Oscar Spierings

After a long hiatus, I am finally back on the project. Personal life has been quite hectic, but I am now ready to dive back into cracking the nuts of the ImagoTag ESLs. Looking back, it's been already about half a year since i last worked on the project, so I will need to get back into the groove of things.

Current status:

• Vusion 2.6: Working bootloader, toolchain and flasher with basic 'hello world' functionality.
• G1 4.4: Pinout reverse engineering in progress, got the CC Debugger working on the debug header and setting up the toolchain.

If at all possible, i would like to create a shared source with minimal differences between the two firmwares. At some point i would like to get full OpenEPaperLink working, but that is quite a bit off. First getting some wireless functionality and showing some images on the displays would be a good start.

Bootloader​

This journey began when i read some blog posts by Dmitry Grinberg and Aaron Christopher detailing their experiences with reverse engineering electronic shelf tags with E-Ink displays. It took me about 6.5 minutes before i had ordered a couple of Solum ST-GR29000 ESL tags from ebay. These tags cost me around €9 each. This wasn't a bad price at all and i was excited to get started. After installing OpenEPaperLink on these tags i was happy with the results. I instantly foresaw myself using these on each and every box of parts in my office. However this would be quite expensive. So, having zero impulse control or apparently no ability to do the quick math that would have told me that this would be a bad idea, i ordered 80 more tags, this time, substantially cheaper tags.

The only difference between the two tags was that the cheaper tags had a different microcontroller on board. The main caveat is that Aaron Christopher, the maker of the OpenEPaperLink firmware, just so happens to be working for SES-imagotag, the company that makes the cheaper tags and has no intention of making them compatible. Ever. It seems he and i disagree wether an open source firmware would benefit or harm a company. I think it would benefit them, but nonetheless, i respect his decision. However this leaves me having to reinvent the wheel and make my own firmware.

With 5 years of experience in Research & Development of embedded systems, this sounds like a fun challenge that will definitely not take up all of my free time for the foreseeable future.

The plan​

The overall plan should have been:

1. Reverse engineer the layout and connections of the PCB
2. Find the appropiate datasheets and toolchain to write my own firmware
3. Write my own firmware

Writing this post halfway through the process, i definitely wasn't as straight forward as i had hoped. The latest revision of the plan is as follows:

1. Reverse engineer the layout and connections of the PCB
2. Find the appropiate datasheets and toolchain to write my own firmware
3. Realize that the MCU on board is EOL, documentation is scarce, debugging hardware is non-standard and hard to acquire and the toolchain is not what i had hoped
4. Fix up the toolchain
5. Get a basic serial bootloader working where i had to write my own flashing tool just to Development
6. Only now 'start' writing my own firmware (which is where i am at as of writing this post)

Since this series of posts will go over the process chronologically, the full plan and status isn't too relevant and is documented in the other sections of this website. Feel free to look around for a more complete 'plan' and status of the project. Back to the topic at hand.

First observations​

The tags i received are SES-ImagoTag VUSION 2.6 BWR UU340 tags. These are wireless ESL tags with 868MHz radio, a 2.6" E-Ink display and two LED's in the front.

Components​

To find the components and do preliminary tracing i just take my trusty Zeiss Opmi-1 microscope and start looking around. This is a great way to find the components and get a feel for the layout of the PCB. This resulted in the following list of components:

I am quite sure the last component on the list is a flash memory, but i haven't been able to reference the markings to any specific part yet. However when looking at similar products, the logical choice would be a 1Mb serial flash memory that shares the SPI bus with the E-Ink display. Later testing will probably confirm this. Finding the NFC chip was actually quite tricky, since the markings of the chip mostly lead to a 4-pin NFC chip that is completely different. It just so happens that i'm pretty good at chinesium.

chi·ne·si·um /ˌčʌɪˈniziəm/ n. informal, humorous

1. The cryptic yet technically accurate language commonly found in product descriptions, instruction manuals, and specifications from Chinese manufacturers, characterized by: a. Specifications that require contextual interpretation b. Technical values that exist within a flexible range of possibility c. Product features described through carefully worded, albeit ambiguous phrasing

Example: "According to the chinesium in this datasheet, the LED driver is 'compatible with standard voltages' and has a 'recommended operating current of about 350mA ±20% typical.'"

Origin: 2010s, blend of "Chinese" + "-ium" (linguistic suffix), popularized in online commerce communities

Related: chinesium interpretation (n.): the art of accurately determining a product's actual specifications from deliberately flexible descriptions

back on topic, it turned out that the exact part numbering referred to a completely different product, but the FM11NT0X1D where the X had to be replaced with the value on the part was the correct part (same manufacturer, completely different product and product range, go figure).

Finding connections​

To find the connections of the PCB i followed my usual method of taking pictures and tracing the signals out on my ipad. This might not be the best or most efficient way, but i like it and it works for me.

Testing setup​

To hack and reverse engineer hardware i prefer to make a setup somewhere in between permanent and temporary. Usually I just 3D print some standoffs and lay everything out on a piece of wood. This allows me to tweak, experiment and poke around while still having a stable setup.

I did add a mosfet board in between the power supply and the ESL tag to possibly start doing some glitching attacks. However i didn't get to that yet, i might do that at some later stage.

Programmer​

Some searching lead to the discovery that the propietary programmer from Axsem is just an FT2232H with a tri-state buffer. This meant that i could rig up my own programmer with parts laying around.

Welcome to the ESL hacking chronicles, this will be the place where i will document all my work around hacking my own stash of electronic shelf labels. Everything will be divided into three categories:

• Reverse engineering
• Tooling and Development
• Projects
• Blog

Reverse engineering​

This category will contain all the information i have gathered about the electronic shelf labels. This will include information about the hardware, software and communication protocols. Everything is geared towards documenting the specific hardware variants i have used and both the results and process of reverse engineering them.

Tooling and Development​

This category will contain all the information about the tools and development environment i have used to develop the software for the electronic shelf labels. This will include information about the software i have used, the development environment and the software i have developed. Since there are multiple types of ESL tags i have procured and some of them required extensive work to just be able to work with them. This is a separate category from the projects.

Projects​

Here i will documeten the projects that come out of the reverse engineering and development work. Initially this will mostly be test projects, and will grow accordingly

Blog​

I will try to make a series of blog posts that will be a bit more informal and give some insights into the process, the challenges and the fun i have had with this project. This will also tie together the rest of the documentation in a more chronological storyline.