Flashing unidentified chip PCB label: RB-WS8000B-FD02_V1.0 #35
Comments
|
Counting the already used pins (GND, VDD, LED, buzzer, button, xtal x2, antenna) that leaves you with exactly zero pins left for an uart or similar, so if there is any flashing possible here it will have to be pin-shared with either the buzzer, button and/or LED. Does the tag still boot when you hold the button while applying power? |
|
I've done some more thinking (and reading), trying to figure out how to flash these and what CPU they could be.
This, to me, strongly indicates an ARM CPU (and also how it could be programmed). Additionally, I briefly looked at the existing "Kindelf" APK with jadx, but it's a pretty dumb BT protocol. It seems very amateurish and also contains a lot of debug printing. This is in "sources/com/lenze/kindelf/application/MyApplication.java" (yes, that's probably their sourcefile name): MyBleItem myBleItem = new MyBleItem();
String trim = Pattern.compile(" [\n`~!@#$%^&*()+=|{}':;',\\[\\].<>/?~！@#￥%……&*（）——+|{}【】‘；：”“’。， 、？] 0").matcher(bluetoothDevice.getName()).replaceAll(" ").trim();
if (trim.contains("Tag-It")) {
trim = "iTAG";
}
myBleItem.setBleNickName(trim);
Log.d(TAG, "OnMyDeviceFound123: " + trim);
myBleItem.setAddresss(bluetoothDevice.getAddress());
myBleItem.setBtnShowText(getString(R.string.un_conn_ble));
myBleItem.setImageByte(null);
if (bool.booleanValue()) {
myBleItem.setHasBattery(bool);
}
this.bleItemHashMap.put(bluetoothDevice.getAddress(), myBleItem);
DeviceFragment.getInstance().UpDateOnUIThread(); public void AlarmByAddress(String str) {
Log.e("开始报警1", "开始报警" + str);
if (this.bleGattMap.containsKey(str) && this.bleGattMap.containsKey(str)) {
Log.e("开始报警2", "开始报警" + str);
Log.e("开始报警4", "开始报警" + str);
this.bleWrireCharaterMap.get(str).setValue(new byte[]{1});
Log.e("开始报警5", "开始报警" + str);
this.bleGattMap.get(str).writeCharacteristic(this.bleWrireCharaterMap.get(str));
return;
}
Log.e("开始报警3", "开始报警" + str);
}
public void CancleAlarmByAddress(String str) {
Log.e("开始报警1", "开始报警" + str);
if (this.bleGattMap.containsKey(str)) {
Log.e("开始报警2", "开始报警" + str);
Log.e("开始报警4", "开始报警" + str);
this.bleWrireCharaterMap.get(str).setValue(new byte[]{0});
Log.e("开始报警5", "开始报警" + str);
this.bleGattMap.get(str).writeCharacteristic(this.bleWrireCharaterMap.get(str));
return;
}
Log.e("开始报警3", "开始报警" + str);
}
public void SetDeviceISAlarm(String str, boolean z) {
Log.e("设置断开是否报警", "设置断开是否报警" + str);
if (!this.bleAlarmWrireCharaterMap.containsKey(str)) {
Log.e("设置断开是否报警", "设置断开是否报警" + str);
return;
}
Log.e("设置断开是否报警", "设置断开是否报警" + str);
if (z) {
Log.e("设置断开是否报警:断开报警", "设置断开是否报警" + str);
this.bleAlarmWrireCharaterMap.get(str).setValue(new byte[]{1});
} else {
Log.e("设置断开是否报警:不报警", "设置断开是否报警" + str);
this.bleAlarmWrireCharaterMap.get(str).setValue(new byte[]{0});
}
Log.e("设置断开是否报警", "设置断开是否报警OK" + str);
if (this.bleGattMap.containsKey(str)) {
this.bleGattMap.get(str).writeCharacteristic(this.bleAlarmWrireCharaterMap.get(str));
}
}(I suggest to read the full code for context, if anyone plans to reimplement this in some other language / tool) I didn't check if they also have a network / online service where the app reports the location to. |
|
This tag in its current state will not have a network to report to for sure. |
It doesn't seem to show up in the list of bluetooth devices then, it also beeps differently during bootup. Unfortunately I'm still not sure how to get the chip into debug mode though. import asyncio
import bleak
from bleak import BleakScanner
async def main():
devices = await BleakScanner.discover()
for d in devices:
print(d)(Then rescan using I have it wired up for testing (using some clamps and clips) but I'm unable to get SWD to work from an ESP8266 (nodemcu v3). I speculate the following pin usages: (left north to south, starting near notch)
(right south to north)
Taken orientation from PCB label:
I'll probably have to sacrifice one of my boards to desolder the chip. One last thing I'll try before is to listen on the GPIOs during bootup. But I'll have to set up my logic analyzer first and I'm not sure when I'll find time for this. |
|
Great find on the different boot beeps, it seems to at least boot different code when you hold the button! |
I think that might have been a fluke 😢 Here are some observations with TCK / TMS disconnected:
But:
So there doesn't seem to be a difference here. it simply didn't appear in BT because I probably held the button for too long, so it also went to sleep on BT. The sound was simply the button press sound. I'm noticing that it also powers up without VDD:
I've also tried grounding some pins but it just reset the ESP (probably cause I'm causing shorts) The question remains: once normal operation starts, these are all GPIO.. so how does this chip (if possible) ever return to debugging mode? I've done a bunch of sigrok / pulseview sniffing on all 3 GPIOs and confirmed my SWD looks correct - but at least in the current state, the board does not reply. I also noticed the https://datasheet.lcsc.com/lcsc/2206281830_wisesun-WS8300F5ES16_C2980817.pdf manual even explicitly mentions "SWD (JTAG)" for a similar pinout.
