logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Fiddling with my first Matter device - 10A 1CH switch [CB3S / BL2028N (BK7231N)]

divadiow 4479 66
ADVERTISEMENT
Reply Cool? Ranking DIY | New topic
Notify about new articles
  • I grabbed this from Ali to have a play. https://www.aliexpress.com/item/1005006155824101.html

    Image of an AliExpress product page showing the Matter1CH switch module.

    It comes with a CB3S module which is BK7231N.

    The VCC was just about accessible with a pin, so no soldering.

    Short boot log:

    Code: text Expand Select all Copy to clipboard
    
BK7231n_1.0.13
REG:cpsr        spsr        r13         r14
SVC:0x000000D3              0x00401C1C  0x000033AC
IRQ:0x000000D2  0x00000010  0x00401E0C  0x37A60330  
FIR:0x000000D1  0x00000010  0x00401FFC  0x7A05E227  
SYS:0x000000DF              0x0040192C  0x00000158  
ST:0x00000000
[I/FAL] Fal(V0.4.0)success


go os_addr(0x10000)..........


    Assuming the CB3S module was standard hardware I used BKflasher to dump the factory firmware, attached. I also took a small risk and flashed OBK to the module to see if it would boot up with an AP, as expected with any non-Matter BK device, but sadly not. I was able to flash it back to factory though and it worked again.

    Will OBK not working be because of some other partition differences? The RF partition? Should I try "Restore RF part" in the easy flasher?

    Will OBK support Matter one day? Does it need to? I know there's a lot of other development, so maybe low priority.

    Questions!

    Anyway, here are some more pics

    Matter 1CH switch module next to an open casing with a visible electronic board on a green measurement mat. Electronic module with visible components labeled RSH-2L-TDQ001-WiFi-V1.0 Close-up of a PCB with various electronic components, including a KP16051SF chip. Smart module with casing and box. CB3S module with electronic components on a green mat. Electronic module with a green terminal block and a black relay. Relay module on a wooden surface. CB3S electronic module mounted on a board with other components. Confirmation of Uascent smart plug connection with Alexa account.
    Screen of BK7231 Easy UART Flasher app showing successful write process.
    Attachments:

    Cool? Ranking DIY
    About Author
    divadiow
    Level 34  
    Offline 
    divadiow wrote 2731 posts with rating 469, helped 245 times. Live in city Bristol. Been with us since 2023 year.
  • ADVERTISEMENT
  • #2 20940663
    p.kaczmarek2
    Moderator Smart Home  
    That's a very interesting and informative post. I haven't seen a matter BK7231 yet.

    Are you really sure that's BK7231N inside and not a BK7231M?

    Since you're saying it's not booting, did you try to catch the bootlog of this device after flashing OBK?

    Another experiment I would suggest is this:
    1. get any original tuya 2MB dump from supportable BK7231N device
    2. flash it to your device
    3. maybe check if you can pair it with tuya as the other device?
    4. flash OBK on top of that
    5. check again if it works or not?

    You can get any dump here:
    https://github.com/openshwprojects/FlashDumps/tree/main/IoT/BK7231N
    Helpful post? Buy me a coffee.
  • #3 20940846
    divadiow
    Level 34  
    interesting. I had not heard of BK7231M. After spending ages flashing various CB3S and other BK7231N firmware, and even the BK7231M firmware from https://www.elektroda.com/rtvforum/topic4017870.html#20837165

    I did not get any output from TX uart log with any combination, not even OBK :( At most I got was 2 squares with a question mark in them. This didnt change with baud rates or retries.

    Finally, I tried to heat up the shield over the chip to see if I could get the whole thing to a temperature where the solder holding it in place melted. I do not have a hot air gun. I gave up and used a blade to slice into the solder. I got it off. It's a BL2028N!

    Close-up of a BL2028N integrated circuit on a blue printed circuit board. Electronic circuit board with components on a wooden surface.

    So I'm no further forward getting a non-factory firmware working but I'll keep playing. Flashing from another BK7231N factory firmware to OBK does not seem to make a difference. No sign of the device in the Tuya/Cozylife/Smart Life apps with any Tuya firmwares.
  • #4 20940857
    p.kaczmarek2
    Moderator Smart Home  
    That's very strange, BL2028N is known to work with OpenBeken. Have you tried flashing whole 2MB of dump from a working OBK device or a flashable Tuya device?

    I would say that it has to work, because otherwise, it would mean that there is some kind of extra strange difference between your BL2028N and the old BL2028N's which worked with OBK, and that would be very.... strange.
    Helpful post? Buy me a coffee.
  • #5 20940900
    divadiow
    Level 34  
    yeh weird. I'll flash again with OBK and leave it longer.
  • Helpful post
    #6 20940912
    p.kaczmarek2
    Moderator Smart Home  
    I've searched for 0x00401C1C, here is a possibly related thread:
    Flashing Aubess Plug via Serial Adapter: BK7231M/CB2S Not Creating Open AP Post-Flash
    That seem to confirm that you have the M flavour marked suprisingly as BL2028.
    It also means that there is not much point in trying to run it with current build, we would need some SDK-site adjustments to support M, I don't know if it's currently possible.

    Added after 10 [minutes]:

    EDIT: I have one idea, I'll let you know.

    Added after 7 [minutes]:

    I think they might have just changed encryption keys. I'll try to provide you with a binary to test.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #7 20941456
    divadiow
    Level 34  
    p.kaczmarek2 wrote:
    That's very strange, BL2028N is known to work with OpenBeken. Have you tried flashing whole 2MB of dump from a working OBK device or a flashable Tuya device?


    yes, quite a few now. some of my own and at least these two in repo. no AP or log out with any

    Screenshot showing two BK7231N files listed.

    do we have any full 2mb ones from a known BK7231M?

    Added after 2 [hours] 10 [minutes]:


    Also they're not Tuya firmware now but uHome?
  • ADVERTISEMENT
  • Helpful post
    #8 20942139
    p.kaczmarek2
    Moderator Smart Home  
    I have some BK7231M devices sent by a user. Currently I've checked the dumps and they seem to have changed encryption keys, so the solution would be to build OBK with a correct keys:
    Snippet of the build.sh script for the OpenBK7231T platform with encryption-related lines.
    Helpful post? Buy me a coffee.
  • #10 20942214
    p.kaczmarek2
    Moderator Smart Home  
    What is the MAC address of this device?

    Added after 24 [seconds]:

    EDIT: Wait it seems you posted the reply on the screenshot while I was posting my question
    Helpful post? Buy me a coffee.
  • #11 20942216
    divadiow
    Level 34  
    ha. thought you'd gone mad

    38:73:EA:E2:C5:8B yes
  • #12 20965795
    divadiow
    Level 34  
    I picked up another Matter device. The familiar 16A mini switch. To my surprise this one comes with an ESP32-C3 chip on module SM-028C3 on a little riser. I can only find this in relation to that module model:
    Presentation board with SM-028C3 modules on display.

    some internals:

    Close-up of a green circuit board with labels: PWM5, PWM4, ITX, IRX, GND, VCC, and the text matter_module 20230512. SM-028C3 electronic module with ESP32-C3 chip on a carrier board with visible connectors. Opened Matter WiFi Smart Switch device with visible ESP32-C3 board. Close-up of a small electronic module labeled matter-module 2023051.2 with terminals marked PWM5, PWM4, TX, RX, GND, VCC. Close-up of a circuit board of a mini switch with markings and connectors. SM-028C3 module with ESP32-C3 chip on a green PCB with markings. Close-up of an ESP32-C3 chip on an SM-028C3 module. Image of a green printed circuit board with various connectors and labels. Box labeled Matter MINI WiFi Smart Switch on a green mat background.

    Sadly, I suspect it's like this device, with Secure Boot enabled so no flashing even Tasmota :(

