ginbot86 / ColorLCDVape-RE

Reverse-engineering of rechargeable disposable vapes that include a small color TFT LCD (Raz/Kraze/etc.)
https://ripitapart.com/2024/04/20/dispo-adventures-episode-1-reverse-engineering-and-running-windows-95-on-a-disposable-vape-with-a-colour-lcd-screen/
72 stars 4 forks source link

Adding mention of other models (e.g. Kraze HD Mega 20K/RAZ DC25000) #5

Open ginbot86 opened 4 months ago

ginbot86 commented 4 months ago

The structure of the repository and its corresponding documentation will need some restructuring to accommodate Raz/Kraze vapes of different models.

I've recently acquired some Kraze HD Mega 20K (aka RAZ DC25000) vapes with a much larger 160x128 LCD (sometimes incorrectly referred to as OLED) and a pushbutton. It uses the same Nations Tech microcontroller but with a 4 MiB SPI NOR Flash chip. The LCD type could not yet be determined and I have not been able to find 128x160 SPI LCD models that use a 10-pin mezzanine connector. I'm going to hazard a guess that it uses the same ST7735 or compatible controller, to reduce firmware development efforts.

Preliminary work on dumping the MCU firmware (the same SWD cable trick still works), and creating the SPI Flash split map has already been completed; attempts to re-theme the vape have not yet commenced as of today (July 29th, 2024).

ginbot86 commented 4 months ago

The stock theme has been converted to PNG and an example theme layout was created in issue 3.

Notably, the Kraze HD Mega SPI Flash contains two "BOOST Mode" graphics, of which only one is used.

ginbot86 commented 3 months ago

Many more samples of the HD Mega have been acquired. The difference between the two Boost mode graphics can be correlated by what appears to be a hidden version screen (see issue 3).

The first Boost mode graphic has a flame pattern that resembles tigers' faces, with the second being a more plain flame graphic.

If you hold the side button for over 10 seconds, a version screen will appear, with a string like "GV2024 0318V1", or "GV2024 0408V2". The V1 and V2 determine which graphic is used, with the V1 being the "tiger flames" and V2 being the plain flames.

Rea-XEVION commented 2 months ago

On the "MTRX MX 25000" vapes with both a full color 14 pin screen and a separate segmented display pcb for battery and juice percentages, I can confirm that the puff count or juice meter is stored in sram. On my "candied grape" unit, disconnecting the battery for a few seconds made it jump from thirty something back to 100%. The back of the main PCB does have two test pads labeled C and D for clock and data, as does the child pcb for the segmented display showing percentages and coil activity. Keeping the battery connected during disassembly required me to cut plastic in close quarters to the battery terminals and wires, so it's safer to just cut the positive wire and reconnect later.

Estacaco commented 1 month ago

20241020_220545 The Geek Bars sold in the US seem to be using identical hardware in a different case as well.

ginbot86 commented 2 days ago

After building a custom sniffer cable, I have obtained LCD SPI traffic captures, and with it, the display's pinout:

Pin Name Purpose
1 D/C Command/data select (low = command, high = data)
2 /RST Reset (active-low)
3 SDI SPI data in (aka MOSI/COPI)
4 CLK SPI clock (aka SCLK/SCK)
5 /CS LCD chip select (active-low)
6 GND Power/signal ground
7 VCC LCD logic power supply
8 LEDK LED backlight cathode (goes to ground)
9 LEDA LED backlight anode (switched for backlight control)
10 GND Power/signal ground

The LCD SPI bus runs at about 10 MHz. I haven't sussed out what controller the LCD is using yet, but it'll probably be a common one like the ST7735S.

kraze hd mega raz dc25000 lcd captures.zip split_map_hdmega.csv