The first time [konbaasiang] ordered some ceiling LED lights from Tuya, he was pleased to find they contained an ESP-12F that could easily be flashed with a different firmware. So when he ordered 30 more of them at a cost of nearly $900 USD, you can understand his frustration to find that the popular WiFi-enabled microcontroller had been swapped out for a pin-compatible clone that Tuya developed called the WB3L.
Some people would have just chalked this one up to bad luck and used the Tuya-supplied software to control their new lights, but not [konbaasiang]. Since the new chip was outwardly identical to the ESP8266, he decided to take the nuclear option and replace them with the genuine article. With a comfortable spot to work from and a nice microscope, he started on his desoldering journey.
Now it would have been nice if he could have just dropped in a real ESP-12F and called it a day, but naturally, it ended up being a bit more complex than that. The WB3L apparently doesn’t need external pull up and pull down resistors, but [konbaasiang] needed them for the swap to work. He could have come up with some kind of custom adapter PCB, but to keep things simple he decided to run a pair of through hole resistors across the top of the ESP-12F for GPIO 1/2, and use a gingerly placed SMD resistor to hold down GPIO 15.
[konbaasiang] reports that all 30 of the lights survived the transplant and are now running his own homebrew firmware. While this story had a happy ending, it’s still a cautionary tale. With a growing trend towards replacing the venerable ESP8266 with cheaper and less hacker-friendly silicon, buying IoT hardware with the intent to replace its firmware is likely to get riskier in the near future.
So he didn’t even open the clones metal can to show us the contents? I’m outraged to be honest. All my respects to the good sir though for his dedication to fix it.
That’s not a secret https://developer.tuya.com/en/docs/iot/device-development/module/wifibt-dual-mode-module/wb-series-module/wb3l-module-datasheet
The tuya module is actually an upgrade to the 8266 as it comes with Bluetooth.
Isn’t an Upgrade for me, as I often even don’t need WiFi. E.g. I use reprogrammed Gosund P1 as a programmable “Socket power on delay” for external Hardware/Detectors on “analytical Systems”…
Was a qnd solution because of peak current and I had a P1 in the car… Works, never change a running System 😜👍.
(Of course “we” have a switch on procedure written down somewhere, but who cares…)
I wonder if this is about being able to support the new CHIP IP protocol in the future. It requires Bluetooth LE for onboarding.
Unfortunately, I bought a couple of Tuya lights with same WB3L last year. first, the bluetooth doesn’t really work and damn! the part failed about a couple of months. I advise sticking to the good old ESP8266.
I couldn’t tell after a quick look, is Tuya calling these new one the same as the old ones? I have been frustrated by the emerging trend of not using version numbers (or any other identification) for slightly different versions of products. I guess the thinking is “It’s just a black box, no need to worry about what’s inside”. Sigh, just another example of the disposable culture we live in.
In most cases it is not visible from the outside what kind of MCU module is installed. Changes on the inside do not usually result in a different marking of the final product.
You can get a hint at what MCU is installed by observing its MAC address on your Wifi network and doing a lookup in an OUI database.
Tuya makes the module and software infrastructure for other manufacturers to integrate into their bulbs or other gadgets. The different modules have model numbers clearly printed on them.
Although I wouldn’t let a Tuya module on my network, I can’t fault them if the bulb manufacturer chooses to change modules without changing the SKU or packaging.
TUYA is actively resisting the community from using tools like `tuya-convert`. On their github they explain that there was a sort of cat-and-mouse game between them, with TUYA finding ways to oppose and tuya-convert finding work-arounds. Since approximately July 2020 TUYA products with different controllers altogether started popping up.
Obviously, not telling which controller is inside a product, on the box, is part of that strategy. Imagine a second hand market for products for their known controller…
Not exactly. Tuya has never actively impeded the DIY community. Tuya-convert started as a by-product of a security talk at some CCC conference. They just reacted (after a long long time) by “fixing” that “security flaw”.
We would all appreciate easy means of converting their products but Tuya are not the ones to blame here.
Shelly, for example, actively supports flashing your own firmware to their products by openly providing convenient headers to do so. Their OS even supports OTA flashing of foreign firmware, even including its own boot loader. Tuya was never embracing alternative firmware to the same degree because their business model seems to include control over their user’s devices and data.
“Frankensteining” of (not only Tuya) IoT devices happens on a daly basis in the “Tasmota” alternative firmware community.
There is also a lot of collective experience bundled in the device template repository.
Countless PCB images have been collectively analyzed in the Tasmota Discord channel.
What’s the best way to desolder Wroom modules with a big square pad underneath the module’s PCB?
You need to heat the PCB underneath. Hot air preheaters are a good choice. I’d imagine an MHP30 could help as well although I haven’t tried it yet.
The rebranded LSC Smart Home LED strips I bought (from a European store chain called Action) now contain a Beken BK7231 WiFi-enabled microcontroller. This is not a module, but just a 32-pin QFN on the main PCB with support components (including a crystal). There’s no easy way to swap it, lest you want to go dead-bug style with lots of magnet wire.
You have two good choices in that situation:
1) Find the RGB Mosfets and 3v3/GND and wire up an ESP12 module to them (<$1)
2) buy a H801 LED controller including the a.m. module ($6.5)
Tom,
I found your Hackaday posting as I too was trying to identify a mysterious SoC board inside an RGB LED controller. Again, this one has the dreaded(?) Beken BK7231T Wifi & Bluetooth mini board welded to the main PCB. What I can confirm though, thanks to clues posted here is, my mystery board is a “Tuya WB8”.
There is a closely related “Tuya WB3S” (BK7231T) board with a developer page showing matching pinouts.
https://developer.tuya.com/en/docs/iot/wb3s-module-datasheet?id=K9dx20n6hz5n4
The pinouts seem an almost 1:1 swap with the ESP-12F module except, there is an extra UART TX/RX channel. According to the WB3S datasheet, UART2_TXD (P0) and UART2_RXD (P1) are used to display internal information of the module and are “unavailable to customers”. On my board these pins are not used, so are possibly inert?
Thanks for posting :)
This is one of those “they got popular because they were hackable now they don’t want us to hack them” deals. Give it 6 months to a year and Tyua will be sad no-one buys their products any more.
Check this out: https://www.elektroda.com/rtvforum/topic3850712.html
How to write your own firmware for the Beken devices and there is also a Tasmota replacement already made.