Skip to content

Latest commit

 

History

History
223 lines (168 loc) · 8.16 KB

re.md

File metadata and controls

223 lines (168 loc) · 8.16 KB

Home | Reverse engineering | BTMD v0.1 - v0.2 - v0.3 - v0.4 | References

Reverse engineering

Bluetooth modules

Receivers used for testing

  • Anker SoundCore 2 speaker
  • Apple AirPods Pro, 1st generation

"KCX_BT_Transmitter"

Playing around with AT Commands

9600 bps, 8N1, no EOL char

AT+ // Just to make sure transmission is good
AT+REST // Reset - and this will start scanning
AT+DISCON // even though you are not connected
AT+DELVMLINK // erase saved memory of prior connection
AT+VMLINK? // view VM Links in saved memory (should be none)

AT+SCAN

AT+CONADD=0x08ebed1d110c // Anker SoundCore 2
AT+CONADD=0x0c3b50a0e8aa // Apple AirPods Pro
Attempts to set the volume

🚫 Testing was abandoned when no successful connections could be established.

Scosche Flytunes

Manufacturer website

Initial tests
  • Anker SoundCore 2:
    • Successful connection on first attempt! 🎉
  • AirPods Pro
    • Finding the correct timing to press the pairing buttons on both devices was tricky
    • Successful connection after a few attempts
    • Auto-reconnect after power cycling 🎉
Misc. notes

✅ Selected for use in BTMD prototype

Other candidates (not tested)

TaoTronics TT-BA07
  • Manufacturer website
  • Supposedly works with Apple AirPods --> to be tested
  • Bluetooth version... 5.0? 4.1?
iLuv AirFree
Hagibis X3
Aluratek AirStream
1Mii ML400
  • Manufacturer website
  • Bluetooth 5.0
  • claimed AirPods compatible
  • nice small form factor, no battery, only USB-C power

Minidisc internals

See references page for schematics and other useful documents.

Sony MZ-R500 (minidisc.org, MiniDisc wiki) was chosen for its wide availability and reasonable second-hand price.

Potential power rails for Bluetooth

GND

Potential access points:

  • Main chassis ground?
  • AP609
  • S801 (Hold switch)
  • TP910
"VG"
  • Listed as 7.3V in schematic diagram.
  • Measured as 6.6V @ AP914 against hold switch GND
  • Measured as 7.0V @ C608

Potential access points:

  • IC601 - VG (pin 36)
  • IC701 - VG (pin 23)
  • IC901 - VG (pin 19)
  • C608 +
  • C920
  • D903 - (to LG)
  • AP914

Other thoughts:

  • IC901 Block diagram: IC901 "generates" VG (19) from LG (18), referenced toPGND2 (17).
  • PGND2 as ideal GND point? TP910 is relatively close to IC901 where VG is generated...
  • Overall block diagram: IC901 VG is output, LG is direct battery voltage "VB" for headphone amp (IC302), Motor/Coil drive (IC701), System controller (IC801) via L904.
  • D903 (MA729-TX Schottky) links LG (anode) to VG (cathode).
"LG"

Comes directly from battery +

  • IC901 pin 18
  • IC701
    • VM1 (pin 7)
    • VMU (pin 49)
    • VWVW (pin 45)
    • All three seem to be high sides of H-bridge drivers:
      • VM1 for RO1, FO1, RO2, FO2 etc. (focus and tracking coil drive)
      • VMU and VWVW for U0, V0, W0 (M601, spindle)

Potential acces points:

  • AP951
  • AP952
  • AP726

Pairing button

  • End Search is most promising because it is unnecessary for normal operation of MD player. Auto End Search can be configured in settings menu.
  • REC could be another good candidate if recording functionality is not deemed relevant.
  • Use RC circuit to force longer button push for pairing?
  • Somehow respect state of Hold slider?
  • Photograph button PCB against white screen -> good contrast of traces
    • Single layer board
    • Lots of 000 0 Ohm resistors as bridges
    • Multiplexed? Resistor ladder? No idea
    • Measure PAUSE, SET KEY 1, SET KEY 2 aka. D1, D2, D3
  • Trace nets from End Search button down to FFC
    • Pin 2: DGND
    • Pin 6: SET KEY 1
  • Try scraping off soldermask on marking in corner -> works
  • Scrape off soldermask on trace of button ring
  • Remove protective foil around test point of trace of button center
  • Cut traces to rest of button PCB

Audio out

  • Test using sine / square wave MP3 file playing on MD in a loop -> youtube file 440 Hz for 1 hour
  • How to control volume (especially on AirPods)?
    • Tap volume buttons and somehow send to BT chip?
    • Force volume to max / medium on BT chip and rely on MD player volume setting
  • Which line to tap?
    • IC801 - AOUTL (29), AOUTR (30) ... maybe line level suitable for BT chip?
    • IC302 - IN L (22), IN R (21) ... same as above? --> TBD
    • IC302 - OUT L (2), OUT R (4) ... coupled to headphone jack via C and R
  • Tap appropriate ground potential!

Open/Close Detect Button

  • S806 is depressed by the front shell when the player is closes
    • no debugging possible without closing the shell
    • Depressing the button with a shim is cumbersome/fiddly
    • Added jumper wire between AP806 (OPEN CLOSE SW) and AP609 (GND)
    • Will leave wire detached from AP806, but installed for safety and easy bridging during future debugging
      • Marked with black circle on kapton tape

Workbench photos