Home Automation

Flash Tuya Mini Smart Switch with ESPHome

Continuing the Tuya device hacking series, this post describes how to flash the Tuya Mini Smart Switch with ESPHome firmware. I picked up a few of these switches on sale for only a few dollars each, found that each of them are slightly different internally, despite looking almost exactly the same on the outside. This post covers the first of the three different versions I have, but I’m sure there are more out there.

Smart Switch Version 1

I looked up the pinout of the BK7231N qfn32 chip, and found that the pins are labeled on the chip itself. I was able to identify the following pins:

1
2
3
4
5
6
7
8
9
10
11
# Read firmware from device three times to ensure we have a good copy
ltchiptool flash read -d /dev/cu.usbserial-TG10005e0 -b 921600 BK7231N mini-smart-switch-num1-1.bin
ltchiptool flash read -d /dev/cu.usbserial-TG10005e0 -b 921600 BK7231N mini-smart-switch-num1-2.bin
ltchiptool flash read -d /dev/cu.usbserial-TG10005e0 -b 921600 BK7231N mini-smart-switch-num1-3.bin
# MD5 check
md5sum mini-smart-switch-num1-*.bin
# Keep one file where MD5s match
rm mini-smart-switch-num1-1.bin mini-smart-switch-num1-3.bin # read 1 was bad
mv mini-smart-switch-num1-2.bin mini-smart-switch-num1.bin
# Optional: Test reflashing the firmware
ltchiptool flash write -d /dev/cu.usbserial-TG10005e0 -b 921600 mini-smart-switch-num1.bin

The firmware was confirmed good, I wanted to try flashing it with ESPHome, as they have recently added support for the BK7231N chip. We will need configuration for the ESPHome firmware, which thankfully can be done by analyzing the firmware we just read from the device. Our new friend ltchiputil can do this, thanks to the “UPK2ESPHome” plugin. This can be done through the GUI, or from the command line:

1
ltchiptool plugin upk2esphome firmware mini-smart-switch-num1.bin

Which results in the following ESPHome configuration:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
esphome:
  name: upk2esphome-bk7231n

bk72xx:
  board: generic-bk7231n-qfn32-tuya

logger:

web_server:

captive_portal:

mdns:

api:
  password: ""

ota:
  password: ""

wifi:
  ssid: !secret wifi_ssid
  password: !secret wifi_password
  ap:

text_sensor:
  - platform: libretiny
    version:
      name: LibreTiny Version

binary_sensor:
  - platform: gpio
    id: binary_onoff_1
    pin:
      number: P6
      inverted: true
      mode: INPUT_PULLUP
    on_state:
      then:
        - switch.toggle: switch_1
  - platform: gpio
    id: binary_switch_all
    pin:
      number: P23
      inverted: true
      mode: INPUT_PULLUP
    on_press:
      then:
        - switch.toggle: switch_1

switch:
  - platform: gpio
    id: switch_1
    name: Relay 1
    pin: P7

status_led:
  pin: P26

With some minor adjustments, I compiled a new firmware using ESPHome, and flashed it to the device. The device booted up, and I was able to control the relay using the switch in Home Assistant without any issues. The physical switch also worked as expected, and the LED on the device was also functional. The device acts exactly as it did before, but now we have full control over it.

Smart Switch Version 2

Repeating steps…

1
2
3
4
5
6
# Read firmware from device until I had two good copies
flash read -d /dev/cu.usbserial-TG10005e0 -b 921600 BK7231N mini-smart-switch-num2.bin
# MD5 check
md5sum mini-smart-switch-num2*.bin

ltchiptool plugin upk2esphome firmware mini-smart-switch-num2-configured.bin
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
esphome:
  name: upk2esphome-bk7231n

bk72xx:
  board: generic-bk7231n-qfn32-tuya

logger:

web_server:

captive_portal:

mdns:

api:
  password: ""

ota:
  password: ""

wifi:
  ssid: !secret wifi_ssid
  password: !secret wifi_password
  ap:

text_sensor:
  - platform: libretiny
    version:
      name: LibreTiny Version

binary_sensor:
  - platform: gpio
    id: binary_onoff_1
    pin:
      number: P14
      inverted: true
      mode: INPUT_PULLUP
    on_state:
      then:
        - switch.toggle: switch_1
  - platform: gpio
    id: binary_switch_all
    pin:
      number: P8
      inverted: true
      mode: INPUT_PULLUP
    on_press:
      then:
        - switch.toggle: switch_1

switch:
  - platform: gpio
    id: switch_1
    name: Relay 1
    pin: P15

status_led:
  pin:
    number: P6
    inverted: true

Smart Switch Version 3

On inspection, I found it to have the ZT2S Tuya module, which, unfortunately is a Zigbee module, and not a WiFi module. Unfortunately, this means that this device cannot be flashed with ESPHome, and will not be covered in this post. I could replace the module with a small ESP8266 module, but that’s currently not worth the effort for me.

https://developer.tuya.com/en/docs/iot/zt2s-module-datasheet?id=Kas9gdtath9p0

Ref: