Lovely

Successfully reverse engineered the cloud bound 15€ OBI Energy Tracker to get it fully on local setup Either by using it via an custom ESP32 AP or by getting the stock AP to connect to your server🥳 Hack Video youtu.be/U4Vvf0kHnEk German howto video youtu.be/2jMEaRuSJ18

Finished the latest hacking project🥳 A deep look inside of the AOHi 280W USB Desktop charger ended up in a replacing Custom firmware^^ 🎬Here: youtu.be/1UGUZloDsPU Source code: github.com/atc1441/AOHi... Fun challenge to 95% replicate the firmware and add extra features to it

Finally found the right Registers to toggle on the MiBand 9 / 10 and its BES2700iMP Best1503 SoC to enable the Quad-SPI and its 50mhz DMA transfer Allows up to 100 FPS Full screen at 212x510 RGB565 Pixel🥳 Doom round can start. Explanation video on YT🎥: youtu.be/oFswl8FKiRo

Fully Hacking DOOM onto the MiBand 9 / 10 Full Quad-SPI Display driving

YouTube video by Aaron Christophel

youtu.be

Finally hacked the MiBand 9 and 10 SoC The BES2700iMP was until now fully closed and without any public SDK/Hacks. By using the leaked IHC SDK I was able to run a full custom firmware to of course Play some DOOM on it! 🎬 www.youtube.com/watch?v=XdoP... GitHub: github.com/atc1441/MiBa...

TL;DW: Claude One-shotted a python Video player for this mini 10€ Smartphone Viewfinder. Including the download of the needed Youtube video...

For sure the lately "trending" and super cheap Video Walkie Talkies are now also Doomed 🥳 Full video now on YouTube: youtu.be/5aRQLHLls0k Source code and Precompiled firmware is available here: github.com/atc1441/TXW8... When Multiplayer?😅

Fun fact, a web upload trigger gives you root read access on the Tolino Vision Color, but im not even sure if they are in general just more open for tinkering. 7" Full Color Linux eink reader for 200€ is anyway more on the expensive side

Just finished an new E-Paper firmware SoC port🥳 The long hated Realtek RTL8762ESL and RTL8752HJL now got a fully featured ATC_RTL_BLE_OEPL Firmware and so have full OpenEpaperLink Support Released on GitHub: github.com/atc1441/ATC_...

Sadly a bit to simple to pull off^^ Doom running on the GL-iNet Slate 7 Pro Travel Router www.youtube.com/watch?v=9gOM...

Doom on the Slate 7 Pro Travel Router - GL-BE10000 GL-iNet

YouTube video by Aaron Christophel

youtube.com

Just finished Porting of Doom onto a toaster: www.youtube.com/watch?v=8Pfr...

Doom on a Toaster ...

YouTube video by Aaron Christophel

youtube.com

New toy, Pudu Food delivery Robot. Doom runs fine on its internal Android RK3399 NanoPC-T4 Basically an over engineered Hoverboard with two RealSense D435 3D Cameras and Lidar Longer video on YouTube: youtu.be/cBzTto2OIDQ

Finally there is DOOM on a Cooking Pot... Nice hacking challenge of a way over-engineered "Smart-device"! Inside we can find 4 SoC's from 4 companies: Heat control via STM32F031 Input button via PIC18F8.. Wifi via ESP32 Main FW Renesas 400Mhz ARM A9 Full video on YouTube: youtu.be/V5Jtc7wTbQ8

Crazy that the Smart BLE Ring with a Matrix Display is real🤪 But something is strange this claimed unknown PAR2860 SoC(If that is really inside the ring) looks very much like the firmware of the 7 Segment Ring (DA14585 SoC) but is still different. maybe a cloned DA14585?

