Chinese smartwatch AN1 Smart Watch

Box

Hello, fans of Chinese and not very good gadgets. I'm sure many are fed up with this endless stream of faceless tablets, especially, for example, companies like Google draw in price and quality trims his Nexus, making the acquisition of another Chinese know name of tablet dubious proposition.
Guarantee — in this review of tablets will not. While everyone is looking forward to a new wave of wearable devices, namely smartwatches from Apple, Motorola, LG and others, the Chinese do not have a long pull and urgently released their version of the smartwatch, a sample of which fell into my hands.

Meet 100% know name smartwatch — SmartWatch AN1.
Spoiler: at the end of the review it will get hacked.

History


If you ever do a review of anything on habré, then be sure that sooner or later you will knock on the PM good Chinese and will offer to tell habru about a particular gadget, and the choice of a hoo what wide: than tablets, as you know, in their dull warehouses no of items for I. T. no. A Chinese tablets review, especially on habré — it ignoble, starting in 2012.
But this time, my lucky day: cute girl asked me to look at their smart watch and, if interested, to make a survey. Of course, because the topic of Wearables I care about for a long time, but here such a case fell to evaluate the Chinese approach. April 23, shipped via Singapore, may 19, on our mail, quite quickly. Most of the photos are clickable.

Parcel
Figure 1. Well they fill in the Declaration. Hopefully, the contents
sacred boxes will pull more than the MP4 player for $0.06.


scope and characteristics


With the characteristics of a strange situation: on the, on the box, and in fact the characteristics differ.
the the the the the the the
OS Android 4.0.4, on the box and in firmware is 4.1.1
CPU 1GHz, Single Core, MT6515 ARMv7, graphics: OpenGL ES 1.1, PowerVR SGX 531, AnTuTu score: 5855
Memory 512M RAM, 4GB NAND flash (markup, such that there are about 512M — half on /system and /data)
Display 2", 320x240, TFT capacitive (5 points)
Communication GSM, EDGE, GPS, FM, Bluetooth 3.0, WiFi b/g/n (chip MT6628)
Slots and ports microUSB, microSD, SIM
dimensions 60 x 41 x 15, 72g with battery (900mAh, Lithium, 3.7 V)
Specification on the box
fake Box spec

Dump build.prop
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=IMM76D
ro.build.display.id=ALPS.ICS2.MP.V1.18
ro.build.version.incremental=eng.lt.1395940871
ro.custom.build.version=1395940871
ro.build.version.sdk=15
ro.build.version.codename=REL
ro.build.version.release=4.1.1
ro.build.date=Fri Mar 28 01:23:10 CST 2014
ro.build.date.utc=1395940990
ro.build.type=user
ro.build.user=lt
ro.build.host=ubuntu
ro.build.tags=test-keys
ro.product.model=AN1
ro.product.brand=XINGHAN
ro.product.name=F9-2S
ro.product.device=F9-2S
ro.product.board=XINGHAN
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=XH_F9
ro.product.locale.language=zhr
ro.product.locale.region=CN
ro.Wi-Fi access.channels=
ro.board.platform=
# ro.build.product is obsolete; use ro.product.device
ro.build.product=F9-2S
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=fise15_ics2-user 4.0.4 IMM76D eng.lt.1395940871 test-keys
ro.build.fingerprint=alps/fise15_ics2/fise15_ics2:4.0.4/IMM76D/1395940871:user/test-keys
ro.build.flavor=
ro.build.characteristics=default
persist.sys.timezone=Asia/Shanghai
# end build properties

# begin mediatek build properties
ro.mediatek.version.release=ALPS.ICS2.MP.V1.18
ro.mediatek.platform=MT6575
ro.mediatek.chip_ver=S01
ro.mediatek.version.branch=ALPS.ICS2.MP
# end mediatek build properties
#
# system.prop for generic sdk
#

rild.libpath=/system/lib/mtk-ril.so
rild.libargs=-d /dev/ttyC0


# MTK, Infinity, 20090720 {
Wi-Fi access.interface=wlan0
# MTK, Infinity, 20090720 }

# MTK, mtk03034, 20101210 {
ro.mediatek.wlan.wsc=1
# MTK, mtk03034 20101210}
# MTK, mtk03034, 20110318 {
ro.mediatek.wlan.p2p=1
# MTK, mtk03034 20110318}

