Groundspeak Forums: Dissecting the Chirp - Groundspeak Forums

Jump to content

Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

Dissecting the Chirp Geek warning!

#1 User is offline   savant9 

  • Cum hoc ergo propter hoc
  • Group: +Premium Members
  • Posts: 682
  • Joined: 23-February 03

Posted 30 November 2010 - 11:23 PM

After seeing many unanswered questions, plus a bunch of my own, I wanted to find out a few things about the Garmin Chirp.

As we already know the chirp gets locked to the first unit that programs it. Surely there is a debug/test connection somewhere on the device that could be used to override this, given the right programmer. But how to access it? Lets take a look. The chirp is quite well sealed, but there is a sticker under the battery area that is easily removed. Under this sticker we see 11 contacts.

Posted Image

Bingo. Now the question is, what are these connected to? There is no real way to know without a more detailed understanding of the hardware inside. As this is a well sealed unit, you cannot open it without destruction of the housing. A few minutes of careful dremel work and it is open. For those that aren't aware of how small these things are I have included a Canadian quarter for size comparison. And for those who are unaware of the size of a Canadian quarter, its the same size as a US quarter.

Posted Image

The battery side doesn't reveal too much to us. We see that it is made by Dynastream Innovations. This isn't really surprising as they are the company that created the ANT protocol, and are owned by Garmin. I find the copywrite 2007 interesting. I have speculated before that the chirp is basically the same hardware as the Garmin Footpod. It shares the same housing at any rate. More on this later.

The only other things to note about this side are the battery contacts, large ground plane, many traces and vias, but otherwise unpopulated. The two unmasked vias are labeled TXD and RST. Well RST goes directly to Pin #11 and Pin #1 goes to the ground plane. 2 contacts identified, only 9 to go. Lets take a close look at the other side.

Posted Image

This side is much more interesting. Too hard from that image to read the markings on the components but they are:

The larger black square is the micro controller. It is a Texas Instruments MSP430F2350 datasheet here

The smaller black square is the wireless transceiver. It is a Nordic Semiconductor nRF24L01 datasheet here

There are also a couple crystals and assorted capacitors and resistors, and the unmasked antenna. Note the unpopulated area in the center of the PCB? More speculation on my part, but I believe that this could be where the accelerometer is located if this were a FootPod.

Thats all I have for now, I will continue to follow the traces and read the datasheets to determine the remainder of the pin connections. Later this week I will update with more findings.

#2 User is offline   Driddy 

  • Stumbler in Chief
  • Group: +Premium Members
  • Posts: 116
  • Joined: 16-November 09

Posted 01 December 2010 - 06:35 AM

Great work! Thanks for posting this -- and I look forward to more installments.

#3 User is offline   ATXTracker 

  • Premium Member
  • Group: +Premium Members
  • Posts: 270
  • Joined: 27-April 06

Posted 01 December 2010 - 08:55 AM

I look forward to hearing more. Reading through your post I was expecting some revelation about hacking or programming the Chirp. Quick! Hook some devices up to those terminals and tell us what you find.

Hopefully, they are not easily hackable, as that would lead to theft.

Chirp Plug:
iPhone Chirp support is currently #12 on the list. A few more votes could push it into top ten:
http://feedback.geocaching.com/forums/7527...e-app?ref=title

#4 User is offline   John E Cache 

  • Premium Member
  • Group: +Premium Members
  • Posts: 945
  • Joined: 09-February 02

Posted 01 December 2010 - 10:14 AM

View Postsavant9, on Nov 30 2010, 11:23 PM, said:

Note the unpopulated area in the center of the PCB? More speculation on my part, but I believe that this could be where the accelerometer is located if this were a FootPod.
Cool. The first thing I noticed in your pics was the cut out around that unpopulated area. My guess was vibration reduction for that part. I guessed mic, speaker or accelerometer. So I guess we both guessed accelerometer. Does removing the battery reset the owner id?

#5 User is offline   ecanderson 

  • Premium Member - This Space for Rent
  • Group: +Premium Members
  • Posts: 3505
  • Joined: 13-January 08

Posted 01 December 2010 - 10:51 AM

View PostJohn E Cache, on Dec 1 2010, 11:14 AM, said:

The first thing I noticed in your pics was the cut out around that unpopulated area.
Could also be for functional or EMI reasons - the idea being to cut the ground plane everywhere except back under the traces that follow it - although I'd have to say, routing the thing out like that looks like a bit of overkill. Keeps recirculating currents from other parts from causing noise on a sensitive part.

