Aaron Christophel
Cheap Arduino E-Ink Display from old supermarket Price Tag
updated
Part 1 here: youtu.be/MpSVU3t1J38
The price will be shown higher in the link, check out the "From $0,99" / "3 From 2,99€" offers until you find the one from the link.
Link to the Watch: https://s.click.aliexpress.com/e/_DmzEqAt
No guarantees that your watch will have the same SoC as they seem to switch the model at random!
Used WebFlasher:
atc1441.github.io/BLE_EPaper_OTA.html
rbaron's work on a similar watch:
rbaron.net/blog/2021/07/06/Reverse-engineering-the-M6-smart-fitness-band.html
Part 2 here: youtu.be/NvNtfvvK60E
The price will be shown higher in the link, check out the "From $0,99" / "3 From 2,99€" offers until you find the one from the link.
Link to the Watch: https://s.click.aliexpress.com/e/_DmzEqAt
No guarantees that your watch will have the same SoC as they seem to switch the model at random!
Find the E-Paper wall 1.0 and 2.0 videos here:
youtu.be/CLmotCeMlq0
youtu.be/CAxm5W5Jioo
Follow me on Twitter: https://x.com/atc1441
You can find the same battery holder as in the video here(Affiliate):
https://s.click.aliexpress.com/e/_DmVDkCb
Follow me on Twitter: https://x.com/atc1441
Since I could not let go of the idea to know how the buttons work you now will know it as well!
Follow me on Twitter: https://x.com/atc1441
The custom firmware is released here, very Alpha as of now:
github.com/jjwbruijn/OpenEPaperLink/tree/master/ARM_Tag_FW/OpenEPaperLink_TLSR
Compiled firmware is here:
github.com/OpenEPaperLink/OpenEPaperLink/blob/master/binaries/Tag/TLSR_HS_BWY_75.bin
The flashing tool used in the Video is my WebFlasher: atc1441.github.io/ATC_TLSR_Paper_UART_Flasher.html
Follow me on Twitter: twitter.com/atc1441
youtu.be/q9o9sKY2hk8
youtu.be/tcqLgjmzUzM
Get your DOOM device here:
de.aliexpress.com/item/1005006925557526.html
Only possible by the great work of Spritetm:
github.com/Spritetm/esp32c3-doom-bauble
Both models can be found here:
https://s.click.aliexpress.com/e/_DCJh4af
and
https://s.click.aliexpress.com/e/_DlVSod9
Infos:
Main SoC Rockchip PC30
8GB Flash
1GB RAM
Android 8
Wifi/BLE
Get the Colmi Smart Ring here:
https://s.click.aliexpress.com/e/_DcyUheT
The Repository and tool can be found here:
github.com/atc1441/ATC_RF03_Ring
Part 1:
youtu.be/w90RVspTkt8
Follow me on Twitter: twitter.com/atc1441
https://s.click.aliexpress.com/e/_DcyUheT
In this video we will take a deeper look into the Colmi Bluetooth Smart Ring R02 and its SoC
Part 2:
youtu.be/IOMqtFrNpTI
The Repository and tool can be found here:
github.com/atc1441/ATC_RF03_Ring
SDK From BlueX:
gitee.com/BXMicro/SDK3
bluexmicro.com/wp-content/uploads/BLE_SDK_V2.1-V2.1.zip
Follow me on Twitter: twitter.com/atc1441
https://s.click.aliexpress.com/e/_DFpaNPZ
Inside we can find the Fudan FMSC Chip which is not very much known about
Follow me on Twitter: twitter.com/atc1441
action.com/de-de/p/3203284/nor-tec-selfie-halter
Listenai website:
listenai.com
Partial SDK of Listenai device:
cloud.listenai.com/zephyr
Sequre screwdriver
ES666 Oled variant:
sequremall.com/products/electric-screwdriver
ES555 LED Variant:
sequremall.com/collections/screwdriver/products/sequre-es555-smart-screwdriver-with-electric-manual-modes-support-fixed-automatic-working-modes-suitable-for-repair-disassembly-assembly-rc-models-drones-mobile-phones-computers-electronics
See here for more info's:
youtu.be/-qvn0YUiH5o
Find a few more updates in between on Twitter:
twitter.com/atc1441/status/1761321813412282668
Only working because of these 2 great Repos from wonderful people:
github.com/Spritetm/esp32c3-doom-bauble