# MTK, mtk03034, 20101213 {
mediatek.wlan.ctia=0
# MTK, mtk03034 20101213}


# MTK, TeChien {
ro.media.enc.the hprof.file.format=3gp
ro.media.enc.the hprof.codec.vid=m4v
ro.media.enc.the hprof.vid.width=720

ro.media.enc.the hprof.vid.fps=30
ro.media.enc.the hprof.vid.bps=3400000
ro.media.enc.the hprof.codec.aud=amrnb
ro.media.enc.the hprof.aud.bps=12200
ro.media.enc.the hprof.aud.ch=1
ro.media.enc.the hprof.aud.hz=8000

ro.media.enc.mprof.file.format=3gp
ro.media.enc.mprof.codec.vid=m4v
ro.media.enc.mprof.vid.width=352
ro.media.enc.mprof.vid.height=288
ro.media.enc.mprof.vid.fps=30
ro.media.enc.mprof.vid.bps=990000
ro.media.enc.mprof.codec.aud=amrnb
ro.media.enc.mprof.aud.bps=12200
ro.media.enc.mprof.aud.ch=1
ro.media.enc.mprof.aud.hz=8000

ro.media.enc.lprof.file.format=3gp
ro.media.enc.lprof.codec.vid=h263
ro.media.enc.lprof.vid.width=176
ro.media.enc.lprof.vid.height=144
ro.media.enc.lprof.vid.fps=30
ro.media.enc.lprof.vid.bps=384000
ro.media.enc.lprof.codec.aud=amrnb
ro.media.enc.lprof.aud.bps=12200
ro.media.enc.lprof.aud.ch=1
ro.media.enc.lprof.aud.hz=8000
# MTK, TeChien }

#
Wi-Fi access.tethering.interface=ap0
#

ro.opengles.version=131072

Wi-Fi access.direct.interface=p2p0
dalvik.vm.heapgrowthlimit=64m
dalvik.vm.heapsize=128m


# Encrypt phone function
ro.crypto.tmpfs_options=mode=0771,uid=1000,gid=1000
ro.crypto.fs_type=ext4
ro.crypto.fs_real_blkdev=/emmc@usrdata
ro.crypto.fs_mnt_point=/data
ro.crypto.fs_options=noauto_da_alloc
ro.crypto.fs_flags=0x00000406

# audio
ro.camera.sound.forced=0
ro.audio.silent=0

# USB Config Type
ro.sys.usb.storage.type=mtp,mass_storage

# USB MTP WHQL
ro.sys.usb.mtp.whql.enable=0

# Power off opt in IPO
sys.ipo.pwrdncap=2

ro.sys.usb.storage.type=mtp,mass_storage

#
# ADDITIONAL_BUILD_PROPERTIES
#
fmradio.driver.chip=3
ril.external.md=1
ro.sf.hwrotation=0
ril.current.share_modem=1
launcherplus.allappsgrid=2d
launcher2.allappsgrid=3d_20
curlockscreen=2
ro.mediatek.gemini_support=false
drm.service.enabled=true
fmradio.driver.enable=1
mediatek.wlan.chip=MT6628
mediatek.wlan.module.postfix=_mt6628
dalvik.vm.mtk-stack-trace-file=/data/anr/mtk_traces.txt
ro.config.notification_sound=OnTheHunt.ogg
ro.config.alarm_alert=Alarm_Classic.ogg
ro.config.ringtone=Backroad.ogg
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt

Specification NAND
image

Markup NAND
[PART] blksz: 2048B
[PART] [0x0000000000000000-0x000000000003FFFF] "PRELOADER" (128 blocks)
[PART] [0x0000000000040000-0x00000000000FFFFF] "DSP_BL" (384 blocks)
[PART] [0x0000000000100000-0x00000000003FFFFF] "NVRAM" (1536 blocks)
[PART] [0x0000000000400000-0x000000000041FFFF] "SECCNFG" (64 blocks)
[PART] [0x0000000000420000-0x000000000047FFFF] "UBOOT" (192 blocks)
[PART] [0x0000000000480000-0x000000000097FFFF] "BOOTIMG" (2560 blocks)
[PART] [0x0000000000980000-0x0000000000E7FFFF] "RECOVERY" (2560 blocks)
[PART] [0x0000000000E80000-0x0000000000F9FFFF] "SECSTATIC" (576 blocks)
[PART] [0x0000000000FA0000-0x0000000000FFFFFF] "MISC" (192 blocks)
[PART] [0x0000000001000000-0x00000000012FFFFF] "LOGO" (1536 blocks)
[PART] [0x0000000001300000-0x000000000139FFFF] "EXPDB" (320 blocks)
[PART] [0x00000000013A0000-0x000000000FE9FFFF] "ANDSYSIMG" (120320 blocks)
[PART] [0x000000000FEA0000-0x0000000011C9FFFF] "CACHE" (15360 blocks)
[PART] [0x0000000011CA0000-0x0000000011C9FFFF] "USER" (0 blocks)

For reference: CPU MT6515 is the absolute double MT6575only difference is the absence of 3G 6515. MT6575 came out in 2011, and the market fell by early 2012. The operating system is everywhere indicated as AN1 Android 4.1.1, even in the firmware, but in fact there is Android 4.0.4 ICS, which was released in 2012.

The device comes in 5 different colors: black, white, pink, gold with white, gold and black. As you can see, my chances of getting on an overview of normal device color was 20%. On the other hand, the chance to get the pink ones are the same, so I am eternally grateful for the gold. SWAG!

image
Figure 1. Summer hand is literally boiling beneath them.
awolf
PPC, what is IT you do
don't tell me you were going to use as a watch.
they can kill

xlab:
This is the watch as they are to use
No wood to chop.
although wait a minute...

Package Manual
Figure 2-3. Standard box contents: subject, headphones, wire, power supply, manual in broken English.

Cap Cap2
Figure 4-5. Button Vol+, back button, plastic cap, usb speaker, you can see the hole for the camera

Cap to the usb is hard plastic, immediately began to move away and become totally useless — had to be removed. The strap is made from silicone-rubber, tighten well (if you want, you can tie it off).
Buttons 2 Battery
Figure 6-7. Home button, power button on the other side of the hull. The battery is removed very easily, under it are slots for microSD and SIM.

Connector audio jack is missing, included were headphones microUSB, they also act as antenna for FM radio. Best use — cut it in half, and the remaining piece of wire used as an antenna, the radio will work through the speaker.

103 Nikolay
Figure 8-9. Wearable on wrist music box conditional uncle Vasya.

Display CWM
Figure 10-11. TFT screen hardly drags, but all clearly visible. Best of all, of course, at night.

The screen behaves as any of a family of TFT at different angles inverts the colors, in the sun it is visible badly, there is graininess, spots flashes. Don't know about TTX. The backlight cannot be adjusted.

image
Figure 12. SWAAAAG!

Price and availability


No coupons and referral links I have for you there, and the price, in my opinion, biting 4300руб. Buy this model can be in TinyDeal (there are various other models of normal colors, even black is off). On DealExtreme incorrect specifications from the box and in the photos the clock is reversed top and bottom, so that is where I am I will not give references. Let them learn to examine their goods.

Software and firmware


As I wrote above, on the device is Android 4.0.4. Verify it is simple: first, you can see the dump build.prop (under the table of characteristics) and find the build identifier ALPS.ICS2.MP.V1.18, second, you can a few times to poke around on line as 4.1.1 in settings and catch the Easter eggs from 4.0.x:

about easter
Figure 13-14. "About Phone".

The firmware is almost AOSP, minor modifications to decrease weight and ease of use, the screen 2". The standard Android — no more, no less. Next will be only selected screenshots.

lock home
Figure 14-15. Lock screen and desktop (installed watch MIUI).

apps1 apps2 apps3
Figure 16-18. 3 screen built-in apps. Except SuperSU.