What's better then a Smart Ring with 7 Seg Display? A Smart Ring with matrix Display! 20€ version on Aliexpress(Affilia) s.click.aliexpress.com/e/_c4aEitU1 Main BLE SoC PXI PAR2860 with 512KB Flash and 32KB RAM Still on order but excited to Hack it next! Previous Hacks in next comment

The Simple nRF52832 Spectrum Analyzer is now working on the Allmiibo LCD and OLED Variant🥳 Fully OTA Updateable from pixljs and back Find the Source Code of the pixlAnalyzer now here: github.com/atc1441/pixl... And a YouTube Explanation Video here: youtu.be/kgrsfGIeL9w

Just finished Hacking the Pill Camera that you'd swallow for an easy endoscopy Ti CC1310 SoC Glitched and Dumped which allowed to Reverse Engineer its firmware and RF Protocol up to full Image receiving🥳 No security included but short range. 📽️🎬 here: youtu.be/qEIW5gOLzIs

New idea - use the #Raspberrypi to directly drive parallel Eink displays. Pictured - Kindle 6" 1024x758 34pin panel driven by a RPIZ2W and (one of a kind) custom PCB. youtube.com/shorts/LwGyG... Benefits - the RPI (or any Linux SBC) can create/push the pixels faster than any ESP32. low cost SBC.

RPI fast Eink

YouTube video by tdfsoftware

youtube.com

Lets take a look inside one of those Aliexpress "Smart" Car Keyfobs which you can retrofit your "Lame" Car Key with 😅 TLDR: It does not run Doom 😞 The internal RTL8762TD Hast sadly "only" 192KB of RAM Find the Teardown video here: youtu.be/oAmtu87EdYo

Lets take a look inside one of those tiny Pill Cameras that you swallow to check your innards😳 Video on YouTube: youtu.be/pf_eOLRd6B4

Pill Camera Teardown, Capsule endoscopy

YouTube video by Aaron Christophel

youtu.be

Finally there is code execution on this Shi**y Realtek RTL8752H and RTL8762ESL ARM SoC🥳 Full custom firmware goes Brrrrr These chinese vendors like Realtek Bluetrum and Jieli only care about copy protection and cribble down a perfectly fine ARM Core with their tooling🙄

Teardown of the Tuya KWS-303WF Wifi Power Meter including cut-off Relay Inside we can find: - Tuya CBU Modul with Beken BK7231N ARM SoC 2MB Flash 256KB RAM - Relay claimed 63A - Power Meter - LCD 60x160 Pixel - External NTC Temp Sensor aliexpress.com/item/1005008...

Teardown of an OBD Find My Adapter from Aliexpress aliexpress.com/item/1005007... As expected as simple as it could get, 3.3V Voltage Regulator with an currently unknown BLE SoC ESM412 2449XFD No connection to CAN and OBD just for power

DOOM on a Vape via ScreenSharing and custom Firmware 😁 Source code on Github here: github.com/atc1441/Vape... And find a full video on Youtube with more details: youtu.be/rVsvtEj9iqE

Teardown of the 2" LCD Screen Mirror device ~20€ From Aliexpress s.click.aliexpress.com/e/_oCyfENx Surprisingly packed - Unknown DH390D HT2522A SoC likely HiChip HC15xx 4MB SPI Flash - Battery Powered - Speaker - Realtek WiFi Chip - Jieli BLE SoC Similar to youtu.be/pFBn6lMJ7q8

Fun fact this 3€ USB-C to Headphone converter has more Flash and RAM then the first moon landing. de.aliexpress.com/item/1005009... The internal RISCV Bluetrum SoC AB136D got: 128 KB Flash 60 KB RAM Perfect USB Rubber Ducky, easy to reflash without opening via the USB DP Pin🤪

Also got the OLED Amiibo Emulator😅 Sometimes for < 8€ in the combo offers! aliexpress.com/item/1005008... They are just too cute and a nice Hackable gadget with everything included in a small case. nRF52832 SoC SPI Flash LCD/OLED NFC Battery Arduino able x.com/atc1441/stat...

Teardown massacre of random 2€ Aliexpress Airpod clones 😅 80% Bluetrum (AB) and 20% Jieli

While not a full custom firmware you can find the current Bluetrum AB5682 SoC Hacking results here github.com/atc1441/Blue... This SoC Is used in the A9 Pro Airpod Clones and many more cheap BLE Gadgets. Quite Beefy for its price: RISCV 2MB Flash 162KB RAM 98KB ROM

Thats Code execution on the infamous AB5682B BLE SoC used in the cheap headsets and other BLE hardware🥳 This Bluetrum Chip series is ugly 😅 Debug via 1 Wire UART and a somewhat secured proto This code now runs from RAM since we next need a loader to dump an write to Flash