Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

any ideas about the microcontroller or protocol the tag use? #5

Open
mofosyne opened this issue Oct 27, 2015 · 107 comments

Comments

@mofosyne
Copy link

commented Oct 27, 2015

I did a bit of a teardown of the device, but could not find the microcontroller data sheet it uses. How did you work out its communication?

Btw here is the teardown of the iTag PCB . I find no mention of "ST17H25 datasheet" in google for the BLE SoC

@sylvek

This comment has been minimized.

Copy link
Owner

commented Oct 27, 2015

Hi,
the only information that i have is the name "Quintic PROXR".
your link is very interesting.

@sylvek sylvek added the question label Oct 27, 2015

@mofosyne

This comment has been minimized.

Copy link
Author

commented Oct 27, 2015

Your reference BLE tag you used is same in shape as mine?


Oh btw, it might be a good idea to use the wiki to record any findings on the gatt profile of various tags. E.g. what each services exist and how to respond to each of em (maybe one of them have the wrong battery address?)

@sylvek

This comment has been minimized.

Copy link
Owner

commented Oct 27, 2015

yes exactly the same… i suppose that the problem is under the android code of your phone :-/ :-/

@mofosyne

This comment has been minimized.

Copy link
Author

commented Oct 27, 2015

True true. Btw what's your guess about "SWS" pin on the PCB? I deduced PWM1 as the LED, and BZ+ to be for the buzzer.

But I am not sure what SWS stands for. I wonder if its a way to "program" the microcontroller? Or is it serial output? Then again... there is also a possibility that the IC is hardcoded and locked.

@hosek

This comment has been minimized.

Copy link
Contributor

commented Oct 27, 2015

Opened mine (http://i.ebayimg.com/images/g/NUQAAOSw3ydV5nNb/s-l500.jpg) same shape, same pcb, but the chip has different labeling:
TL SR8266
F512ET32
CK1526
cfapom 1p

@sylvek

This comment has been minimized.

Copy link
Owner

commented Oct 27, 2015

My device contains.. Vcc, God, RX, TX, atm?, in, clk

@sylvek

This comment has been minimized.

Copy link
Owner

commented Oct 27, 2015

20151027_213910
20151027_213900

@sylvek

This comment has been minimized.

Copy link
Owner

commented Oct 27, 2015

KLJ-1230 for the buzzer
Q902t
434NJ

@mofosyne

This comment has been minimized.

Copy link
Author

commented Oct 28, 2015

Man... You got a really beautiful board. It even has rx and tx. Which is
probably the serial port.

sylvek's tag:

VCC = Positive Voltage Source
GND = Ground Voltage
RX = UART receive?
TX = UART transmit?
DT(N?) = ?
IN = Input something?
CLK = Input Clock Signal
RST = reset

Maybe the RST,CLK,IN,DTN is part of a programming interface

Could try soldering to GND, RX, and TX to a serial converter and see what it says

Google search on the IC:

One broken url at eliabieri.com/65 :

my attempt on reverse engineering the cheapest bluetooth ...
eliabieri.com/65
Aug 19, 2015 - Inside I found the TLSR8266 which is produced by TELINK semiconductor. Besides that, theres a small buzzer inside, which can be used to ...

* TLSR8266/TLSR8266F512 

* datasheet in http://www.docin.com/p-878724807.html (can somebody download this and rehost it?)

@mofosyne

This comment has been minimized.

Copy link
Author

commented Oct 28, 2015

hmmm... do you think we should document this in the wiki perhaps?

@mofosyne

This comment has been minimized.

Copy link
Author

commented Oct 28, 2015

Oh and btw sylvek, is the packaging for your tag the same as mine? Is the name of the tag the same? Or did it look different?

@sylvek

This comment has been minimized.

Copy link
Owner

commented Oct 28, 2015

Man... You got a really beautiful board. It even has rx and tx. Which is
probably the serial port.

you're the first guy to tell me that ^^

@sylvek

This comment has been minimized.

Copy link
Owner

commented Oct 28, 2015

Oh and btw sylvek, is the packaging for your tag the same as mine? Is the name of the tag the same? Or did it look different?

my packaging was exactly the same !

@sylvek

This comment has been minimized.

Copy link
Owner

commented Oct 28, 2015

Could try soldering to GND, RX, and TX to a serial converter and see what it says

i could, i have the serial 3.3V controller and an arduino if necessary

@mofosyne

This comment has been minimized.

Copy link
Author

commented Nov 7, 2015

yea that would be interesting to see

@mofosyne mofosyne closed this Nov 7, 2015

@mofosyne mofosyne reopened this Nov 7, 2015

@sylvek

This comment has been minimized.

Copy link
Owner

commented Nov 7, 2015

;)

Le sam. 7 nov. 2015 à 12:38, mofosyne notifications@github.com a écrit :

Reopened #5 #5.


Reply to this email directly or view it on GitHub
#5 (comment).

@hosek

This comment has been minimized.

Copy link
Contributor

commented Nov 11, 2015

Today is "singles day" on chienese markets and those tags are ~2$ and itag ~5$ so expect new wave of new requests or in worst case incopatibilities:/
I will add some photos of pcb when the second batch arrives

@sylvek

This comment has been minimized.

Copy link
Owner

commented Nov 11, 2015

i tried yesterday to weld some wire to the tx-rx "pin" … impossible. I'll try it an another day.
do you have a link to by some itag? (with paypal support if possible)

@mofosyne

This comment has been minimized.

Copy link
Author

commented Nov 11, 2015

brace-yourself-winter

Have you considered asking these suppliers for images of the PCB?

@mofosyne

This comment has been minimized.

Copy link
Author

commented Nov 19, 2015

Update: Just recently got another tag of the same shape, but from a different supplier that looked like it had a different PCB inside... it came... but with the same crappy PCB (mcu: ST17H25) that I disassembled before 0.o . Seems like the photo that showed hint of a programming pad is from an older version of the tag.

I have a feeling they got to the volume that they just opted for a factory preprogrammed or perhaps even an ASIC based chip (which is only economical in large volumes). Or just any methods that would allow them to do away with a programming pin pads.


but there is some slight change:

The board version is BL-180 when previously it was XTR-001-V1

@sylvek

This comment has been minimized.

Copy link
Owner

commented Nov 19, 2015

do you have a link to buy some iTag? i'm looking for it (needed to develop a version with support of several devices)

@mofosyne

This comment has been minimized.

Copy link
Author

commented Nov 19, 2015

it was brought from ebay.com.au from a random selection of buyers. But I suspect all these buyers are buying from the same factory. e.g. alibaba or something

search term bluetooth tag


Oh about soldering to RX and TX pads in your BLE tag, try using 30awg wires, those are nice for tight soldering attempts. Oh and use some flux too.

@hosek

This comment has been minimized.

Copy link
Contributor

commented Nov 20, 2015

Mine pcb
img_20151120_103912
img_20151120_103921

@mofosyne

This comment has been minimized.

Copy link
Author

commented Nov 20, 2015

hosek, this is your IC's marking

TLSR8266
F5123T32
CK1528
CFAPCm 1P

? Looks to have same pinout as the ST17H25 in the 3 separate tags I opened.

1. First teardown mcu
    ST17H25
    F512ET32
    CK1528
    CFAPOJ 1P

2. Second tag from same store
    ST17H25
    F512ET32
    CK1528
    CFAPOL 1P

3. Third tag from different store
    ST17H25
    F512ET32
    CK1528
    CFAR2W 1P

F512ET32 has 512 and 32, which might mean "Flash 512kb and 32bit cpu" or " Flash 512kb and EEPROM 32kb" something like that. ARM inside?
edit: After checking the datasheet in http://www.docin.com/p-878724807.html on page 8. I am convinced it is "Flash 512kb and 32bit cpu"


Now that I compaired all these tags. The CK1528 and F412ET32 seems to be pretty constant. But google search turns up nothing...

again I am reminded of this:

One broken url at eliabieri.com/65 :

my attempt on reverse engineering the cheapest bluetooth ...
eliabieri.com/65
Aug 19, 2015 - Inside I found the TLSR8266 which is produced by TELINK semiconductor. Besides that, theres a small buzzer inside, which can be used to ...

and this PDF in http://www.docin.com/p-878724807.html that I cannot download for some reason.


For now, I'm pinging http://www.telink-semi.com/site/contact#level-1 for any more info... hopefully they reply in english

@mofosyne

This comment has been minimized.

Copy link
Author

commented Nov 20, 2015

Does anyone speak chinese here? Can you download the pdf here? http://www.docin.com/p-878724807.html

Anyway these are what sticks out to me:

Pinout at page 71

capture

...

!!!!!! SWS and SWM !!!!! at page 39 !!!!! This looks very very interesting !!!!

Ohhh.... so it means.... Single Wire Master and Single Wire Slave

capture

image

image


So essentially, it does seem like there is a possibility of programming this... But you need to do it via SWS, using their programming system... Could be an approach if we can somehow emulate the communication. Then the next is what is their compiler etc...

Unless we can get Telelink to be friendlier to us :D ?

Or is this essentially the 1-wire protocol via MAXIM?


http://www.telink-semi.com/site/product_detail/50

TLSR8266/TLSR8266F512 (BLE SoC)
General Description
The TLSR8266/TLSR8266F512 is Telink-developed BLE SoC solution which is fully standard compliant and allows easy connectivity with Bluetooth Smart Ready mobile phones, tablets, laptops. The TLSR8266/TLSR8266F512 supports BLE slave and master mode operation, including broadcast, encryption, connection updates, and channel map updates.
The TLSR8266/TLSR8266F512 is designed to offer high integration, ultra-low power application capabilities. It integrates strong 32-bit MCU, BLE/2.4G Radio, 16KB SRAM, 128/256/512KB external FLASH (TLSR8266) or 512KB intrnal FLASH (TLSR8266F512), 14bit ADC with PGA, 6-channel PWM, three quadrature decoders, a hardware keyboard scanner (Keyscan), abundant GPIO interfaces, multi-stage power management module and nearly all the peripherals needed for Bluetooth Low Energy applications development.

Key Features:

  • General features
    ■ 32bit high performance MCU, up to 48MHz
    ■ Program memory: external 128/256/512KB FLASH (TLSR8266) or internal 512KB FLASH (TLSR8266F512)
    ■ Data memory: 16KB on-chip SRAM
    ■ 12M/16MHz&32.768KHz Crystal and 32KHz/32MHz embedded RC oscillator
    ■ A rich set of I/Os:
    ◇ TLSR8266: Up to 41/37/22 GPIOs depending on package option;
    ◇ TLSR8266F512: Up to 35/20 GPIOs depending on package option;
    ◇ DMIC (Digital Mic);
    ◇ AMIC (Analog Mic)
    ◇ Mono-channel Audio output
    ◇ SPI;
    ◇ I2C;
    ◇ UART;
    ◇ USB with hardware flow control;
    ◇ Debug Interface.
    ■ Up to 6 channels of PWM
    ■ Sensor:
    ◇ 14bit ADC with PGA
    ◇ Temperature sensor
    ■ Three quadrature decoders
    ■ Operating temperature:
    ◇ ET versions: -40℃~+85℃ temperature range
    ◇ AT versions: -40℃~+125℃ temperature range
    ■ TLSR8266 Package
    ◇ TLSR8266ET56/TLSR8266AT56, 56-pin QFN 7×7mm
    ◇ TLSR8266ET48/TLSR8266AT48, 48-pin QFN 7×7mm
    ◇ TLSR8266ET32/TLSR8266AT32, 32-pin QFN 5×5mm
    ■ TLSR8266F512 Package
    ◇ TLSR8266F512ET48/TLSR8266F512AT48, 48-pin QFN 7×7mm
    ◇ TLSR8266F512ET32/TLSR8266F512AT32, 32-pin QFN 5×5mm
  • RF features
    ■ BLE/2.4GHz RF transceiver embedded.
    ■ Bluetooth 4.0 Compliant, 1Mbps and 2.4GHz 2Mbps Boost Mode.
    ■ -92dBm BT4.0 Rx Sensitivity.
    ■ RF link data rate up to 2Mbps.
    ■ Tx output power up to +8dBm.
    ■ Single-pin antenna interface.
    ■ RSSI monitoring.
  • Features of power management module
    ■ Embedded LDO.
    ■ Battery monitor: Supports low battery detection.
    ■ Power supply of 1.9V~3.6V.
    ■ Multiple stage power management to minimize power consumption
    ◇ Rx/Tx mode current:13mA
    ◇ Suspend mode current: 20uA
    ◇ Deep sleep mode current: 0.7uA

Target Applications:

  • Smartphone accessories
  • PC and tablet peripherals, including Mouse / Keyboard
  • Remote Control and 3D glasses
  • Wireless Microphone
  • Health monitoring
  • Sports and fitness tracking
  • Wearable devices

Development tools:
A full set of development tools for the BLE SoC are provided, which include EVB, reference design and SDK for customers to perform evaluation, quick application prototyping and firmware development.


lol... that devkit is not going to come cheap

@sylvek

This comment has been minimized.

Copy link
Owner

commented Nov 20, 2015

wow great!
20151120_140538

mine use a Quantic chip (http://electronics360.globalspec.com/article/4758/nxp-buys-wearable-bluetooth-business)

ref: Q9021 434NJ OOUME

@zoranx

This comment has been minimized.

Copy link

commented Nov 29, 2015

@FSJO

This comment has been minimized.

Copy link

commented Nov 22, 2016

I have no fcc id printed on the pcb, but yes otherwise it should be possible.
do you have a ID starting with 3-4 letters(manuf id) then a number?

@SlowBro904

This comment has been minimized.

Copy link

commented Nov 22, 2016

Not on mine. When I said I found docs it was on another module I was interested in.

@JendrikDerWeise

This comment has been minimized.

Copy link

commented Nov 29, 2016

nutmini

Hi, I have a nut mini and I´m wondering if it is possible to flash it. Does anybody know? And if yes, could you give me a hint how? The writing on the PCB is not really helpful, and I don´t know how to figure out what is what.
My goal is to connect a TAG to an Arduino... sorry for the offtopic, but I couldn´t finde really much informations...

@petiolarid

This comment has been minimized.

Copy link

commented Nov 30, 2016

I have a Nut Mini that I've used for a project with a Raspberry Pi. The Nut Mini does not have a button and is constantly broadcasting whilst the other models currently available (Nut 2 and Nut 3) do have a button and only broadcast a Bluetooth signal for a brief period when their 'button' is pressed.
For my purposes the Nut 2 and Nut 3 are much more useful.

@JendrikDerWeise

This comment has been minimized.

Copy link

commented Dec 7, 2016

I need a presence detection. So the nut minis broadcasting is exactly what I need. But I have no clue how to see it with Arduino...

@FSJO

This comment has been minimized.

Copy link

commented Dec 7, 2016

did you try using a raspberry with bluez or other bluetooth stack with BLE support?
I think thats the easiest way instead of arduino. However, make sure the scan completes otherwise the radio might hang. If it gets unresponsive its a good idea to control the bluetooth module/usb-dongle with a GPIO thus being able to restart it.

Do you have different mac_addresses or UUID on your device ?

@sylvek

This comment has been minimized.

Copy link
Owner

commented Dec 7, 2016

@shyba

This comment has been minimized.

Copy link

commented Dec 31, 2016

Hi. http://www.lenzetech.com/product/showproduct.php?lang=cn&id=82
Found some more info: ST17H25 is a Lenze Tech product.
btw, congrats on helping to re-purpose those things. I love to mod gadgets and this thing is BT4.0. Sounds promising.

@shyba

This comment has been minimized.

