LCW 007
LCW-007 is the name of the Wi-Fi module used in some of LG's connected appliances. The module (also called a "modem" in various places) acts as a bridge between the appliance and LG's cloud services.
The main component is the RTL8711AM SoC by Realtek. This is an ARM-based Wi-Fi SoC. Application code and data is stored on an externally accessible SPI flash chip. The name "ameba" appears in various places referring to this SoC family.
The firmware is not encrypted so it can be easily downloaded from the flash using a generic SPI flash programmer (I've used raspberry pi with flashrom). The code is proprietary so I'm not at liberty to offer binaries. Contrary to the popular Espressif chips, the flash contents is loaded into the spacious on-chip DRAM before execution (although the datasheet mentions something about memory-mapping as well).
User data is encrypted with a key that seems to come from eFuses. The key can be retrieved by debugging the chip via SWD
I don't know if there is any kind of signature check on the firmware, but since the debugging interface is available, you can modify the firmware in a variety of ways at runtime.
My findings are based on the firmware marked with version "clip_v2.00.15.05-RTK_RTL8711am-SDK-8-RELEASE".
The 6-pin connector supplies power (5V) to the board and provides a 3.3V UART interface for full-duplex communications between the appliance and the modem. The voltage levels conveniently match most hobby-level UART modules on the market :)
On the back side, a footprint for a debug connector is available. It offers access to the debug UART interface as well as SWD debug interface. Both are 3.3V as well.
The communications protocol needs to be reverse engineered. The module cycles through a range of baud rates, 9600 is one of them.
The debug UART runs at 38400 baud during the bootloader phase. During the main application execution it is disabled by default. If (enabled)[SetupProtocol#setcertinfo], it runs at 115200 baud and offers a simple text console for inputting commands.
The SWD debug interface is unlocked (at least it is on my device), offering huge insight into the workings of the module. This project contains the necessary configuration files to connect to the device with openOCD.
The pictures come from the FCC submission. I've aligned them and traced some of the signals.
- RTL8711AM datasheet
- Open RTL8710 SDK and another project
- FCC documentation contains lots of interesting information
- Korean-language Gist with some potentially interesting information - be sure to check the revision history