New nRF52832 based smart watch available (ID107HR Plus)

New nRF52832 based smart watch available (ID107HR Plus)

It looks like the same company who make the ID107 HR have brought out a new product called and ID107 Plus, which uses the better nRF52832 MCU

I ordered 2 of these from AliExpress and they arrived a few days ago. However at the moment I can’t work out the best way to open the device to look inside.

https://www.aliexpress.com/item/100-Original-Makibes-ID107-Plus-Smart-Bracelet-BT4-0-Heart-Rate-Monitor-Smartband-Pulse-Sports-Fitness/32809803432.html?spm=2114.13010608.0.0.RsxZli

 

I’ve also contacted the company via an Alibaba PM to confirm if this is one of their products, or whether some other company are using the same model numbering system to pass their product of as being like the ID107 HR etc

https://ido-smart.en.alibaba.com/?spm=a2700.8304367.0.0.jP93J4

 

 

 

Externally the watch has the usual rubber strap

 

 

But the main functional part of the watch is designed to be removed for charging

 

And features a USB connector at one end (sorry for the focus on this photo , but you can clearly see the USB connector ūüėČ )

 

 

Fortunately Curt White ( https://github.com/curtpw ) has sent me some photos of an ID107 Plus he has managed to take apart, and also some information about the internal connections.

 

Firstly the USB is only connected to power and ground, so is only usable for charging.  I suppose it could be modified so that the SWD connections, for programming where wired to the normal USB  D+ and D- but this appears to be a difficult modification to make

The watch seems to have the nRF52832 MCU as well as :-

KX022 accelerometer

Si1143 optical sensor for HR

Azoteq IQS263

Macronix MX25L series USON package SPI flash

Curt informs me that he thinks the MCU pins used for these are as follows

 

#define  KX022_SCL                5
#define  KX022_SDA                3
#define  KX022_INT                6
#define  KX022_ADDR               4
#define  KX022_NCS                7

#define  MX25_SO                  27
#define  MX25_CE                  28
#define  MX25_SCK                 30
#define  MX25_SI                  31

#define  SI1143_SCL               18
#define  SI1143_SDA               10
#define  SI1143_INT                8
#define  SI1143_LED                9

But I have not verified this myself

 

Here are the photos Curt sent me

 

 

I before taking my watch apart (or breaking it apart), I have looked at the Bluetooth Services which are advertised by this device, and it only advertises 1 primary service with UUID 0x0AF0 . This is a unregistered 16 bit UUID,i.e Its not a service ID which has been registered with Bluetooth.org

Within this service there are 4 characteristics

0x0AF6 Рread  / write

0x0AF7 – read / notify

0x0AF8 – read / notify

0x0AF9 – read / write

 

All of these characteristics read as 0x00 but I have not tried writing to them.

Ideally one of these would be a DFU service in disguise, but at the moment its not possible to know if that’s the case, or possibly whether writing to one of these services would cause the device to go into DFU upload mode.

 

I have asked the manufacturer via an Alibaba PM, to ask whether the device is updatable via DFU, and hopefully they will get back to me with more information (assuming they do make this device)

 

If the manufacturer is not willing to give any information, one option is simply to compile a test application onto a nRF52832 dev board (I have the Nordic dev board as well as several nRF52832 based module boards), which advertises the same services, and then run the iOS or Android app, and see what comms occur e.g. what does the App send and what does it get back.

I’ve also got a rooted Android phone, (running Lineage OS), so I can also install the VeryFit app that communicates with this device and copy the file back onto my PC and decompile it.

I may be able to do the same thing on iOS as I have an old / rooted iPad; but it only runs iOS 6, which may not be compatible with the VeryFit app

 

 

Its early days for customising this device but it does show a lot of promise, and if DFU could be used to upload firmware, it would make it very practical to use.

 

 

Update.

I got a response from the manufacturer confirming that they do make the ID107HR Plus and that it uses the nRF52, however they don’t really understand my question. I asked whether it is possible to upload via DFU, but they think that I want them to write custom firmware.

And that the minimum order quantity for this is 50,000 units !!!

I have now asked if they have phased out the nRF52

 

I’ve also asked them if there is any way they can pre-flash just a DFU service (I didnt tell them what the firmware does as I don’t think their sales person understands) e.g. if we but 100 units and pay a premium for each item.

 

I suspect they don’t want to get involved in such small things, but I may as well ask

 

Leave a Reply