Bluetooth/touchscreen vapes (e.g. Feed Sync)

[ginbot86]

I just got a sample of a Feed Sync disposable vape with Bluetooth and touchscreen functionality.

I have disassembled the vape and found that it is based on a JL7012F6 SoC with 16M of SPI Flash and a CST816D touchscreen controller. The IPS LCD is labeled FPC-205BJ07004-V2, but I couldn't find any documentation on the display or figure out its resolution yet. It does seem to be designed for a smartwatch, with rounded corners.

The JL7012 is a proprietary dual-core 32-bit MCU clocked up to 160MHz and 640k of RAM. It even includes a hardware FPU, image decoder and 2D GPU!

[ginbot86]

There's USB test points on the board that are not exposed on the USB-C port itself. These could be worth investigating to see what enumerates on a computer.

[ginbot86]

2409302301_JieLi-Tech-JL7012F6_C7434396.pdf

Documentation is limited and I can't find an SDK for the JL7012 yet. There is some speculation that the JL7012 is the AC7012 (part of the AC701 series) and some firmware/other tools are available for it. This has not yet been verified by myself.

I dumped the SPI Flash and there are no discernable strings in what I suspect is firmware/watchface storage. One security concern I have is that previous notifications, location information, and caller ID/incoming phone numbers are retained in Flash even if the list is "cleared" by the user! All of these regions are near the end of the memory space with some kind of binary formatting that I have not deciphered yet. This also means I am hesitant to upload said SPI Flash dump due to the presence of potentially sensitive data from the previous user as well as from my own attempts to navigate the device's features.

[ginbot86]

Testing the USB test points doesn't yield any results. Nothing enumerates on my computer.

[ginbot86]

Attempts to intercept the LCD communication lines resulted in me breaking the device. However, I think I have tracked down the LCD's connector/pinout and controller.

This is a listing on Alibaba, citing a 240x284 LCD, 15-pin FPC and the GC9307 controller: https://www.alibaba.com/product-detail/Small-size-1-83-inch-240x284_1601068305425.html

Another one has the same connector but uses an NV3030B controller (albeit with no published pinout): https://www.alibaba.com/product-detail/Nv3030B-15Pin-Socket-Fpc-240X284-Ips_1600619889969.html

p1190049-NV3030B_datasheet_V0.6_20220118.pdf
GC9307.pdf

[ginbot86]

I found a more plausible lead with better matching physical dimensions, and a defined pin 14 (TE/Tearing Effect) for frame synchronization:

https://www.buydisplay.com/2-inch-240x296-ips-tft-lcd-display-spi-interface

No leads on the capacitive touch panel yet, unfortunately.

[NoNamedCat]

Are there any Software Development Kits (SDKs) or something similar available for this particular microchip?
Where can i find the SDK for the AC7012 ?

[ginbot86]

No such luck finding it yet. JieLi's own docs site doesn't even acknowledge the existence of the JL7012, and the jielie open-sourced repository doesn't mention it either.

I have a suspicion the SPI Flash's main contents are encrypted/scrambled but haven't tried tools to decrypt it yet.

[ginbot86]

It's really unfortunate that it's so hard to develop software for this thing. The JL7012 is a mighty powerful processor (on paper at least) and it's a shame that (at least for the Western world) we don't have access to the tools to repurpose it.

[ginbot86]

I have successfully gotten the LCD portion of the Feed Sync display functioning on an ESP32-C3 development board and a modified ST7789 library from Adafruit. I think it is indeed using the GC9307 controller, which is mostly compatible; there are some addressing control (MADCTL) and offset differences that make it not fully work with the ST7789 library out of the box.

[NoNamedCat]

How do you do the connections for the screen?

[ginbot86]

I used a 0.3mm FPC breakout board I got off Amazon. They only had a 25-pin and 33-pin option available on short notice, so I went with the 25-pin and just aligned it with the rightmost edge of the vape's 15-pin LCD connector. It's very fiddly and fragile, but sufficient for a proof of concept.

I've never finished a PCB design before, but I'm currently trying my hand at designing a breakout PCB for just the LCD and adding an onboard CST816 touchscreen controller. Wish me luck 😅

[NoNamedCat]

I can help you if you want to. I design PCBs professionally

[NoNamedCat]

https://www.kepuhaodianzikeji.com/newsinfo/2815183.html

[NoNamedCat]

Here in this video you can see that the JL7012A is treated as JL701X and it uses the AC701x SDK:

https://www.bilibili.com/video/BV1qb4y1W7qH/

[ginbot86]

Neat! Hopefully that brings us closer to being able to run custom code.

[ginbot86]

After several hours I think I have a workable first-draft PCB design for the LCD breakout... DRC checks passed which is promising.

[NoNamedCat]

https://github.com/zhengzhengchuang/umeox_JL701n_128_lvgl_watch

[ginbot86]

If I'm reading that correctly, that's the software development tools and the code for the OS, at least on that model of smartwatch?

(Also it's kind of funny the readme just says "none")

[NoNamedCat]

I think it is.

I think i found a bootloader (uboot modified) for the AC701N (I think it is the same CPU because the video that i show to you)

https://github.com/Jieli-Tech/fw-Bootloader/tree/main?tab=readme-ov-file

[NoNamedCat]

Sorry if i make spam here, but im trying to get to every hole in the internet to get information about this chips.
Here you can see another github site with a lot of information about this CPUs:
https://github.com/kagaimiq/jielie?tab=readme-ov-file

They also call the AC701N BR28

[NoNamedCat]

Based on that name i think i found the SDK::

https://gitlab.zh-jieli.com/fushaowen/701n_1t2_tws/-/tree/73163ef0e1fb791cb330a1b3b853a690bc272f83