This post has been edited by ecanderson: 01 December 2010 - 10:54 AM


#6 User is offline   ecanderson 

  • Premium Member - This Space for Rent
  • Group: +Premium Members
  • Posts: 3505
  • Joined: 13-January 08

Posted 01 December 2010 - 10:55 AM

To the OP. It would certainly be interesting to see what happens if that RST line is taken to ground during battery insertion ... wonder if it would still remember whose Garmin it belongs to?

#7 User is offline   John E Cache 

  • Premium Member
  • Group: +Premium Members
  • Posts: 945
  • Joined: 09-February 02

Posted 01 December 2010 - 03:40 PM

View Postecanderson, on Dec 1 2010, 10:51 AM, said:

View PostJohn E Cache, on Dec 1 2010, 11:14 AM, said:

The first thing I noticed in your pics was the cut out around that unpopulated area.
Could also be for functional or EMI reasons - the idea being to cut the ground plane everywhere except back under the traces that follow it - although I'd have to say, routing the thing out like that looks like a bit of overkill. Keeps recirculating currents from other parts from causing noise on a sensitive part.
Interesting guesses, more please. How about this? The missing part is a vibration detector tuned to the frequency that little "diving board" vibrates at. The cut out vibrates; the pedometer counts a step.

#8 User is offline   Cacheoholic 

  • Geocacher
  • Group: +Premium Members
  • Posts: 1277
  • Joined: 17-April 03

Posted 01 December 2010 - 04:44 PM

If the mounting area of the accelerometer was tuned to the natural resonate frequency of a foot step then you would get multiple (resonance) pulses out of the accelerometer with each foot step. This would be highly undesirable. In the vibration world we try hard to keep away from this condition because resonance exaggerates vibration. Most accelerometers have a fixed output of 100mv/g at a very wide frequency bandwidth. There would be no need to try to make it vibrate at a fixed frequency.

#9 User is offline   dfx 

  • CDJ Abuser
  • Group: +Premium Members
  • Posts: 8107
  • Joined: 06-April 07

Posted 01 December 2010 - 05:08 PM

View PostJohn E Cache, on Dec 1 2010, 01:14 PM, said:

Does removing the battery reset the owner id?

no it remembers all details of the programming without power.

#10 User is offline   savant9 

  • Cum hoc ergo propter hoc
  • Group: +Premium Members
  • Posts: 682
  • Joined: 23-February 03

Posted 02 December 2010 - 12:04 AM

Here are the pinouts from left to right for the top picture. Almost all pins go directly to the MCU.

1: -3v
2: unknown appears to go to RST through a small component, via comes through under MCU
3: MCU pin 10 (TA1)General-purpose digital I/O pin/Timer_A, compare: Out1 output
4: MCU pin 36 (TMS)Test mode select. TMS is used as an input port for device programming and test.
5: MCU pin 37 (TCK)Test clock. TCK is the clock input port for device programming and test.
6: MCU pin 35 (TDI/TCLK)Test data input or test clock input. The device protection fuse is connected to TDI/TCLK.
7: +3v
8: MCU pin 34 (TDO/TDI)Test data output port. TDO/TDI data output or programming data input terminal
9: MCU pin 14 (CAOUT/TA0/CA4)General-purpose digital I/O pin/Comparator_A output/Timer_A, capture: CCI0B
input/Comparator_A input
10: MCU pin 32 (TBOUTH/ACLK)General-purpose digital I/Opin/switch allPWMdigital outputs to high impedance -- Timer_B3:TB0
to TB2/ACLK output
11: MCU pin 38 (RST/NMI)Reset input, nonmaskable interrupt input port.

#11 User is offline   savant9 

  • Cum hoc ergo propter hoc
  • Group: +Premium Members
  • Posts: 682
  • Joined: 23-February 03

Posted 02 December 2010 - 12:06 AM

View Postecanderson, on Dec 1 2010, 10:55 AM, said:

To the OP. It would certainly be interesting to see what happens if that RST line is taken to ground during battery insertion ... wonder if it would still remember whose Garmin it belongs to?


