Hallo again . I have as single older smart switch based on the BK7231N chip . Haven't seen any related forum topic so i created this one . I upload firmware (will have credentials) , template and photos .
Getting bus success!
Going to set baud rate setting (115200)!
Chip ID: 0x7231c
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 200000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Flash size is 2MB
Entering SetProtectState(True)...
sr: 34
sr: 34
final sr: 34
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to read encryption key...
Encryption key read done!
Encryption key: 510fb093 a3cbeadc 5993a17e c7adeb03
Going to start reading at offset 0x00...
0x00... 0x1000... 0x2000... 0x3000... 0x4000... 0x5000... 0x6000... 0x7000... 0x8000... 0x9000... 0xA000... 0xB000... 0xC000... 0xD000... 0xE000... 0xF000... 0x10000... 0x11000... 0x12000... 0x13000... 0x14000... 0x15000... 0x16000... 0x17000... 0x18000... 0x19000... 0x1A000... 0x1B000... 0x1C000... 0x1D000... 0x1E000... 0x1F000... 0x20000... 0x21000... 0x22000... 0x23000... 0x24000... 0x25000... 0x26000... 0x27000... 0x28000... 0x29000... 0x2A000... 0x2B000... 0x2C000... 0x2D000... 0x2E000... 0x2F000... 0x30000... 0x31000... 0x32000... 0x33000... 0x34000... 0x35000... 0x36000... 0x37000... 0x38000... 0x39000... 0x3A000... 0x3B000... 0x3C000... 0x3D000... 0x3E000... 0x3F000... 0x40000... 0x41000... 0x42000... 0x43000... 0x44000... 0x45000... 0x46000... 0x47000... 0x48000... 0x49000... 0x4A000... 0x4B000... 0x4C000... 0x4D000... 0x4E000... 0x4F000... 0x50000... 0x51000... 0x52000... 0x53000... 0x54000... 0x55000... 0x56000... 0x57000... 0x58000... 0x59000... 0x5A000... 0x5B000... 0x5C000... 0x5D000... 0x5E000... 0x5F000... 0x60000... 0x61000... 0x62000... 0x63000... 0x64000... 0x65000... 0x66000... 0x67000... 0x68000... 0x69000... 0x6A000... 0x6B000... 0x6C000... 0x6D000... 0x6E000... 0x6F000... 0x70000... 0x71000... 0x72000... 0x73000... 0x74000... 0x75000... 0x76000... 0x77000... 0x78000... 0x79000... 0x7A000... 0x7B000... 0x7C000... 0x7D000... 0x7E000... 0x7F000... 0x80000... 0x81000... 0x82000... 0x83000... 0x84000... 0x85000... 0x86000... 0x87000... 0x88000... 0x89000... 0x8A000... 0x8B000... 0x8C000... 0x8D000... 0x8E000... 0x8F000... 0x90000... 0x91000... 0x92000... 0x93000... 0x94000... 0x95000... 0x96000... 0x97000... 0x98000... 0x99000... 0x9A000... 0x9B000... 0x9C000... 0x9D000... 0x9E000... 0x9F000... 0xA0000... 0xA1000... 0xA2000... 0xA3000... 0xA4000... 0xA5000... 0xA6000... 0xA7000... 0xA8000... 0xA9000... 0xAA000... 0xAB000... 0xAC000... 0xAD000... 0xAE000... 0xAF000... 0xB0000... 0xB1000... 0xB2000... 0xB3000... 0xB4000... 0xB5000... 0xB6000... 0xB7000... 0xB8000... 0xB9000... 0xBA000... 0xBB000... 0xBC000... 0xBD000... 0xBE000... 0xBF000... 0xC0000... 0xC1000... 0xC2000... 0xC3000... 0xC4000... 0xC5000... 0xC6000... 0xC7000... 0xC8000... 0xC9000... 0xCA000... 0xCB000... 0xCC000... 0xCD000... 0xCE000... 0xCF000... 0xD0000... 0xD1000... 0xD2000... 0xD3000... 0xD4000... 0xD5000... 0xD6000... 0xD7000... 0xD8000... 0xD9000... 0xDA000... 0xDB000... 0xDC000... 0xDD000... 0xDE000... 0xDF000... 0xE0000... 0xE1000... 0xE2000... 0xE3000... 0xE4000... 0xE5000... 0xE6000... 0xE7000... 0xE8000... 0xE9000... 0xEA000... 0xEB000... 0xEC000... 0xED000... 