logo elektroda
logo elektroda
X
logo elektroda

Tuya Wifi Sensor MM32F003TW loses WiFi after low battery—how to recover or reflash?

dex 129 2
ADVERTISEMENT
  • #1 21802374
    dex
    Level 27  
    Tuya Wifi Sensor MM32F003TW loses WiFi after low battery—how to recover or reflash?
    I am trying to recover, self died sensors.
    5-4 years ago I bought 4 of them on aliexpress for like 25-30euro for 1pcs. At that time it was quite expensive, nowadays you can get such sensor for like 8-10 euro. All 4 sensors died when the battery voltage was slowly decreasing. Sensor were set to report the data every 20minutes, they were used to control heating in house. The battery set could withstand like 8-10 weeks. If you did not change them on time the sensor was "kaput". So is the story. The problem was reported by other users wide on internet. The reason is probably explained in the errata of the MindMotion MM32F003 mcu. As for now I just want to repair them, "as it is"(actually as it was).

    The issue: the device is losing wifi connection, the LCD display works, temp humidity measurements works, you can press the pair button, wifi icon is blinking - but it does not connect to the router. After battery insertion it starts, but id does not set proper time wihout network acces, clock starts and counts from 0:00.

    I figure out that the problem is in the WiFi CSB3 module.
    What I did I cloned the data from other newest similar sensor //but different MCU// with CB3S module, and I could pair it. I can connect it to network and the sensor is visible in the tuya Smart app. The donner device despite is powered went offline. I observed that they were visible kind of alternatelly. When one is visible the other is offline. This is I guess due to cloning of the wifi data, I do no tknow perhaps MAC or other ID.

    I can dump all the broken CB3S modules. The tricky point is I that..guess some section should be uniqe like MAC or tuya IS or key.
    As far as I remeber the broken//erased CB3S module was RF active, however, on a different way than good module. I was observing the RF activity on spectrum analyzer.
    Electronic module with microchips and connected color-coded wires
    Two TRONIC batteries in a white holder with a PCB showing CLK, IO, GND, VCC pin labels

    I will compare the dumps which are on the second computer. Tomorrow.


    There are some bytes differences in good and corupted CB3S module:

    Tuya Wifi Sensor MM32F003TW loses WiFi after low battery—how to recover or reflash?
  • ADVERTISEMENT
  • #2 21802906
    strikexp
    Level 27  
    In network cards and therefore Wi-Fi, you have a unique MAC address. You would have to change it to make two work on one Wi-Fi network.

    Check the one that doesn't start on another Wi-Fi network where this MAC has not been used.
  • #3 21803093
    dex
    Level 27  
    Spent like few hours to get the dump with Flasher, it always hangs stops in the middle of the process:
    SetProtectState(True) success!
    Going to read encryption key...
    Encryption key read done!
    Encryption key: 510fb093 a3cbeadc 5993a1e c7adeb03
    Going to start reading at offset 0x00...
    Reading 0x00... Ok! Reading 0x1000... Ok! Reading 0x2000... Ok! Reading 0x3000... Ok! Reading 0x4000... Ok! Reading 0x5000... Ok! Reading 0x6000... Ok! Reading 0x7000... Ok! Reading 0x8000... Ok! Reading 0x9000... Ok! Reading 0xA000... Ok! Reading 0xB000... Ok! Reading 0xC000... Ok! Reading 0xD000... Ok! Reading 0xE000... Ok! Reading 0xF000... Ok! Reading 0x10000... Ok! Reading 0x11000... Ok! Reading 0x12000... Ok! Reading 0x13000... Ok! Reading 0x14000... Ok! Reading 0x15000... Ok! Reading 0x16000... Ok! Reading 0x17000... Ok! Reading 0x18000... Ok! Reading 0x19000... Ok! Reading 0x1A000... Ok! Reading 0x1B000... Ok! Reading 0x1C000... Ok! Reading 0x1D000... Ok! Reading 0x1E000... Ok! Reading 0x1F000... Ok! Reading 0x20000... Ok! Reading 0x21000... Ok! Reading 0x22000... Ok! Reading 0x23000... Ok! Reading 0x24000... Ok! Reading 0x25000... Ok! Reading 0x26000... Ok! Reading 0x27000... Ok! Reading 0x28000... Ok! Reading 0x29000... Ok! Reading 0x2A000... Ok! Reading 0x2B000... Ok! Reading 0x2C000... Ok! Reading 0x2D000... Ok! Reading 0x2E000... Ok! Reading 0x2F000... Ok! Reading 0x30000... Ok! Reading 0x31000... Ok! Reading 0x32000... Ok! Reading 0x33000... Ok! Reading 0x34000... Ok! Reading 0x35000... Ok! Reading 0x36000... Ok! Reading 0x37000... Ok! Reading 0x38000... Ok! Reading 0x39000... Ok! Reading 0x3A000... Ok! Reading 0x3B000... Ok! Reading 0x3C000... Ok! Reading 0x3D000... Ok! Reading 0x3E000... Ok! Reading 0x3F000... Ok! Reading 0x40000... Ok! Reading 0x41000... Ok! Reading 0x42000... Ok! Reading 0x43000... Ok! Reading 0x44000... Ok! Reading 0x45000... Ok! Reading 0x46000... Ok! Reading 0x47000... Ok! Reading 0x48000... Ok! Reading 0x49000... Ok! Reading 0x4A000... Ok! Reading 0x4B000... Ok! Reading 0x4C000... Ok! Reading 0x4D000... Ok! Reading 0x4E000... Ok! Reading 0x4F000... Ok! Reading 0x50000... Ok! Reading 0x51000... Ok! Reading 0x52000... Ok! Reading 0x53000... Ok! Reading 0x54000... Ok! Reading 0x55000... Ok! Reading 0x56000... Ok! Reading 0x57000... Ok! Reading 0x58000... Ok! Reading 0x59000... 


    tried different speed. Higher the baudrate higher the adress when it stops. With low rates like 56kbps it stops very quickly. Funny year ago it has worked. doest it make any sense? The only difference is other usb adapter based on cp chip. I can not find th eold one.

    Dodano po 59 [minuty]:

    >>21802906 It was tested. the cloned device is recognized in tuya app as it would be the donner, despite it paired over second different wifi network. Currently strugling with flasher and usb adapter.
ADVERTISEMENT