This video details the teardown and potential hacking of an inexpensive "Call Me Smart Ring," presented as a minimalist alternative to high-end smart rings like Oura. Despite its compact size, the ring effectively tracks steps and heart rate, boasting impressive battery life. The internal examination reveals an acceleration sensor, heart rate sensor, charging circuit, and a BlueX RF3 System-on-Chip (SoC). A significant finding for hacking purposes is that the original firmware updates are unsigned and unencrypted, allowing for custom firmware uploads. The presenter demonstrates how to gain direct access to the SoC via its SWD (Serial Wire Debug) interface by carefully scraping away the epoxy potting. While the SoC proves capable (Cortex M0, 0.5MB Flash, 200KB RAM), the primary limitation for general use is the lack of a clear, user-noticeable output mechanism (e.g., haptic feedback). This leads to a proposal for alternative applications, such as a subtle smart home control device leveraging tap and rotation gestures, rather than traditional fitness tracking.
Summarizing the Call Me Smart Ring Teardown & Hacking:
0:00 Introduction to the "Call Me Smart Ring": The video introduces an affordable smart ring, contrasting it with more expensive alternatives like the Oura Ring.
0:42 Core Functionality and Design: Despite its small and subtle form factor, the ring functions effectively as a smartwatch, capable of accurately counting steps and monitoring heart rate.
1:36 Impressive Battery Life: The ring exhibits surprisingly long battery life, especially considering its compact size.
2:00 Internal Components Revealed: A teardown shows the main components, including an acceleration sensor, heart rate sensor, and the charging circuit.
2:26 Magnetic Charging: The device charges via a small, magnetic cradle that connects to USB.
2:57 Firmware Hacking Objective: The primary goal is to investigate and potentially replace the ring's original firmware.
3:09 Unsigned Firmware Updates: The original firmware from the OTA server was successfully intercepted and found to be neither signed nor encrypted, enabling the potential upload of custom firmware without advanced bypass techniques.
3:41 Hardware Debugging Access: To develop custom firmware safely, direct hardwire access to the SoC was achieved by carefully scraping away the protective epoxy to expose the SWD (Serial Wire Debug) pins.
3:50 SoC Identification (BlueX RF3): The internal microcontroller is identified as a BlueX RF3 SoC, a Bluetooth Low Energy chip.
5:28 Successful SWD Connection: The presenter successfully connects an SWD flasher, allowing read and write access to the microcontroller's memory.
5:30 Available SDK: An SDK (Software Development Kit) for the BlueX microcontroller is publicly available, simplifying custom firmware development.
5:44 SoC Specifications: The BlueX RF3 SoC features 0.5MB of Flash memory, 200KB of RAM, and 128KB of ROM, built around a Cortex M0 core.
6:10 Key Limitation: Lack of Output: A significant drawback noted is the absence of a noticeable output device (like a vibration motor or clearly visible LEDs) when the ring is worn, limiting user feedback for custom applications.
6:52 Proposed Smart Home Applications: Due to the output limitation, the presenter suggests a future focus on smart home integration, where gestures like double-tapping and rotating the ring could control devices (e.g., volume, lights) via Home Assistant, leveraging the existing acceleration sensor.
8:05 Future Potential: The ring's discreet design makes it an appealing platform for developing unique, unobtrusive custom firmwares, particularly for smart home control.