0xEE000... 0xEF000... 0xF0000... 0xF1000... 0xF2000... 0xF3000... 0xF4000... 0xF5000... 0xF6000... 0xF7000... 0xF8000... 0xF9000... 0xFA000... 0xFB000... 0xFC000... 0xFD000... 0xFE000... 0xFF000... 0x100000... 0x101000... 0x102000... 0x103000... 0x104000... 0x105000... 0x106000... 0x107000... 0x108000... 0x109000... 0x10A000... 0x10B000... 0x10C000... 0x10D000... 0x10E000... 0x10F000... 0x110000... 0x111000... 0x112000... 0x113000... 0x114000... 0x115000... 0x116000... 0x117000... 0x118000... 0x119000... 0x11A000... 0x11B000... 0x11C000... 0x11D000... 0x11E000... 0x11F000... 0x120000... 0x121000... 0x122000... 0x123000... 0x124000... 0x125000... 0x126000... 0x127000... 0x128000... 0x129000... 0x12A000... 0x12B000... 0x12C000... 0x12D000... 0x12E000... 0x12F000... 0x130000... 0x131000... 0x132000... 0x133000... 0x134000... 0x135000... 0x136000... 0x137000... 0x138000... 0x139000... 0x13A000... 0x13B000... 0x13C000... 0x13D000... 0x13E000... 0x13F000... 0x140000... 0x141000... 0x142000... 0x143000... 0x144000... 0x145000... 0x146000... 0x147000... 0x148000... 0x149000... 0x14A000... 0x14B000... 0x14C000... 0x14D000... 0x14E000... 0x14F000... 0x150000... 0x151000... 0x152000... 0x153000... 0x154000... 0x155000... 0x156000... 0x157000... 0x158000... 0x159000... 0x15A000... 0x15B000... 0x15C000... 0x15D000... 0x15E000... 0x15F000... 0x160000... 0x161000... 0x162000... 0x163000... 0x164000... 0x165000... 0x166000... 0x167000... 0x168000... 0x169000... 0x16A000... 0x16B000... 0x16C000... 0x16D000... 0x16E000... 0x16F000... 0x170000... 0x171000... 0x172000... 0x173000... 0x174000... 0x175000... 0x176000... 0x177000... 0x178000... 0x179000... 0x17A000... 0x17B000... 0x17C000... 0x17D000... 0x17E000... 0x17F000... 0x180000... 0x181000... 0x182000... 0x183000... 0x184000... 0x185000... 0x186000... 0x187000... 0x188000... 0x189000... 0x18A000... 0x18B000... 0x18C000... 0x18D000... 0x18E000... 0x18F000... 0x190000... 0x191000... 0x192000... 0x193000... 0x194000... 0x195000... 0x196000... 0x197000... 0x198000... 0x199000... 0x19A000... 0x19B000... 0x19C000... 0x19D000... 0x19E000... 0x19F000... 0x1A0000... 0x1A1000... 0x1A2000... 0x1A3000... 0x1A4000... 0x1A5000... 0x1A6000... 0x1A7000... 0x1A8000... 0x1A9000... 0x1AA000... 0x1AB000... 0x1AC000... 0x1AD000... 0x1AE000... 0x1AF000... 0x1B0000... 0x1B1000... 0x1B2000... 0x1B3000... 0x1B4000... 0x1B5000... 0x1B6000... 0x1B7000... 0x1B8000... 0x1B9000... 0x1BA000... 0x1BB000... 0x1BC000... 0x1BD000... 0x1BE000... 0x1BF000... 0x1C0000... 0x1C1000... 0x1C2000... 0x1C3000... 0x1C4000... 0x1C5000... 0x1C6000... 0x1C7000... 0x1C8000... 0x1C9000... 0x1CA000... 0x1CB000... 0x1CC000... 0x1CD000... 0x1CE000... 0x1CF000... 0x1D0000... 0x1D1000... 0x1D2000... 0x1D3000... 0x1D4000... 0x1D5000... 0x1D6000... 0x1D7000... 0x1D8000... 0x1D9000... 0x1DA000... 0x1DB000... 0x1DC000... 0x1DD000... 0x1DE000... 0x1DF000... 0x1E0000... 0x1E1000... 0x1E2000... 0x1E3000... 0x1E4000... 0x1E5000... 0x1E6000... 0x1E7000... 0x1E8000... 0x1E9000... 0x1EA000... 0x1EB000... 0x1EC000... 0x1ED000... 0x1EE000... 0x1EF000... 0x1F0000... 0x1F1000... 0x1F2000... 0x1F3000... 0x1F4000... 0x1F5000... 0x1F6000... 0x1F7000... 0x1F8000... 0x1F9000... 0x1FA000... 0x1FB000... 0x1FC000... 0x1FD000... 0x1FE000... 0x1FF000...
