Broadlink MP1 Quad Socket WiFi Power Strip Review and Teardown

Broadlink MP1 is an inexpensive ($20) power strip with four international sockets that can be controlled over WiFi. Since I was interested in finding out how the power strip was designed internally, I asked GearBest whether they could send a sample for evaluation, which they did, and I got it today. So I’ll first check the device, and hardware design, before trying it with the Android app.

I don’t have much to say about the package, it’s just a bland white box with Broadlink logo.


The bottom of the package is useful however, as it contains a sort of user guide in Chinese together with the specifications. I could not find any mentions of CE/FCC/CCC (for WiFi) or UL/TUV (safety) certifications on the package.

Click to Enlarge
Click to Enlarge

There’s no more information inside the box, except what looks like a warranty card in Chinese.

Click to Enlarge
Click to Enlarge

The power strip itself has four multi-standard sockets, a power button, and a 1.5 meter lead with a Australian 3-prong plug. Spacing between each socket is a good 5 cm as advertised.

Click to Enlarge
Click to Enlarge

The bottom on the power strip includes some information including the model number (MP1-1K4S), maximum current and voltage (10A/250V), and a QR core linking to a QQ page redirecting to WeChat app in Google Play Store, so I did not try further…. The device is made by Hangzhou GuBei Electronics Technology.

We can open the device by removing the four rubber pad, and loosening 4 screws, as well as an extra screw placed right on the QR code.

Click to Enlarge
Click to Enlarge

I’m not the best person to evaluate the design of this type of product, but I can see three wires including the ground are connected, the parts carrying the mains appear to be large enough, but I don’t see any type of fuses, which might be suitable in that sort of thing. You may want to check out the comment section, as hopefully more knowledgeable people may give their input. The long board is the really board, and the square board is the brain of the design with the WiFi module.

Click to Enlarge
Click to Enlarge

Four JQF-3FF 12V relays supporting 10A @ 277VAC / 12A @ 125VAC are used to control the sockets. A cable with 4 GPIOs (R1 to R4), GND, and 12V signals is connected between the relay board and WiFi board.

Click to Enlarge
Click to Enlarge

The board (PCCII-U1-2) includes a Broadlink WiFi module, the power button, two LEDs, and an unpopulated “GSRV” header to connect an  ISP programmer. The small chip on the bottom of the pic is XLSemi XL1509 DC-DC converter.

I can’t find specific information about W1SBS03L WiFi module, except through its CMIIT ID, a product ID assigned by the China Ministry of Industry and Information Technology to identify wireless products in the Chinese market. The aforelinked website indicates the module operated in 2400-2483.5MHz frequency range, emits less than 20dBm (EIRP), occupies less than 40MHz bandwidth, and its emissions are inferior than -30 dBm. What I could not find it which chip that module is using.

Click to Enlarge
Click to Enlarge

The bottom of the board has two more small ICs: STMicro STM8S003F3P6 8-bit MCU, and MP157 regulator.

I’ve also tried the power strip. The first step is to scan the QR core on the package, to install the same e-Control app used on Broadlink SP2, or other Broadlink WiFi devices for home automation.

Click to Enlarge
Click to Enlarge

After the welcome screen, you’ll be asked to register or sign-in, but simply select Skip on the top right. If you want to control the plug over Internet, instead of just your local network, you may have to register however. You’d then have to tap on the three blue bars icon to bring the left menu, and select Add device.

At this stage I also connect the power strip, and the power button LEDs will start blinking regularly meaning the strip is ready for configuration.

Click to Enlarge
Click to Enlarge

You’ll be presented with a first window asking you to enter your WiFi password, but when I tried to do this it failed each time. Instead tap on the top right Setup button and switch to AP mode. Click OK in the the second screen shown above, select your access point, enter your password, and you should be able to find the power strip pre-named with a name in Chinese (4-socket power strip).

Click to Enlarge
Click to Enlarge

You’ll be able to turn on or off individual sockets, set timers to turn on or off specific a socket, control all sockets with a single button, or go to settings to change the power strip name, lock the device so that only your device can control the socket, or update the firmware. If you don’t have your smartphone with you, it’s also possible to turn on or off all sockets by pressing the power button on the unit.

I’ve scanned the power strip for both UDP and TCP port with nmap, which reports all TCP ports are closed, and all UDP ports are open|unfiltered.

I’d like to thank GearBest for sending Broadlink MP1 for review, and if you’re interested you could consider buying the device from them for $22.39 shipped. Banggood used to have a promo selling it for just under $20, but the price is now $22.79. You’ll also find Broadlink WiFi power strip on Aliexpress, but the prices are normally around $25 or greater.

Share this:
FacebookTwitterHacker NewsSlashdotRedditLinkedInPinterestFlipboardMeWeLineEmailShare

Support CNX Software! Donate via cryptocurrencies, become a Patron on Patreon, or purchase goods on Amazon or Aliexpress

ROCK Pi 4C Plus

29 Replies to “Broadlink MP1 Quad Socket WiFi Power Strip Review and Teardown”

  1. Looks like a ESP8266 or RTL8710 running in AT command mode. That’s why they needed to add the STM8S003F3P6; they did not want to change the code in the wifi module. This is a decent design. MP157 was good choice for power supply. Only fault I see is that it could have been smaller/cheaper by directly mounting the prongs from the sockets into the PCB and the positioning the relays between each socket. As is – around $8 to produce this.

