Difference between revisions of "Blink SyncModule 2"

From RECESSIM, A Reverse Engineering Community
Jump to navigation Jump to search
VisualWikitext
m
(I updated this entry to have more accurate information about the previously unknown transceiver IC.)
 
(8 intermediate revisions by one other user not shown)
Line 2: Line 2:
 
[[File:Photo3.jpg|621x621px|thumb]]
 
[[File:Photo3.jpg|621x621px|thumb]]
 
==What is it?==
 
==What is it?==
 +
[[Home]] appliance to control other [[Amazon]] [[Blink]] devices.
 +
 
According to the manufacturer:
 
According to the manufacturer:
−
"The Sync Module is a hub that plugs into an electrical outlet to relay commands and network details to devices in the system it manages. The Sync Module 2 requires a power outlet and is connected to your always-on Wi-Fi network to handle activity for up to ten Blink devices. This extends camera battery life, saves clips without a subscription, improves convenience for scheduling, and arms a group of devices at once."<ref>[ https://support.blinkforhome.com/en_US/faq-sm/sync-module-2-faqs]</ref>
+
"The Sync Module is a hub that plugs into an electrical outlet to relay commands and network details to devices in the system it manages. The [https://support.blinkforhome.com/en_US/faq-sm/sync-module-2-faqs Sync Module 2] requires a power outlet and is connected to your always-on Wi-Fi network to handle activity for up to ten [[Blink]] devices. This extends camera battery life, saves clips without a subscription, improves convenience for scheduling, and arms a group of devices at once."<ref>[ https://support.blinkforhome.com/en_US/faq-sm/sync-module-2-faqs]</ref>
  
 
==What can it do?==
 
==What can it do?==
Line 14: Line 16:
 
==Main components==
 
==Main components==
 
===Microcontroller===
 
===Microcontroller===
−
NXP MCIMX6Z0DVM09AB<ref name="NXP MCIMX6Z0DVM09AB">[https://www.nxp.com/part/MCIMX6Z0DVM09AB#/]</ref>
+
NXP MCIMX6Z0DVM09AB<ref name="NXP MCIMX6Z0DVM09AB">https://www.nxp.com/part/MCIMX6Z0DVM09AB#/</ref>
  
−
*ARM Cortex-A7 running Linux
+
*[[ARM]] [[Cortex-A7]] running Linux
 
*900MHz
 
*900MHz
 
*SRAM: 128kB
 
*SRAM: 128kB
Line 24: Line 26:
  
 
===Wifi/Bluetooth Module===
 
===Wifi/Bluetooth Module===
−
NXP 88W8987-NYE2<ref name="NXP 88W8987-NYE2">[https://www.nxp.com/products/wireless-connectivity/wi-fi-plus-bluetooth-plus-802-15-4/2-4-5-ghz-dual-band-1x1-wi-fi-5-802-11ac-plus-bluetooth-5-2-solution:88W8987]</ref>
+
[[NXP]] 88W8987-NYE2<ref name="NXP 88W8987-NYE2">https://www.nxp.com/products/wireless-connectivity/wi-fi-plus-bluetooth-plus-802-15-4/2-4-5-ghz-dual-band-1x1-wi-fi-5-802-11ac-plus-bluetooth-5-2-solution:88W8987</ref>
  
 
*2.4/5Ghz Wifi
 
*2.4/5Ghz Wifi
Line 30: Line 32:
  
 
===Serial flash===
 
===Serial flash===
−
Winbond 25Q256JVEQ<ref name="Winbond 25Q256JVEQ">[https://www.winbond.com/hq/product/code-storage-flash-memory/serial-nor-flash/?__locale=en&partNo=W25Q256JV]</ref>
+
[[Winbond]] 25Q256JVEQ<ref name="Winbond 25Q256JVEQ">https://www.winbond.com/hq/product/code-storage-flash-memory/serial-nor-flash/?__locale=en&partNo=W25Q256JV</ref>
  
 
*256M-bit
 
*256M-bit
Line 36: Line 38:
  
 
===RAM===
 
===RAM===
−
ISSI IS43TR16640BL<ref name="ISSI IS43TR16640BL">[https://www.issi.com/WW/pdf/43-46TR16640B-81280BL.pdf]</ref>
+
[[ISSI]] IS43TR16640BL<ref name="ISSI IS43TR16640BL">https://www.issi.com/WW/pdf/43-46TR16640B-81280BL.pdf</ref>
  
 
*1GB SDRAM
 
*1GB SDRAM
 
*16bit DDR3
 
*16bit DDR3
 +
 +
===Sub-GHz "EZRadio" Transceiver===
 +
Markings: 455A CQRX 220
 +
 +
Silicon Labs Si4455<ref>https://www.silabs.com/documents/public/data-sheets/Si4455.pdf</ref>
 +
 +
* Frequency of 283–960 MHz
 +
* –116 dBm Sensitivity
 +
* Modulation:
 +
** (G)FSK
 +
** OOK
 +
* +13 dBm Max output power
 +
* 50 nA Standby Current
 +
* 500 kbps Max Data Rate
 +
* 1.8 to 3.6 VDC
  
 
==Teardown pictures==
 
==Teardown pictures==
Line 53: Line 70:
 
File:Photo10.jpg|MCU closeup
 
File:Photo10.jpg|MCU closeup
 
File:Photo11.jpg|SRAM closeup
 
File:Photo11.jpg|SRAM closeup
 +
File:Unknown ic.png|Si4455
 
File:Photo12.jpg|Wifi/BT module closeup
 
File:Photo12.jpg|Wifi/BT module closeup
 +
File:Bottom layer zoom.jpg
 +
File:Sync module 2 top layer zoom.jpg
 
</gallery>
 
</gallery>
  
 +
==Serial Communications==
 +
It is possible to read the boot of the device by connecting to the indicated pin.
 +
 +
Baud rate is 115200.
 +
[[File:Txpin.png|none|frame]]
 +
 +
==References==
 
<references />
 
<references />

Latest revision as of 13:59, 22 September 2023

Photo3.jpg

What is it?

Home appliance to control other Amazon Blink devices.

According to the manufacturer: "The Sync Module is a hub that plugs into an electrical outlet to relay commands and network details to devices in the system it manages. The Sync Module 2 requires a power outlet and is connected to your always-on Wi-Fi network to handle activity for up to ten Blink devices. This extends camera battery life, saves clips without a subscription, improves convenience for scheduling, and arms a group of devices at once."[1]

What can it do?

  • Control Blink devices (cameras, doorbells, etc) from the Blink mobile app
  • Connect up to 10 of any Blink Outdoor 4, Wired Floodlight, Outdoor and Indoor (all models), XT2, XT, Video Doorbell*, and Mini* cameras.
  • Support local video storage for up to 10 Blink cameras.
  • Record and store motion clips when you insert a USB flash drive (up to 256 GB).

Main components

Microcontroller

NXP MCIMX6Z0DVM09AB[2]

  • ARM Cortex-A7 running Linux
  • 900MHz
  • SRAM: 128kB
  • SPI/UART/I2C
  • 96KB bootrom, 128KB internal RAM
  • Has Arm TrustZone

Wifi/Bluetooth Module

NXP 88W8987-NYE2[3]

  • 2.4/5Ghz Wifi
  • Bluetooth 5.2 (BLE also)

Serial flash

Winbond 25Q256JVEQ[4]

  • 256M-bit
  • Dual/Quad SPI XIP (133MHz SPI)

RAM

ISSI IS43TR16640BL[5]

  • 1GB SDRAM
  • 16bit DDR3

Sub-GHz "EZRadio" Transceiver

Markings: 455A CQRX 220

Silicon Labs Si4455[6]

  • Frequency of 283–960 MHz
  • –116 dBm Sensitivity
  • Modulation:
    • (G)FSK
    • OOK
  • +13 dBm Max output power
  • 50 nA Standby Current
  • 500 kbps Max Data Rate
  • 1.8 to 3.6 VDC

Teardown pictures

  • Front face of the BSM2

  • Back face of the BSM2

  • Top view

  • To take off the top part just use a spudger, guitar pic, etc. No glue or screws to take the top cover off.

  • PCB view (top)

  • PCB view (top) closeup

  • PCB view (bottom)

  • Serial Flash closeup

  • MCU closeup

  • SRAM closeup

  • Si4455

  • Wifi/BT module closeup

  • Bottom layer zoom.jpg
  • Sync module 2 top layer zoom.jpg

Serial Communications

It is possible to read the boot of the device by connecting to the indicated pin.

Baud rate is 115200.

Txpin.png

References

  1. ↑ [ https://support.blinkforhome.com/en_US/faq-sm/sync-module-2-faqs]
  2. ↑ https://www.nxp.com/part/MCIMX6Z0DVM09AB#/
  3. ↑ https://www.nxp.com/products/wireless-connectivity/wi-fi-plus-bluetooth-plus-802-15-4/2-4-5-ghz-dual-band-1x1-wi-fi-5-802-11ac-plus-bluetooth-5-2-solution:88W8987
  4. ↑ https://www.winbond.com/hq/product/code-storage-flash-memory/serial-nor-flash/?__locale=en&partNo=W25Q256JV
  5. ↑ https://www.issi.com/WW/pdf/43-46TR16640B-81280BL.pdf
  6. ↑ https://www.silabs.com/documents/public/data-sheets/Si4455.pdf
Retrieved from "https://wiki.recessim.com/w/index.php?title=Blink_SyncModule_2&oldid=1879"