Not sure how how missed that blue LED on GPIO5. Good, now there are 3 unknown GPIOs.
Yes, this is what I am thinking. Unfortunately, everything is hidden between the main PCBs of this unit. Pictures here show the internals of a slightly different version, but I cant read what is written on the ICs.
The Sonoff Pow uses the HLW8012, which requires 3 pins to interface with the microcontroller, CF, CF1, and SEL. CF and CF1 both output a square wave which frequency indicates the power on CF, and current or voltage on CF1, depending on if SEL is high or low. With any luck, this chip is also used on these outlets. I am finding a 2.11 Hz square wave on GPIO12 (when not plugged in to mains), so it’s possible. I think trial and error on assigning GPIO_HLW_CF, GPIO_HLW_CF1, and GPIO_HLW_SEL to GPIOs 12, 13, and 16 will determine this.
Update: I tried all 6 permutations of assigning CF, CF1, and SEL to GPIOs 12, 13, and 16, and plugging into mains. No combination reported any value for voltage, except for when CF1 was connected to GPIO12; it would read 1 V when the relay was on. The energy counter also slowly went up (0.001 kWh/min or so) when CF was connected to GPIO12.
Update2: I plugged the outlet into mains and a load into the outlet and probed each of the unknown GPIOs. GPIO12 now has a 1.0262 kHz square wave, GPIO13 had a square wave that varied with power to the load. GPIO16 had nothing. When I pulled GPIO16 high or low (thinking it was SEL), the output on GPIO12 did NOT change as expected. I reflashed, setting GPIO12 to CF1, GPIO13 to CF, and GPIO16 to SEL. Values for Voltage, Current, and Power displayed but did not make any sense. I tried calibrating the measurements by sending the MQTT commands but now the values just seem to jump around randomly. Additionally, the values are all 0 unless the relay is toggled ON.