1

I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the only, i've also tried the EEPROM which returned random characters (translated from chinese characters). I've ran through the PCB and was not able to find any decent pins i could use to access the MCU other than a UART connection between the MCU and the bluetooth chip, so i was wondering if it would be possible to get info from the MCU through this serial pins?

I'm posting the picture for perspective

enter image description here

3
  • 1
    does the device list an FCC ID?
    – Igor Skochinsky
    Feb 13 '20 at 19:00
  • @IgorSkochinsky i'm afraid not, i found similar ones but i believe the MCU will be different.
    – Terramoto
    Feb 14 '20 at 9:30
  • hiiiiii, helppppp, can you get my the drivers of that controller??, like "backup drivers" from "Driver Easy Program" plsssss, i have a problem with the drivers of a chinese controller, and need exactly drivers of that thing (BM-829 (5028B) VER1.2") plsss pls plssss, can you DM me on twitter ("@twitter.com/johanestaenuso") or facebook ("JohanEsta EnUso") or here, pls pls pls, really need it :(((
    – Johan
    Jun 4 at 4:11
1

I see the following possibilities:

  • intercept Bluetooth communication and inject bogus packets to crash the CPU firmware and hopefully achieve code execution. This is very difficult to do blindly though since you have only this UART and no other means of observation what happens inside.

  • there may be a strap pin that forces the chip to go into bootloader mode on startup which then may support commands for reading the flash or uploading code into RAM. Again, this is difficult without any documentation.

  • there may be JTAG pins or another diagnostic UART. It’s quite unlikely IMO that the board has no diagnostic options at all so try to trace where every pin of the CPU goes and see if you can discover a group of test pads.

0

When you mention trying the EEPROM, is that IC5? It looks very much like a SPI flash IC. I would see about dumping the flash contents from it if that is not what you meant. Test which pins are VDD and VSS with a DMM, then see if you can find some datasheets for SOIC8 flash ICs that have the same power and ground pins. A Raspberry Pi is great for dumping spi flash content. Can you link to the EEPROM Dump?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.