I have a bluetooth speaker. Infinity Fuze 100.
It's a good speaker.
But it has annoying messages on startup and shutdown. And for other interface events. I'd like to either get rid of them entirely, or replace them with simple beeps, instead of wordy messages.
I'm confident if I can get the firmware binary I should be able to patch it the way I want. I do have experience reversing software successfully.
This is my first attempt at hardware hacking however and I'm a bit stuck.
What I've tried so far:
1 - Looked up online if this speaker has a service mode. So I could just connect it via usb, set it to service mode and read/write firmware. Some speakers do have this. According to its manual, this speaker doesnt seem to.
2 - I tried holding down various button combinations hoping some combo will put it into a service mode that may be undocumented in the manual. Din't work.
3 - Read online maybe I need to manually get at the firmware using something called JTAG, so I opened up the speaker and took out the board to inspect it. Here are its front and back:
4 - I can't see an obvious JTAG interface. So I looked up the data sheet for the main chip : ATS2815, which seems to be a fully integrated blue tooth audio chip.
Even though I looked at its pin layout, I can't figure out if JTAG is present?
5 - I also looked up the chip XT25F08B, and that seems to be a NOR flash memory. Here is the data sheet.
What I'm wondering is:
- Where is the JTAG interface? Am I missing something obvious?
- My guess is that the firmware must reside on XT25F08B flash memory. Is this correct?
- If it is true, then is there a simple and direct way to read/write this memory without bothering with JTAG (if it's not present or can't be figured out)?
Maybe all this is entirely the wrong approach, and there is another way to get at the firmware?