Espruino on your watch!

I believe it's the actual company, but I'm not 100% sure. It'd be a full firmware hopefully - so Espruino plus a bootloader with the same key I use for Espruino, so effectively it'd be open to anyone even if you just wanted to use C/C++ (although developing via repeated DFU update would be super painful).

How price competitive this could be to typical ebay/aliexpress prices?

I don't know yet until I hear back from them... Hopefully it wouldn't be that far off if I can put in a ~1000 pcs order - maybe 30% more?

We'll see about the quantities. I think it really depends on the seller - I contacted one when I first made this thread and they weren't interested at all, and a year or so ago I contacted 001phone, but they would only consider custom firmwares for 20k units (shame really as they did a crazy one with everything including GPS inside it).

I had been in talks with someone who had found a watch manufacturer that was happy to do it (as well as providing the actual schematics), but then he told me he wanted me to do all the porting, put up the money, and then pay him per watch sold - so that one kind of faded out and I decided it was a bit underhand to go direct to the manufacturer.

The watch with esprunio on it has me interested.

Oh yes! I've been waiting a long time for this moment ;)

Well technically you could just get $9.99 DS-D6 already for few months to have it ;-)
But color one is better for most people I guess.

However with extra 2 gpios availabe on usb pins DS-D6 is also good as a sort of sensor with battery. I am thinking about using one as a RTC, shutdown controller and small status display for raspberry pi (over serial). DS-D6 is simply a good and cheap Espruino nrf52 board with battery and small oled. BTW it lasts 16 days with bluetooth turned on with setWatch on touch button and serial RX pin.

Anyway @Gordon to fill 1000pcs order it needs more than just ask here. Is kickstarter too 'heavy' for this? Or can Patreon somehow work similar to Kickstarter to get money for the order? or just counting likes on twitter on "who wants it' post may do it?

BTW did you think how to solve 'support issue' when such Espruino Watch hangs for someone without any reset button available and without removable battery like Puck has (possible to reset puck)? I guess the only way is to instruct such person to let the battery die (can take weeks with good power saving) and check touch button in bootloader to offer clearing memory when it is attached to charger and it powers on from dead battery.

Hmm, when thinking about it, perhaps with I6 HR C such recovery menu could pop up always when e.g. attaching to charger while both touch areas are held or something like this. If such hook was directy in espruino C code it could prevent bugs in javascript code.

Oh yes, I'd probably end up doing something like a KickStarter - I just wanted to get a super-rough idea if anyone was interested.

Having the 2 pins on the DS-D6 USB is really nice, but I imagine for most people having more than one capacitive sense area is probably be quite high up their list.

I was thinking about the reset issue, and adding something to look at the button in the interpreter was the plan (just a really long press) - but checking if charging as well (and also charge + 2 buttons as you say) is a great idea, and with a watchdog timer I could hopefully make it reasonably robust.

edit: there's also the accelerometer that could be checked as well.

It looks like IWOWN are happy to do custom firmwares for 1000 devices, but at pretty much the same price they sell one device for - so I won't be able to do them near AliExpress prices once import duties/shipping/etc come into play.

Either way they should be pretty affordable though.

for most people having more than one capacitive sense area is probably be quite high up their list.

Yes, easily scrolling up and down is cool and gives more way to interact. BTW did you know KX023 accelerometer has specific mode for directional tap and double tap detection? When enabled it triggers interrupt and you just read from register if it was tap or double tap and from which direction. I tested it on DS-D6 and it works relatively good, I can hit the watch from sides or top when on hand and it can work as buttons too. When not on hand all 6 sides are detected of course. However it could also trigger when just wearing the watch and e.g. hit the desk with hand so it could be used only in controlled cases e.g. in some submenu when you already touched main button but still it is good.

Anyway, great with IWOWN, I6 HR C is very nice. If this succeeds maybe it could work also with their other/future models possibly having GPS. Or perhaps they could consider gpios attached to usb pins in future if you ask them as Desay does with all their models (I wonder if it helps them to flash firmware easier or why they care? I've seen it on all their models on FCC photos).

just FYI the DS-D6 is now down to $6.99 on gearbest this is all time lowest so far (and btw for some reason the postage is lower when getting more than one)

Looks like original Desay bootloader does not handle DFU package with softdevice and bootloader combined correctly. Funny thing but it does overwrite itself correctly with new bootloader but for some reason it does not update softdevice 3.0 or 3.1 correctly. It almost does, all data between addresses 0 - 0x1f000 is almost fine except one part between 0xE000-0xE7FF where after DFU update is just 0xFF. Which is pretty strange because it does handle softdevice update 2.0.0->2.0.1 where same locations are updated correctly.

I found this is known Nordic bug described here with exactly same symptoms.

Knowing that, I managed to patch Desay bootloader binary and fix the bug. Then I managed to update DS-D6 to Espruino SDK12 based bootloader+SoftDevice 3.0 and then I could successfully upload current SDK12 based Espruino build which seems to work just fine! I can also reboot back to bootloader when holding watch button while doing reset and I also have signed package for restoring SDK11 based Desay bootloader and older soft device. So now I am back to SDK11 based espruino build with all those updates and downgrades done via DFU without needing to open the watch and use SWD :-)

Also another news is that thanks to getting some help with obtaining Desay firmware update packages for various devices it looks like all of them seem to be based on SDK11 (the app binary starts at 0x1c000 => uses 2.0.x SoftDevice) :-) So there is %99 chance that e.g. Lenovo HX03F or HXo3W (on gearbest here and here) are both SDK11 based so can be flashed over serial just like DS-D6 or DS-D9. I couldn't resist and ordered HX03W to see (it was $16.99 few days ago).

Nice! So you still have to open the watch to get Espruino on it - but once that is done you can DFU back?

Is there a chance that some of these watches either use the bootoader in debug mode (so it doesn't check the key) or use the OEM Nordic private key?

It looks like I may have somebody who is interested in ordering a bunch of Espruino watches so I'm looking into this a bit more - but it'd likely be a watch rather than a band as you get better displays and a bigger battery. If there was a way to get these flashed without having to do a custom order it'd be awesome.

No need to open the watch. The fixed bootloader can be updated over DFU too. The bug is only in updating SoftDevice. So going from new watch to SDK12 based espruino is just three DFU packages.

• fixed bootloader
  
• SoftDevice 3.0 + espruino bootloader
  
• espruino app
  
  

I hope I can do the same with HX03W once it comes.

I don't know about device having debug keys used. Currently I have this GT-101 tracker
https://fccid.io/2APKW-GT101 which does use signed updates and with espruino signed update DFU returns invalid object error. I will try debug keys.

EDIT:
So I guess it ends on this line https://github.com/espruino/Espruino/blob/master/targets/nrf5x_dfu/dfu_req_handling.c#L284
and according to that code even in debug mode it does check the signature. It only skips version checks. This line ends version checks and validation below is always called.

BTW any progress with IWOWN, I6 HR C? Do you still see this as being possible?

Well, IWOWN would supply with custom firmware, and I've got the I6 HR C, taken it to bits and put some wires on SWD - however no luck getting it communicating yet and I ran out of time. I think most likely I need to take the reset wire out as well so I can properly erase the UICR stuff.

Having said that, I'm waiting to hear back from them about whether they have other nRF52 watches (rather than bands). They have some exciting looking GPS watches and IMO those would probably be more exciting to most Espruino users - there's loads of stuff you could do with a tiny programmable GPS-enabled watch.

The guy who did the I6 HR C video linked above has arduino C code running including display and accelerometer. His pinout is here https://1.bp.blogspot.com/-u2liAXOgxNM/XLC19ECtZ5I/AAAAAAAAOQY/OqhCkViYJyYR4VAhA8IRPftWaUBSqPMogCLcBGAs/s1600/Pinout%2BI6HRC%2B12.04.2019.png and arduino code is attached here https://www.mikrocontroller.net/topic/467136#5714773

He is also the guy who can figure out lot of links to firmware downloads from the android apps so we are currently in the process of going through DFU zips for devices supported by VeryFit apps and WearFit apps. Some are interesting, most new ones has signed firmware. All of them Nordic chips. BTW some already have 52840 chip e.g. the ID205 (possibly this one?). Of course it uses latest SDKs to support that CPU so the DFU is signed. Some of older ones are based on 51442 which seems like odd choice as they are used with BLE SoftDevices, not ANT.

I'll send update if something useful comes out of this. Veryfit are those various IDxxx devices, WearFit app devices are often sold as Wearpai (e.g. the GT-101 FCC ID manual has Wearpai there) but there are many other sellers rebranding this on aliexpress like e.g. Letike.

Wow, that's very cool. I had been looking for nRF52840 watched but without much success. It seems to have 4 pins on the back which is a very good sign for USB compatibility as well.

Yes, I'd be really interested if you find anything out about those ones - ID205 especially looks like a really good fit if it has a proper touchscreen too.

The ID205 is also listed here https://idoosmart.manufacturer.globalsources.com/si/6008849563328/pdtl/Smart-watch/1165759500/smart-watch.htm which I suppose is the page of the "Shenzhen DO Intelligent Technology Co. Ltd" manufacturer. The page mentions "Very Fit Pro" app and "Main CPU: Nordic nRF52842". If you are interested in direct veryfit app hosted firmware download link let me know. It is signed firmware, the .bin file inside is ~700K and initial stack pointer points to 0x2003F3F8 so SRAM is 256KB, interrupt vectors point to 0x26xxx so 0x26000 is app start which implies soft device version. Also "nrfutil pkg display" shows info like:

  |- Type: application
   |- Image file: ID205.bin
   |- Init packet file: ID205.dat
      |- signature_type: ECDSA_P256_SHA256
      |- hw_version 0x000000E2 (226)
      |- sd_req: 0xA9
      |- hash_type: SHA256

However I did not find this model here https://fccid.io/2AHFT which otherwise has most of their devices.

This was one of the first firmware files so I hoped there could be more nRF52840 ones but this was the only one after all. However good news is that their older nrf52 models are based on SDK11 so the firmware is not signed, here are model names (from FW metadata)

• ID130Plus Color HR - possibly https://fccid.io/2AHFT616/Users-Manual/Users-Manual-4126121
  
• ID132Color (bt name SAT 1500 B1)- https://idoosmart.manufacturer.globalsources.com/si/6008849563328/pdtl/Smart-bracelet/1162975468/Smart-bracelets.htm
  
• ID153
  
• ID151
  
• ID128_Color_HM - possibly https://fccid.io/2AHFT624/Users-Manual/Users-Manual-3965560
  
  

I also went throught WearFit app links but all nrf52 ones are signed (M2S,M6,eTimerFit,AISIRER-8C_HannStar) however there are lot of nrf51 based, all of them using the 32K SRAM variants so they are moderately usable too (K1,B15S,C1,CK11,E26,M8,OSSINE X7, P2 HR,SWB200,T-FLY,YKY_SH,Tempo,Z18).

Nice - thanks!

Interestingly Shenzhen DO Intelligent Technology were the maker of that first watch (right at the start of this thread) that I ran Espruino on - unfortunately they were completely not interested in doing custom firmwares.

However, with those older devices on SDK11 and unsigned then as you say it'd be possible to just update the firmwares wirelessly without even opening them.

Yes at most one needs to open just one but all other can be updated wirelessly. With a bit of luck even the first one will work as I tried with DS-D9 and generic espruino build. It comes up and can be connected over bluetooth and the rest of HW could be figured out by trial and error from espruino and/or reverse engineering the firmware.

I have another batch of SDK11 nrf52 based trackers, these are too from VeryFit Pro app but there was no sensible metadata so the strings are from firmware binary

• Polyfit HR Pro
  
• ID 107 Plus Color HR
  
• ID131 Color HR
  
• ID133 Color HR
  
• ID130 Plus Color HR
  
• S4000
  
• ACT304
  
• ID115 HR (this one is nrf51, 32K)
  
• ACT101 (nrf51, 16K, look like ID115)
  
  

The S4000 is interesting as it has GPS however I cannot find any info about it. These are bluetooth names so the product may have different name. Some interesting strings from S4000 binary : sony\gps_cxd56xx_agps.c, oled, spi_flash,PPG_sensor\si117x\si117x_ic.c

There is another nRF52840 watch. I was going through 60 FW links from H Band android app (credit goes again to the same guy) and most is nrf51, some is nrf52 - all nrf52 are SDK12, signed and one has stack pointer 0x20037404 so looks like 256KB SRAM. nrfutil says it is hw version 52 however the soft device is recent with app start at 0x26000 (same as ID205 above, sdk12 SoftDevice 3.0 has 0x1f000). The string found in firmware that may be device name is V12 which may be this
https://wosmart.en.alibaba.com/product/60829664160-807772971/FITUP_smart_watch_bracelet_V12_sport_fitness_tracker_nRF52840_smart_bracelet.html and possibly also https://www.cavosmart.com/products/fitness-tracker-v12/
Again the firmware is signed so this is just if one wants to take it apart.

EDIT: this one is a bit risky to get for the 52840 chip, there are two same/similar devices V12 and V12C. The V12C one has older nrf52 chip. If you check this page in chinese and translate to english http://www.wo-smart.com/p-333.html then it is very confusing what is the difference and which one is better/newer but they do mention different chips. I also found V12C FW binary and this one is indeed SDK12 based with <64K SRAM stack pointer.

Wow, the atc1441 guy did it again. He published playstore app https://play.google.com/store/apps/details?id=com.atcnetz.ble.readwrite to update DS-D6 over bluetooth easily. So if you were hesitating to get TTL serial working now you have one less excuse to get this $7.99 watch to run Espruino ;-)

It can even detect Espruino and reboot it to bootloader automatically so you can easily update to newer Espruino version.

This should also work with other devices manufactured by Desay. I will verify it with DS-D9 I have and also with HX03W once it finally arrives.

Wow, that's really cool.

Weren't you saying on the older firmwares you could just update via Bluetooth using the Nordic utils once you had a working bootloader? So has he basically packaged a DFU updater (for old and new DFU) with the correct bootloaders? Or is there more to it?

This is bluetooth DFU for original Desay bootloader - it does not use standard Nordic BLE DFU guids so cannot be updated via nrf connect Android app. Until now the procedure of updating new device was using nordic tools over TTL serial. So this is targeted to SDK11 based development with original bootloader for people who don't have usb to TTL serial adapter. Not just for Espruino built with SDK11 but also for Arduino code.

Once updated to espruino SDK12 bootloader (which now works still only via TTL serial, this tool does not handle uploading bootloader or soft device yet) this D6 flasher is no longer useful as you can use nordic nrf connect since the DFU over BLE is standard nordic one (and signed, not old legacy format).

That's really neat - so you literally just power on the watch, run this app with the firmware, and you're sorted? That's the kind of thing that could easily be automated to update off-the-shelf watches.

Stuff is still going on my side, although I'm finding it extremely difficult to get any interest from watch manufacturers. I've switched to using a sourcing company (so someone that speaks Chinese) to try and reach out to some manufacturers so hopefully I'll have some success soon.

Because I might have someone up front that's willing to buy a bunch if they're more watches than bands I'm looking more on the watch front, but there's some really nice stuff out there. Hopefully I can go with something that's got the nRF52840 and a full touchscreen, which should make for a really interesting device.

That's really neat - so you literally just power on the watch, run this app with the firmware, and you're sorted? That's the kind of thing that could easily be automated to update off-the-shelf watches.

Yes, but only for those made by DESAY INFOR TECHNOLOGY CO.,LTD. https://fccid.io/2AEMN https://www.globalsources.com/si/AS/Desay-Infor/6008849906089/Homepage.htm

So if you e.g. could source this one https://www.globalsources.com/si/AS/Desay-Infor/6008849906089/pdtl/smart-bracelet/1167004880.htm or this one https://www.globalsources.com/si/AS/Desay-Infor/6008849906089/pdtl/Heart-rate-Smart-Bracelet/1167004822.htm it would most probably work (we do have links for DFU zips for most models including this D15F or Z10F one)

EDIT:
And BTW same thing can be done for devices manufactured by "Shenzhen DO Intelligent Technology Co. Ltd" as they also use SDK11 for their ID1xx models (except that ID205 nRF52840 model) so you don't need for them to do custom firmware, you just need to meet minimum order which may be an issue too.

However if you aim for nRF52840 then SDK11 is out of question, looks like they stick with old proven SDK11 they initially started with when going for nrf52, but they cannot do this with nRF52840 .

And others possibly started with nrf52 a bit later so they stick to SDK12 (and signed firmware :-( )

If you want something more watch like they have this one https://www.globalsources.com/si/AS/Desay-Infor/6008849906089/pdtl/smart-watch/1167004841.htm but we don't have firmware for this one so cannot say if is it same SDK11 as others.