E-ink displays are great, but working with them can still be a bit tricky if you aren’t an OEM. [Jasper Devreker] got his hands on three e-ink shelf displays to reverse engineer.
After cracking the tag open, [Devreker] found a CC2510 microcontroller running the show. While the spec sheet shows a debug mode, this particular device has been debug locked making reading the device’s code problematic. Undaunted, he removed the decoupling capacitor from the DCOUPL pin and placed a MOSFET between it and the ground pin to perform a voltage glitch attack.
A Pi Pico was used to operate the MOSFET over PIO with the chip overclocked to 250 MHz to increase the precision and duration of the glitch. After some testing, a successful glitch pathway was found, but with only a 5% success rate. With two successive glitches in a row needed to read out a byte from the device, the process is not a fast one. Data pulled so far has shown to be valid code when fed into Ghidra, and this project page is being updated as progress continues.
If you want to delve further into hacking e-ink price tags, checkout this deep dive on the topic or this Universal E-paper Sniffer.
8 thoughts on “Reverse Engineering E-Ink Price Tags”
I would absolutely LOVE to deploy these little tags across my garage/storage room, and pantry. (Making my inventory system that not only list what is where, but actually HIGHLIGHT what I’m looking for would be a pretty big bonus.) But I haven’t yet put in the work to find a system that I can just deploy. I’ve seen some reasonably priced screens on aliexpress – but they each need a $7 driver board that’s allegedly open-source, and serial…so that is a possible solution hiding beneath a project. I’d love to find some surplus and simply deploy it, though.
With a 50x overpowered resistor attached for the “highlighting” functionality.
I started (Yesterday) sticking custom stickers to all my storage containers with text and QR codes linking to an inventory website. Hope this will end my storage chaos!
Indexing the storage containers is clever. I assume you have an easy way to update the database when you add something new to a container? What are you using to do the database portion?
I’ve been wanting to do this, too. Seconding [Navarre’s] question concerning your DB solution.
I think a a dynamic QR library checkout type system would do wonders for me. I currently have a paper sheet attached to each of my storage boxes that at least tells me what should be in each box. Discrepancy almost always starts with me not returing things to their originating place. Often because I retrieve it from a really heavy location.
RFID led tags
Please be kind and respectful to help make the comments section excellent. (Comment Policy)