M17-Project / AtomXL-reverse-engineering

Unihertz Atom XL reverse engineering

Android

• root via https://topjohnwu.github.io/Magisk/install.html
• Intercom app needs native service to talk to hardware
  • see https://github.com/ad1217/M17_Intercom for an example app that uses the native service

Hardware

Block diagram

generated with plantuml

Internal Photos

• Atom XL [Source]
• Atom L, showing unpopulated pads [Source]
  • the Atom L seems to be the exact same hardware, other than the RF components

Microcontroller

• See command-format.md for the commands sent to the MCU.

is an STM32F411CEU6, from FCC ID photos

• product page
• datasheet
• reference manual

Flashing via dfu-util

• android service calls /vendor/bin/auto_update shell script
• ...which uses /system/bin/extcmdtest to put it into DFU mode

uses STM32Cube HAL, 1.5.0 <= version <= 1.14.0

• 1.2.0 adds STM32F411
• 1.5.0 adds HAL_I2S_DMAPause and Resume, which exist in firmware
• 1.15.0 changes HAL_I2S_Init to not match disassembly

CODEC chip is Everest Semiconductor ES8316:

• official datasheet [Source]
• datasheet with registers [Source]

RF Module (DMR-006)

• Product Page (lacking any useful information)
• See command-format.md for the commands sent to the DMR module, via the MCU
• inconveniently filters recieved audio (and maybe transmitted, untested)

IC in RF Module (seems to be an HR-C7000)

• uses a C-SKY CK803S
  • C-SKY Ghidra module
  • C-SKY Architecture user guide

Flash IC

• made by GigaDevice
• maybe a GD25LQ05C ?