Porting Python to a terrible $3 smartwatch
I have a new watch it is terrible what you're looking at here is what's commonly called an M4 wristband or fitness band or some such thing it is the cheapest and nastiest smart watch that small amounts of money can buy this cost me 2 Frank 60 which is about 50% More Than This knockoff blue pill cost me what you get for this very small amount of money not much technically this is a BL attached Smartwatch it connects to a mobile phone that can push notifications and things to it practically it's basically trash they achiev the price point by cutting out all the extraneous features like battery life and reliability and a user interface and buttons and and stuff like that let me take it off my wrist and I'll give you the tour the silicone wristband came with it the watch itself just pops out um like that this is the first watch face this one is built-in you get a choice of two one of which is programmable from the smartphone app pressing the button Cycles you through the main menu a long press select the item so the steps function is a step counter that while I have been playing with this on my desk has gone up by about 200 so I am not convinced that is like accurate maybe real heart rate is the heart rate sensor it also somehow detects blood pressure and blood oxygen levels it works by blinking the LED on the bottom for a long period of time and then eventually it comes up with a number which is always about this I don't think the heart sensor is Real Sports is a bunch of sport related activities we've got running skipping and situp these are all the same if I select it it seems to be a timer it may hook up to the step counter to make the KCAL thing work assuming that's real let me just shake this about a bit has it done anything no so moving on message uh this is possibly the only actual useful feature the thing has this allows your smartphone to push messages to the watch and it displays them on the screen I currently don't have it hooked up to the phone so it just says null and if I select it nothing happens sleep appears to be some kind of sleep sensor I don't know how this works and I don't care weather pulls weather information from an unknown source on the smartphone app no smartphone therefore it says it is sunny and zero deg music lets you control your phone's music player somehow it is deeply cumbersome a single press Cycles the cursor a long press and actually makes the thing happen of course no smartphone so it doesn't do anything more takes you to more items first one of which is the camera this does not have a camera what this does is it triggers the camera on your phone again no smartphone doesn't do anything looking for causes the smartphone to vibrate and the phone has an equivalent feature that causes the wristband to vibrate the could actually be useful these things are so cheap that you could use one as a locator you know buy it stick it on a keychain somewhere except the battery life is not brilliant I'll talk about that later theme lets you switch between the two watch faces we got the built-in one programmable one the smartphone app lets you program this to a limited extent you can basically just change the backdrop I've used a completely black one here and you can move the numbers around and that's all reset resets the thing I'm not quite sure what this is supposed to achieve given that there is no State stored on this to speak of this provides a QR code that takes you to the downloadable app which is actually not completely trash still quite trash and this appears to be the about your Smartwatch screen use the same chipset and you've seen all the features so what I actually going to do with this thing well the answer should be obvious I'm going to pull it apart which is done by spudgy here uh and then it just comes apart and I was actually quite lucky there cuz bits of fragile it does still seem to be working so here is the thing this metal pad here is for the touch thing it pushes onto this metal mesh here on the front half you've got the screen we've got a little PCB underneath it and this is as far as my disassembly has gone so this is all new to me we have a tiny battery a that glued in no it's just sitting there uh we've got the connection to the heart rate sensor which is two wires so yeah I think that is probably just an LED and that round thing is the vibration unit let me pull this out and put it down somewhere here we are looking at the bottom of the board we have these two contacts here connect to the US and they're used to charge the battery the battery itself is soldered on here these two contacts are for the LED SL heart sensor the vibrator connect here I have managed to break this wire it was connected to that pad there here we have the microcontroller that makes it all tick and there's some passives probably for managing the battery and doing the Bluetooth stuff let me turn it over so this is what really interest me about this thing on the board here we have test pads TX RX vbus and BT that's probably the Bluetooth antenna and and if I move the screen out of the way over on this side we have test 3.3 volts ground dat and S SWS I happen to know the SWS is single wire debug and oh good it still works so what we've got here is a battery powered microcontroller with a screen on a tiny PCB with Bluetooth low energy with a whole bunch of useful ports brought out what can I do with this [Music] [Music] [Applause] [Music] [Applause] [Music] oh [Music] h [Music] well I think that is some of my finest work that's sarcasm this horrible mess of bad sold joints and