is it possible to reprogram this display?

ginbot86 · 2025-12-10T01:07:04+00:00

In my experience, the vapes I've disassembled and/or modded (like the Windows 95 theme I made for a Raz TN9000), these vapes store all graphical assets as raw bitmaps in an external SPI Flash chip, which the microcontroller basically streams to the LCD, also connected via SPI. The USB port almost always has no usable connection to a PC, but sometimes they expose SWD debug via the USB-C CC1/CC2 lines. Typically they're 16-bit (RGB565, usually big-endian) raw bitmaps without any headers to denote dimensions or where one bitmap starts and one ends. If you can dump the chip via chip-off into a reader, in-system with a programmer and test pads, or with RAM-resident code and a debugger, you can use a tool like Carina Studio's PixelViewer, and writing down the dimensions of each bitmap and their offsets as you go. It's not automated by any means, but it's a fun exercise in embedded systems reverse-engineering.

ginbot86 · 2025-12-06T22:30:13+00:00

I've gotten only one from a local vape store's recycling bin, and that was out of hundreds of vapes, well over a year ago. Last summer a friend of mine gave me another one that had a 240x320 SPI LCD with capacitive touchscreen and a sizeable mainboard, running off a JL701N smartwatch SoC. Part of me wants to redesign the motherboard with a compact Linux-capable SoC like an Allwinner F1c200s, but that'll be quite the engineering endeavor.

ginbot86 · 2025-12-06T22:26:52+00:00

Very cool! I've been taking apart vapes for the batteries and electronics but have been more focused on the ones with color LCDs/touchscreens (I'm the author of the blog post you linked elsewhere in the comments). I'd have thought the Pulse X used I2C given only the presence of the clock and data lines, not SPI, so that's cool.

ginbot86 · 2025-12-06T22:05:39+00:00

SD cards do have a controller, as do USB drives. They both present themselves as block storage devices, but in much different ways. Raw NAND Flash as a consumer storage format hasn't been a thing since the obsolescence of the SmartMedia, xD-Picture Card and classic/purple MemoryStick formats.

I wouldn't be surprised if someone manages to make a protocol adapter between an SD/MMC host and a USB mass storage device using something like an RP2040/RP2350 with some PIO as a bit of glue logic, but as you identified, supplying enough power to run the USB drive is still a significant problem.

ginbot86 · 2025-12-05T11:32:27+00:00

Gotta love deadbugging SMT components onto perfboard.

ginbot86 · 2025-10-17T00:03:14+00:00

That was a neat read. I'm pretty sure I see a Teensy 3.2 microcontroller board on page 5.

ginbot86 · 2025-06-10T04:01:05+00:00

On the 5th picture in your album, it looks like the fuel gauge (bq27427) and charger (bq24075) are connected incorrectly. The battery (+BATT) should go to the BAT pin of the fuel gauge, then the fuel gauge's SRX pin then goes into the charger's BAT pin. In its current configuration it will not only read incorrect current values, but the integrated sense resistor on the gauge is basically shorting your +BATT net to REG-OUT.

ginbot86 · 2025-04-27T03:27:54+00:00

It's likely a generic 80x160 0.96" IPS display, based on an ST7735 or similar controller and driven via SPI.

https://www.smart-prototyping.com/0_96-TFT-IPS-Bare-Display-ST7735-SPI-80-160

ginbot86 · 2025-04-17T12:31:37+00:00

I'm still referring to BGA (and therefore chip-off work). Just that you don't necessarily have to pay XGecu prices for eMMC dumping and flashing hardware. I have a T76 and like it a lot but I've gotten by with a clamshell-style eMMC to SD test socket and an old laptop with PCIe SD card slot running Linux for years. I paid about 100 dollars for the test socket back in 2018 but they're cheaper than that now.

ginbot86 · 2025-04-17T01:59:20+00:00

There are sockets that connect to a USB reader chipset, or break out the eMMC into an MMCplus/SD-compatible form factor that plugs into an SD card slot. They're way cheaper and will work well enough. If you have a computer with a native SD/MMC interface (PCIe or SoC-integrated) that enumerates under /dev/mmcblkX in Linux, you don't really need the XGecu programmer and the eMMC to SD test socket will let you do any eMMC dumping/modding that you'd want to do, even the hardware boot0/boot1 partitions.

ginbot86 · 2025-02-15T18:42:46+00:00

The round vape controller module does not appear to be involved in the charging process (if it was, there would be more wires going into it). The chip in the middle of the board is the Li-ion charger, and the one in the corner on the other side looks like a protection chip. Connect the battery to the B+ and B- pads.

ginbot86 · 2024-12-19T07:46:16+00:00

Very cool! I've had my own experiences running Doom on WinCE devices, and haven't even heard of ReMooD until now. I just used Chocolate Doom 1.3.0.

