Disassembling the Spectacles is somewhat tedious but possible to do mostly cleanly if care is taken. You'll need a heatgun to soften the glue that holds the covers on either side. After taking off the temples of the glasses by removing the screws holding them on just slowly and carefully pry at the covers after heating them gently (I used ~120 C air).
The right side contains the camera, microphone, radio SoC, antennae, video processor, flash memory, and a heatsinking frame. The left side contains the battery, button, LED ring, and light sensor.
Layers of the stack are variously held together with board-to-board mezzanine connectors, heatsinking compound, and weak adhesive. The radio board comes first.
It uses an nRF51822 from Nordic Semiconductor, which is able to do Bluetooth Low Energy and other 2.4GHz protocols. It also contains an ARM Cortex M0 processor. Its connected by a flex cable to a mystery IC (would love info on this part if you have it - maybe it handles WiFi?).
On the other side of a mezzanine connector is the main processor, which is an Ambarella A12W Wearable Camera SoC. Besides video processing hardware there is an ARM Cortex A9 onboard, which can run up to 500 MHz. On the other side of the board is the system memory - 16 GB of Kingston flash:
Here's a straight-on view of the camera (the mic can be seen hanging off the side):
That about wraps up the electronics on the right side. The left side contains the battery, model SC01 with a nominal voltage of 3.8V and capacity of 137mAh.
Attached to the battery by a short cable is what I assume is a power management board.
The middle IC below the connector says "FW 6JAA" and the smaller one below says "47CT9". The IC to the upper right is an STMicroelectronics part labelled "022 449".
On the other side of the battery is the button board.
At the front is the LED ring board.
The rectangular IC may say "BA0 633 631". The square IC is labelled "6572 5523". On the other side are the 15 LEDs and light sensor.
Light sensors are always neat to look at up close.
And that's pretty much everything! The two sets of electronics are connected through the top of the frame by a flat cable that is embedded into the plastic. I couldn't find a clean way to get access to it. Maybe it was molded into the plastic? Would love to hear about how that might have been done from someone who is familiar with the manufacturing technique.
To sever the connection with Snapchat I see two possibilities:
- A merely very challenging reverse-engineering of either the BTLE or WiFi protocols used to ask the glasses for the videos it has stored.
- An extremely difficult hardware hack that repurposes the onboard electronics. Maybe the functionality would be most easily tapped by targeting the nRF51822? Unlikely to work regardless.
Discussions
Become a Hackaday.io Member
Create an account to leave a comment. Already have an account? Log In.