Blink SyncModule 2: Difference between revisions

From RECESSIM, A Reverse Engineering Community
Jump to navigation Jump to search
← Older editNewer edit →
VisualWikitext
Undo revision 1874 by Hexpwn (talk)
Tag: Undo
(now correctly) fixed reference links
Line 16: Line 16:
==Main components==
==Main components==
===Microcontroller===
===Microcontroller===
NXP MCIMX6Z0DVM09AB<ref name="NXP MCIMX6Z0DVM09AB">[https://www.nxp.com/part/MCIMX6Z0DVM09AB#/]</ref>
NXP MCIMX6Z0DVM09AB<ref name="NXP MCIMX6Z0DVM09AB">https://www.nxp.com/part/MCIMX6Z0DVM09AB#/</ref>


*[[ARM]] [[Cortex-A7]] running Linux
*[[ARM]] [[Cortex-A7]] running Linux
Line 26: Line 26:


===Wifi/Bluetooth Module===
===Wifi/Bluetooth Module===
[[NXP]] 88W8987-NYE2<ref name="NXP 88W8987-NYE2">[https://www.nxp.com/products/wireless-connectivity/wi-fi-plus-bluetooth-plus-802-15-4/2-4-5-ghz-dual-band-1x1-wi-fi-5-802-11ac-plus-bluetooth-5-2-solution:88W8987]</ref>
[[NXP]] 88W8987-NYE2<ref name="NXP 88W8987-NYE2">https://www.nxp.com/products/wireless-connectivity/wi-fi-plus-bluetooth-plus-802-15-4/2-4-5-ghz-dual-band-1x1-wi-fi-5-802-11ac-plus-bluetooth-5-2-solution:88W8987</ref>


*2.4/5Ghz Wifi
*2.4/5Ghz Wifi
Line 32: Line 32:


===Serial flash===
===Serial flash===
[[Winbond]] 25Q256JVEQ<ref name="Winbond 25Q256JVEQ">[https://www.winbond.com/hq/product/code-storage-flash-memory/serial-nor-flash/?__locale=en&partNo=W25Q256JV]</ref>
[[Winbond]] 25Q256JVEQ<ref name="Winbond 25Q256JVEQ">https://www.winbond.com/hq/product/code-storage-flash-memory/serial-nor-flash/?__locale=en&partNo=W25Q256JV</ref>


*256M-bit
*256M-bit
Line 38: Line 38:


===RAM===
===RAM===
[[ISSI]] IS43TR16640BL<ref name="ISSI IS43TR16640BL">[https://www.issi.com/WW/pdf/43-46TR16640B-81280BL.pdf]</ref>
[[ISSI]] IS43TR16640BL<ref name="ISSI IS43TR16640BL">https://www.issi.com/WW/pdf/43-46TR16640B-81280BL.pdf</ref>


*1GB SDRAM
*1GB SDRAM
Line 63: Line 63:
</gallery>
</gallery>


== Serial Communications ==
==Serial Communications==
It is possible to read the boot of the device by connecting to the indicated pin.  
It is possible to read the boot of the device by connecting to the indicated pin.  


Line 69: Line 69:
[[File:Txpin.png|none|frame]]
[[File:Txpin.png|none|frame]]


== References ==
==References==
<references />
<references />

Revision as of 16:10, 10 September 2023

What is it?

Home appliance to control other Amazon Blink devices.

According to the manufacturer: "The Sync Module is a hub that plugs into an electrical outlet to relay commands and network details to devices in the system it manages. The Sync Module 2 requires a power outlet and is connected to your always-on Wi-Fi network to handle activity for up to ten Blink devices. This extends camera battery life, saves clips without a subscription, improves convenience for scheduling, and arms a group of devices at once."[1]

What can it do?

  • Control Blink devices (cameras, doorbells, etc) from the Blink mobile app
  • Connect up to 10 of any Blink Outdoor 4, Wired Floodlight, Outdoor and Indoor (all models), XT2, XT, Video Doorbell*, and Mini* cameras.
  • Support local video storage for up to 10 Blink cameras.
  • Record and store motion clips when you insert a USB flash drive (up to 256 GB).

Main components

Microcontroller

NXP MCIMX6Z0DVM09AB[2]

  • ARM Cortex-A7 running Linux
  • 900MHz
  • SRAM: 128kB
  • SPI/UART/I2C
  • 96KB bootrom, 128KB internal RAM
  • Has Arm TrustZone

Wifi/Bluetooth Module

NXP 88W8987-NYE2[3]

  • 2.4/5Ghz Wifi
  • Bluetooth 5.2 (BLE also)

Serial flash

Winbond 25Q256JVEQ[4]

  • 256M-bit
  • Dual/Quad SPI XIP (133MHz SPI)

RAM

ISSI IS43TR16640BL[5]

  • 1GB SDRAM
  • 16bit DDR3

Unknown IC

Markings: 455A CQRX 220 Unknown purpose. Maybe custom radio.

Teardown pictures

  • Front face of the BSM2
    Front face of the BSM2
  • Back face of the BSM2
    Back face of the BSM2
  • Top view
    Top view
  • To take off the top part just use a spudger, guitar pic, etc. No glue or screws to take the top cover off.
    To take off the top part just use a spudger, guitar pic, etc. No glue or screws to take the top cover off.
  • PCB view (top)
    PCB view (top)
  • PCB view (top) closeup
    PCB view (top) closeup
  • PCB view (bottom)
    PCB view (bottom)
  • Serial Flash closeup
    Serial Flash closeup
  • MCU closeup
    MCU closeup
  • SRAM closeup
    SRAM closeup
  • Unknown IC closeup
    Unknown IC closeup
  • Wifi/BT module closeup
    Wifi/BT module closeup

Serial Communications

It is possible to read the boot of the device by connecting to the indicated pin.

Baud rate is 115200.

References

  1. ↑ [ https://support.blinkforhome.com/en_US/faq-sm/sync-module-2-faqs]
  2. ↑ https://www.nxp.com/part/MCIMX6Z0DVM09AB#/
  3. ↑ https://www.nxp.com/products/wireless-connectivity/wi-fi-plus-bluetooth-plus-802-15-4/2-4-5-ghz-dual-band-1x1-wi-fi-5-802-11ac-plus-bluetooth-5-2-solution:88W8987
  4. ↑ https://www.winbond.com/hq/product/code-storage-flash-memory/serial-nor-flash/?__locale=en&partNo=W25Q256JV
  5. ↑ https://www.issi.com/WW/pdf/43-46TR16640B-81280BL.pdf
Retrieved from "https://wiki.recessim.com/w/index.php?title=Blink_SyncModule_2&oldid=1876"