Bluetooth speaker eeprom

[HaQue]

The complexity comes from trying to do a lot with a small MCU. Plus you would be surprised how many technologies get mashed together in very small cheap devices: CPU's, audio codecs, compression algo's, BT stacks, filesystems etc. A lot of it is very old code, buggy.

I have binwalk running fine on my laptop in a Kali VM(that was in my bag!!) but felt it easier to install on my new PC with twin large monitors, as I would likely be using it for hacking around a lot. (it just occurred to me to just copy that VM, doh!)

geeks are prone to run off on tangents.. I saw a good example: show me something that takes 10 minutes to do and instead I will take 10 days to automate it.

[Crawlie69]

geeks are prone to run off on tangents.. I saw a good example: show me something that takes 10 minutes to do and instead I will take 10 days to automate it.

True LOL.

I guess this project is the equivalent of your quote lol. It's actually a rather 'stupid' project lol. However i've done a couple of these 'stupid' projects now, and man it is nice when you finally figure out stuff. Great learning as well.

I'm actually doing this for a family member, but ultimately, succesfully tapping into this firmware will make it possible to reuse this old crappy speaker, for a nice little homemade bluetooth speaker, instead of throwing it in the bin.

- Oh and i don't know if i've said this yet, but i've already changed the speaker name successfully, so replacing that terrible chinese lady voice, would be PRICELESS

[Crawlie69]

The firmware might be based on Anyka's Spotlight10 BaseLine and Media Development Kit which uses ARM Development Suite (ADS) Version 1.2 for AK10 MCUs.

- Quote from some random site i strolled upon. Perhaps it's possible to use the 'ARM Development Suite' to disassemble the firmware?

[Crawlie69]

I'm very happy to tell you that the problem has been solved. Another guy on a forum identified the files as 'Bluetooth SBC format'. With the help of sbcdec (Linux) it's possible to decode the audio, along with encoding new audio files. From there the process should be pretty similar to my last speaker project, which means it's just a matter of replacing the audio files. Thanks so much for the help so far!

[HaQue]

I'm very happy to tell you that the problem has been solved. Another guy on a forum identified the files as 'Bluetooth SBC format'. With the help of sbcdec (Linux) it's possible to decode the audio, along with encoding new audio files. From there the process should be pretty similar to my last speaker project, which means it's just a matter of replacing the audio files. Thanks so much for the help so far!

Nice!
I was in the process of going through different audio codecs with audacity. I spent a while trying PCM and ADPCM, importing as raw with different bitrates etc & different formats as well just looking for anything that had similar frames or even the same kind of structure, to maybe look down the XOR road.
Strange that with the extensive searching for filetypes commonly used for audio, I never came across that one.

Also, I would have thought it would have to be one of the codecs already supported by the speaker.

[HaQue]

Bugger! I had looked at this page and totally missed the significance:
https://habr.com/en/post/456182/

If I had spent more time, I would have found this at the bottom:

Bonus: SBC reference encoder, A2DP bitstream information and test files. This file was previously posted on Bluetooth website publicly, but now it is available only to those who have joined Bluetooth SIG.

sbc_test_01.sbc

frame size 0x42

Code:

9C F2 12 9A 00 00 7B DD DE F7 77 BD DD EF 77 7B DD DE F7 77 BD DD EF 77 7B DD DE F7 77 BD DD EF 77 7B DD DE F7 77 BD DD EF 77
9C F2 12 9A 00 00 7B DD DE F7 77 BD DD EF 77 7B DD DE F7 77 BD DD EF 77 7B DD DE F7 77 BD DD EF 77 7B DD DE F7 77 BD DD EF 77
9C F2 12 17 31 00 7E F6 DF BD B7 EF 6D FB DB 7E F6 DF BD B7 EF 6D FB DB 78 E6 DD C5 34 87 75 02 E3 79 35 99 F6 5A E5 47 61 A3
9C F2 12 3C 41 00 BE 83 2D AA 18 54 61 E2 54 86 68 E7 AD 9B 39 96 A5 18 72 98 9F 95 C8 38 6E 29 5C AB 85 30 EE 0D FA 4B 7E 0C
9C F2 12 EC 41 11 C0 6D 2E 3C 3B EE EE EB BB B6 EC E8 22 C8 42 F2 84 33 AA F0 F1 4B BE B0 73 83 C3 F1 6C B5 2B 59 6E D2 9A B2
9C F2 12 F1 41 10 C8 B0 EF AB CC D4 BA 44 B4 70 F2 58 13 65 CF 29 AB BB 82 F5 B3 3A 0D 2F 15 EB A3 43 36 D2 DC 66 07 09 4C 33
9C F2 12 50 62 10 6A 2A 17 8F 16 CB 15 CC D1 75 4C 9E 4B 17 6B B5 C6 89 6C C8 56 91 24 C2 B9 53 70 4B 9B 55 93 54 8A 44 B8 CE
9C F2 12 99 61 11 43 27 16 49 B5 DC 91 EA D2 9D 26 A7 0E 37 BB AD 3F 2C 47 A9 0E CE 14 94 49 9E E3 4A E6 8D F5 A3 4A B0 CE D4
9C F2 12 54 61 01 48 43 5A 53 49 7B 8E 83 23 7D 83 19 B3 46 AF 4D C6 90 79 CA 97 EB 43 7D 08 C8 B2 36 CB 0C 8A 44 FC AE 41 41
9C F2 12 2D 71 11 A5 56 A5 70 C7 32 4D B4 D4 74 36 E0 8D C9 9D 66 1E A3 7F D7 5F 25 C6 6B 71 B1 51 84 25 29 68 4C C3 96 D0 C3
9C F2 12 F9 72 11 8E B3 65 30 DA 5A 16 79 4D 8F BA 64 0E 9A 2A B6 78 C5 9E 25 68 53 1B BA 23 78 D1 DB BB 6A D4 D9 51 C6 91 6D
9C F2 12 57 83 11 A0 16 28 D9 19 70 D2 43 91 93 16 63 B9 98 FD 46 6B 89 AE DE 71 38 4B A5 5A 7A A4 88 91 62 6A 18 40 D2 12 AA

attached is the resource

Attachments

29l4kd.zip

(3.04 MiB) Downloaded 347 times

[Crawlie69]

Thank you very much with the help anyway. Always warming to have strangers help me, and take time out of your lives to help me with my weird projects. And thanks for uploading that bonus