Finally there is DOOM on a Cooking Pot... Nice hacking challenge of a way over-engineered "Smart-device"! Inside we can find 4 SoC's from 4 companies: Heat control via STM32F031 Input button via PIC18F8.. Wifi via ESP32 Main FW Renesas 400Mhz ARM A9 Full video on YouTube: youtu.be/V5Jtc7wTbQ8

Crazy that the Smart BLE Ring with a Matrix Display is real🤪 But something is strange this claimed unknown PAR2860 SoC(If that is really inside the ring) looks very much like the firmware of the 7 Segment Ring (DA14585 SoC) but is still different. maybe a cloned DA14585?

What's better then a Smart Ring with 7 Seg Display? A Smart Ring with matrix Display! 20€ version on Aliexpress(Affilia) s.click.aliexpress.com/e/_c4aEitU1 Main BLE SoC PXI PAR2860 with 512KB Flash and 32KB RAM Still on order but excited to Hack it next! Previous Hacks in next comment

The Simple nRF52832 Spectrum Analyzer is now working on the Allmiibo LCD and OLED Variant🥳 Fully OTA Updateable from pixljs and back Find the Source Code of the pixlAnalyzer now here: github.com/atc1441/pixl... And a YouTube Explanation Video here: youtu.be/kgrsfGIeL9w

Just finished Hacking the Pill Camera that you'd swallow for an easy endoscopy Ti CC1310 SoC Glitched and Dumped which allowed to Reverse Engineer its firmware and RF Protocol up to full Image receiving🥳 No security included but short range. 📽️🎬 here: youtu.be/qEIW5gOLzIs

New idea - use the #Raspberrypi to directly drive parallel Eink displays. Pictured - Kindle 6" 1024x758 34pin panel driven by a RPIZ2W and (one of a kind) custom PCB. youtube.com/shorts/LwGyG... Benefits - the RPI (or any Linux SBC) can create/push the pixels faster than any ESP32. low cost SBC.

Lets take a look inside one of those Aliexpress "Smart" Car Keyfobs which you can retrofit your "Lame" Car Key with 😅 TLDR: It does not run Doom 😞 The internal RTL8762TD Hast sadly "only" 192KB of RAM Find the Teardown video here: youtu.be/oAmtu87EdYo

Lets take a look inside one of those tiny Pill Cameras that you swallow to check your innards😳 Video on YouTube: youtu.be/pf_eOLRd6B4

Finally there is code execution on this Shi**y Realtek RTL8752H and RTL8762ESL ARM SoC🥳 Full custom firmware goes Brrrrr These chinese vendors like Realtek Bluetrum and Jieli only care about copy protection and cribble down a perfectly fine ARM Core with their tooling🙄

Teardown of the Tuya KWS-303WF Wifi Power Meter including cut-off Relay Inside we can find: - Tuya CBU Modul with Beken BK7231N ARM SoC 2MB Flash 256KB RAM - Relay claimed 63A - Power Meter - LCD 60x160 Pixel - External NTC Temp Sensor aliexpress.com/item/1005008...

Teardown of an OBD Find My Adapter from Aliexpress aliexpress.com/item/1005007... As expected as simple as it could get, 3.3V Voltage Regulator with an currently unknown BLE SoC ESM412 2449XFD No connection to CAN and OBD just for power

DOOM on a Vape via ScreenSharing and custom Firmware 😁 Source code on Github here: github.com/atc1441/Vape... And find a full video on Youtube with more details: youtu.be/rVsvtEj9iqE

Teardown of the 2" LCD Screen Mirror device ~20€ From Aliexpress s.click.aliexpress.com/e/_oCyfENx Surprisingly packed - Unknown DH390D HT2522A SoC likely HiChip HC15xx 4MB SPI Flash - Battery Powered - Speaker - Realtek WiFi Chip - Jieli BLE SoC Similar to youtu.be/pFBn6lMJ7q8

Fun fact this 3€ USB-C to Headphone converter has more Flash and RAM then the first moon landing. de.aliexpress.com/item/1005009... The internal RISCV Bluetrum SoC AB136D got: 128 KB Flash 60 KB RAM Perfect USB Rubber Ducky, easy to reflash without opening via the USB DP Pin🤪

Also got the OLED Amiibo Emulator😅 Sometimes for < 8€ in the combo offers! aliexpress.com/item/1005008... They are just too cute and a nice Hackable gadget with everything included in a small case. nRF52832 SoC SPI Flash LCD/OLED NFC Battery Arduino able x.com/atc1441/stat...

