seemoo-lab / openhaystack

Build your own 'AirTags' 🏷 today! Framework for tracking personal Bluetooth devices via Apple's massive Find My network.
https://owlink.org
GNU Affero General Public License v3.0
8.6k stars 464 forks source link

Aliexpress nRF51822 beacon support #35

Open sthorley opened 3 years ago

sthorley commented 3 years ago

From reading #20 it seems I could use this on the Aliexpress nRF51822 beacon chips by simply taking the existing firmware.bin and replacing the string with the advertisement key.

Could this process be added to the app which could then just dump the patched firmware somewhere to manually flash? I'm still awaiting my ST-link v2 to arrive for the actual flashing process so haven't tested things yet but the form factor of the nRF51822 chips is perfect for this application.

Sn0wfreezeDev commented 3 years ago

Hi, The current firmware may run on the nrf5182 beacons, but it would use too much energy for the small batteries attached. I'd recommend that you have a look at the firmware code and reduce the sending interval at least. Currently the chips are sending as fast as possible, which will use up energy quite quickly.

Nevertheless, I like the idea of copying the final firmware with the key to a location from which you can manually flash any chip.

acalatrava commented 3 years ago

Is there any (good) reason why the current firmware is sending out the data as such fast rate?

schmittner commented 3 years ago

No good reason. It's just an artifact from early testing.

Will update this soon.

sthorley commented 3 years ago

Got mine updated and working today. I'll do a quick write-up for anyone who was a bit intimidated by the flashing process (I was at the start)... This was tested on Mac mini M1 running Big Sur 11.3

  1. Create New accessory in OpenHaystack app
  2. Click Deploy and select "Export Microbit firmware"
  3. Save the firmware file.
  4. Solder 4 wires onto the 4 pads as shown in the image below.

  1. Connect these wires to the corresponding pins on your STLink v2 and connect to Mac.
  2. Install "Open-ocd" using Brew: brew install open-ocd If you don't have telnet installed install it too. brew install telnet
  3. From terminal run: openocd -f /opt/homebrew/opt/open-ocd/share/openocd/scripts/interface/stlink-v2.cfg -f /opt/homebrew/opt/open-ocd/share/openocd/scripts/target/nrf51.cfg
  4. Open-OCD should now be running
  5. Open a new terminal window and use telnet to connect to the open-ocd session telnet localhost 4444
  6. Send halt command: halt
  7. Optional: Backup existing NRF Firmware: dump_image /Your/File/Path/flash.bin 0 0x40000
  8. Erase existing flash: nrf51 mass_erase
  9. Verify new firmware file: program /Your/Firmware/File/Path/openhaystack_firmware.bin verify
  10. Program the firmware: program /Your/Firmware/File/Path/openhaystack_firmware.bin
  11. Send resume command: resume

Congrats your tag should appear in OpenHaystacks momentarily.

mowtschan commented 3 years ago

@sthorley Thank you!

I just got it working on NRF51822 as well - it's amazing!!! Thanks!!!

just in case if someone will not find open-ocd configs, I found them here:

/usr/local/share/openocd/scripts/interface/stlink-v2.cfg
/usr/local/share/openocd/scripts/target/nrf51.cfg
yoution commented 3 years ago

hi, @sthorley thanks you I meet this problem, can you help me? image

mowtschan commented 3 years ago

@yoution , Can you try to put the full path to the openhaystack_firmware.bin?

yoution commented 3 years ago

@mowtschan thanks ,it's done, it's the file path error

yoution commented 3 years ago

I use the firmware directly, it seems the refresh rate is too low,I took it with my iphone in my car, and the points in the map are too sparse
image

Sn0wfreezeDev commented 3 years ago

That's not really a firmware issue. It's more part of the design of Apple's Find My network. The device needs to be found by nearby iPhones and nearby iPhones won't report more than 4 locations of the same device in 30min to 1 hour. So if your device is moving you need A) a nearby iPhone and B) frequently changing nearby iPhones, because your own iPhone would not send a location update to Apple every minute or so.

