1. The darker colored square panel with the button on it snaps off. Pry it carefully off from one side to remove it:
2. There's two "slide-out" corner pieces on the male plug side. Slide these towards the button side:
3. Remove the three screws that are now exposed:
4. The case containing the female outlet side should separate easily now. No prying necessary:
5. The circuit board is actually two boards soldered together in an "L" shape. The small edge with the button on it contains the serial header for the ESP8266. From the top down, the connections are VCC, RX, TX, N/C, N/C, GND (Notice the two unused pads labeled TX & RX. They don't appear to be connected.)
6. Here's a shot of the ESP8266EX chip on the back of the smaller board, beneath the relay.
7. I soldered a pin-header to the pads to program it. At the time I didn't know which two TX/RX pins to use so I soldered all four. You can ignore the lower two.
8. The button is connected to GPIO0, just like the Sonoff Basic. Press and hold the button while plugging in the USB Serial adapter to put the ESP8266 in flash mode (Follow the flash instructions on the Sonoff-Tasmota project from here.)
The S31 purportedly does power/current monitoring, too. I haven't tried getting that working yet. (I'll update this blog post if I get that working too.) As of this writing the Sonoff-Tasmota 5.11.1 firmware runs on it and controls it as a "Sonoff Basic" just fine. Relay toggling and button control work as expected.