Cheap Ebay BLE Tag Teardown (iTag via iTracing app)
Scored really cheap from ebay. Wonder whats inside, and if it can be reprogrammed at all?
Annotation
1:
BLE micro controller
There appears to be some unused pins on one side of this mcu. But datasheet is hard to come by. Does anyone know what chip this is?
- 1st Row Text: "ST17H25"
- 2st Row Text: "F412ET32"
- 3st Row Text: "CK1528"
- 4st Row Text: "CFAPOL 1P"
2:
- GND = Ground
- SWS = (connects to the pin near the dot of uC)
- Is this possibly a programming pin for the uC?
- PWM = This drives the BLUE LED
3:
Push Button (only one here)
4:
This allow for testing the buzzer.
polarity is marked. as BZ+ and BZ-
- BZ- = GND
- BZ+ = Buzzer signal
5:
MT-8530 peizo buzzer.
- Positive marking is confirmed to mark the pin that is connected to B+ (Vbatt)
This is no connected directly to the microcontroller like in simple musical greeting cards.
Instead it is most likely connected to
Silkscreen notes
U1
This is the microcontroller as mentioned above. I think it is called "ST17H25", but cannot find datasheet.
LC8266
I initially thought this is an LDO stepping the battery voltage from 3V (coin cell voltage) to something like 2V or 1.8V.
However on checking the device, it did not appear to function as one.
After further studying of the pcb, I think it is most likely a mosfet gate. Since it uses only one resistor to what is likely the gate of the mosfet (resistor connected to uC).
BLUE LED1
Well it usally blinks to be discovered. Is connected to the PWM testpad (which is connected to uC).
B+
Battery Positive
B-
Battery Negative. Also GND ground level.
P/N:15 37
A diode that is placed essentally electrically across the buzzer. Which is most likely to dissipate the built up energy of the buzzer, when the mosfet driver is suddenly switched off duing a buzzer PWM cycle.
12Mhz Crystal
The BLE microcontroller runs on 12Mhz
Well as a tag, it works alright. But as a hackable platform, it's not that great. Datasheet is unknown. Would be good to understand it's protocol thought.