    https://templates.blakadder.com/unsupported/sonoff_MINIR4M.html

    boot log

    Code: text Expand Select all Copy to clipboard
    ESP-ROM:esp32c3-api1-20210207
Build:Feb  7 2021
rst:0x1 (POWERON),boot:0xd (SPI_FAST_FLASH_BOOT)
SPIWP:0xee
mode:DIO, clock div:1
Valid secure boot key blocks: 0
secure boot verification succeeded
load:0x3fcd5978,len:0x38a4
load:0x403cc710,len:0x930
load:0x403ce710,len:0x5804
entry 0x403cc710
I (77) boot: ESP-IDF v4.4.3-dirty 2nd stage bootloader
I (77) boot: compile time 11:09:15
I (77) boot: chip revision: 4
I (79) boot_comm: chip revision: 4, min. bootloader chip revision: 3
I (86) boot.esp32c3: SPI Speed      : 80MHz
I (91) boot.esp32c3: SPI Mode       : DIO
I (96) boot.esp32c3: SPI Flash Size : 4MB
I (100) boot: Enabling RNG early entropy source...
I (106) boot: Partition Table:
I (110) boot: ## Label            Usage          Type ST Offset   Length
I (117) boot:  0 esp_secure_cert  unknown          3f 06 0000d000 00002000
I (124) boot:  1 nvs_matter       WiFi data        01 02 00010000 00006000
I (132) boot:  2 nvs_matter_bkp   WiFi data        01 02 00016000 00006000
I (140) boot:  3 nvs              WiFi data        01 02 0001c000 00010000
I (147) boot:  4 otadata          OTA data         01 00 0002c000 00002000
I (155) boot:  5 phy_init         RF data          01 01 0002e000 00001000
I (162) boot:  6 ota_0            OTA app          00 10 00030000 001e0000
I (170) boot:  7 ota_1            OTA app          00 11 00210000 001e0000
I (177) boot:  8 fctry            WiFi data        01 02 003f0000 00006000
I (185) boot: End of partition table
I (189) boot_comm: chip revision: 4, min. application chip revision: 3
I (196) esp_image: segment 0: paddr=00030020 vaddr=3c120020 size=20ee0h (134880)                                 map
I (227) esp_image: segment 1: paddr=00050f08 vaddr=3fc94a00 size=03a0ch ( 14860)                                 load
I (231) esp_image: segment 2: paddr=0005491c vaddr=40380000 size=0b6fch ( 46844)                                 load
I (242) esp_image: segment 3: paddr=00060020 vaddr=42000020 size=11c45ch (116438                                0) map
I (436) esp_image: segment 4: paddr=0017c484 vaddr=4038b6fc size=09154h ( 37204)                                 load
I (444) esp_image: segment 5: paddr=001855e0 vaddr=50000010 size=00010h (    16)                                 load
I (444) esp_image: segment 6: paddr=001855f8 vaddr=00000000 size=0a9d8h ( 43480)                                
I (458) esp_image: Verifying image signature...
I (458) secure_boot_v2: Verifying with RSA-PSS...
I (464) secure_boot_v2: Signature verified successfully!
I (473) boot: Loaded app from partition at offset 0x30000
I (473) secure_boot_v2: enabling secure boot v2...
I (479) secure_boot_v2: secure boot v2 is already enabled, continuing..
I (486) boot: Checking flash encryption...
I (491) flash_encrypt: flash encryption is enabled (0 plaintext flashes left)
I (498) boot: Disabling RNG early entropy source...
  • #13 20968295
    ferbulous
    Level 18  
    Hi @divadiow
    How did you restore to the stock firmware for the BL chip?
  • #14 20968329
    divadiow
    Level 34  
    oh. I think I used the Easy flasher. You have to check the "allow backup restore" box
    Screenshot of BK7231 Easy UART Flasher with the Allow backup restore option checked.

    and I think the filename has to start "readResult_BK7231N_QIO.." for it to appear in the list, if you're trying to restore from a backup taken by another app.
  • #15 20968339
    ferbulous
    Level 18  
    Thanks, i actually tried to restore to stock using bk7231tools but never worked for me.
    This was before easy launcher tool though

    Do you plan to swap esp32c3 chip on the matter relay switch since it’s secure boot enabled?
  • #16 20968355
    divadiow
    Level 34  
    ferbulous wrote:
    Thanks, i actually tried to restore to stock using bk7231tools but never worked for me.
    This was before easy launcher tool though


    excellent.

    ferbulous wrote:
    Do you plan to swap esp32c3 chip on the matter relay switch since it’s secure boot enabled?


    well. I don't *need* to, I have it just to play with tbh. I've got quite a few smart switches now. I am playing with a tiny ESP8285 that was orphaned from a destroyed GU10 that I've now flashed to Tasmota and have since found the GPIOs using an LED. This is the only mention of this tiny board I could find, so I've just updated the post for anyone else who might find the info useful

    https://discourse.superhouse.tv/t/flashing-an-esp-8285-on-a-wiz-bulb/741/4?u=divadiow

    anyway, it *could* be transplanted into the Matter device, but it'd need some careful layout and size planning. There are only 3 GPIOs to play with so I guess that would cover LED, button and relay.