capan tape is the fitness watch spread out onto a breakup board it's actually one of these pcbs this is a thing I had made for the brother word processor project that I still haven't done the final episode on I had to make five of these and I used one for the real project so I now have four spare in fact they they've got lots of connected pins and 3.3 volt and 5vt power rails and so they're actually quite well suited for this and you know I might as well use it for something let me show you around the board this is USB 5V power it's rooted through this switch here to the PCB the battery which is slightly squidgy which is a bit disturbing is rooted through this switch also to the board so I can isolate either the battery or all the power or just run it off AC etc etc these two lights here indicate the status of the 5V and 3.3v rails the 5vt rail comes directly from the USB 3.3v comes from the tap of the board's own regulator that's this wire here the peripherals are all still present so we've got the vibrator here and the fake heart rate sensor here and these pins are the UR TX and RX and reset s SWS data and test and ground and that is basically all there is to it I used Magnet Wire in a lot of places is that Magnet Wire no that's that's a hair uh this is Magnet Wire which is very similar to a hair let me just get rid of that I picked this because it was the thinnest wire I had and in fact this turned out to be a big mistake Magnet Wire is incredibly hard to deal with it's just so thin and flimsy that controlling it is difficult plus before you can solder to it you've got to strip the enamel coating off which is a pain once I switched to this thicker wire things became a lot easier I can actually strip this using my finger nails having the microscope made an enormous difference my ability to control the soldiering iron accurately turns out to be limited by my ability to see rather than my ability to move the soldiering iron itself the trickiest bit of soldiering was the reset wire which actually goes on to one end of a tiny surface amount capacitor on the other side of this board and that was really painful and I'm very proud of the fact that I actually managed to solder one of these solid core wires to it I think it's actually this green wire here which goes to a pin here which is then rooted VI track to the r pin there this is the point where I finally come clean I'm not reverse engineering this thing someone's already done that I'm just following the instructions and according to the instructions now that I've done the breakout board I should be able to build a debug interface plug it in and then I can read and write the Flash there's only one small problem doesn't flipping work this is what the setup looks like this is on our baron. Net's website
which has a lot of useful information on reverse engineering these things the board here is very slightly different from mine which is interesting and slightly suspicious so it's possible that mine doesn't work the same way but anyway let me walk you through it we're using the SDM 32 blue pill as a debugger interface between the actual computer and the board itself the board debugger interface consists of a single line S SWS here which is used for both transmit and receive the blue pill debugger here is using two pins A6 and A7 A7 is used for receive and A6 for transmit there is also b0 here which is used to hard reset the board and of course a ground interface the protocol is weird and extremely bespoke each bit is transferred as five time units these two red boxes here show a zero bit which is low high high high high and a one bit which is low low low low high there is also occasionally a a single low time unit which is used for hand shaking the conversation is controlled by the debugger interface the board here only talks when the debugger tells it to this avoids the need for any kind of contention Logic the debugger line is pulled High by a pull-up resistor the two ends can drive it Low by connecting the line to ground through a transistor I don't know yet where the pull-up resistor is it could be at either end that is something I may need to find out so why isn't it working on my setup well as always the thing to do is to hook it up to an oscilloscope and see what is actually going on I have replaced my nice neat test harness cable with this breadboard thing the resistor and the test harness has been replaced with this pot it's all set up and running the PC is continually pinging the board with a get chip ID command so all I need to do now is turn on the osilloscope and there's a thing so that is a packet and its reply if I zoom out you can see that we're sending lots of packets one after the other and if I zoom in [Music] this stuff is the outgoing command to the board this is the board's reply which is very interesting notice that if I can get this set correctly the board's responses are not actually dropping to zero volts they are only dropping by a pretty small amount in fact I should be able to tell this thing to figure out what it is if I set it to here uh go to Vertical uh V Min and down here it's 24 Vol that's not right 35 volts um I mean it's clearly not 35 volt I think I have the time 10 stuff set up incorrectly so the probe is set to time 10 and it's set here to time 10 so it should be working but ignore that I mean that's clearly 3.5 Volts for the maximum and 2.4 Volts for the minimum if I scroll [Music] left minimum goes down to -6.8 which is here that Mark there is showing 0 volts so that's interesting it means that the the board driver on the debug line is unable to