Kankun smart plug OpenWRT upgrade

During recent cleanups of all my IoTs devices, I wanted to disable Kankun reporting to company servers (I’ve moved everything to customs firmwares like Tasmota or Espurna with House Assistant to manage it – so I don’t want any third parties) and also it seemed to be a good idea to upgrade OpenWRT on it.

If you haven’t seen this type of smart plugs it’s a little nifty device. Comparing to recent Sonoff type smart plugs – that utilize esp8266 (that I like a lot and use with all type of other projects – but mostly ESP32 now) – this plug has Atheros AR9330 rev 1 chipset with full OpenWRT Linux on it. If you want to do more, than just on/off operations it’s just perfect device.

So, just to give you an idea how I’m planing to use it – lately (probably because it’s an old hardware) for time to time my main Linux server is crashing. But instead of rebooting it simply hangs – something to do with IO on disk array. But since it’s happening so rarely, and it can happen even with new hardware, I wrote a small script that will reboot device connected to Kankun plug if it’s internal counter won’t be zeroed regularly. So with CGI script my Linux server is heartbeating Kankun every 5th minute. If it fails to do so, after 10 minutes (two beats) – Kankun will restart server on it’s own. So this will work even when WiFi network will go off.

Long story short, if you would like to update your plug to latest, supported OpenWRT 17.01.7 (it would probably work also with newer releases – but I don’t need it), you can download prepared firmware from here (sorry, I’ve deleted the file during cleanups).

The only difference, from stock binary, is that this firmware has enabled WiFi by default, so you can connect to your Kankun after upgrade. It creates “OpenWRT” access point – without password.

Step, by step:

  • First you need to connect to your device with ssh – default credentials are (root/p9z34c). This can also produce another problem, ssh daemon on Kankun is so old, that newer ssh clients does not accept it’s algorithms. To force ssh client to use older agorithm add “KexAlgorithms=+diffie-hellman-group1-sha1“. So it should look like this “ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 root@kankunIP”
  • Create backup of current firmware “cat /dev/mtd5 >/tmp/backup.bin”
  • Copy backup file to other device (with scp)
  • Copy new firmware to /tmp/
  • Flash new firmware (the same command to restore backup) “sysupgrade -v -n /tmp/lede-17.01.7-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin”
  • Login to new device with ssh on root account – there is no password now
  • User ‘passwd’ to setup root password

Then to control relay in the plugin:

echo 26 > /sys/class/gpio/export
echo out > /sys/class/gpio/gpio26/direction

After above (put it to /etc/rc.local) you can on and off relay with:

root@KankunPlug:~# echo 1 >/sys/devices/platform/ath79-gpio/gpio/gpio26/value 
root@KankunPlug:~# echo 0 >/sys/devices/platform/ath79-gpio/gpio/gpio26/value 

There is also one more issue – button doesn’t work as before – it will only restart plug. Quick investigation shows that we have to modify one file “/etc/rc.button/reset”.

I could provide it with the firmware – but I’ve find out, it doesn’t work, after everything else was done. So you have to change it by yourself. For example it could look like this:


. /lib/functions.sh

OVERLAY="$( grep ' /overlay ' /proc/mounts )"

case "$ACTION" in
  [ -z "$OVERLAY" ] && return 0

  return 5
  . /etc/diag.sh
  set_state failsafe
  if [ "$SEEN" -lt 5 ]
  elif [ "$SEEN" -lt 10 ]
    echo "REBOOT" > /dev/console
  elif [ "$SEEN" -ge 10 -a -n "$OVERLAY" ]
    echo "FACTORY RESET" > /dev/console
    jffs2reset -y && reboot &

return 0

You will also need “/usr/bin/relayCycle.sh” used above. I could include it in this script as a function, but I’ve also used it in CGI – so it’s separate command.

Anyway, this will work now like this. If you press the button and release it under 5 seconds – this will change relay state (cycle), 5-10s – reboot device, >10s – do the factory reset.

And /usr/bin/relayCycle.sh (remember to make it “chown a+x”):


ST=`cat $FILE`

if [ $ST -eq 1 ]
  echo 0 >/sys/devices/platform/ath79-gpio/gpio/gpio26/value
  echo 1 >/sys/devices/platform/ath79-gpio/gpio/gpio26/value

Above article was partially based on: https://openwrt.org/toh/kankun/kk-sp3

Notify of

Inline Feedbacks
View all comments
3 years ago

Update firmware link not work, can you reupload?

3 years ago
Reply to  Sauron

Ouch, was looking for that as well!

Is it just enough as changing /etc/config/wireless as mentioned in https://openwrt.org/docs/guide-user/network/wifi/basic right?

2 years ago

The firmware is available directly from openwrt. It’s the same as TP-Link WR703n and comes with WiFi enabled by default.

After flashing connect to SSID “Openwrt” as above.
To connect to your home Wifi there are two things to do:
append two lines to /etc/config/network
config   interface  ‘wwan’
    option  proto  ‘dhcp

replace the config wifi-iface section in /etc/config/wireless with
option device ‘radio0’
 option network ‘wwan’
 option ssid ‘<your-SSID>’
 option mode ‘sta’
 option encryption ‘psk-mixed’
 option key ‘<your-WPA2-key>’

vi is available as an editor or use (Win)SCP to edit the files.

1 year ago
Reply to  Pete

I did flash with https://archive.openwrt.org/releases/17.01.7/targets/ar71xx/generic/lede-17.01.7-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin but now I can’t connect to device anymore. Looks like wifi AP is not running on this image or I did something wrong even the update was successful. Any help what I can try?

Would love your thoughts, please comment.x