A proper smartwatch can cost quite a bit of money. However, there are some cheap Bluetooth-connected watches that offer basic functions like show your incoming calls, dial numbers and display the state of your phone battery. Not much, but these watches often sell for under $20, so you shouldn’t expect too much.
Because they’re so cheap, [Lee] bought one of these (a U8Plus) and within an hour he had the case opened up and his camera ready. As you might expect, the biggest piece within was the rechargeable battery. A MediaTek MT6261 system on a chip provides the smart part of the watch.
[Lee] noticed some pads on the underside of the board. Two were marked as RXD and TXD, so he (correctly) assumed they would be a serial port. He also identified pads he thinks are for JTAG. Using a Bus Pirate, he was able to read the output from the serial port easily.
If you Google MT6261, you’ll see there are several ways to unlock and flash the chip that is essentially an ARM CPU with supporting I/O devices. That means for under $20 you could have a wearable development platform if you put in the work to get an adequate toolchain going. The MediaTek wiki would be a good place to start although it doesn’t list the MT6261 directly. A quick web search indicates that the MT6571 may be similar enough to get started.
Compared to other homebrew smartwatches that we’ve seen before, the U8Plus would make a very clean-looking build. Then again, maybe you want an obvious homebrew watch on your wrist.
here is a youtube video where i had made a teardown of the watch too
https://www.youtube.com/watch?v=XMPzY1u6HUk
Thanks man! Always love watching teardown videos.
Nothing better than constructive descruction… ;-)
the page falls apart if you have scripting turned off, in a very weird way
How is it different from this? http://imgur.com/IyjMxxh
It is the same watch.
He found RXD and TXD, but then I saw D+ and D- too, so it’s got USB too ?
it has a full usb plug on the side so you can connect it directly to a computer to transfer files and make formware upgrades
sovyou dont need an soldering iron for that
*firmware
*so you
sry i am writing on a chuwi tablet its a little bit harder
:D
You forgot the “an soldering iron” mistake. Correct all or nothing, sir.
what would is from with “an soldering iron” ?
my main language is german and i am not even good at this, so please forgive my unknowing
have a nice day.
More info on the MT6261 can be found in the Fernvale topic over at the Kosagi forum (http://www.kosagi.com/forums/)
Thats… actualy very very intresting. They confirmed my ideas on the diferent MT6261 out there (basicly it could mean, MT6261M external and DA internal flash)
I … need to dig in that forum some more. (Cheap watch anyway)
Interesting that the board has pads for an EM shield over the SOC, but they skip it. They use the battery instead. I wonder if they bother with agency approvals, or just take their chances. Also pads for a flash memory (guess) that isn’t there. Maybe they crammed their firmware onto the chip and didn’t need external flash.
What is the difference between the U8 and the U8plus? U8 seems to be even more cheaper on the internet and it’s based on the MT6260. That’s the only thing I could find out.
Seems like Bluetooth 4.0 + more iPhone support. http://www.u8watch.net/U8Plus.html vs http://www.u8watch.net/
I got a MT6261 one, please watch out for the firmware trouble, hope someone will make a nice wiki and forum. Because information is a bit everywhere. Basicly the Watches run an os called Nucleus RTOS. 0x00400000 (4MB/32Mb) norflash, and some apear to have a Winbond W25Q32BV. “If you go into engineering mode on your watch it will tell you that it has MRE. MRE stands for (MAUI Runtime Environment)MTK its self offers mre app development SDK.The apps are written in C
http://developer.mediatek.com/mre/en
https://web.archive.org/web/20150630”
There are quickstart tutorials out there, PLEASE make a backup first. also, my USB cable that came with it hat no working datalines, when you do have a working cable, turn the watch off. Insert it in the computer and it will see a “unkown” device, wich is Mediatek Vcom (drivers are outthere) wich is used for fixing a bricked device or just firmware. if no correct data is send, it will switch to USB storage mode (wich is empty with mine, maybe we can “fix” this) for 20bucks, its a MUST HAVE :D
also, some datasheets for the MT6261 or 60 are actualy for the Smartphone one, these are actualy MT6261
Hope some of you might like this, over at XDA there is quite more info. But its alott of digging. I hope to run something else than Nucleus, or “fix” some apps. Definitly fun to play with. http://forum.xda-developers.com/showthread.php?t=2657970&page=104
That’s excellent – thanks :)
Your welcome, and great teardown :D
I realy miss the edit button, but I was trying to say, and you can see clearly in your pictures, its a MT6261DA. and im not sure, but a Lenovo X2-T0 is supposed to have one as-well (maybe we can check the FCC pictures already?)
Alixpress is selling variations of the 6261 with other letter combos, quite intresting.
by the way, I have a problem with mine, I cant make a backup yet because I keep getting a “S_FTHND_ROM_ENTRIES_CREATED_YET ( 5068 )”. So I hope we getting this awesome cheap watch more awesome. (people keep saying it was worthless, but they dint realize the “hacker/maker” community hasn’t found it yet… now…)
if I could edit… check this video out from 31C3:
https://www.youtube.com/watch?v=msrTR3hNDQM
Fernvale: An Open Hardware and Software Platform, Based on the Closed-Source MT6260 SoC [31c3]
They got some kind of linux running but NuttX for sure :D (I wonder if the lcd and touch can be easy to implemement at least.) Serial is under the lcd.
Found with Google : MT6260 technical brief => http://www.mikrocontroller.net/attachment/242886/datasheet.pdf
solid video. I really enjoyed when you were opening this watch part by part. I’ve new experienced about this.
Interesting. Any idea where we a can get those small touchscreens at reasonable prices? Tried Aliexpress but wasn’t successful
Yes, I’ve been trying to do so myself. No luck so far…
My watch-phone has a Mediatek 6261. There’s so many watches with a nice amount of peripherals available based on MTK chips. The only downside is the software is often pretty bad. Being able to write your own would be fantastic, it’d open up a whole world of development, smartwatch hacking! Really hope this goes somewhere.
hi, great teardown – found this via google. I have a clone watch and noticed that in my watch – I do not have the small, round black object on top of the speaker(? I think that is what it is.. the large black rectangle next to the battery). What is that small round black circular object please?
It’s a vibrating motor. (My U8-clone doesn’t support vibration, but that seems to be a software problem.)
I tried reading back the ROM a second time, but it failed in the process. Now Windows reports a problem with the USB descriptor when I connect the watch to the laptop. Should I try to reflash it with a complete backup using a serial USB device connected to the RXD and TXD pads? Or have I bricked it somehow beyond repair?
Long-hold the reset button on the back (the hole in the metal back-plate) and it will restore the original flash (probably from ROM?)
These watches are now being dumped at under $10, this is the BT 3 version, but it is the Android App that is a real security issue. http://securityaffairs.co/wordpress/44987/mobile-2/smartwatch-with-backdoor.html
But for $10 that is still a great deal on misc spare parts for some hack.
Mediatek 6261 is also used in cheap SIM800L modules (~3.6$). So would be grate, to be able to tear down, also a software for it and have similar ecosystem like in esp8266 but for GSM.