Paying China to reverse engineer for you

3 minute read 23 November 2017

image

In 2016 while visiting Shenzhen factories for a client, I wanted to hunt the markets for my favorite toys, dumb wearables, in order to learn from the design and see what parts are common and cheap. I bought everything I could until I found these veryfit id101′s I liked.

image image

The id101 have a Nordic nrf51 bluetooth chip which is what I use in my work, and which has two open source bluetooth stacks, Apache Mynewt and Zephyr.

image

After charming my market contact by returning every few days to buy a handful more of them off her, I finally got back to a factory contact on WeChat. They’re made by idoosmart and they agreed to a tour of the factory. I was quite impressed with what I saw. They were clean and had complete testing throughout including water pressure testing every unit as far as I could tell. These guys put out roughly 10k per line per day, and they had several full lines running. I got quotes for something like $9 bucks with no heartrate, and $12 bucks with heartrate in quantities as low as 100. I was paying ~$20 in the markets, and a year later now the id101 can be bought for $20-$40 from any one of many amazon resellers.

I grabbed one of the cheap USB oscilloscopes in the markets and sat at Gee Coffee Roasters to reverse engineer my board. I desoldered all the components and took a picture to mark up while I probed the board.

image

It wasn’t pretty but got the job done. I identified most of the components and connections.

  • Printed on board: "id101 ver 2.1 2016.06.13 3716"
  • Nordic nrf51822 qfaca1 1609ab - Bluetooth LE
  • hnox ver 2.2 2016.4.19 - HR sensor
  • Azoteq iqs263a - Captouch Controller
  • na45e - Battery charge or voltage regulator (?)
  • "8c630 og155r" sot-23-8? - Erm driver (?)
  • "2 w6 358411p ba 6" (15pin flex ribbon cable to SSD1306 oled
  • "1187-02 hxs 2016.09" - 4pin Digitizer 4
  • "ib 122" LGA-12? maybe Bosch Bma250e accelerometer (?)

Durning this time I finally met Ian and Jin from Dangerous Prototypes who told me about their little known Chinese reverse engineering service. For $80 they’ll reverse engineer a populated 2 layer PCB to Protel in a few days. I handed over $80 and a freshly purchased id101. After a few days Jin got back to me and said it was taking a bit longer. I forgot about it and a few weeks later I had a zip file with some nice pics of a 4 layer (oops) board which presumably slowed them down.

imageimageimageimage

The zip also had the the Protel CAD files. Protel was apparently bought by Altium and is now subsumed into their ~$10k designer tool. I tried to obtain an old copy to run in a VM but it ended up being a huge pain in the ass and so I got bored and put this project down.

Recently, I found out that Altium’s free (though otherwise uncompetitive) online design tool Circuitmaker will actually import Protel files including PCBS. I opened that old zip file in there and found it looking pretty good!

image

It probably took me a day or two of stitching screenshots, probing nets and marking up images in order to get my jpg. My working rate aside, $80 to get a fully interactive view of the board is worth it in every case I can think of.

Sadly, thats about where I left the id101 project. Find the id101 uploaded to my Circuitmaker account with the zipfile as an attachment. Something I’d love to try next would be to try to actually produce a device based on reverse engineered files.