Espruino on your watch!

[gfwilliams]

Posted at 2016-01-22 by @gfwilliams

I got distracted today... There are these 'smart' watches on eBay right now called iDO / DO 003. If you look on eBay for 'fitness watch' and then find ones that look similar, you'll see you can get them for under £10 in the UK, including postage.

They're wireless, with the same nRF51822 chip in as the micro:bit (which I now have Espruino running on) - which got me thinking....

---

Attachments:

• P1060665.JPG

[gfwilliams]

Posted at 2016-01-22 by @gfwilliams

Hmm. forum upload troubles...

Attachments:

• P1060668.JPG

[gfwilliams]

Posted at 2016-01-22 by @gfwilliams

opened...

Attachments:

• P1060670.JPG

[gfwilliams]

Posted at 2016-01-22 by @gfwilliams

The battery is soldered on :)

Attachments:

• P1060681.JPG

[gfwilliams]

Posted at 2016-01-22 by @gfwilliams

3 wires for SWD

Attachments:

• P1060684.JPG

[gfwilliams]

Posted at 2016-01-22 by @gfwilliams

And you have Espruno on it - it took a while to get the OLED going, but it does say hello ESPRUINO in this picture, although I didn't focus properly :)

The watch itself new appears as a BLE UART device, and you can program it through the Web IDE (at least on Chromebook or Android phones).

Attachments:

• P1060690.JPG

[gfwilliams]

Posted at 2016-01-22 by @gfwilliams

Rough info so far:

CPU: https://infocenter.nordicsemi.com/topic/com.nordic.infocenter.pdf.ps/nRF51822_PS_v3.1.pdf
Accelerometer: http://kionixfs.kionix.com/cn/datasheet/KX022-1020%20Specifications%20Rev4.0%20cn.pdf
0.49" OLED - SSD1306 - http://www.buydisplay.com/download/manual/ER-OLED0.49-1_Series_Datasheet.pdf (but not that pinout)

Name	Pins	Notes
RX pad	P0.17 ?
TX pad	P0.18
CLK pad	SWDIO
DIA pad	SWDCLK
32k osc?	P0.26, P0-27	Not fitted
Vibrate	P0.07	via some FET/transistor
Button	P0.04	Needs input_pullup
Accelerometer	P0.10-16?	Kionix kx022-1020
	P0.16	clk
	P0.15	short pulses? irq?
	P0.14	data
OLED		SSD1306 64x32
	P0.29	MOSI
	P0.30	SCK
	P0.0	DC
	P0.1	RST
	P0.2	CS

Test code - there's very little program space at the moment:

var BTN = D4; pinMode(BTN,"input_pullup");

var initCmds = new Uint8Array([ 
  0xAe,
  0xD5, 
  0x80, 
  0xA8, 31,
  0xD3,0x0,
  0x40,
  0x8D, 0x14, 
  0x20,0x0, 
  0xA1,
  0xC8,
  0xDA, 0x12,
  0x81, 0xCF,
  0xD9, 0xF1,
  0xDb, 0x40,
  0xA4,
  0xA6,
  0xAf 
]);
var flipCmds = [
     0x21,
     0, 63,
     0x22,
     0, 7];


var dc = D0;
var rst = D1;
var cs = D2;

var g = Graphics.createArrayBuffer(63,31,1,{vertical_byte : true});

var spi = new SPI();
spi.setup({mosi: 29 /* D1 */, sck:30 /* D0 */});

digitalPulse(rst,0,10);
setTimeout(function() {
  digitalWrite(cs,0);
  digitalWrite(dc,0); // command
  spi.write(initCmds);
  digitalWrite(dc,1); // data
  digitalWrite(cs,10);
}, 50);

g.flip = function() { 
cs.reset();dc.reset();
spi.write([0x21,0,127,0x22,0,7]);
for (var i=0;i<4;i++) {
  spi.write(0xb0+i,0x00,0x12);
  dc.set();
  spi.write(Uint8Array(this.buffer,64*i,64));
  dc.reset();
}cs.set();
};