Copy link

commented Jan 7, 2017

@mofosyne just got a very cheap ($1.85) bluetooth selfie shutter to tinker with and it came with ST17H26. It's like this one, but totally unbranded.
Found it's datasheet on Docin. No idea how to download it, Google Translator is breaking the UI buttons. So I am reading on the website.

http://www.docin.com/p-1814297477.html

ST17H25 here: http://www.docin.com/p-1814343474.html (hey, this IC is way better than the one I got! Mine is OTP ROM)

It has the Single Wire Slave pin as well, but for my DIY project I think i2c or even the buttons pads are enough. I am trying to make a DIY cadence/speed sensor for my bike using this cheap selfie shutter + hall effect sensors, but for this price I think I will keep buying them for Bluetooth 4.0 DIY projects. 😄

Something I noticed on their datasheet: There are no scary confidential warnings or something like this, but mail addresses for sales and information! 👍
I think it should be fine to contact them if any of you is in the process of creating a commercial project and looking for a good and cheap BT SoC.

I hope it helps you.

@lbodnar

This comment has been minimized.

Copy link

commented Jan 28, 2017

This MLE-15 tag also nicely violates basics of BLE specification.

When button is pressed it continuously sends ADV_IND advertising packets every 17 milliseconds.
Specification calls for minimum 20ms plus random interval between 0ms and 10ms to allow two identical devices to not jam each other continuously. So the repeat interval should be 25+-5ms.

Leo

mle-15

@0to1a

This comment has been minimized.

Copy link

commented Jan 29, 2017

I have buy much JDY-10 (they said it's CC2541) from China and the name of IC is blank. I saw the name is TLSR8266, how to program it?

@SlowBro904

This comment has been minimized.

Copy link

commented Mar 14, 2017

I have an idea for reprogramming these. Press some moldmaking silicone over the MCU, once it cures pull it off, and very carefully paint small traces using conductive paint out to some breakout points. Tada, you now have a reusable programming "hat." Buy dozens of these at $2 each and reprogram them for a longer life.

It's an idea I'm pursuing for a chicken tracking device.

@MD2020nMe

This comment has been minimized.

Copy link

commented Mar 20, 2017

There is a freeRTOS port of Telink chip that can possibly useful. Especially the drivers. This works well on their 8269 (pin to pin to 8267 with larger SRAM). JW played with the OpenOCD for this chip. He can possibly be the source of the tools. There are some tools floating around. JW may have them.

@dwaynez

This comment has been minimized.

Copy link

commented Jun 14, 2017

My itag with the ST17H26 chip in it does not seem to advertise the link loss service. Without this service, it appears that there is no way to tell the tag not to alert on disconnect from the phone. Is anyone aware of a cheap tag that provides a link loss service that the tag could be told to not signal on link loss?

@brailateo

This comment has been minimized.

Copy link

commented Jul 25, 2017

Hello all! I recently bought 2 devices with ST17H26 chip (CH1615) and I'm using them as a "Panic Button" for my old parents. It seems to be the perfect "use case", they are off all the time (no battery use) and when needed, long press put the tag ON, I have 4 old phones and tablets (Android 4.4.2) all over the place in house with a small program that detects them.
Everything is ok, BUT ... the range seems to be too small (approx. 3 or 4 meters). Did anyone tried to replace the MIFA PCB antenna with a Wire Antenna (lambda/4) in order to increase the range?

Thanks for itracing2, it helped me as an inspiration source for my detection program,
Teo
antenable

@electron1979

This comment has been minimized.

Copy link

commented Sep 23, 2017

Looks like a neat little IC, already packaged. I'm interested in doing the same, but where is this "relevant file" referred to below?

It is SPI not JTAG, as it does not have the "JTAG_MODE" (pin 24) or "JTAG_RST" (P03, pin 1) pins broken out.

"128K bytes FLASH memory is used for storing program code. It can be accessed through a simple SPI interface. Four GPIO P0.4, P0.5, P0.6 and P0.7 are used for program FLASH in program mode. You can read, write or erase the FLASH space with different SPI command. For detail information, please refer to the relevant file. After erase, all the data in the FLASH are 0xFF, customer can write their program into the FLASH. Also, the data in the FLASH can be read out for debug. Once the developing process is done, the access for the FLASH can be forbbided by writing 0x12345678 into the last four addresses. ([128k-4]~[128k])", https://www.google.com.au/url?sa=t&rct=j&q=&esrc=s&source=web&cd=11&ved=0ahUKEwjWgu788LrWAhXEWbwKHYxmAeg4ChAWCDYwAA&url=http%3A%2F%2Fwww.9mcu.com%2F9mcubbs%2Fforum.php%3Fmod%3Dattachment%26aid%3DNjA1NDZ8NjZmOGNlMDl8MTQ4NDkwMjY5NXwwfDEwNzg3NzA%253D&usg=AFQjCNEOo0hViuf0z3YOueaEoEQt3eADiA, so maybe it has been "forbidded"?

