Don’t buy this smartwatch / fitness tracker !

Don’t buy this smartwatch / fitness tracker !

posted in: BLE, nRF51822 | 14

Just a quick post about another smartwatch / fitness tracker that I was miss-sold on eBay

Its title was
A16 Bluetooth Smart Watch Health Wrist Bracelet Heart Rate Monitor Sports New
Do NOT buy this watch

http://www.ebay.com.au/itm/182341391730

 

It is listed as using the Nordic nRF52832 Bluetooth MCU, but when I opened the watch to see how to reprogram it, I found it contained a Dialog processor

 

Unfortunately as I had already accepted the item, and given feedback in eBay.
But as the item was delivered by registered post with a tracking code and I had to sign for it, the vendor knows I received it, so I couldn’t simply pretend it had never arrived (which is sometimes the best option with dodgy vendors as they have to resend or give a refund if you don’t receive the goods)

 

I have written to the vendor ( http://www.ebay.com.au/usr/rsp99998 )  to complain, I doubt they care, so I think I’ve just wasted $30 as I bought 2 of them.

 

But I doubt I will get a good resolution from this.

14 Responses

  1. Gurpreet
    |

    I ordered http://www.ebay.ca/itm/281909052367, and got a watch which has identical PCB and components as others have posted with nrf51822. The chip on my watch is market N51802 QFAAAO — which seems like a Nordic knockoff. So far, I have soldered the SWD lines and GDB recognizes it as ARM Cortex-M target.

  2. Roger Clark
    |

    Very interesting about the Nordic rip off.

    You may not be able to program it if GDB says its a ARM Cortex-M.

    If a real Nordic nRF51 just comes up as Cortex-M, it means that the BMP has not identified exactly what the device is, but knows its a ARM device

    I can’t remember if I have posted how to do this, but you’d need to try to read the device ID from one of the memory mapped registers in the chip, to get its device ID and then add that device to the nRF51 plugin code in the BMP (and recompile it and reflash)

    I’m sure if you search the web you’ll find details of the memory address for this.

    Of course it depends on how much of a nRF51 rip off it actually is… Its possible that you can reflash it as an unknown ARM cortex M, but I have never heard of them before.

    I will try posting to the Nordic Devzone about this, to see if anyone can elaborate on what this device is

  3. Roger Clark
    |

    To follow up on this one…

    I posted to the Nordic Devzone and it appears that this is a custom version of the nRF51

    So it is a legitimate device made by Nordic, but its unclear how it differs from a regular nRF51, apart from its ID.

    https://devzone.nordicsemi.com/question/111921/is-the-n51802-qfaa0-a-nrf51-rip-off/

    You could checkout that link next week as Nordic may give an official response to the question

  4. Gurpreet
    |

    Thanks Roger. The device ID is 00D2 and I have recompiled the BMP but still working on getting USB drivers loaded.

    (gdb) monitor swdp_scan
    Target voltage: Not Implemented!
    Available Targets:
    No. Att Driver
    1 ARM Cortex-M
    (gdb) attach 1
    Attaching to Remote target
    warning: while parsing target memory map (at line 1): Required element is missing
    0x0000d16c in ?? ()
    (gdb) set mem inaccessible-by-default off
    (gdb) x 0x1000005C
    0x1000005c: 0xffff00d2

  5. Roger Clark
    |

    Are you sure the ID code is 00D2 ?

    If you have correctly add that ID to the code, the BMP will report that the device is a nRF51. At the moment, its still not being recognised as an nRF51, so you will not be able to upload to it.

  6. Gurpreet
    |

    Yes, the new BMP recognizes it as nrf51822. That GDB dump was from before new ID was added to BMP. So far, I am trying to figure out a way to get its flash memory dump.

  7. Roger Clark
    |

    Ah.

    You mean how to read back the existing contents of the nRF51.

    Most likely its read protected, but the read protection is known to have a bug on the nRF51

    I heard some people have tried to backup the existing flash data from these fitness trackers, (by exploiting this bug), but I don’t think anyone has succeeded in getting a full set of usable data from them.

  8. Gurpreet
    |

    Thanks Roger. Does the repo – https://github.com/rogerclarkmelbourne/Arduino_nrf51822 still need a 32 Khz xtal.

  9. Roger Clark
    |

    No.

    That repo is based on a newer version of RBL’s repo and it does not need the 32khz crystal

  10. Gurpreet
    |

    Excellent. The smart watch works. I can load and run watch examples on it. The chip is similar to QFAA chips with 265 kB flash and 16kB RAM.

  11. Roger Clark
    |

    Cool

    I’ve not had much time to do anything with my smart watches

    There are some guys on https://gitter.im/nRF51822-Arduino-Mbed-smart-watch/Lobby who are occasionally developing some programs for these smartwatches, so it may be worth subscribing and posting there (but it has been quiet for several weeks)

  12. Jahnathan
    |

    Roger how did you open the unit? I’ve got the similar ID101HR and am unsure where to start with disassembly.

  13. Roger Clark
    |

    I’ve opened so many of these I’m not sure which one is which

    I think the ID101HR has 4 screws and you end up having to pull the back section through the middle / band of the watch to get it apart, by rotating the back a bit, being careful not to break the ribbon cable

  14. Albert PROUST
    |

    Hello,

    I’ve just read your post and it is very interesting. In fact, we have the same problem as you mentioned above. We are trying to develop our own firmware for this kind of MCU (N51802).
    @Gurpreet you(ve mentioned you upload a firmware to that MCU. Where did you get the sample code?

    @Roger, thank you for your thread very interesting.

Leave a Reply