//function cmd(c){cs.reset();dc.reset();spi.write(c);cs.set();}
//function dispoff(){cmd(0xae);}
//function dispon(){cmd(0xaf);}

 g.drawString("Hello",0,0);
 g.drawString("ESPRUINO",10,10);
 g.flip();

[gfwilliams]

Posted at 2016-01-22 by @gfwilliams

My attempts at tracing the PCB. Still don't know exactly where the accelerometer connects, but at least I have some ideas based on poking around on the 'live' watch.

edit: right-click, open image in new tab :)

Attachments:

• do-003.jpg

[gfwilliams]

Posted at 2016-01-22 by @gfwilliams

It was programmed using OpenOCD - I messed up though and didn't manage to save the contents of the existing firmware!

Next steps, when I get time:

• Move the OLED driver into C code, save some Flash by removing the arraybuffer graphics
• Figure out how to use the over the air updates - I can't keep dismantling it every time I need to update the firmware :)
• Turn it back into a watch!
• Work out how the accelerometer is connected

[gfwilliams]

Posted at 2016-01-22 by @gfwilliams

If you want some kind of wireless sensor then you could do a lot worse than this...

• Rechargeable, with proper charger
• Bluetooth Low Energy
• Vibrate
• Screen
• Button
• Accelerometer
• 2x pads on the back that are just general purpose IO
• 2x pads on one side that are general purpose IO too (probably meant for a 32k crystal)

[espruino-discuss3]

Posted at 2016-01-22 by Ollie

This looks amazing. Will be following progress!

[gfwilliams]

Posted at 2016-01-22 by @gfwilliams

Latest firmware, kind of watch-like:

var initCmds = new Uint8Array([ 
0xAe,0xD5, 0x80, 0xA8, 31,0xD3,0x0,
0x40,0x8D,0x14,0x20,0x01, 0xA1,
0xC8,0xDA,0x12,0x81,0xCF,
0xD9,0xF1,0xDb,0x40,0xA4,
0xA6,0xAf ]);

var dc = D0;
var cs = D2;

var g = Graphics.createArrayBuffer(63,15,1,{vertical_byte : true});

var spi = new SPI();
spi.setup({mosi: 29 /* D1 */, sck:30 /* D0 */});

digitalPulse(D1,0,10);//rst
cs.reset();dc.reset();spi.write(initCmds);delete initCmds;cs.set();

g.flip = function() { cs.reset();dc.reset();spi.write([0x21,0,127,0x22,0,7]);for (var i=0;i<4;i++) {spi.write(0xb0+i,0x00,0x12);dc.set();spi.write(Uint8Array(this.buffer,64*i,64));dc.reset();}cs.set();};

var n=0;

function onSec() {
var d=new Date();g.clear();g.drawString(d.getHours()+":"+d.getMinutes()+"."+d.getSeconds());g.flip();if (n++>10) {spi.write(0xae,cs);clearInterval();}
}

pinMode(D4,"input_pullup");
setWatch("clearInterval();setInterval(onSec,1000);n=0;spi.write(0xaf,cs);",D4,{edge:"falling",repeat:true});

Turns out 200 variables really isn't very much!

[espruino-discuss3]

Posted at 2016-01-22 by ColinP

Hello,

Looks very interesting! After my hacking with the Adafruit board last week I finally managed to get around to the unrelated stuff I was supposed to be working on. One ebay order later and you have managed to distract me a little bit more :-)

What do you use with openocd to program it? I'm a bit tempted to order one of the STM32 discovery boards with STLink on it, which I think should work..it's easier to attach to that than the JLink Lite I was using previously.

[gfwilliams]

Posted at 2016-01-22 by @gfwilliams

Yes, I just used an STM32F4Discovery board. You just pull 2 jumpers off, then it's 2 wires and ground. OpenOCD seems a bit crazy though - I ended up trying to dig the relevant command-line out of Adafruit's tools.