drop the voltage all the way to zero the most likely reason for this is that there's a pull-up resistor somewhere which the board's driver is unable to overcome looking at the circuit diagram the reason why this resistor is in line between the debug line and the TX pin suggests that the pull-up resistor is on the TX pin of the microcontroller and that this thing is supposed to reduce the ability of the pullup resistor to pull up I make it easier for this thing to pull the thing down so possibly just increasing the resistance might help but anyway let's just try fiddling with this resistor I haven't tried this let's see what happens to the that signal so if we increase it nothing's happening yeah in fact I found two sets of instructions with different resistance values this was set to 750 ohms uh I also saw 1K ohm clearly it doesn't matter what it is so I think there's two possibilities as to why this isn't working two options one is a software issue where that the python client that's talking to the debugger interface doesn't understand this particular chip that is it read the chip ID but it doesn't understand it the other option is that the debugger is unable to read the response from the board due to the pull-up resistor and in fact looking at the way this thing works I'm a bit suspicious because the stm32 has controllable pull-up resistors and all the pins so when this is listening to the board shouldn't it be disabling the pull-up resistor effectively trating the pin in fact it should be possible for this thing to actually just use one pin I think there's probably something in the SDM 32 architecture that doesn't allow it but that signal looks really suspicious to me finally after a great deal of work I have the debugger interface working and all I had to do to make that happen was to throw away the stm32 version and write my own from scratch using an rp240 AKA raspber P Pico in fact the rp240 Pio Hardware makes this kind of interface really easy easy to use so all I need now is a single connection from the S SWS pin to the Pico and another connection for the reset line and I don't need any of the resistor stuff or shorting two pins together or anything but anyway can demonstrate that this is running and now I can do this just to reset the board and look we have a flashing light I have managed to compile one of our Baron's test programs deploy it onto the thing program The Flash and it works and we have a flashing light this is good news it means we've done all the hardware stuff the next step is to think about the software before we do that we're going to go on a brief detour and take a look see what inside this thing this is a zoomed in image that I stitched together from images from my terrible USB microscope and it lets you see the major components of the inside in particular you can see the Bluetooth antenna the Clock Crystal the unpopulated pad for the heart rate sensor clearly marked HRS and a pad that I think might actually be for the accelerometer in which case the step counter values I was was looking at earlier would in fact be fake but the most obvious component is the CPU which is a tlsr a232 this is made by telink which is a Chinese Internet of Things company that produces chips for a bewildering different variety of protocols and applications this particular chip the tlsr a232 is strangely not visible on their product page however if we go to Mouser you can find it for sale here and this is exactly the same chip that's in my SmartWatch entertainingly even if you buy a thousand of them the price you're paying is about half of what I paid for the entire Smartwatch luckily it is possible to find telink documentation if you search for it with Google and that gives you stuff like the data sheets the SDK the manual for the SDK which is very useful and of course the IDE the IDE is particularly important because it comes with a compiler tool chain why you need a compiler tool chain well this thing is not a arm processor it is tellings proprietary CPU called the tc32 and the tc32 is fascinating this is a file from telink STK this is the startup code this is the first first thing that executes when the chip comes alive and it contains the usual stuff you'd expect to see here like the very first thing in the flash is a jump to the reset routine here is where the irq set up etc etc here is the reset routine itself at hex 20 bytes into the Flash and this is some tc32 machine code and all the tc32 instructions as you can see start with a t so T load R clearly you know loads the value from memory into a register T compares to registers jump if greater than or equal to add this is all looking extremely familiar if you're used to these small embedded risk machines in fact possibly too familiar let me show you their compiler luckily there are Linux binaries available uh tc32 e GCC and it is a GCC port although there isn't any Source available if I ask it for Target specific options we get some stuff here is the option to enable tc32 code generation here is an option for modifying the arm thumb stack frame here are some stuff for the apcs um calling convention stuff in fact as far as I can tell I think their back end is basically the arm back end end with a few minor adjustments I suspect that all they've done is done a custom assembler and then change the code generator to produce these instructions rather than the equivalent thumb instructions so let's try an experiment I will pull some code out of this file and convert it to thumb and then we'll assemble the two and see what they look like so here it is this is the tc32 code this is the thumb code and yes I did just search and replace all the instruction names for the thumb equivalent here is the disassembly of the tc32 code so here is that first T loar which turns into 0910 Etc all the way down here is the disassembly of the thumb code and you will see that the actual btes generated are very nearly the same in fact as far as I can tell there's only like one maybe two bits of difference between the thumb instructions and the tc32 instructions which means I'm pretty sure that tc32 is basically just a subset of thumb with the op codes rearranged just enough that you can't run thumb code on a tc32 processor this is is necessarily a bad idea the thumb instruction set is very good it's spectacularly dense producing very small programs if you're going to base your own instruction set on something you could do a lot worse than copy thumb but this does seem to be kind of blatant on the plus side it does make the code quite easy to read so let me delete all these windows and let's take a look at the SDK itself it is not complicated which is great you get a directory full of headers and C files which contains most of the interface to the underlying Hardware so if I go to gp. C this is the interface for the gpios you get Source all these are doing is writing to the underlying Hardware registers which you can read up on in the data sheet so we've got routines for initializing stuff routines for changing the function and so on the source being available means that it's easy to reason about and debug there doesn't seem to be detailed SDK documentation but there are lots of good comments both in the implementation and in the headers that you'll likely be interacting with you do get some binary only libraries for example this one contains the blle stack so you don't get sourced to that which is a bit of a shame you get a standard G LD Linker script for actually putting together Flash images which is nice it's all simple and straightforward and doesn't try to do anything that's magic which is basically ideal if you're going to be writing software for one of these embedded chips but most importantly we also have our Baron's GitHub who has done all the heavy lifting of figuring out how to actually build programs against the SDK so I just follow here through to Blinky and this is the program that I just ran it's dead simple we include a lot of the SDK stuff we initialize the CPU we tell it what Clock Crystal we're using initialize the gpos tell it that pb4 is to be used as a GPO set it to be an output pin set the level and then every 500 milliseconds we toggle it it's that simple and there's also a make file that actually builds it but honestly this just being GCC and LD that is pretty straightforward so all in all it's actually a simple and easy to use SDK which I like armed with our new knowledge of how things work we can actually make some modifications to our program let's try making the UR work cuz I haven't done that yet it'll be interesting to try so first thing we need to do is that because of the pin assignments on the board we need to move our blinky light pin away from B4 cuz that's going to be the UR TX line we're going to use C1 which is the test pad which I've already brought out to a pin so that's just going to be a matter of pin p IO pc1 that was pc1 wasn't it yes and then change these to p no GP pb4 to pin right now we want the uart our Baron has provided some handy sample code that makes the uart work but it's using dma and I don't want to use dma for this I want to do this the simple way so we're going to go straight to the .h file which contains all the SDK functions and we want to first thing we do is want to set the pins so that will be Ur set pin txb 4 rxb 5 and PB 4 GPO [Music] pb5 okay now we want to initialize it using init board rate which I looked at earlier that is down here we need to set the various clock dividers to get the board R we want we want 115 kboard luckily the values we can just pull right off this table so that's going to be 9A 13 now we want the parity and stop bit so we want eight N1 so we go look at the E nums up here8 you get by default n is parity none and stop bit one is here okay in order to actually output something we scroll down we go past all the dma and interrupt stuff and eventually we get some standard functions marked ndma for the ndma method and this is the one we want art ndma send bite so art ndma send bite and we going to send our traditional lowercase Q okay that should be our program so over here We R run our make file and we get a output binary which we can look at and we see it is 4K of text 12 bytes of initialized variables 420 bytes of uninitialized so that will be leaving well uh 16384 - 12 - 420 that leaves that many bytes spare to do stuff with okay so I think that's our program the next thing to do is to download it onto the board rearrange the pins hook up a Serial terminal and see if it works so back at the workbench the first thing I'm going to do is to just move the Blinky over to the t pin then I can Flash it using my python client for the tellink debugger thing that I put together let's do that from the right directory there we go there raise the flashes and writes it very slowly that has successfully flashed it but the CPU is still in halt so tell it tell it to run and oh thank goodness that works okay next thing is to hook up the uart so this is the TX pin from the Picos uart which I now see has the wrong connector this has to connect to the pin over here so let me just try and dig up a replacement wire got one okay so that goes to a spare row going to use white for this that goes down here and then this will then go to one of these two pins let's just go for that one first now back on the terminal we want to start up our serial terminal and nothing happens okay the configuration is right so I bet we've plugged that into the RX line let's try the other one oh thank goodness this is actually the first time I've tried this for real so I am very glad that that has worked with an absolute minimum of drama so we've got a fully functioning SDK we can write programs that are not the example programs that someone else road we have the uart working we have standard gpios working we don't have the screen working yet but honestly I trust our Baron's code to do that so the next thing is to write something with it oh look I seem to have done a micropython port so if anyone doesn't know what micropython is it's a port of python to ridiculously small microcontrollers it runs just fine in this thing 16k of RAM and it gives you a full python environment you know this we are looking at here the python command lines you can do Expressions you can do strings you can Define functions you can do classes it all works porting it is really straightforward it took me about an hour to get from a c hello world to getting the micropython command prompt working there were a lot of later rough edges as I learned more about how both micropython and this thing works turns out that the SDK that I said was pretty good is less good once you look at the details it's got a lot of missing features undocumented things and just plain broken things but I have made it work so not only do we have a full python system we have a bunch of peripherals as well so I can do uh from machine import pin I can make a pin if I can type on this little keyboard uh let me see we put our white LED on test I think it was that's called pad test it's an output pin we can set it high the light goes on we can set it low light goes off I did also by the way find that uh the green LED here is in fact hooked up to the debugging Port so we can repurpose that as a gpio uh uh that should be called pad oh yes notice that you actually get a proper readline implementation it even has tab completion not sure you can see that there it is and we can set it off and on again let's turn it off because it's probably taking quite a lot of current we have other features oh yeah before I do that let me just show you if we import GC this allows us to show show you how much memory is free which is 7K let me do a garbage collection and that's gone up to 9 and 1/2k that's actually a reasonable amount for this thing you can write respectable small programs and they will fit in Ram but of course this being micropython there are features here you don't have to put your python programs in Ram you can embed them into the flash image and run them directly out of flash so your python code consumes no Ram so the ram here is used only for your program workspace and it stretches a lot further than you might think but other features let me import OS we have a file system which is empty so micropython is currently about 130 oddd K and the Flash is 512k which 500 is usable so all the rest is a little FS flash file system and if I can find this one stat VFS uh stat VFS slash that shows us we're using 4K blocks there are 85 on the flash 81 are in use let's write a file write mode and we're going to write hello world uh where did I put the backs slash on this keyboard not that one oh yeah it's an American keyboard it doesn't have a backs slash when there's a UK key map on it and let's just do that then and it writes and closes the file so now if we do list here again there is our file and if we do stat VFS we can see we've used one block the command line prompt makes writing programs for this thing Breeze but there are other features let me switch actually let me close the terminal and switch to the other thing here because Ada fruits ampy program is a very handy tool that will talk to a micropython or circuit python board and do stuff with it so if we do LS it will show us the file system and I can do get test.
text and that has red and dumped test. text to stood out uh let me try and put a file let's [Music] do put readme do MD and that should copy it onto the flash like so go back to here fire up the terminal again os. list dear ah uh andp does a soft reset of the board so we have to do that and there's our file we do uh a equals actually let's do 4 L in trying to remember how this works uh open test. text does that work print
L yep that does work uh I should probably use a uh a WI is there but I'm not going to these are just going to leak and stay open the garbage collector will catch them eventually yes it's not a very big file so I've zoomed in a bit on the thing to make it a bit more visible you won't be able to see me typing but never mind let me write a very simple program just to show you how this works we want to we want to not do that from machine import pin so we are going to create a pin for the uh the LED which is on uh pad s SWS uh pin. out it comes on let me turn that off uh the sent is inverted so let me turn that off button is button pin do in uh while while true LED not button so now if I push the button this is the thing that micropython makes so easy I don't have to flash it I don't have to compile anything you can just connect up your serial terminal and type and it just works let me reset the thing hey that worked so the LED is attached to the software debugging pin I had repurposed that as a gpio and yet I was still able to reset the board Bo using the debugger so apparently just because it's a gpio doesn't mean the debugger stops listening which is a little bit worrying to be honest what happens if you're using it as a ioin and you just happen to receive stuff that the debugger interprets anyway never mind so let me go back to this window and I'll show you another feature which is this one we can use amp to download and run arbitrary python files which is great for doing development and in fact what I've done is oh yeah uh have to turn off the serial terminal first otherwise that may get everything confused back to the other window there we go we have a clock yes I made the screen work that was really annoying so the screen is interesting our Baron's watch has a st7789 I think possibly a something three but one of those this does not this has a gc1 1209 which is subtly incompatible to the st7789 which means that these watches do vary somewhat which is not great so I knew that our Barons had a slightly different PCB from from having looked at pictures but having a different screen is interesting so the big difference between this and the st7789 is the st7789 has more video memory it will support 320x 240 screens and the controller chip which is embedded into this glass slab contains the frame buffer for the screen you send commands to it that draw into the video memory and then Stuff shows up on the screen the gc1 1209 has less video memories it only supports a frame buffer of 132 by 132 or something by 160 I forget what the something is this screen is 80 by 160 so we need the second mode you control which geometry the controller chip is set to by strapping certain pins and this interface cable has the wrong set of pins strapped so when the thing starts up it assumes it's connected to a 132 x 132 LCD and you only get part of the screen it's cropped to to form a 132 by 132 Square you can override the geometry setting but it took forever to find the weird undocumented command sequence from someone one on the interwebs that does it luckily I did find it at that point I was basically reduced to randomly fiddling with things to try and understand what was going on so it was a great relief when I finally made it work anyway this is a clock it's a very bad clock it shows the time since startup since the clock program started up rather the internal timer is 32 bits and rolls over rather irritatingly soon so I have to keep my own count of the time which gets updated once a second we have just to show it's doing something in tiny blue writing down here is the amount of free memory and if you watch it you can see it slowly count down as the Heap fills up and then jump up again as a garbage collection happens and over here we have what might be the battery voltage this is using some of tellink sample code to try and read the battery but their code was producing nonsensical results and I ended up scaling it by a factor of two and it produces what might be the right result I fiddled with it a bit and it does vary slightly and it does seem to drop when I disconnect the power but I don't know if it's working which brings me to my next major point I don't have any power management stuff in this so it's running flat out how long will this tiny and disturbingly Squishy battery last so I am going to rig up a time lapse and find out [Music] [Music] I was honestly expecting it to take longer than that I know what's happening of course this is my clock program in Python the way it works is it figures out when the next second is and it just sleeps for that long this isn't actually quite right due to the way the clock rolls over really I need to figure out a way to change the underlying clock time be a 64-bit int but anyway this works well enough but if we go look at the sleep function this is my implementation in the tc32 back end and all it does is it calls the telling SDK sleep function and if we go and look at that it just spins the CPU at full power for the appropriate amount of time the CPU is running flat out at 100% maximum power usage so that is why we're only getting about about 45 minutes of runtime really what I should be doing is using an interrupt setting one of the hardware timers and then putting the CPU to sleep until the interrupt happens but I don't know how to do that there are some functions in the STK that suggest that they're doing that but they don't seem to be complete and at this point I can't be bothered to actually you know figure it out I can deal with all of that later because I have other things to get on with you see I have a new smartwatch yes by buying another one I now magically have two of them this is the original packaging you get a plastic bag full of Smartwatch stuff we have the watch which works and we have a silicone wristband which kind of works and we have some instruction manuals which I haven't bothered to read but probably also indeed works so the point of this is that the one that I disected which is here in this plastic bag is probably not going back inside the case so by buying a second one it's not like they're expensive I should be able to do a similar modification to this but in a much more user friendly way and hopefully end up with something that is actually you know small and elegant and useful and stuff but first of course okay let's open this up the way I did the other one like so yeah I sincerely doubt that this thing is waterproof so here we have the works just as they were before uh it looks like the same PCB yeah I'm pretty sure that's the same and I want to try and add some pins somewhere for an external connector I thought of using this if I can cut away part of the case I should then be able to solder some Thin wires in [Music] [Music] [Music] some rather poor dremeling later and I do actually have a slot for this thing it would stick in here I'll probably I need to fasten it in with hot glue but now it's done I don't really like it very much yeah I'm not very keen luckily I do have two of these cases there's the other one so there is a certain amount of scope for screwing [Music] up yes I think I prefer it with the wires and the hole it's less elegant in that there's we stuff hanging off it when it's not in use but I think it's going to be so much less hassle this way so can we fit The Works back in there we go that's the PCB in place now let's see if we can actually rout these wires somewhere useful [Music] [Applause] [Music] [Applause] [Music] I'm being an idiot with this I'm trying to root the wires through this tiny little hole but I am doing it all wrong I don't need a hole [Music] by cutting a slot rather than a hole I achieve exactly the same effect because when the lid is put on it turns into a hole but now I can just slide the wires down rather than having to thread them through the hole [Music] [Music] so here it is all hooked up and if I touch the button it still works which is rather nice I have this here hooked up to my debug buer bridge on the RAS P Pico via four wires in order TX or possibly RX RX or possibly TX ground and S SWS data I do not have the reset line hooked up because getting at the reset line of one of these things is ridiculously hard and it turns out you don't actually need it when the stock firmware is running the debugger cannot communicate with the device however I can manually restart this and then the debugger can grab control and halt the CPU this has actually shown up an interesting point which is once the CPU is halted you can't turn it off the battery is hardwired into it I can unplug the USB but I can't unplug the battery this means that it will just sit there with the CPU hold Hood running the battery down until the battery goes flat the only way of getting out of this state is to use the debugger to start the CPU up again so let's plug this back in turns out this is not plugged in at this end there we go and it starts charging so I have the debugger working and I've been able to dump the ROM which has shown up a rather interesting issue in that the ROM on this is actually different from the one I got of the Viv sected one here we are looking at the two ROMs the one on the left is from the old wristband and the one on the right is from the new wristband and they are very similar but there is a bite here which is different and in addition there are more changes further on each of these things has a version number which if I find oops typ in correctly come on there we go V 17944 for the old one and B1 7387 for the new one and you can see this in the about page more than that there's a additional serial number which you can see here 3091 41545 also visible on the about screen where over on this one the number is different and you'll also notice that these strings are in a different place I did dump the ROM several times and compared the results so I'm pretty sure that they are correct also I have reflashed the old wristband with the old ROM and it works so that's nice I haven't tried that yet on the new one I was expecting the ROMs to be different because the shodi app that comes with them fit Pro when you change a preference setting it actually ref flashes the device remotely so I was expecting to see some changes but I would have thought that that would just be the the visual asset this this stuff but it seems to be more than that given that the screens are different in the two devices then maybe there is a different driver built in or maybe it just happens to update this stuff when you change the preferences and what I'm looking at is nothing at all I will try reflashing the second device with the old ROM and seeing what happens but I honestly have other things I want to do with it such as run micropython on it yep it works fine if I find more go through to this page V1 17944 this is the version number for the first ROM anyway on to micropython okay because the reset Line's not hooked up it's asking me to manually reset the thing oh yeah I have to unplug the power to get the watch to actually Start Up Normally so I find more reset and here we go and it works excellent uh I'm this means I do in fact have the RX and the TX lines wired the right way around which means I can replace this horrible thing with an actual connector okay Pi here we go that's the wrong Port that to TTY [Music] 2 uh and the Watch Works excellent although I notice I I think the colors are different and it's clipped so I've gone away and looked at the footage and yes the colors are different I will bring up some b-roll here now this is very interesting it suggests that there is a way for the firmware to figure out what kind of screen is being used and configuring it accordingly because the configuration settings are obviously different for the different types of screen I was unable to make this work I tried it I I wanted to read back stuff like the screen ID and I would actually thought that the myo line master in slave out which connects the screen to the processor wasn't hooked up but this means that if the firmware is capable of adapting to different screens there must be a way for it to do that so have another look I suppose but anyway the main thing is it works so sum up time I think these things are really interesting they're cheap they're easy to