ATC1441
@atc1441
Hack the planet! my biggest passion is to run a custom firmware on as many devices as possible
Another mandatory DOOM Port finished...😅 This time on an still unknown but fully reversed Chinese SoC. The 6€ 104 Games Action Console as well as the 13€ PacMan Nice Challenge and quite playable YouTube video: www.youtube.com/watch?v=jsV_... Full Source: github.com/atc1441/Acti...
Added Home Assistant Auto Discovery to the MQTT Client of the the Custom ESP32 Gateway which allows for a simple integration🥳
Successfully reverse engineered the cloud bound 15€ OBI Energy Tracker to get it fully on local setup Either by using it via an custom ESP32 AP or by getting the stock AP to connect to your server🥳 Hack Video youtu.be/U4Vvf0kHnEk German howto video youtu.be/2jMEaRuSJ18
Finished the latest hacking project🥳 A deep look inside of the AOHi 280W USB Desktop charger ended up in a replacing Custom firmware^^ 🎬Here: youtu.be/1UGUZloDsPU Source code: github.com/atc1441/AOHi... Fun challenge to 95% replicate the firmware and add extra features to it
Finally hacked the MiBand 9 and 10 SoC The BES2700iMP was until now fully closed and without any public SDK/Hacks. By using the leaked IHC SDK I was able to run a full custom firmware to of course Play some DOOM on it! 🎬 www.youtube.com/watch?v=XdoP... GitHub: github.com/atc1441/MiBa...
Link to Aliexpress as well as a look inside: s.click.aliexpress.com/e/_c45RCfet Overall it seems the device is using a Smartwatch firmware and minimum of hardware to be what it is. Lets see if it can also find some Firmware extraction or update methods...
TL;DW: Claude One-shotted a python Video player for this mini 10€ Smartphone Viewfinder. Including the download of the needed Youtube video...
For sure the lately "trending" and super cheap Video Walkie Talkies are now also Doomed 🥳 Full video now on YouTube: youtu.be/5aRQLHLls0k Source code and Precompiled firmware is available here: github.com/atc1441/TXW8... When Multiplayer?😅
Fun fact, a web upload trigger gives you root read access on the Tolino Vision Color, but im not even sure if they are in general just more open for tinkering. 7" Full Color Linux eink reader for 200€ is anyway more on the expensive side
Just finished an new E-Paper firmware SoC port🥳 The long hated Realtek RTL8762ESL and RTL8752HJL now got a fully featured ATC_RTL_BLE_OEPL Firmware and so have full OpenEpaperLink Support Released on GitHub: github.com/atc1441/ATC_...
New toy, Pudu Food delivery Robot. Doom runs fine on its internal Android RK3399 NanoPC-T4 Basically an over engineered Hoverboard with two RealSense D435 3D Cameras and Lidar Longer video on YouTube: youtu.be/cBzTto2OIDQ
Finally there is DOOM on a Cooking Pot... Nice hacking challenge of a way over-engineered "Smart-device"! Inside we can find 4 SoC's from 4 companies: Heat control via STM32F031 Input button via PIC18F8.. Wifi via ESP32 Main FW Renesas 400Mhz ARM A9 Full video on YouTube: youtu.be/V5Jtc7wTbQ8
Aha! Mystery solved, the mentioned chip is actually the Display driver The main SoC is the one next The DA14535 with a 24 Pin case renesas.com/en/products/... This explains why the firmware is so similar to the DA14585^^ Not a clone This opens up everything for a custom firmware
Crazy that the Smart BLE Ring with a Matrix Display is real🤪 But something is strange this claimed unknown PAR2860 SoC(If that is really inside the ring) looks very much like the firmware of the 7 Segment Ring (DA14585 SoC) but is still different. maybe a cloned DA14585?