github.com/fragglet/miniwad
Custom firmware and firmware uploader here:
github.com/atc1441/ATC_Wifi_Toothbrush
Find a few more updates in between on Twitter:
twitter.com/atc1441/status/1761321813412282668
First video about the displays: youtube.com/watch?v=Cp4gNXtlbGk
OpenEPaperLink How-To Guide video: youtu.be/8oQdo9bJ7Rk
Follow me on Twitter: twitter.com/atc1441
youtu.be/LBL6pVpHpdE
Get it here for sometimes as low as 26€ from Aliexpress:
https://s.click.aliexpress.com/e/_DmPOIJx
Follow me on Twitter: twitter.com/atc1441
( Of course there might be better, faster or different solution go get there or use IDA! this is just my way :) )
https://s.click.aliexpress.com/e/_Det686Z
Mentioned STC Soldering iron Custom firmware and video:
youtube.com/watch?v=mId_FW86pwQ
github.com/atc1441/ATC_stc_solder_iron
Follow me on Twitter: twitter.com/atc1441
The custom firmware is released here, very Alpha as of now:
github.com/jjwbruijn/OpenEPaperLink/tree/master/ARM_Tag_FW/OpenEPaperLink_TLSR
Compiled firmware is here:
github.com/jjwbruijn/OpenEPaperLink/blob/master/binaries/Tag/TLSR_HS_35_ALPHA.bin
The flashing tool used in the Video is my WebFlasher: atc1441.github.io/ATC_TLSR_Paper_UART_Flasher.html
Follow me on Twitter: twitter.com/atc1441
https://s.click.aliexpress.com/e/_DmPOIJx
Follow me on Twitter: twitter.com/atc1441
twitter.com/atc1441/status/1722039843578859661
twitter.com/atc1441/status/1724012261230993709
Follow me on Twitter: twitter.com/atc1441
Waveshare Passive NFC E-Paper display
Source Code Repository:
github.com/atc1441/Waveshare_NFC_E-Paper_Display_custom_firmware
There are multiple different sizes available and all seems to use the same SoC inside
waveshare.com/2.13inch-nfc-powered-e-paper.htm
Follow me on Twitter: twitter.com/atc1441
Follow me on Twitter: twitter.com/atc1441
Follow me on twitter:
twitter.com/atc1441
This allows you to drive E-Paper Price Tags with a custom firmware and show your favorite content on them
Thanks to PCBway for sponsoring this video and the Flex PCBs
Go and check them out: pcbway.com
PCB and STL files are available here:
github.com/jjwbruijn/OpenEPaperLink/tree/master/Hardware/2.9-1.54%20NanoAP%20by%20ATC1441
OpenEPaperLink GitHub Repo:
github.com/jjwbruijn/OpenEPaperLink
https://openepaperlink.de/
OpenEPaperLink Getting started video:
youtu.be/Etonkolz9Bs
How to flash the display Firmware step by step:
youtu.be/98fOzZs__fc?t=719
Home Assistant integration:
github.com/jonasniesner/open_epaper_link_homeassistant
Follow me on twitter:
twitter.com/atc1441
You can find the SEQURE SI012 Pro Max Soldering iron here:
9%OFF code: NEW
sequremall.com/products/sequer-si012-pro-max-portable-oled-soldering-iron-with-color-ambience-light-chinese-english-and-russian-menu-applicable-t12-ts-si-soldering-iron-tips-support-pd-qc-3s-6s-battery-power-supply
Unterstützt durch Produktplazierungen
gist.github.com/atc1441/41af75048e4c22af1f5f0d4c1d94bb56
Special bonus video:
youtu.be/OkfS_z0FrlE
A thread of this reverse engineering session can also be found on Twitter:
twitter.com/atc1441/status/1667252413051424773
08.06.2023 - Bypass was found and reported to WCH
09.06.2023 - WCH Confirmed the bypass and noted that newer the ISP Tool allows to set the erase length which allow to erase more than the 6-8K bytes as shown in this video. This makes the User of the CH573 responsible for the firmware protection. 6-8K bytes will be always erased.
WCH Noted that the 6-8K bytes where chosen to speed up the erasing.
As per WCH the erase length option does not need an update of the Bootloader.
Tested Bootloader version: 2.80
Follow me on twitter:
twitter.com/atc1441
The NFC part of the band is not locked into as this is not the interesting part.
Demo code on GitHub:
github.com/atc1441/Disno_band_NRF31512
Part 1 of the Hardware hacking and Firmware extracting can be found here:
youtu.be/C-UCr9mJ9bY
You can find a Tweet writeup here on twitter:
twitter.com/atc1441/status/1662192314649833472
Find Part 2 with the firmware reversing here:
youtu.be/i91RUKcc3ew
You can find a Tweet writeup here on twitter:
twitter.com/atc1441/status/1662192314649833472
This video reveals an exploit on how to glitch the nRF31512 and presumably also the:
nRF31502
nRF31504
nRF24LE1
nRF24LU1+
nRF24E1
nRF24E2
The talked of nRF51 Glitching info's can be found here:
youtu.be/tMPD0kBG_So
- Flash a custom firmware on the ZBS243 based E-Paper Price tags
- How to connect such a display to an ESP32 as Access point
- How to flash this Access Point
- How to use the OpenEPaperLink firmware to drive displays wireless and simple
OpenEPaperLink Github Repo:
github.com/jjwbruijn/OpenEPaperLink
https://openepaperlink.de/
Home Assistant integration:
github.com/jonasniesner/open_epaper_link_homeassistant
ZBS_Flasher:
github.com/atc1441/ZBS_Flasher
How to flash the display Firmware step by step:
youtu.be/98fOzZs__fc?t=719
Follow me on twitter:
twitter.com/atc1441
github.com/atc1441/ATC_stc_solder_iron
Solder iron:
vi.aliexpress.com/item/1005003373147424.html
More info's on Twitter:
twitter.com/atc1441/status/1631957971725942785
hackaday.io/project/189695-triink-low-power-ble-e-paper-clock
The issues where disclosed to Sumup in private and closed, said by Sumup, in newer Firmware version
Timeline:
20.03.2022 - Release of "Doom" video on Twitter, without disclosing any exploit or issues
23.03.2022 - Contacted by the Security team of Sumup followed by a disclose of the issues shown in this video to Sumup
18.02.2023 - An E-Mail written to Sumup with info about the release of the issues after 1 Year
21.02.2023 - Answer from Sumup and acknowledge of the releasing from Sumup
22.02.2023 - Release of this video to Sumup via E-Mail
23.02.2023 - Release of this video and the shown issues to the Public
Find the mentioned Twitter posts here:
twitter.com/atc1441/status/1505591252766576645
twitter.com/atc1441/status/1506024219540606978
twitter.com/atc1441/status/1487084797382037504
twitter.com/atc1441/status/1485660721493028873
twitter.com/atc1441/status/1484506242370478083
Doom used:
github.com/maximevince/fbDOOM
It is used to act as an Access Point interface for E-Paper price tags that run a custom firmware from Dmitry, see the linked video for more info's on that.
CC2652/CC1352 Firmware:
github.com/atc1441/ZBS_Flasher/tree/main/CC2531_station/EPaperStation_cc13x2_cc26x2_Driver
E-Paper Firmware:
Source: github.com/atc1441/ZBS_Flasher
Video: youtu.be/98fOzZs__fc
Ti Flash Programmer 2:
ti.com/tool/download/FLASH-PROGRAMMER-2/1.8.2
Ti CCS Studio:
ti.com/tool/CCSTUDIO
2.9" E-Paper Price Tag: youtu.be/98fOzZs__fc
7.4" E-Paper Price Tag: youtu.be/kPy8rIQ75NU
Custom firmware GitHub Link: github.com/atc1441/ZBS_Flasher
Dmitrys Price Tag Reversing: http://dmitry.gr/?r=05.Projects&proj=29.%20eInk%20Price%20Tags
Follow me on twitter:
twitter.com/atc1441
The old controller board is sadly intended to be used in an automatic matter for mass production and not so much to tinker around and engrave funny things into metal
youtu.be/kPy8rIQ75NU
Follow me on twitter:
twitter.com/atc1441
youtu.be/DRuVUtqFqcg
Follow me on twitter:
twitter.com/atc1441
youtu.be/aAmc0V1FIa8
Follow me on twitter:
twitter.com/atc1441
youtu.be/XdeNul8OkhI
Follow me on twitter:
twitter.com/atc1441