I'd even try to send them an e-mail, but wisesun.com and wisesun.com.cn have been offline for the past week already (last google cache and archive.org are from mid November). I'm also not too motivated to desolder the chip right now because I totally forgot that I'd also have to wire up another XTAL / support components. I'm also not sure what the unnamed test pad is for. I'm starting to think it might be used to pull some pin in another direction (potentially other side of beeper or LED?). |
|
The datasheet of the WS8000 here: https://www.taoic.com/company/7287/WS8000==45b88e7c-2bd3-11ec-9475-00163e1552d4-28_detail.html |
Yes, I had linked it in my initial post already - it's also my main source about the WS8000 (aside from extrapolating from datasheets for other chips). Wisesun, for other chips, also has more detailed datasheets with some instruction listings, block diagrams etc. After realising that wisesun.com isn't down, but simply blocked for me (or the western audience in general?) I've accessed it through a china-proxy. They don't have any material for WS8030 (#13) and limited info on WS8000 (not even a factsheet), but I'm also attempting to send mails to ask for datasheets now (hoping that some of my mailhosters will be accepted by their route and host).
Note that only a portion of the memory is OTP. I'm not too concerned with that (yet). |
|
Not sure how I missed this so far, but http://wisesun.com/products_table.php?protypeid=21&parenttypeid=19 has an image with their 2.4GHz chips. This overview includes the WS8000 (which always starts with WS8000P) and confirms it as Cortex-M0 (although they keep saying "Context M0"): I guess the OTP is a problem now, because these tables suggest it's only RAM and OTP, critically, no flash and only a small EEPROM (if we are lucky). Another table (蓝牙模组 / Bluetooth module) names WS8000-M6 which is Cortex-M3 [error?]: The dimensions make it sound like it's a daughterboard. Also note how the naming scheme appears to be:
I'll probably also try to check the chip under different light, in case I missed a chip marking. |
|
Dear friend, Is there any progress in finding a solution to read/write the chip? |
I've just received 3 tags.
Store: https://de.aliexpress.com/item/1005002599386785.html (Bought on 2. Nov 2023)
Seller: FuXin Trading Co., Ltd.
Product (US name): "Anti-Lost Mini GPS Tracker Locator Finder For Kid Key Pet Dog Cat Bicycle Car Low-Power And Environment-Friendly Practical" ("White" and "Black")
I had hoped these to be Lenze ST17H66.
However, unfortunately, they are more similar to #13.
I speculate these are WS8000, judging by the board label (which happened to be WS8030 in the other one).
In fact, the WS8030 is also available in SOP8.
The pinout roughly seems to match, but I didn't probe it yet.
Factsheet: https://www.taoic.com/company/7287/WS8000==45b88e7c-2bd3-11ec-9475-00163e1552d4-28_detail.html
This also lists JLINK TMS / TCK, so it might not be JTAG, but some specific variant of JTAG (that I'm not familiar with).
The datasheet also mentions Keil and JLINK in particular.
Testpoints:
Unfortunately there's no TXD / RXD, so I'm not sure if I'll just throw these away.
Appears to be a 16.000 MHz Clock and some SOP8 controller (as mentioned above, likely WS8000).
The included booklet tells you to use the "Kindelf" app: https://play.google.com/store/apps/details?id=com.lenzetech.kindelf
Note how this is in fact by Lenze.
Photos:
Any ideas for custom firmwares or flashing / flash readback?
What kind of CPU is this?
Note that I found an unrelated wisesun datasheet which mentions some common CPU archs:
https://datasheet.lcsc.com/lcsc/2304101800_wisesun-WS51F0030Q20T_C5118070.pdf
Page 6 mentions a bit about their naming scheme (although might not be applicable).
It lists 8051 (not 32-bit), PIC16 (not 32-bit, but PIC32 exists), ARM Cortex-M and even RISC-V, so these are strong contenders?
https://datasheet.lcsc.com/lcsc/2305111419_wisesun-WS51F7030S08U_C5118066.pdf
Page 6 again.
It lists "RISC" (not any more specific) and 8051
There's also a datasheet downloadable as PDF for the WS8300 https://datasheet.lcsc.com/lcsc/2206281830_wisesun-WS8300F5ES16_C2980817.pdf which mentions many of the same details as the WS8000 factsheet images above (despite being a different package etc).
Also ping-ing @drott
The text was updated successfully, but these errors were encountered: