search

olivluca / bluetooth-tiktok-remote

Plea for help to reverse engineer a bluetooth remote
0 stars 0 forks source link

chip identification #1

Open olivluca opened 2 years ago

olivluca commented 2 years ago

Since the bluetooth chip has been filed out, I cannot identify the chip, the seller says it's from Yizhao, the most useful information I could find about yizhao is this news item (i.e. not useful at all). @biemster @vadimkozhin could you take a look at the pictures and help me identify the chip?

biemster commented 2 years ago

The "Beauty-R1" broadcast name seems to be more common, but I did not find anybody cracking those open yet either.

olivluca commented 2 years ago

I think that this one or this one could be the chip powering it (to find it I google translated "yizhao micro electronics" to chinese and used the translation as the search term).

olivluca commented 2 years ago

I found this repository by @lj19940623 where he collected some information on a similar device using the yc10XX (QFN32 instead of SOP16), unfortunately no sdk.

vadimkozhin commented 2 years ago

Good catch, @olivluca! Seems like you've found it.

I believe it is yc1088. Seems like schematics of this remote control device matches the traces from your board: pin 4 goes to antenna pin 2 and 3 goes to oscillator.

olivluca commented 2 years ago

Thank you @vadimkozhin for the fcc links, maybe it's the yc1059 (according to the datasheet it's the only one where pin 8 is marked VPP). In any case I think these are not reprogrammable (the block diagram says it's 2KB OTP), so there's nothing I can do.

biemster commented 2 years ago

Good find @olivluca ! Pity there is no public SDK found yet. Keep in mind that sometimes chinese manufactures put in flash and brand it OTP for cost reasons (that's why I'm still trying to get the Lenze st17h26 working), but unfortunately it looks bleak indeed.

olivluca commented 1 year ago

Since I couldn't find a way to modify the firmware, I attacked the problem from the other side :wink:

johnhamelink commented 1 year ago

I bought a very similar device: https://www.aliexpress.com/item/1005004882530399.html

The device also presents itself as Beauty-R1.

Some photos of the PCB:

IMG_6676 IMG_6677 IMG_6678

olivluca commented 1 year ago

Yours has an extra button. Did you try the interceptor? (if you want to use it in keyboard emulation mode under android).

johnhamelink commented 1 year ago

@olivluca I was actually hoping to use it on Linux, so the interceptor isn't so useful for me in my case unfortunately

olivluca commented 1 year ago

I think that adapting the "sendkeycode" function it should work under Linux too

olivluca commented 1 year ago

e.g. see https://unix.stackexchange.com/questions/14879/how-to-inject-keystrokes-via-a-shell-script#14882

olivluca commented 1 year ago

But even without any adaptation, you can compile it as is, run it (as root) with -v and see if it finds the clicker and recognizes the buttons.

johnhamelink commented 1 year ago

I was indeed able to compile as-is, using x86_64-linux-gnu-gcc, however I'm unable to get the device to connect:

[bluetooth]# connect 12:22:34:AB:75:8E
Attempting to connect to 12:22:34:AB:75:8E
[CHG] Device 12:22:34:AB:75:8E Connected: yes
[CHG] Device 12:22:34:AB:75:8E Modalias: usb:v05ACp022Cd011B
[CHG] Device 12:22:34:AB:75:8E ServicesResolved: yes
Failed to connect: org.bluez.Error.NotAvailable br-connection-profile-unavailable
[CHG] Device 12:22:34:AB:75:8E ServicesResolved: no
[CHG] Device 12:22:34:AB:75:8E Connected: no
[CHG] Device EC:81:93:A6:A9:27 ManufacturerData Key: 0x0003 (3)
[CHG] Device EC:81:93:A6:A9:27 ManufacturerData Value:
  01 12 46 00 00 02 fc 66 cf 82 e7 21 ec 81 93 a6  ..F....f...!....
  a9 27 20                                         .'              
[bluetooth]#

Looking at bluetooth.service, it seems like Bluez is failing to read HID information (input-hid profile probe failed for 12:22:34:AB:75:8E):

-- Boot b658510940144ca89dcc503876e6ca8b --
Sep 01 16:49:22 pluto systemd[1]: Starting Bluetooth service...
Sep 01 16:49:22 pluto bluetoothd[874]: Bluetooth daemon 5.69
Sep 01 16:49:22 pluto systemd[1]: Started Bluetooth service.
Sep 01 16:49:22 pluto bluetoothd[874]: Starting SDP server
Sep 01 16:49:22 pluto bluetoothd[874]: src/plugin.c:plugin_init() System does not support csip plugin
Sep 01 16:49:22 pluto bluetoothd[874]: src/plugin.c:plugin_init() System does not support vcp plugin
Sep 01 16:49:22 pluto bluetoothd[874]: src/plugin.c:plugin_init() System does not support mcp plugin
Sep 01 16:49:22 pluto bluetoothd[874]: src/plugin.c:plugin_init() System does not support bass plugin
Sep 01 16:49:22 pluto bluetoothd[874]: src/plugin.c:plugin_init() System does not support bap plugin
Sep 01 16:49:22 pluto bluetoothd[874]: Bluetooth management interface 1.22 initialized
Sep 01 16:49:22 pluto bluetoothd[874]: src/device.c:device_set_wake_support() Unable to set wake_support without RPA resolution
Sep 01 16:49:23 pluto bluetoothd[874]: src/device.c:set_wake_allowed_complete() Set device flags return status: Invalid Parameters
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/ldac
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSink/aptx_hd
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/aptx_hd
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSink/aptx
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/aptx
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSink/aac
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/aac
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSink/sbc
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/sbc
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSink/sbc_xq
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/sbc_xq
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/aptx_ll_1
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/aptx_ll_0
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/aptx_ll_duplex_1
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/aptx_ll_duplex_0
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/faststream
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/faststream_duplex
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSink/opus_05
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/opus_05
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSink/opus_05_duplex
Sep 01 16:49:50 pluto bluetoothd[874]: Endpoint registered: sender=:1.21 path=/MediaEndpoint/A2DPSource/opus_05_duplex
Sep 01 16:49:57 pluto bluetoothd[874]: src/profile.c:record_cb() Unable to get Hands-Free Voice gateway SDP record: Host is down
Sep 01 16:50:02 pluto bluetoothd[874]: profiles/audio/avdtp.c:avdtp_connect_cb() connect to EC:81:93:A6:A9:27: Host is down (112)
Sep 01 16:50:07 pluto bluetoothd[874]: src/profile.c:record_cb() Unable to get Hands-Free Voice gateway SDP record: Host is down
Sep 01 16:51:11 pluto bluetoothd[874]: src/service.c:service_probe() input-hid profile probe failed for 12:22:34:AB:75:8E

I'm out of my depth now, but hopefully that's at least helpful