christian-kramer / JieLi-AC690X-Familiarization

Adventures in figuring out how this incredibly ubiquitous, yet incredibly mysterious integrated circuit works.
304 stars 58 forks source link

Voice prompts #1

Open fabitom opened 4 years ago

fabitom commented 4 years ago

Thank you for your work with this chip. Do you know how to disable voice prompts ? its hard coded ?

buzzcola3 commented 4 years ago

it is not hard-coded as far as I know, this chip sold all over aliexpress. I had a few and they use the same chip but have different voice accents... I'm pretty sure you can modify it at will if you manage to figure out how to flash/reprogram the chip

you just put sounds/voices that you want in the right folder with the right name press flash and you'd be done

bxwengithub commented 4 years ago

From the blog post in you description,

  1. save the .bin file
  2. generate .bfu file using download.bat
  3. save the .bfu file into a usb flash drive
  4. connect the usb drive to the usb pins, power up Did you try that?

https://blog.csdn.net/JaLLs/article/details/85222667

USB
buzzcola3 commented 4 years ago

As far as I know, you need the "batch activator" which gets the chip in some kind of weird "DFU" and possibly even translates USB signals. If you download and read documents from Git JieLi-AC690X-Programming there is basically everything you need. Unfortunately I don't have that "batch activator" ($20) and no one reverse engineered it yet

buzzcola3 commented 4 years ago

When I was translating those documents, there was a mention about updating by BFU file via SD card/ USB stick. But you would have to enable it in firmware

christian-kramer commented 4 years ago

Hi everyone, it's cool to see all the interest in my project!

First of all, I just wanted to share that (in my experience) factory-new chips without firmware are already setup to enter into the "DFU mode" automatically, without the "batch activator". Only if the chips have already been programmed before do you appear to need the activator.

Secondly, I just tried today uploading the .bfu file using a usb flash drive to see if the brand-new chip would accept it. Unfortunately it did not, and still enters "DFU mode" automatically when plugged into a computer.

However, I could be missing something to properly connect the flash drive to the AC6905A.

bxwengithub commented 4 years ago

chris, you said you still cannot upload firmware to the brand-new chip. Did you check if it has some default firmware already loaded? If so what the voice prompt sounds like? Thanks

christian-kramer commented 4 years ago

I did check if there was default firmware, actually. Currently, I have two main indications that there is none loaded:

  1. The device is not recognized as an audio device when plugged into a computer, only a "disk drive". This does not align with the behavior of my pre-programmed chips.

  2. When turned on, no audio is heard from the chip's stereo DAC. This also does not align with the behavior of my pre-programmed chips.

As far as I can tell, these factory-new chips are designed to come "ready-to-program", but I lack several pieces of information to program them successfully. Below is the error output of running "download_cbp.bat" in "JieLi AC690X SDK\apps_soundbox\download\ac690x\post_build"

bxwengithub commented 4 years ago

https://blog.csdn.net/dear5240/article/details/104821919

It seems that each authorized user has a unique key to encrypt the software.

bxwengithub commented 4 years ago

found some more information here. https://www.aliexpress.com/item/10000043867406.html There is a full set of document in google drive: https://drive.google.com/drive/folders/1mlRY6rSlg2HRfW6WnQHuxupsyLbadPpN Not sure how useful it is.

buzzcola3 commented 4 years ago

yep, you have to be authorized by JieLi to use version 2.0 and higher. you can download version 1.5.2 here: https://github.com/buzzcola3/JieLi-AC690X-Programming (and don't forget to disable your antivirus)

Also, if you have 4MBit IC, you have to make sure that the BFU file is under 440Kb so it fits

FW update via USB stick/SD card has to be first enabled in the code and flashed using that "DFU mode"... that "batch activator" maybe does some more magic since it has 3 IC's

Sept1mo commented 4 years ago

Hello Chris, amazing job with this chip. Did you try downloading more recent versions of the SDK? I think there are many in the CSDN community. Also I noticed this: https://www.haolizi.net/example/view_57039.html In that file list there's the 'br21loader.bin" which you seem to be missing, and since the file list seems relatively similar to the SDK you've got, I think it's fair to assume that even if the SDK indicates that's for the 692X version, it may work with your chip. image

Since you already have access to CSDN you may try using the SDK for the AC692X, which seems to be shared here: https://download.csdn.net/download/ledwin/10883331?utm_source=bbsseo.

I'm struggling because I've got a board with that chip that powers on but no longer works or powers up the leds on it. It is recognized correctly by the PC nonetheless. I would asusme the programming on the chip got corrupted or something similar. image

Hope this is somewhat useful.

patrickpredella commented 4 years ago

Hello! Thank you very much for your work on this chip. The info that you pulled out of the internet are golden.

I'm working on a Wuzhi audio amplifier board (100w + 100w). Amazing Board, that has those 4 USB pins exposed on some incredibly comfortable test pads. I would love to be able to reprogram the internal DSP, change the default sound effects and to rename the BT SSID.

After a ton of deep digging through the internet I found this enormous package that seems to contain everything in order to work with the AC692x devices (I believe that yours is actually an AC692X, as it displays as "BR21") https://drive.google.com/drive/folders/1_rg1CTtwDWYpuCx29A9cRrXnMHIq35l0?usp=sharing

I have been following your steps with great success until the "programming mode sequence" that should allow to display the device correctly as a USB device. I have a question: is windows displaying anything before putting the device in "programming mode"? I keep seeing it as an "Unknown USB Device (Device Descriptor Request Failed)"

image

I checked both the sequence generated by the Arduino using an oscilloscope and the connections with the USB Pins of the IC. Unfortunately, though I keep failing

Is there anyone who could help? What do you see before putting the chip in "programming mode"? Is windows device manager showing something at all?

In what sequence are you connecting the terminals? example 1:

  1. USB gnd
  2. USB pwr
  3. clock signal + data signal
  4. disconnect clock and data signal
  5. connect USB d+ and d-

example 2:

  1. clock signal + data signal
  2. disconnect everything
  3. connect all 4 USB pins

Thank you again!

buzzcola3 commented 4 years ago

You might have more luck with the original Chinese programmer. Than you can probe that and see what is it doing and if it is just letting the usb signal through or actually converting it into something else

patrickpredella commented 4 years ago

You might have more luck with the original Chinese programmer. Than you can probe that and see what is it doing and if it is just letting the usb signal through or actually converting it into something else

Would you be able to point me to the original Chinese programmer? I don't seem to be able to find it!

buzzcola3 commented 4 years ago

You might have more luck with the original Chinese programmer. Than you can probe that and see what is it doing and if it is just letting the usb signal through or actually converting it into something else

Would you be able to point me to the original Chinese programmer? I don't seem to be able to find it!

The best way to buy it is here: https://www.aliexpress.com/i/4000014570175.html

I've seen the OG big boy programmer for sale somewhere on taobao I think a while ago, but it was like $100 (one in the picture)

Anyways, I do have maybe similar files as you here: https://github.com/buzzcola3/JieLi-AC690X-Programming

There may be some extra tho

chlorid commented 3 years ago

Hello, quick question: I'm also playing with my sound module (called XY-BT-L) and I followed the guide on the chinese blog post. I have to admit, I don't have exactly the same module as in the blog post, but I thought I can still give it a try. When i uploaded the new firmware, it said once "USB mode" with the new voice. Since then, no LED on and no Audio, no USB recognition on the computer. The bluetooth I can see now is named BT_UPDATA. Could be some kind of USB OTA upgrade mode?? Did anyone experience this behavior? I downloaded this repo here, but I'm not sure now which version it is. Newer or older than the one @buzzcola3 linked to? The drive is empty by the way. Can anybody help me out with a new link?

patrickpredella commented 3 years ago

@chlorid to be honest the maximum I was able to do was to see the device in the list of usb devices, and to make in sort that the uploader recognises it. After that the uploader would keep complaining about missing files and fail the upload.

I was unable to make an account on the Chinese blog. Could you share the content (and eventually SDK) that you found here? It would help for sure!

buzzcola3 commented 3 years ago

@chlorid Wait, I'll undo a git push, I think I had most of the files on GitHub at some point

animaone commented 2 years ago

JieLi seems to be activelly uploading information about its bluetooth sdk: https://github.com/Jieli-Tech

NoahBentley commented 2 years ago

Amazing.

TheSonicZone commented 2 years ago

I have had a look at this information from start to finish. I found a Google Drive folder that you probably already have with all the "dev" stuff for this chip. In there was a video showing how to update the device using some kind of "dongle"- It appears they use some funky USB -> USB converter to program the device.

Whenever there's encryption keys to load firmware I become disheartened because then it is essentially something that the vendor does not want you to mess with.

Valentinriri commented 2 years ago

Hello, Amazing Thx for info and tutorial !

I followed your tutorial on an AC6925 chip but it does not work. I think the initialization sequence "0001011011101111" is not the same for an AC6925.

And once in boot mode, I think we can't just change the name of the chip, like a file in HDD or USB key , we have to reprogram everything... so I dropped :/

TheSonicZone commented 2 years ago

Hello, Amazing Thx for info and tutorial !

I followed your tutorial on an AC6925 chip but it does not work. I think the initialization sequence "0001011011101111" is not the same for an AC6925.

And once in boot mode, I think we can't just change the name of the chip, like a file in HDD or USB key , we have to reprogram everything... so I dropped :/

This chip is too locked down, and I have worked on one too many such systems. There is a valid reason for locking down the firmware- changes to the code by inexperienced folks will invalidate the FCC approval for this device. However they could have made the prompts and name editable, they didn't. They also want some sort of black box to program this device, so it gets a firm NO from me.

Valentinriri commented 2 years ago

Hello, Amazing Thx for info and tutorial ! I followed your tutorial on an AC6925 chip but it does not work. I think the initialization sequence "0001011011101111" is not the same for an AC6925. And once in boot mode, I think we can't just change the name of the chip, like a file in HDD or USB key , we have to reprogram everything... so I dropped :/

This chip is too locked down, and I have worked on one too many such systems. There is a valid reason for locking down the firmware- changes to the code by inexperienced folks will invalidate the FCC approval for this device. However they could have made the prompts and name editable, they didn't. They also want some sort of black box to program this device, so it gets a firm NO from me.

Yes, indeed I had not thought of this possibility ^^, thx for reply =)

christian-kramer commented 2 years ago

Hello, Amazing Thx for info and tutorial ! I followed your tutorial on an AC6925 chip but it does not work. I think the initialization sequence "0001011011101111" is not the same for an AC6925. And once in boot mode, I think we can't just change the name of the chip, like a file in HDD or USB key , we have to reprogram everything... so I dropped :/

This chip is too locked down, and I have worked on one too many such systems. There is a valid reason for locking down the firmware- changes to the code by inexperienced folks will invalidate the FCC approval for this device. However they could have made the prompts and name editable, they didn't. They also want some sort of black box to program this device, so it gets a firm NO from me.

Yes, indeed I had not thought of this possibility ^^, thx for reply =)

Hold on a minute - why would the FCC hold the manufacturer responsible for what consumers do to their product?

TheSonicZone commented 2 years ago

This is how certifications work. I speak from experience. The user, by tinkering with the firmware, can increase the transmit power (possibly) or alter the modulation scheme that while it still works as Bluetooth, it violates the emissions limits and/or spurious harmonics are generated.

Where I live, any Bluetooth device that is marketed/sold (not DIY hobbyist stuff) has to be approved by the government regulatory authority, which involves either testing or using the FCC certificate of the vendor, then for a fee in either case you get a sticker with the approval number to affix to the product.

So in the past they used to do inspections, particularly in the early days of Wi-Fi. They also used to detain products brought in on one's overseas trip e.g if you had a holiday in Thailand and brought a tablet/phone back with you they'd take it away from you at Customs- We got around this by peeling stickers off of other items we had bought locally and affixing it to the imported item. These days nobody cares, the governments have bigger fish to fry it seems, but I speak only of where I live.

I saw in the code they had built a specific version of firmware for FCC testing. This is how it works in China, at work, we rather just comply across the board and send the actual production version to the lab.

But, the Chinese are well known for locking down their stuff, again, speaking from experience and having had to use their silicon in the past. They adore dongles for programming, and often, will not allow you full access to a device, giving you minimal, if any access.

In the past I have had the experience with them where they would not give me any access to a CD player chip but were happy to write the code for us, if we gave them a spec. I was pretty persistent and in the end we just walked away because they refused to budge! Their policy was "no foreigners have access to our technology"

In the end we approached ON SEMICONDUCTOR who were more than happy to give us what we wanted, just it took some time.

christian-kramer commented 2 years ago

If an FCC-certified RF product is discovered to be transmitting outside of its FCC-approved emissions profile due to modifications that the consumer made to it... are there repercussions for the original manufacturer of the product?

TheSonicZone commented 2 years ago

If an FCC-certified RF product is discovered to be transmitting outside of its FCC-approved emissions profile due to modifications that the consumer made to it... are there repercussions for the original manufacturer of the product?

Where I live, the procedure is as follows:

  1. radio equipment is confiscated
  2. Manufacturer may be held liable for damages (seldom happens)

I do not know how it works in other jurisdictions but I believe in the US the repercussions could be bad. As I said I think that is the reason why they locked it down, but my concern is that they made it difficult to customize too so I think their motivation is more along the lines of keeping people out of the chip

christian-kramer commented 2 years ago

I'm not saying you're wrong - I just noticed your locale on your profile and I will readily admit that I am not familiar with the regulations there...

Let's say I did succeed in breaking the encryption on this particular chip to modify its transmit power... would I be able to take it to the authorities to test, and potentially create issues for the manufacturer?

TheSonicZone commented 2 years ago

I'm not saying you're wrong - I just noticed your locale on your profile and I will readily admit that I am not familiar with the regulations there...

Let's say I did succeed in breaking the encryption on this particular chip to modify its transmit power... would I be able to take it to the authorities to test, and potentially create issues for the manufacturer?

Our country has a "special relationship" with China, so yes, its a risk here. I imagine it would be different overseas.

If you had full access to the chip and took your design to an accredited laboratory (accredited with FCC or ETSI) then yes, you would be certifying that chip in your own legal status which means JieLi is not involved, it is a new certification applying to your implementation of the hardware. Which come to think of it you're already doing with the process you've followed.

This is how it works here for all the RF I have designed over the years, using chips from a number of manufacturers. My vendor of choice is Silicon Labs at this time but they're expensive so it doesn't work for all use cases.

My argument is that all this trouble you need to go to shouldn't be necessary. With non-Chinese vendors, at most I have ever had to do was sign an NDA, to get access to everything. This is ridiculous that you need encrypted dongles to perform customisations that do not involve the bluetooth protocol stack.

animaone commented 2 years ago

But with esp32 we are able to do everything and I think it is still approved by FCC... Maybe this is more because of competition against other Chinese companies, cause, they just want to continue being the main stakeholders of the software for this product. It is kind of what most hardware companies such as Intel have done in the past. They don't want someone else playing with their toys otherwise they will lose a piece of the market? Maybe... a hypothesis

buzzcola3 commented 2 years ago

@animaone even esp32 has it's wifi stack locked up. Probably it's both, FCC and IPA

TheSonicZone commented 2 years ago

But with esp32 we are able to do everything and I think it is still approved by FCC... Maybe this is more because of competition against other Chinese companies, cause, they just want to continue being the main stakeholders of the software for this product. It is kind of what most hardware companies such as Intel have done in the past. They don't want someone else playing with their toys otherwise they will lose a piece of the market? Maybe... a hypothesis

The ESP8266 was designed to be customizable by the user- as far as I know the stack is not accessible, which is fine, because the API is given. This is how it works for many other items out there. This is pretty much a given for cellular wireless modules (Sierra Wireless did the same for many years)

animaone commented 2 years ago

My main goal was to change the voice prompts to a dog voice. Unfortunately it may not be possible. Maybe we can use a military exploit to rewrite the audio, either way it might be overkill to use a hammer against a mosquito, but it might be worth the task.

TheSonicZone commented 2 years ago

The ideal solution is to dispense with the voice prompts completely, and instead have a GPIO pin that goes high (or low) when connected and goes low (or high) when disconnected. That is how a generic, OEM module should be, with all these things configurable.

If I was selling a BT Audio module that's how I would do it. Keep the module core locked for obvious reasons but provide a decent API to customize the unit fully.

NoahBentley commented 2 years ago

My caveman idea was to just have a momentary button connected to headphone R and ground. When you start the device you have this button pressed. The IC thinks there is a headphone attached and BLASTS out it message to nowhere. After a few seconds, release the button and you are good to go. I'd like to think someone could come up with a "hands-free" solution. Something simple.

TheSonicZone commented 2 years ago

It would work i.e. muting the audio during BT attach and detach, however on my module, it has no proper hardware pin signaling these changes. So detecting what is happening is going to be kind of difficult. All that happens is the LED flashes at different rates and detecting that reliably requires yet another microcontroller in the mix.