From built-in apps include:
the
    the
  • 2 Dialer — alternative standard dialer appears correctly on the screen 2", the screenshots in Fig. 19-20;
  • the
  • File Manager — convenient prowadnicach, able to see hidden files and open files from the card in the appropriate applications;
  • the
  • CameraMX — sided multi-function app as the camera, the screenshot in Fig. 23. Examples of photos you don't want to see;
  • the
  • Sound Recorder — easy to use the recorder, writes .amr. Spyware feature;
  • the
  • Icon. — stopwatch, screenshot in Fig. 24. When I took the device out of the box, it was installed more apps with similar names and even more crappy content, but after resetting all the data they're gone, and so was not built-in;


list ussd
Figure 19-20. Appearance and convenience dialer I definitely like.

incoming outgoing
Figure 21-22. Incoming call and outgoing.

cameraMX timer
Figure 23-24. CameraMX with premium filters (in-app purchases). Some kind of stopwatch (with banner).

sms contacts
Figure 25-26. Messages and contacts.

email mail
Figure 26-27. Mail app. By the way, can be used in all seriousness — check messages is very convenient.

browser tabs
Figure 28-29. Browser. Despite the size of the screen, the touchscreen performs its function exceptionally well.

The browser works smoothly, the canvas massturbate without brakes, the video opens right on the page or in a separate Appendix, a short demonstration in the video below.



The author of the review has nothing to do with the video.

gallery music
Figure 30-31. Gallery and music. Music app works correctly even .m4a from iTunes.

Built-in Google Play is not, apparently for the sake of saving space for getting rid of google-probes. Install GApps manually, but keep in mind that the version of android 4.0.4 and the SDK 15. On /system partition, should be selective. I'm not a fan of google services in their hours, so I decided that I'll manage the forum 4PDA and Yandex.Store.

store status
Figure 32-33. Yandex.Store that work properly on 2". The status of installed applications (as usual).

pdf maps
Figure 34-35. Reading PDF (performance is fine, but a 2" 320x240 — distortion). Card.

agps gps
Figure 35-36. There is support for A-GPS. GPS test went smoothly satellites quickly found that although I was inside the room near the window.

As for video playback, here MK6575 clearly drawn. Sample resolution 720x304 walked with a noticeable lag in standard video player, VLC and MX Player (with active HW Decoding). So, if you need to watch a movie on your watch, you should convert your pre-resolution (320x240). Just keep in mind that active use of resources CPU/GPU battery holds about 2-3 hours.

power image

Little phreaking


Before you commit lewdness with IOS and carcass of the device, you should get a NAND dump while the device is still alive. First thing is make a system if you haven't done it personally, I romanul once out of the box. Framaroot copes with its task.

image request
Figure 39-40. SuperSU is installed, the access request is running.

Now you should use the kitchen Mtk Droid Tools, created by our compatriot.

mtktools
Use the option Backup (1) to copy the blocks of all partitions of NAND. Option (2) will reseal the downloaded blocks to a format accepted by SP Flash Tool. Option (3) automatically generates and stitches CWM recovery. The login button in recovery mode is VolUp, just enough to hold it when you turn on the device and to the emergence of CWM.

The loading process of the entire family of MTK, mt6575 in particular, flows like this: preloader - > uboot - > kernel. Accordingly, the preloader does the initialization, reads the NAND layout and jumps to the address of uboot. Depending on the reasons for the inclusion (normal, stuck cable, ...), uboot is still downloading or not. Preloader is responsible for rendering the display of the charge and logo, while uboot decides what to do.

Preloader is also responsible for NAND flashing with the utility SP Flash Tool, which is used, roughly speaking, a Chinese plant. In older models of Mediatek, firmware was implemented using UART, but in our case, everything happens quickly and via USB.
Interface SP Flash Tool
image

To flash parts of the NAND, switch off the device, press the "Download" and connect the cable. During the connection of the cable detected by the Preloader program and begins the process. All parts are automatically cling of scatter file generated by MTK Droid Tools (MT6575_Android_scatter.txt). However, the description of the layout of NAND must match the actual markings on the device. In case of a mismatch the program securely notifies the error and write in the log that did not match.
Current markup at the NAND Smart Watch AN1 (taken from the log UART)
part PRELOADER size 0 40000
part DSP_BL size 40000 C0000
part __NODL_NVRAM size 100000 300000
part __NODL_SECCFG size 400000 20000
part UBOOT size 420000 60000
part BOOTIMG size 480000 500000
part RECOVERY size 980000 500000
part SEC_RO size E80000 120000
part __NODL_MISC size FA0000 60000
part LOGO size 1000000 300000
part __NODL_EXPDB size 1300000 A0000
part ANDROID size 13A0000 EB00000
part __NODL_CACHE size FEA0000 1E00000
part USRDATA size 11CA0000 D920000

Thus, in the presence of backups and still alive preloader device is indestructible. In the case of a crappy preloader, mt65xx there is a special meta mode until I had to check it out (fortunately), but this mode is invoked by ways of either a) clamping VolUp when connecting the usb cable, or b) circuit a special test pins to the ground.

