Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision |
web-u2 [2019/09/09 13:48] – [WITRN U2 104083] kingkevin | web-u2 [2019/09/23 13:47] – [WITRN U2 V2.0] typo kingkevin |
---|
| |
The [[http://www.witrn.com/|official website]] is rather empty. | The [[http://www.witrn.com/|official website]] is rather empty. |
It only point to the user guide and software (with broken link).\\ | It only points to the user guide and software (with broken link).\\ |
Instead they recommend to follow the QQ group 313755927. | Instead they recommend to follow the QQ group 313755927. |
| |
==== WITRN U2 V2.0 ==== | ==== WITRN U2 V2.0 ==== |
| |
Because the clone was bricked, I got a genuine replacement. | Because the clone got bricked, I got a genuine replacement. |
| |
{{:u2:witrn-u2_device_front.jpg?0x200|}} | {{:u2:witrn-u2_device_front.jpg?0x200|}} |
- [[https://www.fujitsu.com/downloads/MICRO/fsa/pdf/products/memory/fram/MB85RC16-DS501-00001-8v0-E.pdf|Fujitsu MB85RC16]] I²C FRAM: to store the settings and energy measurements | - [[https://www.fujitsu.com/downloads/MICRO/fsa/pdf/products/memory/fram/MB85RC16-DS501-00001-8v0-E.pdf|Fujitsu MB85RC16]] I²C FRAM: to store the settings and energy measurements |
- [[https://www.st.com/en/microcontrollers-microprocessors/stm32f072cb.html|ST STM32F072CBT6]] ARM Cortex-M0 micro-controller: the brain of the device | - [[https://www.st.com/en/microcontrollers-microprocessors/stm32f072cb.html|ST STM32F072CBT6]] ARM Cortex-M0 micro-controller: the brain of the device |
- UART pins: to connect to the AT-09 Bluetooth module (with TI CC2541 chip). pinout, beginning with square pin: 3.8V GND RX TX | - UART pins: to connect to the AT-09/HM-10 Bluetooth module (with TI CC2541 chip). pinout, beginning with square pin: 3.8V GND RX TX |
===== Software ===== | ===== Software ===== |
| |
===== Support ===== | {{ :u2:software-screenshot.png?400|}} |
| |
| Here a couple of notes about the [[http://www.witrn.com/witrn/u2/WITRN_Software.zip|PC software]] (for Windows). |
| |
| The software is in Chinese, but you can change it by translating the words in the ''lang.ini'' file. |
| Here the {{ :u2:lang.ini.zip |english lang.ini}} (works for versions 4.0, 4.1, 4.4). |
| |
| When started, the software will query [[http://www.witrn.com/updata/U2_NewVersion.pdf]] to get the latest version information. |
| This is not a pdf. I think this is just to pass firewall (just like they use HTTP without SSL).\\ |
| This URL will return a short binary string, for example ''0x44 0x67 0x25 0x11 0x12 0x12 0x13 0x21'': |
| * ''0x44'': Software version 4.4 |
| * ''0x67'': U2 Firmware version 6.7 |
| * ''0x25'': X Firmware version 2.5 |
| * ''0x11'': C3 Firmware version 1.1 |
| * ''0x12'': C1 Firmware version 1.2 |
| * ''0x12'': C0 Firmware version 1.2 |
| * ''0x13'': C0s Firmware version 1.3 |
| * ''0x21'': A0 Firmware version 2.1 |
| |
| If will also query [[http://www.witrn.com/updata/U2_ad.pdf]], which is again not a pdf, but the text to display on the left side.\\ |
| Using the Network upgrade it will also download the Firmware for the U2 at [[http://www.witrn.com/updata/U2_FW_NEW.pdf]] and U2p at [[http://www.witrn.com/updata/U2_4KEYS_FW_NEW.pdf]] (raw binaries) |
| |
===== Communication ===== | ===== Communication ===== |
==== USB HID ==== | ==== USB HID ==== |
| |
| When connected to USB, it appears as an {{ :u2:usb_hid.txt |HID}} (Human Interface Device).\\ |
| When powered while pressing on the OK button, it will boot in the DFU (Device Firmware Upgrade) mode, which allows flashing the firmware. |
| But it is still an {{ :u2:usb_dfu.txt |HID}}, and does not use the DFU profile specified by USB. |
| |
| I've partially reversed the HID communication: |
| * the messages exchanged are 64 bytes long |
| * the host (e.g. software) starts by sending a message. Here an example of message sent (captured from the software): |
| <code> |
| "\xff\x55\x58\x8a\x13\x79\x06\x57\x1a\x01\x0a\x02\x00\x00\x00\x00" \ |
| "\x5e\x00\x00\x00\xff\x55\x2f\xb2\x8b\xdc\x5a\xd4\x1a\x2c\xa4\x00" \ |
| "\xa4\x40\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x74\x21\x4f\x40\x75" \ |
| "\x23\x19\x40\x75\xcc\x01\x01\x00\x02\x04\x00\x00\x5e\x00\xe7\x06"; |
| </code> |
| * this will cause the device (e.g. U2) to send measurements. Since it will only send a couple of messages, keep sending the message every couple of milliseconds (can be the same). Here an example measurement reply: |
| <code> |
| ff 55 13 b4 7f bf 50 ef 1a 2c d7 63 a0 40 0e 74 da 39 0e 74 da 39 0e 74 da 39 bb dd 08 3b 33 33 53 40 74 a8 6d 3c fe 98 f7 41 d2 34 91 c2 14 ae a0 40 0e 74 da 39 00 00 00 00 00 00 00 00 16 ae |
| </code> |
| |
| here how to decode the measurements: |
| ^ index ^ byte(s) ^ format ^ meaning ^ |
| | 0-1 | ''ff 55'' | constant | probably a fixed header | |
| | 2 | ''13'' | integer | number of second | |
| | 3 | ''b4'' | integer | super fast incrementing number (but not related to other bytes) | |
| | 4 | ''7f'' | integer | fast incrementing number (but not related to other bytes) | |
| | 5 | ''bf'' | integer | incrementing number (but not related to other bytes) | |
| | 6 | ''50'' | integer | 1/100th of byte 5 | |
| | 7 | ''ef'' | integer | slow incrementing number (but not related to other bytes) | |
| | 8-9 | ''1a 2c'' | constant | separates timing form measurement values | |
| | 10-13 | ''d7 63 a0 40'' | float | VBUS voltage, in V (e.g. 5.0122 V) | |
| | 14-17 | ''0e 74 da 39'' | float | VBUS current, in A (e.g. 0.0004 A) | |
| | 18-21 | ''0e 74 da 39'' | float | VBUS current, in A (seems the same as previous current) | |
| | 22-25 | ''0e 74 da 39'' | float | VBUS current, in A (sometimes slightly different for the other values, but I don't know why) | |
| | 26-29 | ''bb dd 08 3b'' | float | VBUS power, in W (e.g. 0.0021 W ) | |
| | 30-33 | ''33 33 53 40'' | float | D+ voltage, in V (e.g. 3.3000 V) | |
| | 34-37 | ''74 a8 6d 3c'' | float | D- voltage, in V (e.g. 0.0145 V) | |
| | 38-41 | ''fe 98 f7 41'' | float | In temperature (internal), in °C (e.g. 30.95 °C) | |
| | 42-45 | ''d2 34 91 c2'' | float | Ex temperature (external, from IN Micro-USB probe), in °C (e.g. -72.60 °C, because not connected) | |
| | 46-49 | ''14 ae a0 40'' | float | VBUS voltage (differs from first value, but I don't know how), in V (e.g. 5.0212 V) | |
| | 50-53 | ''0e 74 da 39'' | float | VBUS current (sometimes slightly different for the other values, but I don't know why), in A (e.g. 0.0004 A) | |
| | 54-61 | ''00 00 00 00 00 00 00 00'' | constant | seems always 0 | |
| | 62 | ''16'' | integer | checksum (addition of bytes 8-61) | |
| | 63 | ''ae'' | integer | checksum (addition of bytes 0-61) | |
| |
| There are other messages to get the device's serial number and firmware version, but I did not reverse those. |
==== Bluetooth Serial ==== | ==== Bluetooth Serial ==== |