    BTW – there has to be a port open somewhere on it. Don’t try and hook any test equipment up to this unit, it appears to be hot ground, you will destroy anything you attach to it. To program this unit it needs to not be plugged in, then isolated power is supplied over those four ISP connector points.

  2. @Jon Smirl
    I think I’ve read nmap results too fast:

    All TCP ports are closed, but all UDP ports are open?
    I repeated the test for UDP 1-65536, and it still says all ports are open. For TCP 1 to 65536 all ports are closed. I’d have to capture packets to find out which UDP port is used…

  3. @Jon Smirl
    It looks you are correct. The STM8 MCU is the one connected to the ISP header, and I assume it can be programmed using ST-LINK V2. The only thing is to find out which (AT) commands are used to control the WiFi module, and then we should be in full control…

  4. wow interesting product. The price also makes sense. I can imagine a lot of applications since it is portable just like a regular power-strip.

    Jon are you able to capture the packets between your phone power-strip. If it uses a simple TLV based app-protocol in UDP, then we can control it through scripts via our PC/laptops. I appreciate your nmap tests 🙂

  5. Note that that this thing is using Chinese plugs/sockets, not Australian, they’re similar, but not the same. The ground pin faces down in Australia, on this one it faces up. Also the pins are a smidgen longer on Australian plugs. The live and neutral pins are also partially insulated on most Australian plugs.

    On a side note, something like this, would from this year also require a rely on the neutral to be allowed to be sold in Australia. Go figure why, but it’s the latest confusing regulation there.

  6. @agumonkey

    There is/was the Silvershield Bluetooth (SIS-PM-BT), but apparently it only has/had drivers for Windows XP.

  7. @cnxsoft
    Australian wall socket and plug

    “Official” Chinese wall socket
    and plug

    They’re obviously inverted and the Chinese plugs don’t have the insulation, which is a legal requirement as far as I’m aware, much as with Euro plugs (which are only rated up to 2.5A).

    However, most significantly, it seems like Australia has the live/neutral switched compared to most of the rest of the world.

  8. @Jeroen

    This does not have UL approval, but nothing I see is screwing out “UL fail” to me. It even has the child guard covers over the outlets, not a lot of products have that.

    Don’t poke around inside of this unless you know what “hot ground” means. It is very easy to kill yourself poking around inside a device like this. “hot ground” is not inherently unsafe and it is used in a lot products. It is just something that an inexperienced home hacker should not be playing with. There are exposed mains voltages all over these PCBs.

  9. “Australia’s plug/socket system is codified as standard AS 3112. Although there are slight differences (the pins of Chinese plugs are 1 mm longer and the sockets are installed with the earth contact facing upwards), the Australian plug mates with the socket used in the People’s Republic of China (mainland China).”

    “The reason as to why the dimensions of the Australian type I are very similar to those of (American) type A is because the Australasian standard is actually an obsolete type of American plug. It was patented in 1916 by Harvey Hubbell II, the same electrical engineer who had invented the type A plug. Hubbell’s three-blade design never proved popular in the U.S. because of its incompatibility with the existing type A plug, but it was favoured in Australia over the British type D system, because it was easier for local manufacturers to make plugs with flat pins rather than round ones. In the 1930s, the predominant Australian electrical accessory manufacturers, along with the State Electricity Commission of Victoria, decided to standardize on Hubbell’s design.”

    So, it seems the Chinese sockets are essentially 180-degree rotated Australian sockets, or are they upside-down Australian sockets (line & neutral swapped)?

    More here:

  10. @cnxsoft

    I would love to know those AT commands… I have managed to bork a Haufansmart socket, the internal layout is very similar including the STI chip

    Shortly before I wiped it out I saw an AT command on the serial bus.

    I am going to bet that the firmware is the same in a lot of these chinese esp8266 based devices… I have managed to flash ESPEasy onto the ESP8266, I can see the STI chip on the serial, just need to re-create the commands, or alternately replace the STi chip with an avr based device that I can control…

  11. Hi, I got this Broadlink MP1, but even after numerous tries, I have failed to connect to the device via the App. Please suggest some solutions

    Thank You

  12. Got a couple of these, and due to the guard covers over the outlets, you cannot plugin a 2 pin AU plug, has to have the ground pin.

  13. Hi
    I’ve been trying to get a refund on my purchase from Banggood. I’ve got version MP1-1K4S with firmware v10028 as the latest.
    I have not been able to set this up on my network as it does not support extended characters on its wifi password like @. I’ve also found out on the web that it does not like wifi passwords that are too long though routers would support it.
    Anyone know of a firmware update or hack to sort this out? I don’t want to reduce the complexity of my wifi network just to get this to run when everything else on my network is ok. BTW app reports the firmware as the latest.

    1. If you router supports it, maybe setup an extra SSID and only allow the MAC of Broadlink MP1 to connect to it.

Leave a Reply

Your email address will not be published. Required fields are marked *

Khadas VIM4 SBC
Khadas VIM4 SBC