What's better then a Smart Ring with 7 Seg Display? A Smart Ring with matrix Display! 20€ version on Aliexpress(Affilia) s.click.aliexpress.com/e/_c4aEitU1 Main BLE SoC PXI PAR2860 with 512KB Flash and 32KB RAM Still on order but excited to Hack it next! Previous Hacks in next comment
The Simple nRF52832 Spectrum Analyzer is now working on the Allmiibo LCD and OLED Variant🥳 Fully OTA Updateable from pixljs and back Find the Source Code of the pixlAnalyzer now here: github.com/atc1441/pixl... And a YouTube Explanation Video here: youtu.be/kgrsfGIeL9w
Just finished Hacking the Pill Camera that you'd swallow for an easy endoscopy Ti CC1310 SoC Glitched and Dumped which allowed to Reverse Engineer its firmware and RF Protocol up to full Image receiving🥳 No security included but short range. 📽️🎬 here: youtu.be/qEIW5gOLzIs
Lets take a look inside one of those Aliexpress "Smart" Car Keyfobs which you can retrofit your "Lame" Car Key with 😅 TLDR: It does not run Doom 😞 The internal RTL8762TD Hast sadly "only" 192KB of RAM Find the Teardown video here: youtu.be/oAmtu87EdYo
Finally there is code execution on this Shi**y Realtek RTL8752H and RTL8762ESL ARM SoC🥳 Full custom firmware goes Brrrrr These chinese vendors like Realtek Bluetrum and Jieli only care about copy protection and cribble down a perfectly fine ARM Core with their tooling🙄
Teardown of the Tuya KWS-303WF Wifi Power Meter including cut-off Relay Inside we can find: - Tuya CBU Modul with Beken BK7231N ARM SoC 2MB Flash 256KB RAM - Relay claimed 63A - Power Meter - LCD 60x160 Pixel - External NTC Temp Sensor aliexpress.com/item/1005008...
Teardown of an OBD Find My Adapter from Aliexpress aliexpress.com/item/1005007... As expected as simple as it could get, 3.3V Voltage Regulator with an currently unknown BLE SoC ESM412 2449XFD No connection to CAN and OBD just for power
DOOM on a Vape via ScreenSharing and custom Firmware 😁 Source code on Github here: github.com/atc1441/Vape... And find a full video on Youtube with more details: youtu.be/rVsvtEj9iqE
Teardown of the 2" LCD Screen Mirror device ~20€ From Aliexpress s.click.aliexpress.com/e/_oCyfENx Surprisingly packed - Unknown DH390D HT2522A SoC likely HiChip HC15xx 4MB SPI Flash - Battery Powered - Speaker - Realtek WiFi Chip - Jieli BLE SoC Similar to youtu.be/pFBn6lMJ7q8
Fun fact this 3€ USB-C to Headphone converter has more Flash and RAM then the first moon landing. de.aliexpress.com/item/1005009... The internal RISCV Bluetrum SoC AB136D got: 128 KB Flash 60 KB RAM Perfect USB Rubber Ducky, easy to reflash without opening via the USB DP Pin🤪
Also got the OLED Amiibo Emulator😅 Sometimes for < 8€ in the combo offers! aliexpress.com/item/1005008... They are just too cute and a nice Hackable gadget with everything included in a small case. nRF52832 SoC SPI Flash LCD/OLED NFC Battery Arduino able x.com/atc1441/stat...
Teardown massacre of random 2€ Aliexpress Airpod clones 😅 80% Bluetrum (AB) and 20% Jieli
While not a full custom firmware you can find the current Bluetrum AB5682 SoC Hacking results here github.com/atc1441/Blue... This SoC Is used in the A9 Pro Airpod Clones and many more cheap BLE Gadgets. Quite Beefy for its price: RISCV 2MB Flash 162KB RAM 98KB ROM
Thats Code execution on the infamous AB5682B BLE SoC used in the cheap headsets and other BLE hardware🥳 This Bluetrum Chip series is ugly 😅 Debug via 1 Wire UART and a somewhat secured proto This code now runs from RAM since we next need a loader to dump an write to Flash