    What I've not done is look for a pin-compatible ESP or BK module that would fit into the slot for a nicer soldered finish. I would consider that though.

    do you have the ESP device too?
  • #18 20968375
    divadiow
    Level 34  
    sure. a module would be much nicer than squeezing in something hacky. though it'd be more about the challenge than ending up with a working/deployable device.
  • ADVERTISEMENT
  • #19 20968406
    ferbulous
    Level 18  
    Not quite, but I do have a similar relay device like the matter version you have but it’s using TR6260 chip. I swapped it for esp32c2 running tasmota
  • #21 21106354
    divadiow
    Level 34  
    >>20940846

    OK. so I have my own thread to log some scribbles rather than muddying this one https://www.elektroda.com/rtvforum/topic4056377.html

    playing with my own RT-Threads bootloader device - the matter switch in the first post of this thread. CB3S.

    flashing Uascent factory and then flashing unencrypted BK-N RBL OpenBK7231N_App_1.0.0.rbl file to 0x143000 gives:

    Screenshot of console errors during work on RT-Threads device.

    Code: Text
    Log in, to see the code


    this is where I believe to OTA partition begins on this

    Screenshot of a hex editor with highlighted offsets.
  • #22 21115399
    p.kaczmarek2
    Moderator Smart Home  
    @divadiow what does the new flasher reads on your device?
    https://www.elektroda.com/rtvforum/topic4058227.html
    Can it flash it in BK7231M mode? Just make sure to restore backup first. Flashes is not writing the bootloader now.
    Helpful post? Buy me a coffee.
  • #23 21115403
    divadiow
    Level 34  
    I have progressed much further. I'll post with news shortly.

    I am juggling BK Writer 1.7.5, BKFIL and Easy Flasher for various bits

    Added after 1 [hours] 18 [minutes]:

    so after many hours of using various flashers, factory fw backups from my own UAM028 Uascent uHome Matter device and a couple of others around the internet, including a UAM027 bulb, I've managed to have some success getting OBK to boot using BKFIL and a series of steps.

    a few points of note/reminders:

    -This is a non-Tuya Matter device using CB3S/BL2028N module
    -only 1.0.13 bootloaders from other uHome devices are booting on this device
    -the coeff key is 4862379A 8612784B 85C5E258 75754528 but reads as 00000000 00000000 00000000 00000000 (presumably because efuse read-out is disallowed- something of note for others reporting 0s in Easy Flasher)
    -OTA partition is 0x143000 on these
    -I often have to wipe using Easy Flasher and/or BKFIL (from 0x0) then flash factory, bootloader again and then finally OBK rbl to OTA partition:

    BKFIL software configuration view with binary file parameters.

    -when the Bootloader detects data in 0x143000 it will begin flash update
    -after flashing the 3 files it will often take 1, 2, 3 reboots to initiate flash. eg:

    Code: Text
    Log in, to see the code


    flash happens when this is seen ###############BBBBBBBBBBB##################

    after OTA is complete the red text is appended to the output

    Screenshot of console showing logs related to firmware flashing process.

    and usually OBK begins to boot. it sometimes gets stuck at "bk_misc_init_start_type 0 0"

    Here's a full log from OTA flash through to OBK boot

    Code: Text
    Log in, to see the code


    BUT there is no mac address and so no AP broadcast despite the full factory firmware being flashed in bin 1 in BKFIL

    Info:GEN:dhcp=0 ip=0.0.0.0 gate=0.0.0.0 mask=0.0.0.0 mac=00:00:00:00:00:00
    Info:GEN:sta: 0, softap: 1, b/g/n
    Info:GEN:softap:ssid=OpenBK7231N_8C000000,channel=1,dhcp=1,cipher_type:OPEN

    and no, RF restore doesn't do anything to help. presumably RF partition is in a different location or something.

    so that's where I am right now. my next thing is to work out where the RF partition is.

    Added after 2 [hours] 11 [minutes]:

    look like RF is at 0x1F6000 on these.