Teardown massacre of random 2€ Aliexpress Airpod clones 😅 80% Bluetrum (AB) and 20% Jieli

While not a full custom firmware you can find the current Bluetrum AB5682 SoC Hacking results here github.com/atc1441/Blue... This SoC Is used in the A9 Pro Airpod Clones and many more cheap BLE Gadgets. Quite Beefy for its price: RISCV 2MB Flash 162KB RAM 98KB ROM

Thats Code execution on the infamous AB5682B BLE SoC used in the cheap headsets and other BLE hardware🥳 This Bluetrum Chip series is ugly 😅 Debug via 1 Wire UART and a somewhat secured proto This code now runs from RAM since we next need a loader to dump an write to Flash

Why does this aspire PIXO Vape got a hidden BLE Chip inside? 🤔 Internals: Puya PY32F403 ARM SoC 256kb flash 64kb RAM 16MB External flash LCD with Full touch Unmentioned WS8000 BLE Module Full hackability with an USB Flash drive update not including any CRC or sign checking🙌

One more Doom port^^ This time on an Epaper Translator🥳 Running an XR872at SoC and an 296x152 BW E-Paper display with around 400ms of refresh time Find a teardown done some time ago here: x.com/atc1441/stat... Full Youtube video here: youtu.be/PvTJpbVPxUo

Lets take a closer look inside an 20€ Aliexpress Alarmo clone "Smart AI Kids clock" based on the XR872ats SoC And of course port Doom to it😅 Full Teardown Youtube video: youtu.be/QutpZBTJRDY Github repo with full source code: github.com/atc1441/XR87...

It had to be done 😅 DOOM on the Xiaomi Mi Band 8 Fitnessband Running super smooth on the Amoled Display and the custom firmware with toom on just 2MB of Flash Full video on Youtube: youtu.be/iqyR_LNp9vc

DOOM on the ANKER Prime Charging station😅 The internal SWM34S MCU is just way too nice! 8MB RAM + 16MB Flash directly mapped to memory goes brrrr Video on Youtube: youtu.be/MdOU8SqCqeY

Quick teardown video of an Battery powered 4" LCD Screen Mirror device around 25€ from Aliexpress TLDR: Main SoC is an HCSEMI C3100 which is very similar to the one used in the 20€ Handheld Console SF2000 Video Here: youtu.be/pFBn6lMJ7q8

That's a success 🥳 Glitched and fully Dumped MSP430F417 in a non destructive way Doing a Read data CMD and glitching the check if the password was entered we can dump 240bytes at once By dumping the pass(vector) area we can read the full flash after one glitch bsky.app/profile/atc1...

DOOM on a Toothbrush? Sure! Info's to this, The Toothbrush contains an ESP32-C3 with 4MB Flash. With the codebase from Spritetm github.com/Spritetm/esp... and wad github.com/fragglet/min... I was able to get the complete size down to the 4MB🥳 (Reupload from you know where for the sake of history)

Mendatory Dong DOOM ... In depth details in this Youtube Video: www.youtube.com/watch?v=rAE1... (Reupload from you know what platform for the sake of history)

Fun fact 50% of the (Latest)Firmware in the BLE Enabled Power Bank Anker Prime 27650mAh is just for OTA checking and encryption... Fw version prior to 1.6.2 do not verify OTA at all so better update😅 Did take a look inside and reverse engineered it github.com/atc1441/Anke...

Teardown of the nearly "All in One" Zigbee Sensor from Aliexpress: s.click.aliexpress.com/e/_opaf9hD Contains: - Telink TLSR Zigbee/BLE SoC 512KB/64KB - PHO XBR818 I2C 10G Move Sensor - WHT20 I2C Humidity Temp Sensor - Light Sensor - Led - Button Just missing a Door sensor to be perfect^^

Digged into the Gantner ECO NFC Lock The unlocked STM32L151 did give the Firmware and their Android MoLa App is nice to Reverse engineer still no Luck finding any holes😅 Learned a lot about NFC! The App will emulate an NFC Tag to configure incl. a both way Unique key Handshake

Interesting and relatively cheap Android Payment terminals (US Only 😔) available in masses on eBay Most likely locked to signed APKs so hacking needed☝️ www.ebay.com/itm/11591497... and similar in recommendations fccid.io/HFS-C300/Int...

DOOM runs fine on the 15€ 4G LTE Routers 😂 youtu.be/jung-yLB_Zs Turns out the MSM8916 is just running plain Android 4.4.4 which is even directly mapped to the 128x128 LCD... Basically a bad Android Phone with Hotspot turned on by default s.click.aliexpress.com/e/_okZ8ZXt

Unfortunately the latest Xiaomi Mi Band 10 does also use the same SoC BES 2700iMP as the Mi Band 9 🥲 Just did a quick teardown to find out its mainboard is 90% the same to the older version Video here: youtu.be/QmVwbeRdpVA No further hacking from my side these days.

