4

I'm trying to reverse engineer a solar powered chanting lotus flower so that I might replace the built in audio with something more interesting. The main chip (JL16B-083A - haven't been able to find any info on it) draws data from a 16MB flash that contains about 4.5 hours of audio. This averages somewhere near 8kbit/sec, putting us in speech codec territory. There are 3 differnet "tracks", and I'm looking for help to identify or reverse engineer the specific audio format.

I've extracted the ROM and using a logic analyzer have determined where it gets read and how often - while playing it seems to draw down 6 bytes in rapid succession, 2 bytes after a 20μs pause, 2 more bytes 72μs later, then does a variable amount of 2 bytes reads (around 11-20ish) every 35-110μs. These cycles repeat differently for every track - 39ms for track 1, 19ms for track 2, and 39ms or so for track 3. This seems to imply that we have a variable rate codec and the tracks are of diffrent bitrates, but the same codec across all tracks.

This thing was built to cost in China so I'd be shocked if they didn't just use an off the shelf codec... I was thinking something like MP3 or maybe even G729 as the audio quality isn't exactly stellar, but I haven't been able to tease out anything recognizealbe when I try raw imports to Audacity or VLC... Looking at the data in a hex editor doesn't show any evidence of MPEG frames, but its possible that it's somehow XOR encrypted or otherwise obfuscated... All it seems to do to validate it's found a track after looking at the address table is look at the first 2 bytes, which are always 4B 00. So whatever it is isn't readily recognized on a PC.

Anyone come across this kind of thing before? ROM and logic traces are here, low production values YouTube showing the thing in detail is here - would appreciate any insights peolpe might have to help further this mission!

2
  • Not sure if helpful but if you look for strings and the corresponding hex then you'll find some patterns of strings/hex which are repeated quite often. Next to those you then find some other repeating hex patterns.
    – secfren
    Mar 17, 2023 at 22:10
  • I know this sound stupid, but here is the SDK for another JL chip. You might want to take a look at it to find if there is any custom audio encoding there.
    – raspiduino
    Mar 18, 2023 at 8:19

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.