iiinova — where your digital self keeps evolving

fwrret @firmware.blog · 12/10/2026

You wouldn't download a printer. EPSON XP-442 custom SoC(realoid) emulated in QEMU running it's proprietary RTOS.

110

fwrret @firmware.blog · 26/09/2026

Spanish art masterpiece

000

fwrret @firmware.blog · 11/08/2026

Lo que nunca me imagine es que llegaríamos al punto en donde SOLO te permitan imágenes de genIA. No BBVA, quiero poner una imagen chorra o una comm, no un AI slop generico.

Pantalla pa personalizar tu tarjeta de crédito en BBVA , en donde solo puedes generar imágenes con gen IA

000

fwrret @firmware.blog · 18/08/2025

Con la tontería llevo más de una semana archivando wplace de Tenerife y partes de canarias (También lo estoy expandiendo a otras partes de la península!). Que bonito que se ve! Cuando tenga tiempo, pongo los datos accesibles pa todos y un visualizador.

000

fwrret @firmware.blog · 03/07/2025

This is what I have done so far, I don't think there is nothing more interesting here as the rest of the magic happens on the other MCU and analyzing how all the data is passed is very painful. I'm very tempted to you know, replace some boot and assets images, but this thing cost +400€.

010

fwrret @firmware.blog · 03/07/2025

Why we should use tasks if we have a counters and switch cases? Really, see this shit. The different cases do different subtasks. What I have identified so far is one for the TPMS stuff, another for updating all the global attrs, one for the LCD and another for comm with the other MCU.

200

fwrret @firmware.blog · 03/07/2025

There are a lot of task running normally, most of them are from the different sdks and libs. Where all "the magic" happens is in the Mainboard task.

100

fwrret @firmware.blog · 03/07/2025

The software stack is an FreeRTOS plus + awtk (GUI) + FSC-Blueware (BT) + EC-SDK (screen mirror). The "architecture" is basically the awtk GUI obtains the all the information that it needs from a list of "global attributes" or communicating directly to the BT and EC sdk.

100

fwrret @firmware.blog · 03/07/2025

And of course for the BT and WIFI it uses the Feasycomm FSC-BW121 (it uses the RTL8821CS). Fun fact, I was unable to find the fcc id and the MAC address of both BTs (le and normal) and Wi-Fi are fake/not registered! (34:FA:4A C0:FA:4A 34:C6:4A).

100

fwrret @firmware.blog · 03/07/2025

So the main MCU is the Amt630hV100. There is little to nothing online about it. I found something on CSDN, but I was not able to download it. Besides the LCD, it seems that to this mcu is connected an MMC mem for the fw, an CMT2300A (for TPMS?) and another mcu that communicates to the rest of the 🏍️

110

fwrret @firmware.blog · 03/07/2025

The image is 8mb long and contains the application code, the boot animation (BANI) and the "ROMA" which are the resources files. There is not a fancy FS like littleFS, there is basically a superblock the contains the file path, address and length. Boot anim are concatenated jpg images.

110

fwrret @firmware.blog · 03/07/2025

My motorbike (Zontes GK350) has an instrument panel that can do a bunch of things, including screen mirroring through an app (Carbit ride). How did they make it?

120

fwrret @firmware.blog · 25/06/2025

Dumped the ROM, SRAM, "flash" and OTP. I used rdreg_phy6202.py modifying the reset method to use the one in flash_st17h66.py. Now it's time for Ghidra.

000

fwrret @firmware.blog · 24/06/2025

Finally, I had some time to plug into the UART, and got something!. It seems to use this SDK github.com/17HXX/ST17H6.... I was also able to put it into the RESET mode. The official tools it is the PhyPlusKit, which was documented and there are some dumping tools here github.com/pvvx/PHY62x2....

100

fwrret @firmware.blog · 17/05/2025

Here are pics of another tags, in this case for Google find my device. Same MCU.

100

fwrret @firmware.blog · 10/05/2025

Here are some internal pics of the PCB of the cheap AliExpress Apple tag "Sualio tag" (FindMy-001)

110

fwrret @firmware.blog · 08/02/2025

Aaaa just arrived today, looks soooo cool.

020

fwrret @firmware.blog · 30/01/2025

La traducción suena fatal

Actualización de tracking en el bot de Telegram mi tracking : ": En camino Un proveedor externo de confianza está en camino con su paquete"

000

fwrret @firmware.blog · 14/01/2025

Realmente cuando vi comentado este cambio por primera vez, no me lo creía , pero es que hay jollas aún peores en sus políticas para no deshumanizar. Excepciones principales, colectivo LGTB y género.

000

fwrret @firmware.blog · 08/01/2025

Solstol dumping in progress

100

fwrret @firmware.blog · 26/12/2024

Para todos lo que uséis la tablet en la cama, necesitáis esto

000

fwrret @firmware.blog · 23/12/2024

Y está diferencia tan grande?

000

fwrret @firmware.blog · 22/12/2024

Mini Line is pretty fun #HTB

Hackthebox webpage screenshots that read "Mini Line has been Pwned!"

000

fwrret @firmware.blog · 13/12/2024

Getting back into the rhythm #HTB

Screenshot of HackTheBox webpage that reads "Out of Time has been Pwned!
Congratulations endes, best of luck in capturing flags ahead!"

010

fwrret @firmware.blog · 07/12/2024

That's some Christmas Spirit

000

fwrret @firmware.blog · 04/12/2024

I read Mcfurry 😭. Now I can't stop thinking how the McDonald's fursona would be like.

Notification that reads "Mcflurry por tan poco"

000

fwrret @firmware.blog · 26/11/2024

Después de una odisea, ya lo tengo. Parece ser que las tienda están revendiendo los devueltos o la gente los está abriendo y quitándole el filtro con el que viene 😭 y tuve que devolver el primero que compré.

Garrafa de filtrado de agua Philips instant water

000

fwrret @firmware.blog · 23/11/2024

I don't know why but this bug made me chuckle #bluesky

000

fwrret @firmware.blog · 23/11/2024

Vieron esto y decidieron inventar el turno de 8 a 5 😭

Atardecer en el horizonte, reflejándose el rojo en el oceano

010

fwrret @firmware.blog · 21/11/2024

I made a simple control screen, but I dunno, I'm not really an UI guy.

000

fwrret @firmware.blog · 19/11/2024

I accidentally let the magic smoke get out of the control board while doing some "tinkering". I quicky hack a way to send the messages to make it move. No speed control (random.randind), no emergency stop. Do you all think this is OSHA compliant?

000

fwrret @firmware.blog · 14/11/2024