Skip to content

Instantly share code, notes, and snippets.

#include <stdio.h>
#include <stdint.h>
// Philips Sonicare NFC Head Password calculation by @atc1441 Video manual: https://www.youtube.com/watch?v=EPytrn8i8sc
uint16_t CRC16(uint16_t crc, uint8_t *buffer, int len) // Default CRC16 Algo
{
while(len--)
{
crc ^= *buffer++ << 8;
int bits = 0;
do
This data can be found after activation on the MCUs flash, it contains the DID, Token and BindKey, also the Mac can be found in flash:
00 00 <-ID
1C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <-Length and data
01 00
14 00 62 6C 74 2E 34 2E 31 34 30 68 66 71 6A 38 73 67 6B 30 30 <- Device ID
10 00
1C D7 74 84 57 B3 00 61 19 A4 49 EC 44 95 81 56 FF 4A 16 3E 88 C5 2C FA 2E 2A 9C D9 C3 <- The shared KEY?
<--- Token -----------------------> <------------- Bind Key---------------------->
Key:
00 00 <-ID
1C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <-Length and data
01 00
14 00 62 6C 74 2E 34 2E 31 34 30 68 31 6B 65 37 67 67 63 30 30
10 00
1C 95 41 F9 2F D7 79 7C 1C CF CB F1 1C DA BF 6F 38 CC 40 3F 49 CD 0B 98 0D C6 AA 47 85
04 00
@atc1441
atc1441 / Telink OTA Ble Protocol.js
Last active July 5, 2024 14:14
Telink OTA Ble Protocol
import java.lang.Math;
public class HelloWorld
{
public static void main(String[] args)
{
ParserData parserData1 = parser(new int[]{ 0x52,0x5D,0xD7,0x9F,0x00,0x31 },false);
System.out.print("Flag:");
System.out.print(parserData1.flag);
System.out.print("\r\nSeconds in unix -40 Years: ");
INITCMDS = [
[0xFE],
[0xEF],
[0xEB,0x14],
[0x84,0x40],
[0x85,0xF1],
[0x86,0x98],
[0x87,0x28],
[0x88,0xA],
[0x8A,0],
void oledInit() {
nrf_gpio_cfg_output(23);
digitalWrite(23 , 0);
setGPIOforOLEDasOutput();
digitalWrite(oledSCK , LOW);
digitalWrite(oledRST, HIGH);
delay(20);
digitalWrite(oledRST, LOW);
delay(100);
digitalWrite(oledRST, HIGH);
void init_display()
{
unsigned __int8 temp_buffer[20]; // [sp+0h] [bp-38h]@1
mem_clear(temp_buffer, 20u);
temp_buffer[0] = -2;
write_Command_Display((int)temp_buffer, 1u);
temp_buffer[0] = -17;
write_Command_Display((int)temp_buffer, 1u);
temp_buffer[0] = -21;
List with Compatible devices:
Look under About on the watch for the device Id.
looks something like this:
MOY-TEH5-1.7.7
the middle section is the interesting part, if that is in this list here
it has the compatible bootloader and the same pinout as pinetime for Display and External Flash
const uint8_t bma421_config_file[] = {
0x80, 0x2E, 0xFE, 0x00, 0x80, 0x2E, 0xF1, 0x01, 0xC8, 0x2E, 0x00, 0x2E,
0x80, 0x2E, 0xFC, 0x00, 0x80, 0x2E, 0xFB, 0x00, 0x80, 0x2E, 0xFF, 0x00,
0x80, 0x2E, 0xFD, 0x00, 0x80, 0x2E, 0x42, 0xB0, 0x50, 0x39, 0x21, 0x2E,
0xB0, 0xF0, 0x10, 0x30, 0x21, 0x2E, 0x16, 0xF0, 0x80, 0x2E, 0xF2, 0x01,
0x5D, 0x50, 0x5B, 0x52, 0x01, 0x42, 0x3B, 0x80, 0x41, 0x30, 0x01, 0x42,
0x3C, 0x80, 0x00, 0x2E, 0x01, 0x40, 0x01, 0x42, 0x21, 0x2E, 0xFF, 0xAF,
0xB8, 0x2E, 0x03, 0xB7, 0x80, 0x2E, 0x18, 0x00, 0x80, 0x2E, 0x18, 0x00,
0x80, 0x2E, 0x18, 0x00, 0x80, 0x2E, 0x18, 0x00, 0x80, 0x2E, 0x18, 0x00,
0x80, 0x2E, 0x18, 0x00, 0x80, 0x2E, 0x18, 0x00, 0x80, 0x2E, 0x18, 0x00,