Cheap Smartwatch Teardown

A proper smartwatch can cost quite a bit of money. However, there are some cheap Bluetooth-connected watches that offer basic functions like show your incoming calls, dial numbers and display the state of your phone battery. Not much, but these watches often sell for under $20, so you shouldn’t expect too much.

Because they’re so cheap, [Lee] bought one of these (a U8Plus) and within an hour he had the case opened up and his camera ready. As you might expect, the biggest piece within was the rechargeable battery. A MediaTek MT6261 system on a chip provides the smart part of the watch.

[Lee] noticed some pads on the underside of the board. Two were marked as RXD and TXD, so he (correctly) assumed they would be a serial port. He also identified pads he thinks are for JTAG. Using a Bus Pirate, he was able to read the output from the serial port easily.

If you Google MT6261, you’ll see there are several ways to unlock and flash the chip that is essentially an ARM CPU with supporting I/O devices. That means for under $20 you could have a wearable development platform if you put in the work to get an adequate toolchain going. The MediaTek wiki would be a good place to start although it doesn’t list the MT6261 directly. A quick web search indicates that the MT6571 may be similar enough to get started.

Compared to other homebrew smartwatches that we’ve seen before, the U8Plus would make a very clean-looking build. Then again, maybe you want an obvious homebrew watch on your wrist.

30 thoughts on “Cheap Smartwatch Teardown

  1. Interesting that the board has pads for an EM shield over the SOC, but they skip it. They use the battery instead. I wonder if they bother with agency approvals, or just take their chances. Also pads for a flash memory (guess) that isn’t there. Maybe they crammed their firmware onto the chip and didn’t need external flash.

  2. I got a MT6261 one, please watch out for the firmware trouble, hope someone will make a nice wiki and forum. Because information is a bit everywhere. Basicly the Watches run an os called Nucleus RTOS. 0x00400000 (4MB/32Mb) norflash, and some apear to have a Winbond W25Q32BV. “If you go into engineering mode on your watch it will tell you that it has MRE. MRE stands for (MAUI Runtime Environment)MTK its self offers mre app development SDK.The apps are written in C
    http://developer.mediatek.com/mre/en
    https://web.archive.org/web/20150630

    There are quickstart tutorials out there, PLEASE make a backup first. also, my USB cable that came with it hat no working datalines, when you do have a working cable, turn the watch off. Insert it in the computer and it will see a “unkown” device, wich is Mediatek Vcom (drivers are outthere) wich is used for fixing a bricked device or just firmware. if no correct data is send, it will switch to USB storage mode (wich is empty with mine, maybe we can “fix” this) for 20bucks, its a MUST HAVE :D
    also, some datasheets for the MT6261 or 60 are actualy for the Smartphone one, these are actualy MT6261

    Hope some of you might like this, over at XDA there is quite more info. But its alott of digging. I hope to run something else than Nucleus, or “fix” some apps. Definitly fun to play with. http://forum.xda-developers.com/showthread.php?t=2657970&page=104

      1. Your welcome, and great teardown :D
        I realy miss the edit button, but I was trying to say, and you can see clearly in your pictures, its a MT6261DA. and im not sure, but a Lenovo X2-T0 is supposed to have one as-well (maybe we can check the FCC pictures already?)
        Alixpress is selling variations of the 6261 with other letter combos, quite intresting.

        by the way, I have a problem with mine, I cant make a backup yet because I keep getting a “S_FTHND_ROM_ENTRIES_CREATED_YET ( 5068 )”. So I hope we getting this awesome cheap watch more awesome. (people keep saying it was worthless, but they dint realize the “hacker/maker” community hasn’t found it yet… now…)

        1. if I could edit… check this video out from 31C3:

          Fernvale: An Open Hardware and Software Platform, Based on the Closed-Source MT6260 SoC [31c3]
          They got some kind of linux running but NuttX for sure :D (I wonder if the lcd and touch can be easy to implemement at least.) Serial is under the lcd.

  3. My watch-phone has a Mediatek 6261. There’s so many watches with a nice amount of peripherals available based on MTK chips. The only downside is the software is often pretty bad. Being able to write your own would be fantastic, it’d open up a whole world of development, smartwatch hacking! Really hope this goes somewhere.

  4. hi, great teardown – found this via google. I have a clone watch and noticed that in my watch – I do not have the small, round black object on top of the speaker(? I think that is what it is.. the large black rectangle next to the battery). What is that small round black circular object please?

  5. I tried reading back the ROM a second time, but it failed in the process. Now Windows reports a problem with the USB descriptor when I connect the watch to the laptop. Should I try to reflash it with a complete backup using a serial USB device connected to the RXD and TXD pads? Or have I bricked it somehow beyond repair?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s