Teardown of a few Aliexpress Hörmann Remote Clones Most interesting a Tuya WiFi Enabled one: s.click.aliexpress.com/e/_opwprH1 Which turns out to be just as simple as a standalone remote(4Buttons) connected to the Tuya CB3S Belkin BK7231N module and handled as just GPIOs

Another Heat cost Allocator looked into. This time an Ista non RF Variant. Decapped Blob turns out to be an MSP430C413 8KB ROM 256 Byte RAM Other than that its just: - Custom LCD - 2 Temp Sensor - CR2477 Battery - IRDA Interface Not much to "hack" on without RF and ROM based SoC

Teardown of an random LCD Temperature Logger which is used to export the history data a PDF CSV or TXT Powered by just an CR2450 and claim of 1 year lifetime s.click.aliexpress.com/e/_onjSQYR Inside we can find: - NTC Temp Sensor - STM32L073RBT6 ARM SoC - SPI Flash 25Q64 1 MB - Custom LCD

It's been a while since I promoted my own and others' Maker/Electronics Starter Packs! bsky.app/starter-pack... bsky.app/starter-pack... bsky.app/starter-pack... bsky.app/starter-pack... bsky.app/starter-pack... bsky.app/starter-pack... bsky.app/starter-pack...

Custom firmware on an Heat cost Allocator... No use but funny to look into it and its WMBUS RF Packets Next step is to dump the stock firmware via the ages old Timing attack from @travisgoodspeed (MSP430F417)

ESP32 only WiFi / BLE Jammer Reverse Engineered the ESP32-S3 RF part good enough and found the right Registers and ROM Functions to make it a somewhat "Research purpose only device" Short video now online here: youtu.be/t4IfF0aUa-g

Call me impressed, Gemini helped a lot to create these 2 template designer tools. atc1441.github.io/oepl_json_de... atc1441.github.io/oepl_yaml_de... They allow to quickly create a Drag and Drop E-Paper dashboard for the OpenEpaperLink JSON Template and HomeAssistant plugin

Quick Teardown of the 10€ ZigBee Plant Humidity sensor s.click.aliexpress.com/e/_opby7T8 Insides: - Telink TLSR SoC Capable of BLE and ZigBee, very hackable - Moisture sensor via 555 Timer - Unknown SoC for Moisture measurement - 2xAAA Battery holder - LED - Button - Cheap NTC Sensor

Made a Shitty counter(and clock) out of the overpriced and locked down smiirl Flip subscriber counter🙌 Explanation video and teardown now on YouTube youtu.be/aBNShHO0Vgw

Finally implemented 4 Color support into the ATC_BLE_OEPL E-Paper Display Firmware together with a lot more features which I share in my newest video, including the how to flash "guide" in a one take: youtu.be/9oKWkHGI-Yk

New Smart Ring with LED Segment display are on Aliexpress,unfortunately seems like its RTL8762 based which is still not"Hackable"sadly. So not going to order it s.click.aliexpress.com/e/_okrFoRC Better stick to the SR08 if you want something hackable wit Display😅 youtu.be/xOw-6uMfOjc

Found a Smiirl Sub Counter for cheap on the flea market Damn that's just a very overpriced and unsecure OpenWRT Router with added I2C Interface to the FlipsFlaps running some basic Lua scripts.. 300 bugs for that is bogus! Easy to get SSH within the same network for good reuse

These Memor X3 bad Boys are too cute🥹 Just no use for them so they will end on ebay shortly Still wanted to share this nostalgic view

Dumping firmware from JieLi chips JieLi chips are fairly common in Bluetooth audio devices, but they are also becoming more common in miscellaneous devices. Fortunately, retrieving the firmware is mostly straightforward.

Created a Word Clock for the 9.7" E-Paper Display which utilizes the OpenEpaperLink Project The Python script creates the Word Clock image and does a post request to the OEPL AP which will upload it every 5 minutes to the display Code can be found here: github.com/OpenEPaperLi...

Made a simple repo with the currently ~100 available firmware files of Telink TLSR Based Xiaomi devices for anyone searching for hackable devices 🙌 github.com/atc1441/Xiao... Another set of all ~9000 devices of different SoC's might come later 😅

Someone must have had fun putting 80pcs ESP32 modules seperate in bags... I sure did unpacking it 🥲