[espruino-discuss3]

Posted at 2016-01-22 by @allObjects

nRF51822 (via micro:bit) - just as some STMs - as Espruino / Javascript enabler / platform... really cool.

[espruino-discuss3]

Posted at 2016-01-23 by tve

very cool!

[espruino-discuss3]

Posted at 2019-07-22 by AkosLukacs

I can't read the chip number

Can an SWD programmmer read the chip id? :) If you already took it apart

[espruino-discuss3]

Posted at 2019-07-22 by @fanoush

The legacy guids are e.g. here https://github.com/NordicSemiconductor/Android-DFU-Library/blob/release/dfu/src/main/java/no/nordicsemi/android/dfu/LegacyDfuImpl.java and secure ones here https://github.com/NordicSemiconductor/Android-DFU-Library/blob/release/dfu/src/main/java/no/nordicsemi/android/dfu/SecureDfuImpl.java and both look different.

EDIT: removed stuff, it seems like it matches the legacy guids after all

[gfwilliams]

Posted at 2019-07-22 by @gfwilliams

Thanks! I was struggling to find a proper list of UUIDs for each one.

Don't know if it's helpful for you as a lot of stuff is still likely to change, but there's https://github.com/espruino/Espruino/tree/ID205 online now.

• Bootloader that outputs reset reason on display and also sets up a watchdog so you can't brick a phone by uploading the wrong firmware (LCD support is still very hacky)
• jswrap_id205 code which enables watchdog and does a reset if 2 buttons are held down at the same time for 10 seconds

I guess some of these are features that might make sense to be pulled out into something more general for other watches?

[espruino-discuss3]

Posted at 2019-07-22 by @MaBecker

Can someone please tell me how to get Espruino running on HX03W?

[espruino-discuss3]

Posted at 2019-07-23 by @fanoush

@MaBecker yes, Ok, you are the first one to specifically ask for HX03W so I didn't bother yet to upload something specific for HX03w but it is not a problem

• the easiest at first is to flash just SDK11 based espruino build while keeping bootloader and softdevice intact (later it is possible to upgrade both bootloader and softdevice)

• there is no difference in Espruino build between different nrf52 devices except the bluetooth name which you can change from Espruino, so even now you can use latest firmware for DS-D6 from https://github.com/fanoush/ds-d6/tree/master/espruino/DFU I think the best would be to make generic build where the device name is Espruino instead of DS-D6, DS-D9, HX03W

• easiest is to use D6Flasher from Android phone, you can watch the video there - it is exactly the same with HX03W as with DS-D6. Otherwise you could also use usb to serial adapter and nrfutils as described here

• espruino code to get HX03W display working - simple clock application demo (work in progress) is here

So basically you can start now with DS-D6 files - it is relatively easy. I will make up to date SDK11 based Espruino build for DS-D6 and possibly another generic one (was on vacation last 2 weeks).

You can also rebuild it from source for SDK11 yourself, follow this

What is currently missing for HX03W is package of patched bootloader which is then able to update to newer bootloader and softdevice (like there is for DS-D6) so you can use SDK12 based Espruino build without any patches. It is easy to make one but I just didn't bother yet as SDK11 based espruino build is mostly the same.

[espruino-discuss3]

Posted at 2019-07-23 by @MaBecker

Wow @fanoush, thank you very much!

[espruino-discuss3]

Posted at 2019-07-23 by @fanoush

Just ask if something is not clear. The https://www.youtube.com/watch?v=LDGxU-i7z7U video and the D6 flasher was done by Aaron Christophel http://atcnetz.blogspot.com/ It really helps to make it easier for newbies. Btw as it uses slightly modified Nordic DFU library (with added DFU GUIDs used by Desay bootloader) it also works with secure bootloader used with SDK12 and up. So the same D6 flasher app can be used when e.g. switching between SDK11 based stock firmware or Espruino, SDK12 based Espruino and also SDK15 based micropython with adafruit bootloader - each using different bootloader and DFU service GUIDs.