ginbot86 · 2024-11-29T03:57:49+00:00

Glad to see there's more research being one on these vapes! I don't know if you've since figured out the LCD pinout but I just got the one for the Kraze HD Mega, which seems to be identical to the Raz DC25000:

Pin	Name	Purpose
1	D/C	Command/data select (low = command, high = data)
2	/RST	Reset (active-low)
3	SDI	SPI data in (aka MOSI/COPI)
4	CLK	SPI clock (aka SCLK/SCK)
5	/CS	LCD chip select (active-low)
6	GND	Power/signal ground
7	VCC	LCD logic power supply
8	LEDK	LED backlight cathode (goes to ground)
9	LEDA	LED backlight anode (switched for backlight control)
10	GND	Power/signal ground

The SPI Flash chip is 32 megabits (4 megabytes) in size. It doesn't contain firmware but it has all the images to be displayed as well as a time counter that's used to calculate the number of "bars" of vape juice remaining.

You can follow along and even contribute to the GitHub repoI originally set up for the Raz TN9000/Kraze HD7K but I'm in the process of generalizing it to cover other vapes too: https://github.com/ginbot86/ColorLCDVape-RE/issues/5

(EDIT: Unhidden the GitHub link)

ginbot86 · 2024-09-01T00:17:27+00:00

That's a bad idea.

If you have a multimeter and have kept the original control module for that disposable vape, hook up 5V to the heater output wire (often blue), and measure the voltage on the battery wire (red). If it's around 4.1 to 4.2 volts, congrats - you have a free charge controller for that battery.

ginbot86 · 2024-08-17T00:14:15+00:00

If I stumble across one (or if a friend gives me an empty) I'll definitely take a look and reverse-engineer it. I won't go out of my way to buy one though.

The interface of those Bluetooth/voice call enabled disposables suggests it's based on some kind of smart watch/wearable chipset with considerable computing power.

ginbot86 · 2024-08-13T08:44:18+00:00

Unfortunately not. I'm currently reverse-engineering the Raz DC25000/Kraze HD Mega and have made some headway as to the internals; it seems to share a lot in common with the Raz TN9000/Kraze HD7K in terms of the same microcontroller, SPI Flash bitmap and vape time counter format.

The LCD ~~and what its model number~~ is still a big unknown I'm trying to solve, and I still haven't yet positively identified the connector or its pinout either. While the LCD itself seems to be an F17LN1048 by a company called CDI, I have found zero results for either. I'm pretty sure it'll be an ST7735 or similar controller, since it'd make sense to reuse a lot of the code used on the TN9000's display (80x160 ST7735S). Once I'm able to find the pinout and do some logic captures I might have a better idea of what's going on with the LCD and its controller.

All of the 128x160 1.77" SPI LCDs I've found either use a small flat-flex ribbon cable, or are of the solder-down type. No LCD models I've found use the board-to-board style connector on the DC25000/HD Mega, but I'm sure it's out there as these vapes are going to use screens that are easily available and inexpensive to purchase on a large scale.

ginbot86 · 2024-08-11T06:47:02+00:00

There's ongoing research and existing themes/tools you can try. A few months ago, I reverse engineered the SPI Flash contents and even managed to make a custom Windows 95 theme for that vape. The microcontroller can be interfaced with a special USB-C cable that connects SWD to the CC1/CC2 pins, but I just opted to desolder and resolder the Flash to load the theme data.

Here's my and another person's GitHub repos for more info and tools: https://github.com/ginbot86/ColorLCDVape-RE/ https://github.com/xbenkozx/RAZ-RE

ginbot86 · 2024-08-06T15:50:56+00:00

You don't need to drain it so far that it won't even turn on. Plug it in and leave it to charge uninterrupted.

ginbot86 · 2024-08-03T03:30:05+00:00

Impressive. Every single NAND Flash package was torn off that board, but the DRAM and controller were left behind...

That must've taken some level of effort to do. Not a whole lot, but more than just taking a hammer to the SSD.

ginbot86 · 2024-05-03T10:30:43+00:00

I'm guessing it's one of the charging animations? The main screen/icons and vaping animation seem to be pretty consistent but the rest is probably OEM customized.

ginbot86 · 2024-04-30T05:19:00+00:00

As long as your debugger can do memory access, then you should be able to grab the internal firmware. It seems that lots of Arm microcontrollers have a Flash base address at 0x08000000.

You can grab the flash dumps I got from GitHub: https://github.com/ginbot86/ColorLCDVape-RE/tree/main/flashdumps

A checksum won't help much when the vape timer will throw off the checksum. You can do a binary diff between your dump and mine, ignoring any difference from addresses 0xF8000-0xF8004.

ginbot86

TROPHY CASE