Digoo NX-SP202 smart wifi socket support possible?

[kobuki]

I've purchased a "Digoo NX-SP202" dual smart socket with power metering capability which is most probably using a ESP8266 module variant. I've made a few photos and there are a few interesting chips on the board. I didn't take it apart more as I was afraid of breaking it. If hints of support are positive, I'll take an attempt at complete disassembly. In general, I'm reluctant in giving out my WiFi password to a cloud-only device which controls any mains outlet so I bought it with the anticipation of being able to apply a 3rd-party OSS firmware.

Chips are (first image, from left to right):

1. KP3210SG / AK7EPG.1 / H38 - Kiwi Instruments switching regulator controller
2. BL 0937 / 1818AYH / D798090F - Shanghai Belling "Single phase, built-in oscillator, active power, RMS, and energy metering" IC
3. AMS1117 / 3.3 DN17 - 3.3V LDO

For the metering IC, there's a Chinese PDF available. It apparently uses a fixed pulse width frequency-modulated scheme for U/I/P sensing output.

On the second image, at the top, the WiFi board is clearly visible. It reads KZL827VA and a (manufacturing?) date. Looks very much like the other WiFi boards seen in other espurna compatible devices.

Outside image:

[kobuki]

Upon further investigation, it looks like a "Blitzwolf" variant with 2 relays and utilizing a single BL0937 which already has support. It requires desoldering the plug pins from the board (a very stupid but somewhat sturdy choice) so I'll leave it for later but I think it's supportable.

[ColinShorts]

I think you'll need to disassemble further to identify the vertical module, and maybe see if there are any easily accessible solder points for flashing. I don't think it'll use boards anything like their IP cameras (Linux based), so it'll hopefully be esp based. The BL0937 is supported, so seems plausible.

[kobuki]

Yeah, I plan to fully disassemble it later. The MAC address starts with ce:50:e3 which is a locally administered one, according to the RFC. They're not using an official MAC allotted for Espressif. Fishy, though it works.

[ColinShorts]

I thought that address looked familiar, but it's not in my collection (from dhcpd.conf):

class "iot1" { match if substring (hardware,1,3) = 18:fe:34; }
class "iot2" { match if substring (hardware,1,3) = 2c:3a:e8; }
class "iot3" { match if substring (hardware,1,3) = 5c:cf:7f; }
class "iot4" { match if substring (hardware,1,3) = 60:01:94; }
class "iot5" { match if substring (hardware,1,3) = a0:20:a6; }
class "iot6" { match if substring (hardware,1,3) = dc:4f:22; }
class "iot7" { match if substring (hardware,1,3) = 84:0d:8e; }

It might be used on one of the splashproof sockets I bought from AliExpress that I've never used yet, or some bulbs that got too hot to use in an enclosed fitting... Nothing in the logs either. It'll bug me...

Anyways, if it's based on a blitzwolf you'll likely be in luck.

[xoseperez]

I also have one of these partially disassembled and I'm facing the same problem. I have not yet dared to desolder the plug pins, but it looks like the only way to reach the uC...

[xoseperez]

By the way, mine comes under the brand Oxaoxe, same model NX-SP202. Amazon [ES]: https://www.amazon.es/gp/product/B07G2JGYND

[kobuki]

Yeah, it looks the same model under different branding on the outside. I think I'll take the plunge tomorrow and desolder the pins.

[kobuki]

I made an attempt at desoldering the pins but I failed. I have little experience removing solder from such a mass. It's very hard to heat it to liquify the solder and then it's a very narrow place to work in. If anyone has suggestions on desoldering the pins (see the 2 large blobs of solder in my images), please reply.

Alright. Using the right soldering iron and the right temperature solved it. Images attached of the bare board. What's next?

[kobuki]

Some further investigation revealed a few pins (see the top of this image). The wifi board has 2x7 pins of which the leftmost 2 aren't connected to the main board but present.

Top row, pin 6 - Vcc
Bottom row:
pin 1 - right button (same image, on the other side of the board)
pin 5 - left button
pin 6 - GND

That's what simple DMM probing has shown. I don't know about the rest but since the number of pins is the same, the Vcc/GND is in the same position, I think for now it's possible to assume the layout is the same as for a Blitzwolf type socket so a reflash is likely possible.

If it indeed can be reflashed, OTA would be available for later updates, right?

[gn0st1c]

pin layout:
(shielded part pins = LEFT, bottom pins = RIGHT)

[kobuki]

@gn0st1c: Thanks. Is it from the same model or some module from another smart socket?

If I reflash it, OTA would be available for later updates, right?

[xoseperez]

Yes, you will be able to flash it OTA after.
Now we have to identify the GPIO for the two relays, the 3 GPIOs for the BL0937 (SEL, CF and CF1), the two LED and the button.
What temperature did you use to remove the blob of solder?

[kobuki]

Actually it has 2 buttons, 2 2-color (red/blue) LEDs, the BL0937 and the 2 relays. A lot of IO is needed.

I used 350°C and a solder suction tool. There're 3 blobs to take care of: line, null and ground. The latter is a flat pin between the relays.