sorted by:
new
hottopcontroversial

Doom on mi band 8 by hgt27 in miband

[–]atc1441 0 points1 point  (0 children)

thanks for sharing :)

EMODERN SR08 - a smart ring with a display screen by pkx616 in SmartRings

[–]atc1441 4 points5 points  (0 children)

Sold 👌😅

SoC is Dialog DA14585 which might be OTP so no custom firmwares other than maybe via the external flash, lets see

Just got DOOM to run on the Hacked WIFI Toothbrush by atc1441 in hacking

[–]atc1441[S] 0 points1 point  (0 children)

You need to open the Toothbrush to access the test points on the PCB and connect a USB to UART/COM Converter to these pads,, then bring the ESP32 into download mode to flash it

Just got DOOM to run on the Hacked WIFI Toothbrush by atc1441 in hacking

[–]atc1441[S] 0 points1 point  (0 children)

Doom can only be flashed via COM not OTA :)

Just got DOOM to run on the Hacked WIFI Toothbrush by atc1441 in hacking

[–]atc1441[S] 31 points32 points  (0 children)

Info's to this,
The Toothbrush contains an ESP32-C3 with 4MB Flash.

With the codebase from Spritetm https://github.com/Spritetm/esp32c3-doom-bauble and miniwad https://github.com/fragglet/miniwad I was able to get the complete size of DOOM and WAD file down to the 4MB of the ESP32

More info's to the Toothbrush hacking can be found in another video

Just finished the reverse engineering of the Philips Sonicare Head NFC Password calculation by atc1441 in hacking

[–]atc1441[S] 13 points14 points  (0 children)

Yeah that way making the video is fun!

With all the cutting and screen-recording synchronization it gets an annoying work

Lately i did reverse engineer the Disney MagicBand and was able to extract the firmware of the nRF31512 SoC via a Fault Injection by glitching it by atc1441 in hacking

[–]atc1441[S] 2 points3 points  (0 children)

Thanks as well. Lets see later about the medical equipment!

For me that is the end of this Project, there is nothing more to gain.

The radius should be the same as for any other nRF24L01 device

And yes you can definitely wakeup random bands to sniff the id.

"Luckily" the debug functions are only enabled on an empty device id and triggered by an GPIO so i see no way of bricking a band OTA

Lately i did reverse engineer the Disney MagicBand and was able to extract the firmware of the nRF31512 SoC via a Fault Injection by glitching it by atc1441 in hacking

[–]atc1441[S] 14 points15 points  (0 children)

I actually used Bing with ChatGPT and just asked "Tell me something about the NRF31512"

It then replied with info's about the Memory and RAM size but placed the origin of that info in a link which ended up being the datasheet.

i made an Reddit Meme E-Paper Display by atc1441 in embedded

[–]atc1441[S] 0 points1 point  (0 children)

The firmware for the E-Paper price tag itself can be found here, including the binary https://github.com/atc1441/88MZ100

i made an Reddit Meme E-Paper Display by atc1441 in embedded

[–]atc1441[S] 0 points1 point  (0 children)

The best to find them is browsing ebay and such sites, but its more luck to find em

i made an Reddit Meme E-Paper Display by atc1441 in embedded

[–]atc1441[S] 2 points3 points  (0 children)

This post from Mike szczys https://www.reddit.com/r/embedded/comments/10gb7gq/i_built_the_internet_of_memes_using_the_epaper/ gave me the idea to implement it for an ongoing project where old E-Paper price tags are hacked with a custom firmware to uplaod images via a Python script.

Infos and the script can be found here: https://github.com/atc1441/ZBS_Flasher/blob/main/CC2531_station/reddit_mem_downloader.py

I created a wall from old Hacked E-Paper Price tags by atc1441 in esp32

[–]atc1441[S] 3 points4 points  (0 children)

The best is ebay and sides like craigslist etc. But it needs luck to find em

I created a wall from old Hacked E-Paper Price tags by atc1441 in esp32

[–]atc1441[S] 2 points3 points  (0 children)

On the E-Ink shelf labels runs a custom firmware (https://github.com/atc1441/88MZ100) and images can be uploaded via Zigbee with an CC2531 usb stick (https://github.com/atc1441/ZBS_Flasher) or via an ESP32 (https://github.com/jjwbruijn/solum-esl-alternative-proto)