I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the only, i've also tried the EEPROM which returned random characters (translated from chinese characters). I've ran through the PCB and was not able to find any decent pins i could use to access the MCU other than a UART connection between the MCU and the bluetooth chip, so i was wondering if it would be possible to get info from the MCU through this serial pins?

I'm posting the picture for perspective

enter image description here

  • does the device list an FCC ID? – Igor Skochinsky Feb 13 at 19:00
  • @IgorSkochinsky i'm afraid not, i found similar ones but i believe the MCU will be different. – Terramoto Feb 14 at 9:30

I see the following possibilities:

  • intercept Bluetooth communication and inject bogus packets to crash the CPU firmware and hopefully achieve code execution. This is very difficult to do blindly though since you have only this UART and no other means of observation what happens inside.

  • there may be a strap pin that forces the chip to go into bootloader mode on startup which then may support commands for reading the flash or uploading code into RAM. Again, this is difficult without any documentation.

  • there may be JTAG pins or another diagnostic UART. It’s quite unlikely IMO that the board has no diagnostic options at all so try to trace where every pin of the CPU goes and see if you can discover a group of test pads.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.