Avatar Controls Smart Plug - Cutting the Cloud

Initially I thought that I would be able to reflash the Avatar Controls smart plug that I had repaired with Tasmota using tuyaconvert. But they only work with Espressif ESP32 based boards and once I had access to the internals I found that the microcontroller was a Beken BK7321TQN32 module.

Beken BK7231T sub board

Packed into this tiny 15x20 mm board (marked WB3) is a 32-bit CPU with 2 MB of flash ROM and both Wi-Fi and Bluetooth LE wireless connectivity. Which is all well and good, but how do I get access to and change the firmware of this SoC?

The first decision to make was - which open source firmware system to use on the reflashed device? Broadly speaking there appearred to be two main options, the previously mentioned Tasmota and ESPHome (there are other OS projects, eg EspEasy or ESPurna, but they seem to be somewhat deprecated). Tasmota is based on the MQTT protocol, which is a venerable and widely used communication protocol that should work with any home automation system. ESPHome is a newer project and tailored to integrate with Home Assistant. As I am planning on using the latter, ESPHome seemed the more reasonable choice (though I freely admit that this choice wasn't based on any deep understanding of their relative merits).

The next decision was - how to get the new firmware onto the chip? There is a no soldering option for reflashing Beken chips using tuya-cloudcutter, which uses an over-the-air exploit that has since been patched by Tuya. However the plug was probably old enough that it might have not been patched. The second option required a small amount of soldering - which I was not adverse to - and the use of a USB-to-TTL adapter, but had the advantage of being certain that it would work. However, depending on where the soldering points were this could get a little awkward.

Much rummaging later I couldn't find a Raspberry Pi (the OTA exploit is injected via a networked Raspberry Pi). But after taking another look at the access for soldering (I would have needed to unsolder the whole Beken board) I bit the bullet and ordered a second-hand Pi 4B from eBay along with a case, a 64 GB micro-SD card and a HMDI-to-micro HDMI cable (ouch!).

The instructions from Digiblur's site are given at pace with limited explanation but I found that I could follow them for most of the journey (appended below are some notes on the process). The Avatar plug wasn't on the list of known Manufacturer/Device names so I had to install the Tuya app on a smartphone (fortunately you can use it as a guest) to get the firmware information, which was v1.0.8 for both main and MCU modules. Armed with this info I went down the list of BK7231T 1.0.8 versions until one stuck - 1.0.8 - BK7231T / oem_bk7231s_rnd_switch. Then opened ltchiptool to get details of the active pins on the device, which gave;

I: UPK: Found BK7231T config!

I: UPK: Switch/plug config

I: UPK: - relay 1: pin P7

I: UPK: - button 1: pin P8

I: UPK: Status LED: pin P1,inverted True

So, one relay, one button and one LED. Ltchiptool will output a starter YAML file that will allow for basic control of the device.

Setting up ESPHome as an Add-on to Home Assistant was straightforward but I did have a hiccough on selecting the device type as, for BK72xx boards, there were two options, WB3S and WB3L. I couldn’t see any easy way of identifying which board I had (it was only marked as WB3). So I had to compare the pinouts for the two chips on LibreTiny and make an educated guess based on the proximity of the SCK and CEN attachment points and plumped for WB3L. I did have to combine the ESPHome and ltchiptool YAML into a single piece of code in order to get it to work (with a bit of assistance from Gemini on correct formatting of the YAML output). But work it did, in the end.

JOB DONE

Time: 1 day (combined over several)

Cost: ~£0.50 materials (£73.96 tools - an investment)

Digiblur - How To Guide - Tuya CloudCutter with ESPHome LibreTiny - No soldering

Step 1 - Building the Raspberry Pi Image

Rather than use a standard Raspberry Pi OS distro the protocol uses a headless Lite version that is stripped down and accessed remotely via SSH. I have no idea whether you could just use the standard Desktop Raspberry Pi OS but I'm guessing that you probably could. However in the absence of any real understanding I just followed the instructions…

The command line instructions are:-

• sudo raspi-config - opens the system settings menu to reset the country localisation

• sudo apt update && sudo apt install network-manager - updates the Pi with a list of relevant upgrades and installs the most recent NetworkManager package to manage local network connections

• sudo nano /etc/dhcpcd.conf alterations - tells your Raspberry Pi to stop managing the wireless network interface, giving the system a static IP address

• sudo nano /etc/NetworkManager/NetworkManager.conf alterations - opens the config file for NetworkManager and takes control of the systems network interfaces

Once rebooted Docker is installed, which is a "container" that tuya-cloudcutter will run in (basically a way to ensure that a program will run on all hardware environments).

Step 2 - Install / Update Tuya-CloudCutter

Set up tuya-cloudcutter for use.

