the image, then write the new firmware.
Verify pins (Relay P14, LED P24, Button P28) post‑flash and reassemble. [Elektroda, piotr.ino26, post #21775192]

What failure modes should I watch for when accessing UART?

Lack of test pads forces trace access. Missteps here can require full module desoldering to recover, as access is tight. [Elektroda, piotr.ino26, post #21775192]

Can I rely on listing photos to know the module (WB2S vs T34)?

No. The author notes you cannot tell from auction chassis photos; the received unit had a T34, not WB2S. [Elektroda, piotr.ino26, post #21775192]

Is there evidence this approach worked on at least one unit?

Yes. Quote: "I managed to rip the backup and upload the new firmware," after soldering to the module. [Elektroda, piotr.ino26, post #21775192]

Which LED logic level should I expect?

The config shows Wi‑Fi LED on P24 with netled1_lv set to 1, indicating active‑high LED control in this profile. [Elektroda, piotr.ino26, post #21775192]

Smart socket from AliExpress, no TX1/RX1 leads, BK7252N flashing

Didn't find an answer? Ask Artificial Intelligence