Basic read operation finished, but now it's time to verify...
Starting CRC check for 512 sectors, starting at offset 0x00
CRC matches 0x764C85!
All read!
Loaded total 0x200000 bytes
Wrote 2097152 to readResult_BK7231N_QIO_2026-01-3-21-53-55.bin
Backup created, now will attempt to extract OBK config.
It's not an OBK config, header is bad
OBK config not found.
Backup created, will now attempt to extract Tuya config.
Decryption took 5 ms
Tuya config extractor - magic is at 2023424 (0x1EE000)
Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
Malformed key?
Tuya keys extraction has found 36 keys
Tuya config extracted and shown.
MAC seems to be A8:80:55:08:05:53
Reading file firmwares/OpenBK7231N_QIO_1.18.266.bin...
Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.18.266.bin...
Using hack to write QIO - just skip bootloader...
... so bootloader will not be overwritten!
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 200000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Flash size is 2MB
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to do erase, start 0x11000, sec count 281!
Erasing sector 0x11000... ok! Erasing sector 0x12000... ok! Erasing sector 0x13000... ok! Erasing sector 0x14000... ok! Erasing sector 0x15000... ok! Erasing sector 0x16000... ok! Erasing sector 0x17000... ok! Erasing sector 0x18000... ok! Erasing sector 0x19000... ok! Erasing sector 0x1A000... ok! Erasing sector 0x1B000... ok! Erasing sector 0x1C000... ok! Erasing sector 0x1D000... ok! Erasing sector 0x1E000... ok! Erasing sector 0x1F000... ok! Erasing block 0x20000... ok! Erasing block 0x30000... ok! Erasing block 0x40000... ok! Erasing block 0x50000... ok! Erasing block 0x60000... ok! Erasing block 0x70000... ok! Erasing block 0x80000... ok! Erasing block 0x90000... ok! Erasing block 0xA0000... ok! Erasing block 0xB0000... ok! Erasing block 0xC0000... ok! Erasing block 0xD0000... ok! Erasing block 0xE0000... ok! Erasing block 0xF0000... ok! Erasing block 0x100000... ok! Erasing block 0x110000... ok! Erasing sector 0x120000... ok! Erasing sector 0x121000... ok! Erasing sector 0x122000... ok! Erasing sector 0x123000... ok! Erasing sector 0x124000... ok! Erasing sector 0x125000... ok! Erasing sector 0x126000... ok! Erasing sector 0x127000... ok! Erasing sector 0x128000... ok! Erasing sector 0x129000... ok!
All selected sectors erased!
0x11000...0x12000...0x13000...0x14000...0x15000...0x16000...0x17000...0x18000...0x19000...0x1A000...0x1B000...0x1C000...0x1D000...0x1E000...0x1F000...0x20000...0x21000...0x22000...0x23000...0x24000...0x25000...0x26000...0x27000...0x28000...0x29000...0x2A000...0x2B000...0x2C000...0x2D000...0x2E000...0x2F000...0x30000...0x31000...0x32000...0x33000...0x34000...0x35000...0x36000...0x37000...0x38000...0x39000...0x3A000...0x3B000...0x3C000...0x3D000...0x3E000...0x3F000...0x40000...0x41000...0x42000...0x43000...0x44000...0x45000...0x46000...0x47000...0x48000...0x49000...0x4A000...0x4B000...0x4C000...0x4D000...0x4E000...0x4F000...0x50000...0x51000...0x52000...0x53000...0x54000...0x55000...0x56000...0x57000...0x58000...0x59000...0x5A000...0x5B000...0x5C000...0x5D000...0x5E000...0x5F000...0x60000...0x61000...0x62000...0x63000...0x64000...0x65000...0x66000...0x67000...0x68000...0x69000...0x6A000...0x6B000...0x6C000...0x6D000...0x6E000...0x6F000...0x70000...0x71000...0x72000...0x73000...0x74000...0x75000...0x76000...0x77000...0x78000...0x79000...0x7A000...0x7B000...0x7C000...0x7D000...0x7E000...0x7F000...0x80000...0x81000...0x82000...0x83000