1

Lately I've bought a localisation tag (Apple AirTag alike). When I click a button on my cell phone, the device plays a chiptune-like ringtone. The ringtone is configurable using the app and stored on the tag itself – I confirmed that by comparing firmware dumps before and after changing the ringtone.

To dump the firmware, I connected to the chip SWD interface. The chip is NRF52820 Nordic Semiconductor Bluetooth SoC. I used STLinkV2 together with OpenOCD to dump its memory – manually 256 kB starting from 0.

My goal is to patch this ringtone and upload back to the device, but it surprisingly doesn't work. There is a reddit post describing the chiptune binary format – that's why I know which parts I can edit. So basically:

  1. I dump the firmware.
  2. I change the chiptune using android app
  3. I dump the firmware again.
  4. The changed tune can be found in two places in flash memory (not sure why two). There are also smaller changes in other parts of memory, but also duplicated, so it looks like:
dump1:
address a: somedata_1
address b: somedata_2
address c: chiptune_data
address d: somedata_1
address e: somedata_2
address f: chiptune_data

dump2:
address a: altered_somedata_1
address b: altered_somedata_2
address c: altered_chiptune_data
address d: altered_somedata_1
address e: altered_somedata_2
address f: altered_chiptune_data
  1. I push a button in the Android app and hear that the tune has in fact changed.
  2. I patch the area of code at addresses "c" and "f" to repeating two notes - multiple occurences of "4b 0a 52 0a" to cover the modified ringtone, to break this tune
  3. I program the patched firmware and verify it is successfully written to flash
  4. I turn off devices power to ensure that nothing stays in SRAM
  5. I turn it back on and dump the firmware again to ensure again that flash is modified
  6. I push the button in app and hear the second ringtone, not the modified "chirp"
  7. I dump the firmware for the third time, still my changes are present. It doesn't look like a ringtone is uploaded every time I call the tag - while changing ringtone in settings it takes a longer time to upload than when I call it, moreover, the firmware does not have the changed ringtone.

It looks like there is no way that the old ringtone is on the device anymore(at least in its plain form), yet it plays it.

  1. What am I doing wrong?
  2. Also, why would the same data be stored in two parts of flash at the same time? Or maybe there is a certain type of protection on the chip i don't know about that shuffles the memory addressing?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.