Tracking actually moving device with their exact paths does only work in very populated dense environments, like a shopping area of a town. Also it helps if you have a high density of iPhone users nearby. So 15-20% is probably a good enough rate.

wamazeka commented 3 years ago

@sthorley Thank you!

Reworked your instruction for Windows host, maybe will be useful for someone:

This is for Ali NRF51822 round beacon, flashing with Chinese ST-Link v2 And you have to download openocd binaries

  1. You're almost have .bin firmware - from Openhaystack App or from alternative source
  2. Connect ST-Link v2 and BLE beacon like on image
  3. set firmware=/your/path/to/the/firmware.bin
    d:/path/to/openocd -f interface/stlink.cfg -f target/nrf51.cfg -c init -c "reset halt" -c "nrf51 mass_erase" -c "program %firmware% verify" -c "program %firmware%"

And no need in telnet-mode

buzali commented 3 years ago

Has anyone changed the beacon interval to make the battery use more efficient on these devices?

Sn0wfreezeDev commented 3 years ago

Yes, please check @acalatrava repository for that: https://github.com/acalatrava/openhaystack-firmware

MoutardeForte commented 2 years ago

Hello I have program with programming (I have a jlink) image

Thanks for all

jrusi commented 2 years ago

What’s the battery life with standard firmware on this specific device?

vbetker commented 2 years ago

With standard firmware it's a couple of weeks, with acalatravas version its way longer - I have been running a couple of nRF51822s for half a year now without depleting the battery on any of them.

bruvv commented 2 years ago

@jrusi I got about 5 days out of the default firmware. @vbetker could you perhaps help with flashing the firmware? https://github.com/acalatrava/openhaystack-firmware/issues/15

Itheras commented 2 years ago

@jrusi I got about 5 days out of the default firmware. @vbetker could you perhaps help with flashing the firmware? acalatrava/openhaystack-firmware#15

I can help you out just let me know.

bruvv commented 2 years ago

@Itheras perfect! Do you know what I am doing wrong?

Itheras commented 2 years ago

@bruvv what operating system and what issues are you having?

bruvv commented 2 years ago

@Itheras https://github.com/acalatrava/openhaystack-firmware/issues/15 see that ticket please

Itheras commented 2 years ago

@Itheras acalatrava/openhaystack-firmware#15 see that ticket please

aaah yeah sorry let me see.

Paulnguyenbeam commented 2 years ago

just a note you can put all the commands in the openocd command

if you put -c init -c "reset halt" -c "nrf51 mass_erase 0" -c reset -c "program fullpathtoyourbinfile verify" -c reset -c exit at the end of your command then it does it all without having to open a second termnial issuing the commands via telnet.

Useful if you are doing a bunch at once

HarryWindsor commented 2 years ago

Hello I have program with programming (I have a jlink) image

Thanks for all

I am also only using a jlink I had to run openocd -f /opt/homebrew/opt/open-ocd/share/openocd/scripts/interface/jlink.cfg -c "transport select swd" -f /opt/homebrew/opt/open-ocd/share/openocd/scripts/target/nrf51_mod.cfg. Where I added set WORKAREASIZE 0 to nrf51_mod.cfg.

But I cannot see my device online. How did you flash it with jlink?

backupandforkacc commented 1 year ago

Is there a programming adapter like there is for blitzwolf and tasmota? https://www.thingiverse.com/thing:3476167

dzianisv commented 1 year ago

I flashed in the following way

export PUBKEY=4jSeYlz7GAhKYQBjXS1Ku06A5+UjV2CfvEATNw==
firmware=opnehaystack-nrf51822-firmware.bin

./key-injector.py < /Applications/OpenHaystack.app/Contents/Resources/firmware.bin > $firmware

openocd -f interface/stlink-v2.cfg -f target/nrf51.cfg -c "init; halt; nrf51 mass_erase; program $firmware verify; program $firmware; resume;"
#!/usr/bin/env python3
import sys
import re
import base64
import os