...0x84000...0x85000...0x86000...0x87000...0x88000...0x89000...0x8A000...0x8B000...0x8C000...0x8D000...0x8E000...0x8F000...0x90000...0x91000...0x92000...0x93000...0x94000...0x95000...0x96000...0x97000...0x98000...0x99000...0x9A000...0x9B000...0x9C000...0x9D000...0x9E000...0x9F000...0xA0000...0xA1000...0xA2000...0xA3000...0xA4000...0xA5000...0xA6000...0xA7000...0xA8000...0xA9000...0xAA000...0xAB000...0xAC000...0xAD000...0xAE000...0xAF000...0xB0000...0xB1000...0xB2000...0xB3000...0xB4000...0xB5000...0xB6000...0xB7000...0xB8000...0xB9000...0xBA000...0xBB000...0xBC000...0xBD000...0xBE000...0xBF000...0xC0000...0xC1000...0xC2000...0xC3000...0xC4000...0xC5000...0xC6000...0xC7000...0xC8000...0xC9000...0xCA000...0xCB000...0xCC000...0xCD000...0xCE000...0xCF000...0xD0000...0xD1000...0xD2000...0xD3000...0xD4000...0xD5000...0xD6000...0xD7000...0xD8000...0xD9000...0xDA000...0xDB000...0xDC000...0xDD000...0xDE000...0xDF000...0xE0000...0xE1000...0xE2000...0xE3000...0xE4000...0xE5000...0xE6000...0xE7000...0xE8000...0xE9000...0xEA000...0xEB000...0xEC000...0xED000...0xEE000...0xEF000...0xF0000...0xF1000...0xF2000...0xF3000...0xF4000...0xF5000...0xF6000...0xF7000...0xF8000...0xF9000...0xFA000...0xFB000...0xFC000...0xFD000...0xFE000...0xFF000...0x100000...0x101000...0x102000...0x103000...0x104000...0x105000...0x106000...0x107000...0x108000...0x109000...0x10A000...0x10B000...0x10C000...0x10D000...0x10E000...0x10F000...0x110000...0x111000...0x112000...0x113000...0x114000...0x115000...0x116000...0x117000...0x118000...0x119000...0x11A000...0x11B000...0x11C000...0x11D000...0x11E000...0x11F000...0x120000...0x121000...0x122000...0x123000...0x124000...0x125000...0x126000...0x127000...0x128000...0x129000...Starting CRC check for 281 sectors, starting at offset 0x11000
CRC matches 0x3DC71697!
NOTE: the OBK config writing is disabled, so not writing anything extra.
Writing file data to chip successs.
Decryption took 2 ms
Tuya config extractor - magic is at 2023424 (0x1EE000)
Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
Malformed key?
Tuya keys extraction has found 36 keys
Starting write only OBK config!
Now is: Sunday, 01 March 2026 21:57:16.
Flasher mode: BK7231N
Going to open port: COM12.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Chip ID: 0x7231c
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 200000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Flash size is 2MB
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to read encryption key...
Encryption key read done!
Encryption key: 510fb093 a3cbeadc 5993a17e c7adeb03
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 200000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Flash size is 2MB
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to do erase, start 0x1D1000, sec count 1!
Erasing sector 0x1D1000... ok!
All selected sectors erased!
Now will also write OBK config...
Long name from CFG: OpenBekenN_SWITCH9
Short name from CFG: SWITCH9
Web Root from CFG: https://openbekeniot.github.io/webapp/
Writing config sector 0x1D1000...Writing file data to chip successs.
{
"vendor": "Tuya",
"bDetailed": "0",
"name": "Full Device Name Here",
"model": "enter short model name here",
"chip": "BK7231N",
"board": "TODO",
"flags": "2048",
"keywords": [
"TODO",
"TODO",
"TODO"
],
"pins": {
"7": "WifiLED_n;0",
"8": "Rel;1",
"10": "Btn_Tgl_All;0",
"26": "TglChanOnTgl;1"
},
"command": "",
"image": "https://obrazki.elektroda.pl/YOUR_IMAGE.jpg",
"wiki": "https://www.elektroda.com/rtvforum/topic_YOUR_TOPIC.html"
}