Dissecting the Chirp Geek warning!
Posted 30 November 2010 - 11:23 PM
As we already know the chirp gets locked to the first unit that programs it. Surely there is a debug/test connection somewhere on the device that could be used to override this, given the right programmer. But how to access it? Lets take a look. The chirp is quite well sealed, but there is a sticker under the battery area that is easily removed. Under this sticker we see 11 contacts.
Bingo. Now the question is, what are these connected to? There is no real way to know without a more detailed understanding of the hardware inside. As this is a well sealed unit, you cannot open it without destruction of the housing. A few minutes of careful dremel work and it is open. For those that aren't aware of how small these things are I have included a Canadian quarter for size comparison. And for those who are unaware of the size of a Canadian quarter, its the same size as a US quarter.
The battery side doesn't reveal too much to us. We see that it is made by Dynastream Innovations. This isn't really surprising as they are the company that created the ANT protocol, and are owned by Garmin. I find the copywrite 2007 interesting. I have speculated before that the chirp is basically the same hardware as the Garmin Footpod. It shares the same housing at any rate. More on this later.
The only other things to note about this side are the battery contacts, large ground plane, many traces and vias, but otherwise unpopulated. The two unmasked vias are labeled TXD and RST. Well RST goes directly to Pin #11 and Pin #1 goes to the ground plane. 2 contacts identified, only 9 to go. Lets take a close look at the other side.
This side is much more interesting. Too hard from that image to read the markings on the components but they are:
The larger black square is the micro controller. It is a Texas Instruments MSP430F2350 datasheet here
The smaller black square is the wireless transceiver. It is a Nordic Semiconductor nRF24L01 datasheet here
There are also a couple crystals and assorted capacitors and resistors, and the unmasked antenna. Note the unpopulated area in the center of the PCB? More speculation on my part, but I believe that this could be where the accelerometer is located if this were a FootPod.
Thats all I have for now, I will continue to follow the traces and read the datasheets to determine the remainder of the pin connections. Later this week I will update with more findings.
Posted 01 December 2010 - 08:55 AM
Hopefully, they are not easily hackable, as that would lead to theft.
iPhone Chirp support is currently #12 on the list. A few more votes could push it into top ten:
Posted 01 December 2010 - 10:14 AM
Posted 01 December 2010 - 10:51 AM
This post has been edited by ecanderson: 01 December 2010 - 10:54 AM
Posted 01 December 2010 - 03:40 PM
Posted 01 December 2010 - 04:44 PM
Posted 02 December 2010 - 12:04 AM
2: unknown appears to go to RST through a small component, via comes through under MCU
3: MCU pin 10 (TA1)General-purpose digital I/O pin/Timer_A, compare: Out1 output
4: MCU pin 36 (TMS)Test mode select. TMS is used as an input port for device programming and test.
5: MCU pin 37 (TCK)Test clock. TCK is the clock input port for device programming and test.
6: MCU pin 35 (TDI/TCLK)Test data input or test clock input. The device protection fuse is connected to TDI/TCLK.
8: MCU pin 34 (TDO/TDI)Test data output port. TDO/TDI data output or programming data input terminal
9: MCU pin 14 (CAOUT/TA0/CA4)General-purpose digital I/O pin/Comparator_A output/Timer_A, capture: CCI0B
10: MCU pin 32 (TBOUTH/ACLK)General-purpose digital I/Opin/switch allPWMdigital outputs to high impedance -- Timer_B3:TB0
to TB2/ACLK output
11: MCU pin 38 (RST/NMI)Reset input, nonmaskable interrupt input port.
Posted 02 December 2010 - 12:06 AM
This is something I do plan to try, but I want to do a few other tests prior to this.
Posted 02 December 2010 - 07:23 PM
Posted 03 December 2010 - 07:00 AM
Posted 03 December 2010 - 10:39 AM
I do have various JTAG tools and apps. I have a Ti Launchpad which may or may not be able to work with the MCU. I just have to find it, or order another, as they are dirt cheap.
Posted 04 December 2010 - 04:51 AM
Posted 04 December 2010 - 07:12 AM
And what about smashing it with a hammer ?