And then I broke down.

f9-s2
+ partial photo of the back side (there's nothing interesting).

The cheaper made device, the easier it is to disassemble. The case was sealed the same brand occupies 8 Phillips screws, after unscrewing of which it broke itself (himself). Inside, as it turned out, do not use traditional hot melt glue or some yellow tape. The entire periphery is neatly laid out on shelves and pressed against the housing top. On the same side of A are all of the pertinent pins. First, judging by the similar for example mk6577 activate meta-mode pin is right in the corner and are marked as KCOLO. Secondly, there are the pins tx4, rx4, tx1, rx1, one of them is clearly responsible for the UART. At random it turned out that tx1 and rx1 in the lower right corner.
uart wiring surgery

The battery can be cut with a knife and then the wires from the UART will appear without interference battery. Now to this NEH on the arm even more questions from others.

The boot line of the kernel a.k.a. param line: console=tty0 console=ttyMT0,921600n1 root=/dev/ram nand_manf_id=0xad nand_dev_id=0xbc uboot_ver=2010.06 uboot_build_ver=MAIN2.2.ubt.2274 lcm=1-nt35582_mcu_6575 fps=4732, and then minicom configure the baudrate 921600. My pl2303 with quartz like cope. After booting to communicate with the uart tx/rx is possible using /dev/ttyMT0 and nothing will prevent this.
the
The output helped in understanding the processes mk65xx in the future very useful when debugging custom builds of the kernel/uboot, if not laziness.

Further hacking can be done in the mode of the fan (setup and customization of the firmware while the device is morally obsolete) or guru is to try to glue the existing source code in one puzzle and sborrati AOSP 4.1+ for example. By the way, the source SoC mk65xx is in the public domain. Various companies post the source code of the firmware, following the GPL, but at the same time they manage to merge those or other sensitive parts, which belong to Mediatek. The repository on GitHub point are removed by DMCA, but on 4PDA are immortal archives: http://4pda.ru/forum/index.php?showtopic=535287. Particular enthusiasm in the direction of mt65xx feature of our compatriots, such as luckasfb, honorary members 4PDA and lover to collect custom firmware for mt65xx family from the leaked source. I am a little deeper will check the situation for MT6575, since Android 4.1 will allow you to use the new Google Search with recognition of Russian speech and, in particular, is matchless assistant Duxiu right at the watch on her arm.

Totals


Brand and manufacturer to find failed in labels and prints flashes XINGHAN, nothing good can naguglit failed. Like the model — F9-2S. The device is made in the period October 2013 — March 2014, on sale in April 2014. Overall quality exceptional savings on everything. Platform and OS — the end 2011ого.
It all seems like some kind of experiment in small quantities and with large, as a consequence, price. Even with attempts to deceive the ordinary buyer. :<

On the other hand, forgive me fans of gigahertz cores and megabytes of RAM, these specifications are not a priority. The system works significantly fast (better than some phones I've ever handled), the browser scrolls smoothly, the Wi-Fi speed normal (in my network to 15MBit/s), the battery suffices on viewing time throughout the day. In any case, videos to watch or books to read wristwatch — it can be left elbow to damage.

And finally, the most important component for me is hackability device. On a scale of hackability Smart Watch AN1 deserve a solid 8/10, where 0 on the scale is a Geeksphone Peak (overview I was doing exactly a year ago, by the way), and 10 on the scale is SoC Allwinner A10 and everything connected with it.

This is gonna sound stupid, but I'm afraid hours. They are ticking. And penetrate the brain.
—Dennis Lehan. Island of the damned.
Article based on information from habrahabr.ru

Комментарии

Популярные сообщения из этого блога

March Habrameeting in Kiev

PostgreSQL load testing using JMeter, Yandex.Tank and Overload

Monitoring PostgreSQL with Zabbix