    Screenshot displaying hex data from a binary file.

    vs standard Tuya at 0x1D0000

    Screenshot showing binary data in a hex editor.

    reflashing uhome factory and tuya extracts to 0x1F6000 makes no difference to the no-AP situation


    Screenshot of binary file flashing configuration.
  • #24 21135100
    divadiow
    Level 34  
    added SPI dump of a second 1CH white UAM028 BK7231N/BL2028N Matter CB3S to first post for the collection - CB3S_uHome_Matter_1CH_White_UAM028_SPI.bin

    Circuit board connected to a programmer with wires on a desk.
  • #25 21135369
    p.kaczmarek2
    Moderator Smart Home  
    Can you move the RF partition to the place where OBK expects it to be?
    Helpful post? Buy me a coffee.
  • #26 21135390
    divadiow
    Level 34  
    >>21135369
    divadiow wrote:
    look like RF is at 0x1F6000 on these.



    vs standard Tuya at 0x1D0000



    reflashing uhome factory and tuya extracts to 0x1F6000 makes no difference to the no-AP situation



    already tried that :(

    I have yet to try again though. I plan to start again with new SPI dump

    Added after 1 [minutes]:

    ok so that previous post only mentions the non-Tuya RF location, but I have tried standard 0x1D0000 too, both manually with BKFIL and Easy Flasher
  • #27 21136199
    divadiow
    Level 34  
    I'm no further forward but to make my experience more real here are some gifs.

    first are the files I have queued and then flash with BKFIL
    BKFIL software screenshot with BIN file download configuration.

    then the reboot, a couple of CENs before it'll start OTA, then a couple more CENs to get it to boot fully into OBK.

    GIF showing a terminal console with a flashing and OTA, OBK booting process.

    Added after 9 [minutes]:

    I've flashed uHome and Tuya RF to 0x1F6000 and 0x1D0000 to no effect
  • #28 21137333
    ferbulous
    Level 18  
    Hi, have you tried the 4 gang version?
    The 3 gang and below has COM port and the
    3 wires to connect to the switch.
    But the 4 gang version doesn’t have COM port and there’s only 4 wires to the switch.

    Fiddling with my first Matter device - 10A 1CH switch [CB3S / BL2028N (BK7231N)]
  • #29 21137409
    divadiow
    Level 34  
    Hello. I only have 2 1CH uHome Matter mini switches with which I have been trying to get Openbeken to work on.

    I'm not sure I understand the relevance to the physical differences you have pointed out in the 4CH device though. Presumably the challenges/issues will be the same regarding coeff, bootloader, partition layout, RF not working?

    Added after 2 [minutes]:

    Have you tried to get Openbeken onto one of these? If yes, does your experience match all the above in my previous posts?

    Added after 28 [minutes]:

    Maybe @p.kaczmarek2 would like one of these? Feels a bit passive aggressive perhaps if I just send one.
  • #30 21137429
    ferbulous
    Level 18  
    >>21137409

    Just thought you might’ve figured how to connect the 4gang version to the switch (if you bought one) because I can’t get it to work yet.

    It’s actually the same as this one by avatto with the same pinout except relay 2 is assigned to p28 instead of rx1.
    And it does have 5 cables including COM while mine only has 4

    WSM16-4 WiFi switch module on a black table background.

    I swapped the matter cbu with spare cbu that i have and i got it flashed. I had to add some more solder to each sides because it just wasn’t budging with hot air & flux

    https://www.elektroda.com/rtvforum/topic3946831.html
Reply Cool? Ranking DIY | New topic
Notify about new articles
Report a violation of the law

Topic summary

The discussion revolves around the user's experience with a Matter device featuring a CB3S module and BK7231N chip. The user attempted to flash the device with OpenBeken (OBK) firmware but encountered issues, including failure to boot and lack of output from the TX UART log. Various suggestions were made, including flashing original firmware from compatible devices and experimenting with different firmware dumps. The conversation revealed that the device might actually contain a BL2028N chip, which is known to work with OBK. Users discussed the challenges of flashing non-Tuya firmware, the significance of encryption keys, and the need for adjustments in the SDK to support the BK7231M variant. The user also explored the possibility of using other modules and shared insights on restoring stock firmware and the implications of secure boot on flashing processes.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT