[Solved] [CBU/BK7238] TuyaSmartlife Temperature hygrometer TH06-variant

[Updated topic to reflect new findings and simplify future searches]

Bought a genereic Tuya/Smartlife temperature and humidity sensor from here: Aliexpress

Identified as TH06 in Smartlife app

It is marked CBU/BK7231N but is BK7238 based with a TuyaMCU handling the sensor and controlling power-on/VDD of CBU. RX1/TX1 are directly connected to TuyaMCU prohibiting BK7231 Easy Flasher from doing it's job.



I lifted pin 5, TX1 from the TuyaMCU and connected to CBU TX1/RX1. Got the following warning in the log WARNING! Non-standard encryption key!

Skipping Key check, and got following log:



Then I tried to program with "OpenBK7231N_Q10_1.18.229.bin but it continously reboots....

From the debug log (TX2)



Any ideas what to do next?
AI: Can you provide a detailed wiring diagram or clear description of how you currently have the TX/RX and other relevant pins connected between the CBU/BK7231N and the TuyaMCU (including any modifications you made)?
Soldered wires to USB-adapter, separate power supply. TuyaMCU communicationg serially to CBU RX1/TX1
AI: Did you perform a full flash erase (chip erase) before flashing the OpenBK7231N firmware, or did you just write the new firmware over the existing contents?
Full flash

Added after 2 [hours] 17 [minutes]:

This is the log from the original fw:

CBU labelled modules also now seem to be BK7238 as well as BK7231N. Flash to OpenBK7238.

Flashing OpenBK7238_QIO_1.18.233.bin

Starts successfully, connects to my Wi-Fi and sends MQTT! Great.

Next step is to figure out the required OBK config.

Thanks for your help!

Do you have original flash 2 MB backup? Or maybe did you try packets capture?

Still, I'd be hoping that they didn't change dpIDs since BK7231 version and they will match...

Alternatively, what kind of sensor do you have there? We may have it already supported. What do you think, @divadiow ?

I think my bets are on it having a different schema, but yeh we'd need the tuya config/full flash to be sure. Or could try a couple of TuyaMCU TH0x autoexecs to see if any temp/hum readings show

eg https://www.elektroda.com/rtvforum/topic3968377-30.html#20904927

there seem to be others in that thread

I did a backup of the original FW; it does not work with "Extract Config from Tuya binary"

TuyaMCU analyzer shows the following:



Looks close to a "normal" TH01.
Battery level (4) is 100%.
High temperature alarm (10) level before low temp. (11)
Humidity high (12) before low (13).


Trying the following setup:


I've gotten one read, which was correct, but then it never updates. Read somewhere that CBU will only update on power-on; is that what tmSensor does?

Added after 45 [minutes]:

Looking at the debug logs directly at CBU TX2:



Added after 4 [hours] 20 [minutes]:

I can see that using TuyaMCU Analyzer with the above config will never show any dpId's being sent.

If I comment out "startDriver tmSensor" I will get continous reads of dpId matching the original fw and having correct values.
But power to CBU will be shut-off after a minute

When looking at the debug log, it looks like the startDriver TuyaMCU command constantly fails, thus the linkTuyaMCUOutputToChannel fails.
When running without the tmSensor driver, the startDriver TuyaMCU command randomly works and then a reading is possible.

Is there anything with the BK7238 UART that differs from BK7231 or the amount of memory? The fail seems to be before the commands being added in the Tuya driver, and that is only the buffer alloc and UART init?


drv_tuyaMCU.c

I can confirm that the module is T1-based.

I finally got this device working using the new OpenBK7238_QIO_1.18.247_battery.bin

and the following (partiall) config:




Findings:
- The CBU cannot be programmed directly as Tuya-CPU is connected to RX1. Lift pin5 of Tuya-CPU to program.
- The device uses TuyaMCU ver=3 protocoll, this is the default TuyaMCU, not TuyaMCULE. tmSensor should not be used.
- The WIFI module is powered-on for less than 30 sec by Tuya-CPU at the configured interval, all reporting must be done within this frame
- The battery release has less startup delay than previous versions and connects to wifi/mqtt faster, might be other changes as well
- Static IP-config speeds things up
- delay_ms 30 might be needed to ensure that tuyaMCU driver is loaded properly

Solved as per previous post...