Close

Glorious progress... and EPIC FAIL

A project log for Reverse-engineering JBL flip 4

That is, full teardown, analysis, and hacking.

deepsoicDeepSOIC 11/17/2018 at 00:000 Comments

Initially, I was trying to connect to the chip via SPI, using FT232RL, as described here:

https://github.com/lorf/csr-spi-ftdi

And I couldn't. it just kept saying "no chip".

USB connection was great, but there was a problem: if I change something that would make the firmware crash on startup, I wouldn't be able to recover it, as entering DFU mode requires a button combination to work. So I didn't want to dive into hacking the settings too much.

Connecting via SPI would solve that problem. So I kept pushing. I whipped out a scope, and quickly figured out that the pinout explained in the readme wasn't right. Eventually I reverse-engineered the correct pinout. And filed an issue to the tracker:

https://github.com/lorf/csr-spi-ftdi/issues/39

But now I have a working SPI connection, that doesn't require magic button combination. It just works.

And I dived in.

I started exploring, if the config of the chip changes while it's playing music. Yes, it does, a little bit.

And I connected the keyboard to switch the DSP off. Then started poking at keys, DSP didn't want to switch off, then it suddenly just powered down (and made its typical power-off sound). And that was the end of it.

Now, it won't power on anymore. The chip supply turns on for a split second when I press power button, and that's it.

I tried bypassing the mosfet to force the power to the chip. Unfortunately, it still doesn't boot, and worst of all, PSTool fails to communicate with the chip. It says "no chip". 

I have a bad feeling, that the firmware might have detected hacking, and decided to nuke itself, together with the chip itself. Or maybe I just blew it, as the connector for the keyboard was slightly damaged.

Anyway, RIP CSR8675. You are a horribly obscure masterpiece of super-proprietary engineering, I won't miss you.

Discussions