The command line instructions are:-

• sudo apt install git - installs Git, which is a versioning software, but will also allow automatic downloading and installation of tuya-cloudcutter from a repository such as GitHub

• git clone https://github.com/tuya-cloudcutter/tuya-cloudcutter - downloads and installs tuya-cloudcutter

Step 3 - Install ESPHome Kickstarter firmware on the Device

Once tuya-cloudcutter is running it will need to know the current firmware version on the device to be cut. I located this via the Tuya app and stepped through the choices for my firmware and Beken chip versions until one stuck. Once tuya-cloudcutter has done its thing, you should see the reflashed device as an open network with the SSID of kickstart-bk7231. Connecting to it and opening the 192.168.4.1 address in a browser will pop up the device control page where you can give it the details of your network for it to connect. Once on your network you will be able to see its local IP number.

Step 4 - LT Chip Tool to configure the device

The next step is to install ltchiptool, which will interrogate the chip and give you a description of which pins are connected to output devices. It will also supply a basic YAML file for the device.

Step 5 - Install ESPHome Add-On or Docker Container

This will allow the move from the basic kickstart firmware to ESPHome firmware. As I am running Home Assistant adding ESPHome as an Add-on was the simplest option for me.

Step 6 - Install ESPHome Firmware and Integrate into Home Assistant

At this point things drifted a little from the protocol. Once the kickstart device is located, you can generate an .uf2 file with the ESPHome firmware and use the device's control page to upload it. After some time the device will reappear in Home Assitant with the new name you have given it. For me the process didn't result in a opportunity to include the YAML file supplied by ltchiptool, but with a bit of judicious copy and paste I could include it from the ESPHome Add-on by editing the device's YAML file there and installing it via the Add-on.

The end point of the protocol should be a reflashed device with basic control over its functions via a page on the Device & services Settings page of Home Assistant.

Avatar Controls Smart Plug - Into the Belly of the Beast

Having convinced myself that the smart plug was not working, it was time for a look inside.

But before that, an external inspection found no obvious charring or melted plastic that might have implied some sort of catastrophic failure.

Avatar Controls AWP14H 10 A UK Smart Plug

On the back of the device were manufacturer and model details and some basic electrical performance data (220-240 V input voltage and 2.3 kW / 10 A resistive load). There was also an IEC 60417 - 5016 symbol for a fuse described as a T10AL240V - which is a T[timed(slow blow)]10A[10 amps]L[low overcurrent rating]240V[mains voltage]. So somewhere inside is a 10 A fuse, which appeared to be a reasonable place to start.

The initial hurdle, then, was to open the case. A job easier said than done, as it is designed not to come apart for obvious reasons. Bigclivedotcom has published a video showing a fix for a similar plug in which he says that the cases are glued or possibly ultrasonically welded [timestamp 12:19]. Some vigorous poking with a blade and jeweller's screwdriver didn't make much progress. But a second YouTuber came up trumps; a bit of asymmetric squeezing from a quick-grip to generate a bit of radial stress resulted in a couple of cracking noises. After which the plug parted quite easily revealing the circuitry for inspection.

Avatar Controls AWP14H Smart Plug - Internal Layout

Again, no obviously burnt out components, but one of the electrolytic caps (arrowed) was suspiciously domed compared to the other two. If you watch Bigclivedotcom's video and another from the Buy it Fix it channel it appears that these caps are particularly susceptible to failing.

While it was open I had a look at some of the other components. From what I could glean I think the plug is organised as follows;

1. The T10AL250V fuse is in a board mounted package with a fusible resistor and a zinc oxide varistor for circuit protection and a single diode to rectify the AC supply into a half-wave DC supply.
2. The mains voltage is then converted to a rough 5 V DC supply by a small buck converter and a couple more electrolytic caps.
3. Our questionable 470 μF 16 V electrolytic cap smooths the output of the converter further.
4. Then a 3.3V voltage regulator supplies the control board on a riser.
5. This is a Beken BK7321 system-on-chip.
6. Finally this controls a 10 A relay that switches the plug.

The screen print on the PCB gives the board's details as HYS-01-127_V1.2 2020-07-17, meaing that the maximum age of the plug is 5 years.

I can check the fused components once the board is free from the plug base, but it looks like the low voltage cap is likely going to be the culprit. So out with the soldering iron it is then.

Most of the kit I already had; soldering iron, solder and soldering bit cleaner; and clamps to hold it steady. What I didn't have (or couldn't find) was any desoldering braid, flux or IPA. So these required a bit of shopping.

The IPA (isopropyl alcohol) for cleaning the board after soldering/desoldering came from Amazon for the low, low price of £6.59. I did have some of this before, but the advent of Covid-19 and the great IPA shortage of 2020 emptied my stocks. Obviously I don't want to be sloshing IPA out from a 1 L bottle onto the workpiece, so I poured a bit into an old screw-cap perfume bottle one of the tykes had discarded. Amazon had no SDS available but the supplier, Trade Chem, were quickly able to send one by e-mail (a sign of a good company). The only issue was the cap liner coming apart but that is what you get for cheap-as-chips.

Next was flux and desoldering wick. I hadn't used an electrical soldering flux before but as this job would rely on desoldering I decided not to try and bodge it. So had a look at a couple of videos on flux (What is this flux stuff anyway? and Which one should I buy?) and decided that the whole topic was too niche to get into for a small job. In the end I bought what I felt was one of the more general purpose no-clean fluxes, MG Chemicals 8341 No Clean Flux Paste, at £7.58 on Amazon. An SDS was sourced from CPC Farnell. Along with a hilarious instruction video showing exactly the wrong way to attach a Luer lock needle.

Needlestick injury incoming

Hint: Use the needle cover to twist the needle onto the syringe, then take the cover off. That way if you slip whilst putting the needle on you don’t end up injecting yourself with rosin (yes I know it is a blunt needle but you can stick yourself with it just the same).

Onto desoldering wick and at this point I was running out of steam so I just bought some MG Chemicals Super Wick No-Clean Fine Desoldering Braid, 2.5 mm x 1.5 m 426-NS for £3.22 from CPC Farnell. Good, bad or indifferent it will have to do.

Now I had the tools and materials to hand it was onto desoldering the board from the 3-pin socket assembly. This wasn't quite as straight forward as I had hoped. As the board's main input pins were connected back to the plug socket pins they sucked heat away really fast so even with the soldering iron up at 400 ^oC and added fresh 60:40 solder it was a bit of a struggle. The wick worked quite well but I couldn't easily part the board from the base and when it did come away it took the tag off the neutral pin. There was also some naughtiness with the 10 A fuse.

Avatar Controls Smart Plug - Board dismounted (left), mains tag issue (top right) and unintended fuse damage (bottom left).

Fortunately the fuse was still OK, just a bit melted, as was the fusible resistor next to it meaning that a blown fuse was not the issue. But now I had to repair the tag before I could get back to the original repair. The tag that had come astray looked like it hadn't been punched on properly as I didn't find any pieces of brass that had come away. I did try to punch it back in but it didn't work, so in the end I flooded it with solder. This might not be a great fix but, as regluing the case will make the plug weaker as well, I am not planning on moving it around a lot. So it will have to do.

The final job was to remove the suspect capacitor, which went without issue.

Failed electrolytic capacitor

As well as the slight doming on the top, the bottom was also deformed. When I brought out the multimeter to check its value I found that its max range was 40 μF meaning the replacement cap I had bought would be over range; however measuring the old cap gave a value of 12 μF which is quite a long way from the 470 μF that it should have been. Definitely the prime suspect.

The faulty cap was from a Chinese manufacturer, Dongguan Zhuo Wang Electronics Technology. The full extent of the specs that I was able to obtain was what was written on the outside of the component's packaging. A search for an identical replacement or a similar 470 μF 16 V cap in the same size format yielded nothing so I plumped for the closest that I could find which was a Panasonic EEUFR1C471. These FR- series caps from Panasonic have low ESR (electrical series resistance) and are designed for long service lives with high ripple currents. So I replaced the duff cap with a new one and resoldered the board back onto the base.

Repair Avatar Controls Smart Plug

Once reassembled and plugged in a blue LED came to life and the socket could be switched on and off at the power button. The plug was also visible on Bluetooth as a Tuya LE device.

So it seems to be functional again. The next step is to deal with the firmware…

P.S.

I did contact both Farnell and MG Chemicals to let them know about the H&S flaw in their video, both of which replied that they "would pass it on to the relevant Dept." But it is still up. So if you have stuck yourself, they have already been warned.

Avatar Controls Smart Plug - ?Dead

What's this?

Well from an external source, a "Smart" plug has come winging my way. A friend gave it to me saying that it was not working.

Ten years ago I might have had to explain what a smart plug was but they are pretty common these days. This one is marked as an Avatar Controls AWP14H 10 A UK 3-pin socket. I have no other provenance on it apart from that. I don't know why it isn't working (or even if it is or is not), how old it is, or where it came from.

A trip to Avatar's website only shows info on its latest model, a 16 A version, for which they have stupidly used the same model number. Their support pages are limited to pushing their control app (more on that later) with no product sheets or even any info for older models.

In an effort to track down some relevant data I had a poke around the Wayback Machine. The company have been on the web since 2016 (but only with a placeholder website initially). Our product pops up sometime between 26/06/2019 and 28/09/2019 but had disappeared two years later by 28/10/2021.

No product datasheet was available, with only the following information available.