hack they're pleasantly unusual I mean not just another arm and if you hunt for it there's a reasonable amount of information out there there's a decent data sheet with holes in it there's a mostly adequate SDK with holes in it there's a compiler with big holes in it I'll get on to that later and you can get these absolutely everywhere so here is Al Express pages of them and then for some reason you go on to Performance sport stripes for BMW and the pricing on AliExpress is you know anything from Two and a bit Euros to 78 if you go to Alibaba they're even cheaper but of course you do need to buy more I found this one where the price price actually starts at 80 US Cent although for that you do have to buy 100 million of them for your three Franks dollars pounds Euros you actually get quite a bit of functionality they run micropython very nicely there's actually quite a lot of Hardware in one of these things now the biggest thing about these devices which I haven't really talked about is the Bluetooth low energy stack the reason why I haven't talked about it much is that even though there are samples in the SDK for making it work and ARB Baron has some examples for some reason the BL stack wants to load into RAM not into Flash and it consumes 10K and given that the device has 16k and it uses 2 1/2k for its SBI cache that doesn't really leave a lot of space so if it's going to be at all viable to use B with micropython it will need a brand new stack that uses less Ram the other big issue is you do have to modify them in order to reprogram them you can Flash them OTA and I suppose it would be possible to reverse engineer that protocol but I don't want to so anyone who wants to flash it is going to have to open it up and solder some very small wires on one issue I came up with that hasn't showed up on camera is that without the reset line wired up I actually had a fair bit of difficulty making the device reboot properly after flashing an image I think it was failing to reset properly now it is possible to Halt and run the CPU via the debug interface and I'm not sure that restarting the CPU is working properly I have also found a command which is supposed to do a full reset of the device but I'm not convinced that works properly either it's much easier if you can wire up the reset line but wiring up the reset line is decidedly non-trivial and now let's talk about the compiler tellink has a port of GCC to the tc32 it is very old and not very good and there's no Source available which is really naughty of them it's got some really bad bugs for example here is a c program it is just a simple switch statement which compiles into a jump table down here are the targets so here is where we call Funk with parameter zero we load the parameter we jump to tjl Funk to actually do the work here we have the jump table and this is encoded as a set of of bytes unfortunately here is the code that actually jumps via the jump table and we take the initial value we multiply it by four we load the address of the jump table we add the jump table address to the multiply by4 value read the address and jump but these are not addresses these are btes this just doesn't work it's garbage luckily there's a compiler flag that allows you to make the compiler generate tree style switch statements here it is and those do work but without the flag your code will just crash as soon as it hits a switch statement so for this to be a decent platform it really needs a new compiler porting you know llvm or GTC to the tc32 would be card however I suspect it would be much easier to generate cortex m0 code and then assemble this for the tc32 because I think that the two architectures are so similar that this would be trivial so there is some interesting work there to figure out the exact relationship between tc32 and cortex m0 given the battery life I'm not sure one of these would actually work as a watch it would be interesting to see how long the battery would last when sleeping probably easily long enough but I don't know whether you could sleep the CPU while also having the LCD enabled and still get 24 hours battery life the stock firmware just turns the screen off after a few seconds you have to touch the button to make the time appear which means it's not very useful as a watch but I can totally imagine these things being useful as a mini control panel user interface for some other project just being able to use one as a monitor so all it does is display data that's fed to it via the uart or something that would be plausible a little fiddly to modify the device to actually do that but it's not like they're expensive so anyway I am going to leave it here because this has actually taken quite a while of War clock time and I am desperately afraid this is going to end up either being a 2hour video or 10-minute video so I need to go away and start editing there is a lot more stuff to do here I may or may not do some of it off camera depending on how enthusiastic I feel everything is going up on Gib including my debugger Bridge which is this thing currently being displayed here as a standard Rasberry Pi Pico project the micro python Port I'm going to talk to the micropython people about upstreaming it I am not sure they will want it given that it needs this weird proprietary compiler but we'll see but that'll be on GitHub anyway stuff like ROMs and the sdks and the data sheets I have uploaded to archive.org links to all these things will be below in the description so as always I hope you enjoyed this video please let me know what you think in the comments [Music]
2024-07-01 21:45
