1

I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the only, i've also tried the EEPROM which returned random characters (translated from chinese characters). I've ran through the PCB and was not able to find any decent pins i could use to access the MCU other than a UART connection between the MCU and the bluetooth chip, so i was wondering if it would be possible to get info from the MCU through this serial pins?

I'm posting the picture for perspective

enter image description here

Improve this question
3
  • 1
    does the device list an FCC ID?
    – Igor Skochinsky ♦
    Commented Feb 13, 2020 at 19:00
  • @IgorSkochinsky i'm afraid not, i found similar ones but i believe the MCU will be different.
    – Terramoto
    Commented Feb 14, 2020 at 9:30
  • hiiiiii, helppppp, can you get my the drivers of that controller??, like "backup drivers" from "Driver Easy Program" plsssss, i have a problem with the drivers of a chinese controller, and need exactly drivers of that thing (BM-829 (5028B) VER1.2") plsss pls plssss, can you DM me on twitter ("@twitter.com/johanestaenuso") or facebook ("JohanEsta EnUso") or here, pls pls pls, really need it :(((
    – yojan
    Commented Jun 4, 2021 at 4:11

2 Answers 2

Reset to default
1

I see the following possibilities:

  • intercept Bluetooth communication and inject bogus packets to crash the CPU firmware and hopefully achieve code execution. This is very difficult to do blindly though since you have only this UART and no other means of observation what happens inside.

  • there may be a strap pin that forces the chip to go into bootloader mode on startup which then may support commands for reading the flash or uploading code into RAM. Again, this is difficult without any documentation.

  • there may be JTAG pins or another diagnostic UART. It’s quite unlikely IMO that the board has no diagnostic options at all so try to trace where every pin of the CPU goes and see if you can discover a group of test pads.

Improve this answer
0

When you mention trying the EEPROM, is that IC5? It looks very much like a SPI flash IC. I would see about dumping the flash contents from it if that is not what you meant. Test which pins are VDD and VSS with a DMM, then see if you can find some datasheets for SOIC8 flash ICs that have the same power and ground pins. A Raspberry Pi is great for dumping spi flash content. Can you link to the EEPROM Dump?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.