This is something I do plan to try, but I want to do a few other tests prior to this.

#12 User is offline   savant9 

  • Cum hoc ergo propter hoc
  • Group: +Premium Members
  • Posts: 682
  • Joined: 23-February 03

Posted 02 December 2010 - 06:55 PM

Well, reset clears no data. It appears that pulling the RST pin low during data transfer just pauses the transfer, which then resumes quickly after going open on the RST.

Un-exciting video below.

Posted Image

#13 User is offline   ecanderson 

  • Premium Member - This Space for Rent
  • Group: +Premium Members
  • Posts: 3505
  • Joined: 13-January 08

Posted 02 December 2010 - 07:23 PM

View Postsavant9, on Dec 2 2010, 07:55 PM, said:

Well, reset clears no data.
Didn't figure it would, but it's good to know that you can't easily clear one of these things with a simple jumper. No doubt all of the important stuff in NVRAM can't be cleared without appropriate strings from the other end no matter what happens. That's good both from a "robustness" and security standpoint.

#14 User is offline   arcs 

  • Premium Member
  • Group: +Premium Members
  • Posts: 62
  • Joined: 16-May 03

Posted 02 December 2010 - 08:36 PM

So, in summation and just to be clear and all, all this ▄bergeek falderall jibberjabber convo means that it's, umm, "cool", right?
▄ I gots me one too. Might hang it on my xmas tree. :anitongue:

#15 User is offline   hukilaulau 

  • Premium Member
  • Group: +Premium Members
  • Posts: 1979
  • Joined: 15-December 04

Posted 02 December 2010 - 08:59 PM

Well, I have no idea what you're talking about, but I thought it was pretty cool anyway! :anitongue:

#16 User is offline   JJnTJ 

  • People here are friendly and content
  • Group: +Premium Members
  • Posts: 312
  • Joined: 18-August 10

Posted 03 December 2010 - 05:54 AM

Do you have any JTAG tools to talk to the Boundary Scan port?

#17 User is offline   ecanderson 

  • Premium Member - This Space for Rent
  • Group: +Premium Members
  • Posts: 3505
  • Joined: 13-January 08

Posted 03 December 2010 - 07:00 AM

View PostJJnTJ, on Dec 3 2010, 06:54 AM, said:

Do you have any JTAG tools to talk to the Boundary Scan port?
Assume you're talking to the OP. I've got JTAG tools, but have nothing in the way of an application for that manufacturer, much less that chip. Looks like it's time to do some searching to see who's distributing locally.

#18 User is offline   savant9 

  • Cum hoc ergo propter hoc
  • Group: +Premium Members
  • Posts: 682
  • Joined: 23-February 03

Posted 03 December 2010 - 10:39 AM

View Postecanderson, on Dec 3 2010, 07:00 AM, said:

View PostJJnTJ, on Dec 3 2010, 06:54 AM, said:

Do you have any JTAG tools to talk to the Boundary Scan port?
Assume you're talking to the OP. I've got JTAG tools, but have nothing in the way of an application for that manufacturer, much less that chip. Looks like it's time to do some searching to see who's distributing locally.


I do have various JTAG tools and apps. I have a Ti Launchpad which may or may not be able to work with the MCU. I just have to find it, or order another, as they are dirt cheap.

#19 User is offline   smstext 

  • King of the 5/5's
  • Group: +Premium Members
  • Posts: 722
  • Joined: 31-July 09

Posted 04 December 2010 - 04:51 AM

just an idea, but many years ago to knock the lock function off on a sony mars bar phone you covered all the pins with tin foil, this would reset the phone and it was ready to use again minus the lock. would covering all pins do the same on this?

#20 User is offline   Suscrofa 

  • Geocacher
  • Group: Members
  • Posts: 539
  • Joined: 14-February 06

Posted 04 December 2010 - 07:12 AM

View Postsmstext, on Dec 4 2010, 04:51 AM, said:

just an idea, but many years ago to knock the lock function off on a sony mars bar phone you covered all the pins with tin foil, this would reset the phone and it was ready to use again minus the lock. would covering all pins do the same on this?


And what about smashing it with a hammer ? :)

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic