back to index

Reverse engineering: MP4 Watch

MP4 Watch

The MP4 Watch is a portable audio/video player in a wristwatch format. Available e.g. from ThinkGeek. Manufactured in (where else?) China by Brando.

The watch tested is based on NX5850, a 12 MHz SoC 8051-compatible microcontroller. According to the datasheet, the firmware should be upgradeable through the USB port. The datasheet describes this process. The chip is made by NexiaDevice.

The watch display stays normally off. When the right bottom button is pressed briefly, the display lights up and shows current time.

The watch clock accuracy is fairly decent. No data were measured yet.

The device form factor is surprisingly practical. The headphone cable however has to be pulled through the shirt sleeve, which may be a little annoying during dressing up. The connector is also easy to pull out, which leads to frequent disconnections during dressing up. A workaround is tying a knot on the cable right next to the connector and use a short piece of wire to tie it to the waistband, holding it in.

The drawbacks are chiefly the proprietary USB connector, the 2.5mm audio jack instead of standard 3.5mm, the behavior during showing lyrics .lrc files, and only USB1.1 speed (despite misleading USB2.0 compatibility - but while it supports USB2.0 protocol, the SoC does not support High-Speed, only Full-Speed (only watches based on types NX5850 and NX5855; type NX5856 is High-Speed)). Also the audio recording would be beneficial if it could be started with just e.g. a long press of one of the buttons; getting through menus in certain tactical situations is rather counterproductive. Otherwise it is a marvelous little device. Some of the drawbacks could be eliminated easily, if Brando would be willing to release source code and bootloader.

NexiaDevice, however, advertises "user-friendly Firmware Development Kits", so maybe there's hope in asking them. The NX5850 chip appears hackable, having accessible pins. The NX5856 one is however a BGA, therefore hacking it will not be so easy.

Inside

The back of the device is attached by four tiny screws. After their removal, the lid can be popped open. Most of the volume is unsurprisingly consumed by 250 mAh 3.7V lithium battery. The battery is glued to the system board underneath, so it wouldn't rattle. To the system board it is attached by two wires, conveniently colored red and black. This makes it easy to replace in case it loses capacity, which happens with age to lithium batteries with disconcerting regularity.

The system board is attached by a single even tinier screw on one side and two plastic "teeth" on the other side. Its back side contains some parts related to the battery, the USB and headphone connectors, and a tiny electret microphone located behind the headphone connector. Also the Flash ROM (Samsung brand) and the audio codec (Cirrus 42L51C, low-power 24bit 96 kHz stereo ADC/DAC codec with headphone amplifier) is located here.

After removal of the last remaining screw, the system board was removed from the case. The buttons on the sides needed to be slightly pressed as the white insets with pushbuttons were a little in the way. The other side of the system board features mainly the NX5850, a 12 MHz SoC 8051-compatible microcontroller. The 128x128 OLED display is soldered to the board by a flat ribbon cable.

Reassembly was easy and successful.

th.backside
Unopened backside
th.opened-with-battery
Lid opened
th.opened-without-battery
Battery removed
th.system-board-top
System board top
th.system-assembly-naked
Entire internal assembly

Interface information

File formats

Music

The watch is able to handle music files in MP3 and WMA (incl. [?:Janus_(DRM)|WMA-9 DRM], aka PD-DRM) formats. Files (MP3 and WMA w/o DRM) can be loaded from any operating system able to mount an USB Storage device. DRM-crippled files were not tested with the device.

LRC files

Music can be acompanied with optional lyrics files, in standard LRC format. These have the same file name and directory as the music file, with .lrc extension instead of .mp3.

The device's support for LRC files has however a few quirks:

A highly annoying misfeature is missing fastforward/rewind within the file being played when lyrics is shown. Prolonged pressing of the ffwd/rev buttons, normally leading to change of the offset being played, has no effect. The previous/next file skipping is still supported.

An improvised generator for LRC files can be obtained here.

Images

Uses its own proprietary format. Uncompressed. Conversion software (Windows-only) is included on an installation CD.

Images are stored on the device in "/picture" directory. Copy of demo files shipped with the device is here.

The images are all of identical size, 32768 bytes; for 128x128 display resolution this equals 2 bytes per pixel, suggesting uncompressed 16-bit color depth format. I assume 565 RGB format. Image converter is available in the video converter package linked below.

Video

Uses its own proprietary format. Uncompressed (therefore video files are VERY large). Conversion software (Windows-only) is included on an installation CD.

One short demo file is shipped with the device, as /Bear.nxv (Bear.nxv, 6,792,704 bytes).

Video files can be stored anywhere in the directory structure. After playing a video file, playing is terminated and no next file is played.

Assumption is that the same uncompressed 2-bytes-per-pixel file format as for images is used for video frames, with some sort of interlacing with MP3-encoded audio frames.

Detailed description of the NXV format is at MultimediaWiki.

Converter files for linux/BSD are here - a set of perl and shell scripts utilizing the ffmpeg script.

Cable and connector

USB-A connector numbered as in wikipedia.
Device-specific connector numbered with 1 on the right, the shorter end of the trapezoid at the top, looked against the cable end of a connector. (1 on the left for the device.)

The proprietary connector pinout was reverse-engineered by measuring the connections on the cable. A thin piece of stripped enameled copper wire had to be used to reach the pins in the device-side cable connector due to their annoyingly tiny size.

The connector is probably the Mini USB 8P (Mini B 8 Pin) one. No idea if the pinout is universal; reports are conflicting.

PinUSB pinSignal
11USB +5V
22USB D-
34USB GND
43USB D+
8shieldconnected to shield of both connectors

8 7 6 5 4 3 2 1


1 2 3 4 5 6 7 8

System information

The disk is formatted as standard FAT32. The interface is a standard USB Storage class.

The watch appears as a normal USB drive /dev/sdx device. Caution: it has no partition table, the device has to be mounted directly (therefore "mount /dev/sdx" will work, "mount /dev/sdx1" will not work).

The filesystem details are as follows:

minfo output

device information:

=================== filename="/dev/sde" sectors per track: 63 heads: 255 cylinders: 258

mformat command line: mformat -t 258 -h 255 -s 63 m:

bootsector information ====================== banner:"MSDOS5.0" sector size: 512 bytes cluster size: 8 sectors reserved (boot) sectors: 36 fats: 2 max available root directory slots: 0 small size: 0 sectors media descriptor byte: 0xf8 sectors per fat: 0 sectors per track: 63 heads: 255 hidden sectors: 0 big size: 4129792 sectors physical drive id: 0x0 reserved=0x0 dos4=0x29 serial number: 180FDAA5 disk label="NO NAME " disk type="FAT32  " Big fatlen=4026 Extended flags=0x0000 FS version=0x0000 rootCluster=2 infoSector location=1 backup boot sector=6

Infosector: signature=0x41615252 free clusters=140375 last allocated cluster=50277

Boot sector hexdump: 000  eb 58 90 4d 53 44 4f 53 35 2e 30 00 02 08 24 00 .X.MSDOS5.0...$. 010  02 00 00 00 00 f8 00 00 3f 00 ff 00 00 00 00 00 ........?....... 020  00 04 3f 00 ba 0f 00 00 00 00 00 00 02 00 00 00 ..?............. 030  01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 040  00 00 29 a5 da 0f 18 4e 4f 20 4e 41 4d 45 20 20 ..)....NO NAME 050  20 20 46 41 54 33 32 20 20 20 33 c9 8e d1 bc f4  FAT32  3..... 060  7b 8e c1 8e d9 bd 00 7c 88 4e 02 8a 56 40 b4 08 {......|.N..V@.. 070  cd 13 73 05 b9 ff ff 8a f1 66 0f b6 c6 40 66 0f ..s......f...@f. 080  b6 d1 80 e2 3f f7 e2 86 cd c0 ed 06 41 66 0f b7 ....?.......Af.. 090  c9 66 f7 e1 66 89 46 f8 83 7e 16 00 75 38 83 7e .f..f.F..~..u8.~ 0a0  2a 00 77 32 66 8b 46 1c 66 83 c0 0c bb 00 80 b9 *.w2f.F.f....... 0b0  01 00 e8 2b 00 e9 48 03 a0 fa 7d b4 7d 8b f0 ac ...+..H...}.}... 0c0  84 c0 74 17 3c ff 74 09 b4 0e bb 07 00 cd 10 eb ..t.<.t......... 0d0  ee a0 fb 7d eb e5 a0 f9 7d eb e0 98 cd 16 cd 19 ...}....}....... 0e0  66 60 66 3b 46 f8 0f 82 4a 00 66 6a 00 66 50 06 f`f;F...J.fj.fP. 0f0  53 66 68 10 00 01 00 80 7e 02 00 0f 85 20 00 b4 Sfh.....~.... .. 100  41 bb aa 55 8a 56 40 cd 13 0f 82 1c 00 81 fb 55 A..U.V@........U 110  aa 0f 85 14 00 f6 c1 01 0f 84 0d 00 fe 46 02 b4 .............F.. 120  42 8a 56 40 8b f4 cd 13 b0 f9 66 58 66 58 66 58 B.V@......fXfXfX 130  66 58 eb 2a 66 33 d2 66 0f b7 4e 18 66 f7 f1 fe fX.*f3.f..N.f... 140  c2 8a ca 66 8b d0 66 c1 ea 10 f7 76 1a 86 d6 8a ...f..f....v.... 150  56 40 8a e8 c0 e4 06 0a cc b8 01 02 cd 13 66 61 V@............fa 160  0f 82 54 ff 81 c3 00 02 66 40 49 0f 85 71 ff c3 ..T.....f@I..q.. 170  4e 54 4c 44 52 20 20 20 20 20 20 00 00 00 00 00 NTLDR ..... 180  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 190  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 1a0  00 00 00 00 00 00 00 00 00 00 00 00 0d 0a 52 65 ..............Re 1b0  6d 6f 76 65 20 64 69 73 6b 73 20 6f 72 20 6f 74 move disks or ot 1c0  68 65 72 20 6d 65 64 69 61 2e ff 0d 0a 44 69 73 her media....Dis 1d0  6b 20 65 72 72 6f 72 ff 0d 0a 50 72 65 73 73 20 k error...Press 1e0  61 6e 79 20 6b 65 79 20 74 6f 20 72 65 73 74 61 any key to resta 1f0  72 74 0d 0a 00 00 00 00 00 ac cb d8 00 00 55 aa rt............U.

lsusb -v output

Bus 003 Device 010: ID 1718:1013

Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.10 bDeviceClass 0 Interface bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0  64 idVendor 0x1718 idProduct 0x1013 bcdDevice 1.00 iManufacturer 1 iProduct 2 iSerial 3 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 32 bNumInterfaces 1 bConfigurationValue 1 iConfiguration 0 bmAttributes 0x80 (Bus Powered) MaxPower 100mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 8 Mass Storage bInterfaceSubClass 5 SFF-8070i bInterfaceProtocol 80 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81  EP 1 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040  1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02  EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040  1x 64 bytes bInterval 0 Device Status: 0x0003 Self Powered Remote Wakeup Enabled

TODO

WISHLIST

Firmware source code.


If you have any comments or questions about the topic, please let me know here:
Your name:
Your email:
Spambait
Leave this empty!
Only spambots enter stuff here.
Feedback: