search

ginbot86 / ColorLCDVape-RE

Reverse-engineering of rechargeable disposable vapes that include a small color TFT LCD (Raz/Kraze/etc.)
https://ripitapart.com/2024/04/20/dispo-adventures-episode-1-reverse-engineering-and-running-windows-95-on-a-disposable-vape-with-a-colour-lcd-screen/
63 stars 3 forks source link

RAZ Reset? #3

Open b3ck opened 2 months ago

b3ck commented 2 months ago

I wish there was a way to reset the vape juice meter/counter, for people that refill it, that would come in handy, like a simple program that you can run after plugging it in via USB Type-C would be perfect.

And yes I know that you can with your method, but's a little extreme for the normal person, and yes I know you haven't done much research into the "SWD Debugging Port" and how using to to interact with the External Flash, but just wanted to say it here, as you have already thought about it.. you are not alone in this thinking =)

ginbot86 commented 2 months ago

The requirement for SWD hardware will continue to be a challenge, but another researcher did come up with some software tools to help with editing the juice level: https://github.com/xbenkozx/RAZ-RE/tree/main/Flash%2Freflasher

b3ck commented 2 months ago

So I have the "RAZ Vape DC25000 Disposable", what can I do to help? Is there a way to extract the firmware from this? then make modifications etc..?

ginbot86 commented 2 months ago

The firmware extraction would be with the aforementioned SWD method (I just used my Segger J-Link with the J-Mem tool to grab 0x10000 (64k) bytes from address 0x08000000. The graphics from SPI Flash were dumped by desoldering the chip and mounting it to a 0.5mm-pitch SMD breakout board.

I noticed there are two different "BOOST Mode" graphics in the Kraze model I dumped: one is a plain large flame symbol, and an unused one that looks like tiger's faces in the flames. Which one does yours have in normal operation?

hdmega-boost-alt hdmega-boost

b3ck commented 2 months ago

Normal Mode:

Screen Shot 2024-08-03 at 3 00 24 PM

Boost Mode:

Screen Shot 2024-08-03 at 3 00 33 PM
ginbot86 commented 2 months ago

Interesting... The Kraze variant uses the plain flame graphic for the boost mode.

b3ck commented 2 months ago

Yeah.. dunno.. must have been a approval type of thing with some community board in Canada.

ginbot86 commented 2 months ago

I just went through some photos I took and the first Kraze HD Mega vape I found used the "tiger flames" boost mode graphic. Not sure when the change was made, or if it's consistent...

ginbot86 commented 2 months ago

As mentioned in Issue 5, I have found the correlation between versions. Holding the side button for more than 10 seconds will cause a version number to display, and a V1 firmware uses the "tiger flames" graphic, and the V2 uses the plain flames.

Rea-XEVION commented 1 month ago

On the topic of refilling, years ago when I used to refill rechargeable dumb stick vapes, every single time they would eventually burn out the coil or put a charred hole in the wick even if I never let them run dry. With the raz/kraze and even the v-play all having two coils, I have to wonder if a software change is possible to swap which coil is primary/secondary. This would be useful in case someone gets a burned taste with the normal mode, but not with boost.

ginbot86 commented 1 month ago

It would require some firmware reverse-engineering but I think it could be possible. This is speculation on my part but I imagine that the references to certain GPIOs could be find-and-replaced to swap the roles of the heater coils.