Difference between revisions of "Blink SyncModule 2"

From RECESSIM, A Reverse Engineering Community
Jump to navigation Jump to search
(→‎Teardown pictures: added new top and bottom layer images)
(I updated this entry to have more accurate information about the previously unknown transceiver IC.)
 
Line 43: Line 43:
 
*16bit DDR3
 
*16bit DDR3
  
===Unknown IC===
+
===Sub-GHz "EZRadio" Transceiver===
 
Markings: 455A CQRX 220
 
Markings: 455A CQRX 220
Unknown purpose. Maybe custom radio.
+
 
 +
Silicon Labs Si4455<ref>https://www.silabs.com/documents/public/data-sheets/Si4455.pdf</ref>
 +
 
 +
* Frequency of 283–960 MHz
 +
* –116 dBm Sensitivity
 +
* Modulation:
 +
** (G)FSK
 +
** OOK
 +
* +13 dBm Max output power
 +
* 50 nA Standby Current
 +
* 500 kbps Max Data Rate
 +
* 1.8 to 3.6 VDC
  
 
==Teardown pictures==
 
==Teardown pictures==
Line 59: Line 70:
 
File:Photo10.jpg|MCU closeup
 
File:Photo10.jpg|MCU closeup
 
File:Photo11.jpg|SRAM closeup
 
File:Photo11.jpg|SRAM closeup
File:Unknown ic.png|Unknown IC closeup
+
File:Unknown ic.png|Si4455
 
File:Photo12.jpg|Wifi/BT module closeup
 
File:Photo12.jpg|Wifi/BT module closeup
 
File:Bottom layer zoom.jpg
 
File:Bottom layer zoom.jpg

Latest revision as of 13:59, 22 September 2023

Photo3.jpg

What is it?

Home appliance to control other Amazon Blink devices.

According to the manufacturer: "The Sync Module is a hub that plugs into an electrical outlet to relay commands and network details to devices in the system it manages. The Sync Module 2 requires a power outlet and is connected to your always-on Wi-Fi network to handle activity for up to ten Blink devices. This extends camera battery life, saves clips without a subscription, improves convenience for scheduling, and arms a group of devices at once."[1]

What can it do?

  • Control Blink devices (cameras, doorbells, etc) from the Blink mobile app
  • Connect up to 10 of any Blink Outdoor 4, Wired Floodlight, Outdoor and Indoor (all models), XT2, XT, Video Doorbell*, and Mini* cameras.
  • Support local video storage for up to 10 Blink cameras.
  • Record and store motion clips when you insert a USB flash drive (up to 256 GB).

Main components

Microcontroller

NXP MCIMX6Z0DVM09AB[2]

  • ARM Cortex-A7 running Linux
  • 900MHz
  • SRAM: 128kB
  • SPI/UART/I2C
  • 96KB bootrom, 128KB internal RAM
  • Has Arm TrustZone

Wifi/Bluetooth Module

NXP 88W8987-NYE2[3]

  • 2.4/5Ghz Wifi
  • Bluetooth 5.2 (BLE also)

Serial flash

Winbond 25Q256JVEQ[4]

  • 256M-bit
  • Dual/Quad SPI XIP (133MHz SPI)

RAM

ISSI IS43TR16640BL[5]

  • 1GB SDRAM
  • 16bit DDR3

Sub-GHz "EZRadio" Transceiver

Markings: 455A CQRX 220

Silicon Labs Si4455[6]

  • Frequency of 283–960 MHz
  • –116 dBm Sensitivity
  • Modulation:
    • (G)FSK
    • OOK
  • +13 dBm Max output power
  • 50 nA Standby Current
  • 500 kbps Max Data Rate
  • 1.8 to 3.6 VDC

Teardown pictures

Serial Communications

It is possible to read the boot of the device by connecting to the indicated pin.

Baud rate is 115200.

Txpin.png

References