search

ginbot86 / ColorLCDVape-RE

Reverse-engineering of rechargeable disposable vapes that include a small color TFT LCD (Raz/Kraze/etc.)
https://ripitapart.com/2024/04/20/dispo-adventures-episode-1-reverse-engineering-and-running-windows-95-on-a-disposable-vape-with-a-colour-lcd-screen/
70 stars 4 forks source link

Bluetooth/touchscreen vapes (e.g. Feed Sync) #9

Open ginbot86 opened 6 days ago

ginbot86 commented 6 days ago

I just got a sample of a Feed Sync disposable vape with Bluetooth and touchscreen functionality.

I have disassembled the vape and found that it is based on a JL7012F6 SoC with 16M of SPI Flash and a CST816D touchscreen controller. The IPS LCD is labeled FPC-205BJ07004-V2, but I couldn't find any documentation on the display or figure out its resolution yet. It does seem to be designed for a smartwatch, with rounded corners.

The JL7012 is a proprietary dual-core 32-bit MCU clocked up to 160MHz and 640k of RAM. It even includes a hardware FPU, image decoder and 2D GPU!

ginbot86 commented 6 days ago

PXL_20241113_011602497~2.jpg

IMG_20241113_002146_292.jpg

IMG_20241113_002148_083.jpg

There's USB test points on the board that are not exposed on the USB-C port itself. These could be worth investigating to see what enumerates on a computer.

ginbot86 commented 4 days ago

2409302301_JieLi-Tech-JL7012F6_C7434396.pdf

Documentation is limited and I can't find an SDK for the JL7012 yet. There is some speculation that the JL7012 is the AC7012 (part of the AC701 series) and some firmware/other tools are available for it. This has not yet been verified by myself.

I dumped the SPI Flash and there are no discernable strings in what I suspect is firmware/watchface storage. One security concern I have is that previous notifications, location information, and caller ID/incoming phone numbers are retained in Flash even if the list is "cleared" by the user! All of these regions are near the end of the memory space with some kind of binary formatting that I have not deciphered yet. This also means I am hesitant to upload said SPI Flash dump due to the presence of potentially sensitive data from the previous user as well as from my own attempts to navigate the device's features.

ginbot86 commented 19 hours ago

Testing the USB test points doesn't yield any results. Nothing enumerates on my computer.