This video details an initial attempt to hack the Mi Band 9, aiming to uncover debug headers, dump firmware, and enable custom code or over-the-air updates. The teardown process reveals a design largely similar to its predecessor, the Mi Band 8, but quickly uncovers a critical challenge: the unexpected use of a proprietary Chinese-made System-on-Chip (SoC), the BS27IM, featuring an obscure RISC-V MC1 core. Unlike previous Mi Band models that utilized more documented Dialog or Apollo chips, this new SoC has virtually no public information or SDK, making deep reverse engineering exceptionally difficult. Despite successfully disassembling the device and identifying components like the external Winbond SPI flash, the project is ultimately abandoned due to the significant hurdle presented by the undocumented SoC. The reassembled device, though physically intact, suffered software corruption and failed to re-bind, reinforcing the difficulty of working with this new hardware.
Exploring the Mi Band 9: A Hacking Attempt and Unforeseen Challenges
0:00 Initial Hacking Goals: The video begins an exploration into hacking the Mi Band 9, aiming to find debug headers, dump firmware, and eventually enable custom code or over-the-air (OTA) updates.
0:17 Hardware Expectations: Based on FCC ID images, the creator initially expected a Dialog DA14706/1706 SoC with 1.5MB RAM and 128MB flash, alongside features like an AMOLED display, accelerometer, magnetometer, and light sensor.
1:31 Physical Comparison & Disassembly: The Mi Band 9 is noted as slightly smaller than the Mi Band 8, sharing the same charging cable and a similar screen resolution (around 492x176). Disassembly commenced by carefully prying open the back cover with an exacto knife, successfully revealing the internals without causing significant damage to the casing or clips.
7:37 Internal Components Revealed: Upon opening, an external Winbond SPI flash memory chip is identified. Other visible components include the heart rate sensor, likely an acceleration sensor, and unpopulated chip positions potentially for NFC or regional variations. A "haptic engine" type vibration motor (a metal plate producing movement) is also observed.
11:13 Identifying the SoC (System-on-Chip): After removing the battery and main PCB, the core SoC is located, bearing the label "F4243392703."
12:42 Major Hacking Obstacle: Subsequent research identifies the SoC as a BS27IM, an obscure Chinese-made microcontroller featuring a RISC-V MC1 core. This chip has minimal public documentation (only a brief 3-page PDF), no readily available SDK, and unclear internal memory specifications (speculated 256MB flash, 16MB PS RAM).
13:51 Difficulty & Project Status: The lack of information about the BS27IM SoC makes reverse engineering significantly harder than with previous Mi Band models, which used more common Dialog or Apollo chips. This major hurdle leads the creator to label the project as a "bummer" due to the excessive effort required.
14:55 Attempted Flash Dump: Despite the challenges, an attempt is made to desolder the external flash chip and read its contents using a custom adapter board, with an eye towards analyzing an external firmware update file.
15:41 Project Abandonment & Damaged Device: The video concludes with the decision to abandon further deep hacking of the Mi Band 9 due to the overwhelming difficulty posed by the undocumented SoC. The device, after being reassembled, suffers from software corruption (displaying text instead of images) and can no longer bind to the companion app, reinforcing the complications of this endeavor.
Key Takeaway: The creator suggests that Xiaomi likely chose this obscure chip specifically to deter reverse engineering and make hacking the device much more challenging.