Papperskatt commented 2 years ago

As far as I can tell, these factory-new chips are designed to come "ready-to-program", but I lack several pieces of information to program them successfully. Below is the error output of running "download_cbp.bat" in "JieLi AC690X SDK\apps_soundbox\download\ac690x\post_build"

@christian-kramer I wonder if the fact that you cannot write to the chip is because you seem to have the AC6925 chip, but your circuit is designed around the AC6905 schematic. The 25 and 05 seem to have different pinout for USB; you used pins 3 & 4 which is correct for the 05, but for 25 the correct pins are 4 & 5.

Skärmavbild 2022-11-01 kl  11 30 28

l-maes commented 2 years ago

@patrickpredella: in one of the mentioned downloads there is a file with "video tutorials" but its actually a text file with url's to some QQ website (I assume a chinese youtube equivalent).

I tried watching the first and while I don't understand chinese it seemed primarily to serve the ordering sequence. I will just paste the contents of the "Explain.txt" file verbatim here:

Because the whole compressed package is too large to send to customers, we have uploaded all the videos to Tencent,

If the video feels a little fuzzy, please contact us. Send it to you in HD,

Other videos, please watch at the following link

/ In the use of chips or modules, we have recorded relevant instruction videos: if you are interested, you can have a look in advance ---Please select "HD" for website browsing /

01 bt201 dual mode Bluetooth audio module data transmission serial port at control firmware update demonstration:

https://v.qq.com/x/page/f0766kfjzob.html

02 Bt201 dual mode Bluetooth audio module? Ble data transmission serial port at control support music demonstration

https://v.qq.com/x/page/q07660m1bta.html

03 bt201 dual mode Bluetooth audio module spp data transmission serial port at control support music demonstration

https://v.qq.com/x/page/b0766jqw0p5.html

04 bt201 dual mode Bluetooth audio module spp data penetration function test demonstration

https://v.qq.com/x/page/e0766bz15fw.html

05 "bt201 dual mode Bluetooth audio module" ble data penetration function test demonstration

https://v.qq.com/x/page/o0766ubm78n.html

06 Bt201 module test method and serial port test method

https://v.qq.com/x/page/h0767kjnh6z.html

07 large data transmission demonstration of ble and spp of bt201

l-maes commented 2 years ago

woops missed the last url:

https://v.qq.com/x/page/c0843j975hl.html

sottoalberi commented 1 year ago

As far as I can tell, these factory-new chips are designed to come "ready-to-program", but I lack several pieces of information to program them successfully. Below is the error output of running "download_cbp.bat" in "JieLi AC690X SDK\apps_soundbox\download\ac690x\post_build"

@christian-kramer I wonder if the fact that you cannot write to the chip is because you seem to have the AC6925 chip, but your circuit is designed around the AC6905 schematic. The 25 and 05 seem to have different pinout for USB; you used pins 3 & 4 which is correct for the 05, but for 25 the correct pins are 4 & 5.

Skärmavbild 2022-11-01 kl 11 30 28

@Papperskatt Hi Papperskatt,

I'm not sure you or others are still interested in this subject. I have the SANWU branded stereo audio amp marked as model HF183 on the PCB. The micro chip is also marked only with B03 but through cross reference of each pin/io port and looking in windows10 device manager and seeing BR17 bootloader, I've determined this is the AC6905A, 24 pin microcontroller HF183_AC6905A I have Codeblocks IDE up and running and loaded the ac690x_app.cbp project file from the app_soundbox folder, as a starting point, to try compiling different settings to the device. I don't know if you or others have looked through the SDK but I cant find anything that defines pinout and functions. I'm referring to AC6905A ,B and C versions and others in the AC690x 24 pin series, that have the same pin count but different functions defined at each pin. I plan to use the Arduino sequence(I think that is only for BR17) to eventually upgrade with BFU forced method. Can anyone help? If anyone wants the SDK I'm using I can send a share to GDrive..

cQszasza commented 1 year ago

@chlorid to be honest the maximum I was able to do was to see the device in the list of usb devices, and to make in sort that the uploader recognises it. After that the uploader would keep complaining about missing files and fail the upload.

I was unable to make an account on the Chinese blog. Could you share the content (and eventually SDK) that you found here? It would help for sure!

Hi! I have the exact same amp. Did you managed to do anything with it? I for me this arduino thingy does not work as someone mentioned it in this thread, the 01 pattern must be different for the AC6925A chip. Any info is much appreciated. Thanks!