AWP14H Smart WiFi Plug UK Socket

AvatarControls' Smart Plug is the world's first minimum size UK smart WiFi plug, which has a small size. It can be connected with your phone to control remotely, and support Amazon Alexa & Google Home and IFTTT protocol, which makes your home appliance more intelligent.

Features

• Minimum size design
• Voice Control Works With Amazon and Google Assistant
• IFTTT Put the internet to work for you
• Real-time Monitoring, Energy Saving
• Remote Control, support 3G/4G network, Free APP
• One button to set time function, Multi-group time setting function
• One button to share device to families and friends
• Max current 10A and Max power supports 2300 Watt

So not much on communication protocols (ie Wi-Fi or Bluetooth) other than which home automation services (ie Amazon Alexa, Google Nest, IFTTT) it will interface with, but at least a set of features to expect from it. Hoping that the support data for the associated app might give me some clues was fruitless as there was nothing present on the web around this time. A general web search over the product's "live" dates provided no further information either.

"But, why not just download the app from Avatar Controls and use that to test it?" I faintly hear you ask. Well, firstly, some plugs from some manufacturers have been caught sending large volumes of data out of network and a relatively recent press release from Nokia (remember them?) claimed that 40% of DDoS attack traffic was coming from IoT devices. Secondly, being reliant on the Avatar Controls app means having your data being sent back to them and potentially not just usage data but also voice data (under terms of use agreements that are notoriously easy to "readjust" after the fact). Finally, being reliant on the Avatar Controls app also means relying on their servers working and continuing to support your device. All in all I would prefer to stay clear of the app if at all possible and keep control of both the plug and its data local.

As it happens this may be possible. The Avatar plug seems to have been designed under licence from another manufacturer, Tuya, which is claimed to be the world's leading IoT cloud platform with 252,000 different types of device. They also provide a control app, Smartlife, but that only replicates the same risks as above. However it appears the industrious hacking community have developed ways to reflash the control chips with an open source firmware, Tasmoto, using tuyaconvert. So although not an easy road, it appears that there may be a way forward to making this plug more secure.

But only if it is working…

Ho hum. Back to first principles then, switch it on and see if it lights up.

No lights, no Wi-Fi, no Bluetooth. Pressed and held what I thought might be the pairing button for 5 secs and still nothing. A dead stick. Time for surgery.

P.S.

On the Avatar Controls website I noticed that their UK web store gives a US address as their contact details, but only as a town and Zip code. As I have an enquiring mind I wondered what their offices looked like and it appears that "looked" is the operative word as the industrial unit that they gave as their address is marked as "Permanently closed."

A bit more digging gave an address for their Head Office in China, the very much more impressive Satellite Mansion in Nanshan, Gaugndong province.

Not having a local address and telephone number is a bit of a red flag for dealing with a company. But as I am not buying only repairing/hacking it is not of major importance, to me at least.

'Fridge Door Shelf Repair

Another day, another fix; this time part of the 'fridge has fallen apart. One of the door shelves to be precise, and when I say "fallen apart" I mean a previous fix has failed.

IIRC, at some point in the past I dropped the shelf whilst cleaning it and one of the locating lugs snapped off. But, as I had the materials to hand from the last time I had to repair a SAN (styrene-acrylonitrile resin) fitting from the 'fridge, it wasn't a difficult repair to complete. As you can see the previous repair wasn't a craftsman's job but it had held out for at least a couple of years.

Failed 'fridge door shelf repair

Unfortunately, when I went to make the MEK:DCM 3:1 mix I had used to solvent weld it previously, I found that the dichloromethane had completely evaporated and all I had left was an empty bottle. On inspection it seems that the bottle that it was supplied in wasn't fit for purpose (thanks redoka-chems), next time I'll have to use a better bottle. However, as I learnt previously, "MEK is the required active component and that DCM can be used if a fast drying solvent is required." So I just didn't bother with the dichlor and scrounged up some cloudy MEK that I had been using to solvent weld PVA waste piping (hence the white colour).

Shelf repair in progress

I liberally applied MEK and taped the joint up to secure it in position while it set overnight. The next day everything looked OK, even if the repair was even more bodged than last time. Giving it a bit of a flex to test it under stress seemed fine, but when I tried to refit it there was a sharp crack. Back out with the MEK to reseal the opened joint.

Completed 'fridge door shelf repair

As the part is push to fit I wondered whether the act of gluing the break had caused a bit of shrinkage. So I took out a flat needle file and spent ten minutes opening up the notch in the lug so that it wasn't putting as much stress on the welded joint.

Refitted 'fridge door shelf

This seemed to do the trick and shelf slotted back into place without any more issues. Luckily you can't see the god-awful repair when you open the door so all is good.

JOB DONE

Time: 20 mins in aggregate
Cost: £0.00