Difference between revisions of "Blink SyncModule 2"

From RECESSIM, A Reverse Engineering Community
Jump to navigation Jump to search
((now correctly) fixed reference links)
(I updated this entry to have more accurate information about the previously unknown transceiver IC.)
 
(One intermediate revision by one other user not shown)
Line 43: Line 43:
 
*16bit DDR3
 
*16bit DDR3
  
===Unknown IC===
+
===Sub-GHz "EZRadio" Transceiver===
 
Markings: 455A CQRX 220
 
Markings: 455A CQRX 220
Unknown purpose. Maybe custom radio.
+
 
 +
Silicon Labs Si4455<ref>https://www.silabs.com/documents/public/data-sheets/Si4455.pdf</ref>
 +
 
 +
* Frequency of 283–960 MHz
 +
* –116 dBm Sensitivity
 +
* Modulation:
 +
** (G)FSK
 +
** OOK
 +
* +13 dBm Max output power
 +
* 50 nA Standby Current
 +
* 500 kbps Max Data Rate
 +
* 1.8 to 3.6 VDC
  
 
==Teardown pictures==
 
==Teardown pictures==
Line 59: Line 70:
 
File:Photo10.jpg|MCU closeup
 
File:Photo10.jpg|MCU closeup
 
File:Photo11.jpg|SRAM closeup
 
File:Photo11.jpg|SRAM closeup
File:Unknown ic.png|Unknown IC closeup
+
File:Unknown ic.png|Si4455
 
File:Photo12.jpg|Wifi/BT module closeup
 
File:Photo12.jpg|Wifi/BT module closeup
 +
File:Bottom layer zoom.jpg
 +
File:Sync module 2 top layer zoom.jpg
 
</gallery>
 
</gallery>
  

Latest revision as of 13:59, 22 September 2023

Photo3.jpg

What is it?

Home appliance to control other Amazon Blink devices.

According to the manufacturer: "The Sync Module is a hub that plugs into an electrical outlet to relay commands and network details to devices in the system it manages. The Sync Module 2 requires a power outlet and is connected to your always-on Wi-Fi network to handle activity for up to ten Blink devices. This extends camera battery life, saves clips without a subscription, improves convenience for scheduling, and arms a group of devices at once."[1]

What can it do?

  • Control Blink devices (cameras, doorbells, etc) from the Blink mobile app
  • Connect up to 10 of any Blink Outdoor 4, Wired Floodlight, Outdoor and Indoor (all models), XT2, XT, Video Doorbell*, and Mini* cameras.
  • Support local video storage for up to 10 Blink cameras.
  • Record and store motion clips when you insert a USB flash drive (up to 256 GB).

Main components

Microcontroller

NXP MCIMX6Z0DVM09AB[2]

  • ARM Cortex-A7 running Linux
  • 900MHz
  • SRAM: 128kB
  • SPI/UART/I2C
  • 96KB bootrom, 128KB internal RAM
  • Has Arm TrustZone

Wifi/Bluetooth Module

NXP 88W8987-NYE2[3]

  • 2.4/5Ghz Wifi
  • Bluetooth 5.2 (BLE also)

Serial flash

Winbond 25Q256JVEQ[4]

  • 256M-bit
  • Dual/Quad SPI XIP (133MHz SPI)

RAM

ISSI IS43TR16640BL[5]

  • 1GB SDRAM
  • 16bit DDR3

Sub-GHz "EZRadio" Transceiver

Markings: 455A CQRX 220

Silicon Labs Si4455[6]

  • Frequency of 283–960 MHz
  • –116 dBm Sensitivity
  • Modulation:
    • (G)FSK
    • OOK
  • +13 dBm Max output power
  • 50 nA Standby Current
  • 500 kbps Max Data Rate
  • 1.8 to 3.6 VDC

Teardown pictures

Serial Communications

It is possible to read the boot of the device by connecting to the indicated pin.

Baud rate is 115200.

Txpin.png

References