From the datasheet: FLASH programming: JTAG, I2C, SPI and UART interface. It looks like P04, 5, 6 & 7 are connected to the SPI (4-MOSI, 5-MISO, 6-SCK & 7-CSI (CE)), while the UART interface is also broken out. PROG sets "Flash Program Mode selection; 0: Flash in normal mode & 1: Flash in program mode"???

I think this a dead end, but it was fun trying...

BK3431N Datasheet 1.0.pdf

imag0907
imag0908

@jpmorrison

This comment has been minimized.

Copy link

commented Sep 23, 2017

Found a download link to the Nanosic SDK which appears to have the compiler for Telink MCUs - tc32-elf-gcc. No source code unfortunately and emails don't work to nanosic.com

Forked:
https://github.com/jpmorrison/NANOSIC_IDE.git

@TaaviE TaaviE referenced this issue Feb 2, 2018
3 of 3 tasks complete
@zerog2k

This comment has been minimized.

Copy link

commented Feb 15, 2018

regarding the beken bk3431n - I found this random keil project in github... unsure of how useful it might be to start a blinky/helloworld with a jlink... (Not sure if the flash lock is permanent or resettable):
https://github.com/SuperCoderMan/ble/tree/3d237f8e37c3a989d62c87349219e7691868b971/BK3431_designkit_V2.7
(edit: looks like it might work as a starting point, sadly, seems that the beken sdk is provided as headers and a keil binary library :((( so wont be easy to port to gcc unless someone has a good keil arm lib wrapper)

@fanoush

This comment has been minimized.

Copy link

commented Aug 22, 2018

Hello, anybody got further with flashing Telink TLSR8266/ST17H25 chip via SWS? I got few nice cheap fitness trackers based on this chip, the SDK with gcc appears to work, I have matching firmware binaries for those bracelets as a backup, but it looks like one would currently need the "Telink EVK OTP/Flash Programmer board" to reflash it. Sadly I can't google this programmer board anywhere being available (aliexpress, ebay).

The protocol is poorly documented and only in older versions of the datasheet, later this SWS/SWM part was removed completely. Still, I checked the protocol description and while the basics are good I can't figure our what should be the clock speed for data (unlike with CC2541 where there is extra wire for clock). Also there is only read and write command documented (and begin, end) , how would one actually execute something in the chip via this protocol? How could the tcdb debugger be implemented with this? Maybe backing up and rewriting stack or ISR vectors? Or maybe CPU registers including PC and stack pointers are memory mapped? Would be nice to have some USB debug traces of this EVK programming board doing something.

@tablatronix

This comment has been minimized.

Copy link

commented Oct 17, 2018

For posterity, I just got these 2, seem to be different revisions

28096eac-2aaf-4dd8-80db-43a6edb5ff62
e843676c-c4d3-4c25-b16f-b0f62d99a132
c26a827f-ee32-4864-895f-26d9514f7f7d
80774043-3751-43b0-afb6-0f959e74c372

@feversky

This comment has been minimized.

Copy link

commented Nov 9, 2018

Hello, anybody got further with flashing Telink TLSR8266/ST17H25 chip via SWS? I got few nice cheap fitness trackers based on this chip, the SDK with gcc appears to work, I have matching firmware binaries for those bracelets as a backup, but it looks like one would currently need the "Telink EVK OTP/Flash Programmer board" to reflash it. Sadly I can't google this programmer board anywhere being available (aliexpress, ebay).

