Close

Firmware SDK and toolchain, first success!

A project log for The world's clunkiest key finder

Hack the Parkside smart battery firmware to join the Find My network

biemsterbiemster 09/21/2024 at 17:460 Comments

In the description I already mentioned that this project might be quite straightforward. Since those are usually famous last words I was prepared for defeat, but no!

Connecting a programmer to the chip worked already on the second attempt, with the help of a script by @pvvx: https://github.com/pvvx/TlsrComSwireWriter

I had the pleasure of receiving his help on the FindMy implementation on the Lenze st17h66, and this work on the telink 8250 in the BL7T did not disappoint either. With only 3 wires connected via an USB UART I can read and write the firmware in a pinch.

Second, the SDK. These are usually not easy to find, and if one is found require extensive modifications to get even a basic blinky out of it. But also here we are in luck: https://github.com/Ai-Thinker-Open/Telink_825X_SDK

This SDK has instructions on installing the toolchain (tc32) in Chinese, but it's basically just extracting a tarball to /opt and then you're good to go. The example/8258_feature_test is configured to test the power consumption of an advertisement, which is already very close of what I want to do. A simple "make" in that directory will produce a flashable bin in the "out" directory. That's all there is to it!

The following command will flash this firmware to the BT7L:

python TLSR825xComFlasher.py -p /dev/ttyUSB0 -t 1200 -r wf 0 ../Telink_825X_SDK/example/8258_feature_test/out/8258_feature.bin

I had to set the activation time larger than the default 600 ms,  but other than that it runs straight out of the box.

So with all the technical chores out of the way, now it's time to implement the FindMy advertisement. This is definitely off to a good start!

EDIT: Victor's repo for the Xiaomi BLE thermometer is a goldmine for info and code for the 825x: https://github.com/pvvx/ATC_MiThermometer

Discussions