logo elektroda
logo elektroda
X
logo elektroda

[BK7231N / WB2S] CATA CT-4010 Smart Plug Teardown: Module, OpenBeken Compatibility

rifatx 48 0
ADVERTISEMENT
  • #1 21788533
    rifatx
    Level 1  
    Here is the teardown of a CATA CT-4010 smart plug found in the Turkish market. It has a CB2S module with a BK721N chipset in it so it's compatible with OpenBeken. It is a relative cheap but usable device. It unfortunately has no power metering.

    The packaging:

    [BK7231N / WB2S] CATA CT-4010 Smart Plug Teardown: Module, OpenBeken Compatibility[BK7231N / WB2S] CATA CT-4010 Smart Plug Teardown: Module, OpenBeken Compatibility[BK7231N / WB2S] CATA CT-4010 Smart Plug Teardown: Module, OpenBeken Compatibility[BK7231N / WB2S] CATA CT-4010 Smart Plug Teardown: Module, OpenBeken Compatibility

    Outside:

    [BK7231N / WB2S] CATA CT-4010 Smart Plug Teardown: Module, OpenBeken Compatibility[BK7231N / WB2S] CATA CT-4010 Smart Plug Teardown: Module, OpenBeken Compatibility[BK7231N / WB2S] CATA CT-4010 Smart Plug Teardown: Module, OpenBeken Compatibility[BK7231N / WB2S] CATA CT-4010 Smart Plug Teardown: Module, OpenBeken Compatibility[BK7231N / WB2S] CATA CT-4010 Smart Plug Teardown: Module, OpenBeken Compatibility

    As seen in the last picture, the housing is secured with two 2mm triangular screws. We first have to unscrew those with something like this:

    [BK7231N / WB2S] CATA CT-4010 Smart Plug Teardown: Module, OpenBeken Compatibility

    And then pry open the housing:

    CATA CT-4010 plug with screws removed and a knife used to pry open the case

    Then we see the inside:

    Inside view of CATA CT-4010 smart plug after PCB desolderingInternal view of the disassembled CATA CT-4010 smart plug showing CB2S moduleClose-up of PCB inside the CATA CT-4010 smart plug after disassemblyClose-up of smart plug interior with CB2S module and electronic components visible

    As seen in the last picture, the device has a CB2S module.

    It's not necessary to desolder the module to flash OpenBeken, it's enough to attach PWR, GND, TX and RX lines to the FTDI connector. But the terminals of the module are not accessible and the board is soldered on the lower part of the housing. We first have to desolder it.

    Desoldering points:

    Close-up of smart plug PCB with solder points marked in red circles

    After desoldering, the board looks like this:

    CATA CT-4010 PCB with exposed electronic components after disassembly
    CATA CT-4010 smart plug PCB on a wooden surfaceGreen printed circuit board with soldered components and cutoutsDisassembled power strip and electronics on wooden surface

    Now we can attach the module to the FTDI connector. For this, we can just use spring hooks or solder some cables.

    The flashing setup looks like this:

    Electronic prototype with breadboard, USB converter, and jumper wiresPCB connected with alligator clip wires on a wooden tablePower module with two USB ports, a button, and an active green LED lightUSB-TTL programmer connected to a small breadboard with jumper wires

    Now you can just use the BK7231GUIFlashTool to flash the device.

    I've got two of these devices, and I'm using Linux. Since BK7231GUIFlashTool is a .NET app, I had to use mono to run it. In my experience, I've failed to flash one of the devices using the GUI tool although i could properly get a backup using the GUI tool, so I had to use hid_download_py for that device, which worked flawlessly. I was able to he second device using the GUI tool, but i had a kernel update inbetween. Long story short, use GUI tool to flash, it even works on Linux, but YMMV.

    Here are the outputs ot the GUI tool:

    BK7231N configuration tool interface with Reading success! message displayedFlashing tool interface with green “Write success!” message displayed

    And here is the config dump:

    Screenshot showing Tuya device GPIO config and encryption key from flash memory

    The config generated by the autodump works, but it has some issues regarding the light. Below you can find the corrected version of the config:

    Code: JSON
    Log in, to see the code


    After flashing, you have to resolder the spots to fix the board to the housing. After soldering, the board looks like below, no visible difference:

    Disassembled smart plug showing relay and internal circuit board components.

    Then you can just screw the housing.
  • ADVERTISEMENT
ADVERTISEMENT