PUBKEY = os.environ.get("PUBKEY")

# Decode the base64 string back to bytes.
decoded_bytes = base64.b64decode(PUBKEY)

# Take input from stdin.
data = sys.stdin.buffer.read()

# Replace "OFFLINEFINDINGPUBLICKEYHERE!" with the decoded bytes in the input string.
output_string = re.sub(b"OFFLINEFINDINGPUBLICKEYHERE!", decoded_bytes, data)

# Print the output string to stdout.
sys.stdout.buffer.write(output_string)

It works.

Full article https://dzianisv.github.io/notes/Embedded/Nordic-NRF51822-Airtag.html

devnoname120 commented 1 year ago

@dzianisv What battery life do you get with this beacon? https://aliexpress.com/item/1005003671695188.html?sku_id=12000028906157906

dzianisv commented 1 year ago

@dzianisv What battery life do you get with this beacon? https://aliexpress.com/item/1005003671695188.html?sku_id=12000028906157906

with CR2025 it works about 14 days, looks like the firmware has to be optimized, for instance a deep sleep has to be used? But I am not very familiar with NRF chips internals.

rkreutz commented 1 year ago

Edit: Never mind that, it was an issue with the connectors I had onto the nRF board, GND wasn't properly connected, eventually got it working.

Hey everyone, I've tried flashing the firmware onto the nRF51822 ali express beacon as suggested from above, but I had no success, running the following code returns an error

openocd -f /usr/local/share/openocd/scripts/interface/stlink.cfg -f /usr/local/share/openocd/scripts/target/nrf51.cfg -c "init; reset halt; nrf51 mass_erase; program firmware.bin verify; program firmware.bin; resume;"

I made sure to run this command on the same directory as firmware.bin is located, which is a manually compiled firmware with the appropriate pub key, I get the following error message:

Open On-Chip Debugger 0.12.0
Licensed under GNU GPL v2
For bug reports, read
    http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "hla_swd". To override use 'transport select <transport>'.
Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
Info : clock speed 1000 kHz
Info : STLINK V2J29S7 (API v2) VID:PID 0483:3748
Info : Target voltage: 3.300599
Info : [nrf51.cpu] Cortex-M0 r0p0 processor detected
Info : [nrf51.cpu] target has 4 breakpoints, 2 watchpoints
Info : starting gdb server for nrf51.cpu on 3333
Info : Listening on port 3333 for gdb connections
[nrf51.cpu] halted due to debug-request, current mode: Thread 
xPSR: 0xc1000000 pc: 0x00000c70 msp: 0x20004000
Info : nRF51822-QFAA(build code: H0) 256kB Flash, 16kB RAM
Info : Mass erase completed.
Info : A reset or power cycle is required if the flash was protected before.
[nrf51.cpu] halted due to debug-request, current mode: Thread 
xPSR: 0xc1000000 pc: 0xfffffffe msp: 0xfffffffc
** Programming Started **
Info : Padding image section 0 at 0x00003d5f with 1 bytes (bank write end alignment)
Warn : Adding extra erase range, 0x00003d60 .. 0x00003fff
Error: jtag status contains invalid mode value - communication failure
Error: error waiting for target flash write algorithm
Error: Failed to enable read-only operation
Error: Failed to write to nrf5 flash
Error: error writing to flash at address 0x00000000 at offset 0x00000000
embedded:startup.tcl:1516: Error: ** Programming Failed **
in procedure 'program' 
in procedure 'program_error' called at file "embedded:startup.tcl", line 1581
at file "embedded:startup.tcl", line 1516

Any help would be much appreciated, many thanks.

solarkraft commented 2 months ago

Hey, sorry if this is too off topic. I’m thinking about putting this thing into some hardware and am wondering about the measurements, but can’t find any officially. It seems to be designed to fit on top of a CR2477, which would be around 24.5mm in diameter. Can anyone confirm this? Thank you!