As for HX03W I will upload somewhere DFU package for original Lenovo firmware app so you could recover from Espruino back to original state. Well almost, there is also one flash page at 0x74000 with lenovo specific serial number which is also printed on the box. If this page gets cleared the serial changes to 1234567890 or something but it doesn't matter. In theory you could try to backup it from Espruino via Flash module before it gets overwritten if it bothers you. Or it can be recreated later according to numbers printed on the box.

[espruino-discuss3]

Posted at 2019-07-24 by @fanoush

@MaBecker
HX03W build for current version is here https://github.com/fanoush/ds-d6/tree/master/espruino/DFU/HX03W I have verified it in my device. As mentioned the only difference from DS-D6 build is bluetooth name and also value of process.env.BOARD which is shown when connected via Espruino IDE.

Restore package of Lenovo fitness app is here https://github.com/fanoush/ds-d6/blob/master/fwdump/HX03W_1.0.0.zip

and BTW when using D6 flasher make sure you select the zip file, on my phone I need to touch and hold the zip to select it otherwise it opens the zip and shows file inside it to select

[espruino-discuss3]

Posted at 2019-07-24 by @MaBecker

Great, thanks @fanoush

I have some experience with flashing PuckJS ;-)

[espruino-discuss3]

Posted at 2019-07-30 by @fanoush

DS-D6 is now for $4.99 :-)

[espruino-discuss3]

Posted at 2019-08-10 by user102358

@fanoush I have Makibes m3 smartwatch and it has dual system and one is nrf52840,I would like to make a custom firmware for it,can you help me out? And can you provide me the firmware of cavosmart v12

[espruino-discuss3]

Posted at 2019-08-19 by @fanoush

another interesting nrf52382 watch DT28, FCC ID photos firmware here. The firmware looks signed but there are screws so it looks like it can be opened and closed relatively easily (SWD touch points on the other side of the board). No gps, not 52840 but looks nice and has full touchscreen, big battery and two buttons and is relatively cheap so might be interesting for someone.

And btw looks another $4.99 DS-D6 deal is coming on gearbest in few hours (which is on the other hand only $1 cheaper than 'normal' price with MPOWDS-D6 promo code entered at checkout anytime, so not that big deal)

[espruino-discuss3]

Posted at 2019-08-21 by @fanoush

Not sure if it it is worth mentioning but banggood has $14.99 deal for HX03W now. Not $9.99 like before but still slightly cheaper than normal price.

[espruino-discuss3]

Posted at 2019-08-26 by CrashingDutchman

A story on Hackaday with regard to flashing Arduino on watches: https://hackaday.com/2019/08/23/ota-flash-tool-makes-fitness-tracker-hacking-more-accessible/

[espruino-discuss3]

Posted at 2020-02-19 by @fanoush

Just FYI, there is new "Da Fit app' set of nrf52832 smartwatches that are hackable without taking apart. See this video made by atc1441 https://www.youtube.com/watch?v=n-ZMQaasfAo for more details. The easy flashing procedure is currently in progress but the concept appears to work including reflashing its custom bootloader with nordic one.

Just beware that Da Fit app support watches with multiple CPUs so not all of them are automatically nrf52832. Randoms tips: rectangular with full touch screen P8 (in the video), or with full circular display SN80, CF98, F13 (like this one, not the other one), also the CV16 is quite unusual with dual display.

A week ago I have ordered P8 on aliexpress so it will take some time to arrive to verify the procedure with real device by myself, but there already is lot of things to do before it arrives. I am also thinking a bit about CF98 since from reviews and listings it looks like it is a bit smaller - only 4.1cm diameter unlike F18, DT28 or SN80 which is 5cm.

BTW, looks like all of the watches have external SPI flash as the firmware update procedure depends on it (the stock app receives the firmware from Da Fit app, writes it to SPI, then reboots to bootloader which upgrades the app from SPI with no bluetooth DFU involved).