The protocol is poorly documented and only in older versions of the datasheet, later this SWS/SWM part was removed completely. Still, I checked the protocol description and while the basics are good I can't figure our what should be the clock speed for data (unlike with CC2541 where there is extra wire for clock). Also there is only read and write command documented (and begin, end) , how would one actually execute something in the chip via this protocol? How could the tcdb debugger be implemented with this? Maybe backing up and rewriting stack or ISR vectors? Or maybe CPU registers including PC and stack pointers are memory mapped? Would be nice to have some USB debug traces of this EVK programming board doing something.

hello fanoush. recently i found the company repository https://github.com/17HXX, hope it helps. the EVK board is only available in the company official account in Wechat, but very expensive, 1000RMB. anyone who needs translation or other information, please contact me. i had the idea to make a firmware, and use it as a positioning device for home automation. maybe replacing with a cc2540 is much eaiser.

@fanoush

This comment has been minimized.

Copy link

commented Nov 9, 2018

hello fanoush. recently i found the company repository https://github.com/17HXX, hope it helps. the EVK board is only available in the company official account in Wechat, but very expensive, 1000RMB. anyone who needs translation or other information, please contact me. i had the idea to make a firmware, and use it as a positioning device for home automation. maybe replacing with a cc2540 is much eaiser.

Thank you very much, I already searched github repositories for 'tlsr' and 'telink' but forgot 'lenze', however when trying now it wouldn't find this 17HXX anyway so thanks a lot for this pointer! cc254x is 8051, which does not look easier to me, especially with no free compiler, using IAR 30 day trials gets boring very quickly :-) I managed to recompile BlueBasic for it and tested it with JDY-08 module and it is quite nice but both 8051 arch and 8k SRAM just feels too limiting. I'll definitely check stuff in 17HXX out and see whether it helps me with figuring out how to bitbang SWS. I already got JDY-10 TLSR8266 module for this.

@code0100fun

This comment has been minimized.

Copy link

commented Dec 19, 2018

Sorry if I'm reviving an old discussion but I came across this chip tearing down a "CSI TECH" beacon and I found a datasheet in English that may be useful for some of you https://share.weiyun.com/5JawPYc

@fanoush

This comment has been minimized.

Copy link

commented Mar 15, 2019

As for the TLSR8266 I am not sure if I missed it previously or they added it later but there is link to wiki http://wiki.telink-semi.cn/dokuwiki/doku.php?id=start directly on main Telink page. It contains datasheets, IDE with compiler, BLE SDK. Also there is documentation about Burning and Debugging Tool (BDT) with downloads containing its schematics and firmware binary. It still does not help me to know more about SWS but at least it is lot of (mostly known) info in one official place. BTW from schematics it looks like BDT itself contains TLSR8266 chip which can natively handle USB - the chip has pins for usb data +/- However the TLSR8266 datasheet has no description of USB functionality.

EDIT: the wiki has revision history and most stuff started in October 2018 (and e.g. the TSLR826x page was even updated in March 2019) so it is indeed newer than most comments here. And it is great they are making it available. Also their forum has some interesting bits.

@PlantDaddy

This comment has been minimized.

Copy link

commented Jul 30, 2019

Finally found the right datasheet for the ST17H26:
https://datasheetspdf.com/datasheet/ST17H26.html

PDF page 23, page 22 in the document
https://datasheetspdf.com/pdf-file/1316228/LENZE/ST17H26/1

@fanoush

This comment has been minimized.

Copy link

commented Jul 30, 2019

@PlantDaddy not sure what you're after but some version of that datasheet is also in github project mentined above, see https://github.com/17HXX/17HXX_OTP_Plug-in_Flash_SDK_Release/tree/master/doc , there may be more information there

@probonopd

This comment has been minimized.

Copy link

commented Jul 30, 2019

OTP = one-time-programmable = the end of all firmware hacking dreams?

@fanoush

This comment has been minimized.

Copy link

commented Jul 30, 2019

17H26 has OTP yes, 17H25 has flash like TLSR8266

@arteyshock

This comment has been minimized.

Copy link

commented Aug 20, 2019

Maybe something like this https://ru.aliexpress.com/item/33045005525.html?spm=a2g0s.8937460.0.0.7b032e0eC7oFuA could be used to program TLSR8266

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
You can’t perform that action at this time.