[redfast00]

The idea is indeed to communicate with the tags with their stock firmware (not necessarily using another CC2510, since these aren't made anymore, but that's a possibility).

AES is symmetric cryptography, so that should be possible to extract from the firmware. The tags also show a QR code when the aren't initialized yet, this is likely the setup key. I also read that even if tags are already initialized, it's still possible to reset them with some kind of PUK (not sure how to get that PUK though)

I couldn't find a datasheet for the e-paper screen, so even if re-implementing communication with stock firmware proves to be infeasible, I'll still need the dumped firmware to figure out how the e-paper screen is controlled.

[dutch_scrambler]

Ah, I vaguely remember those old price tags as it's been such a long time. To sniff their RF traffic best use another CC2510 and TI's own packet sniffer app. Their RF protocol is an extension of the default one from TI's application notes for the CC2510 so it's pretty easy to read out. The AES key extraction would be useless, as it's using CBC and a unique per-device IV and NONCE is used, that's random, so if you crack one then it's just that once, you won't be able to alter the prices of the entire shop to your desire.

There's nothing too special in the firmware, just a state machine that's sleeping most of the time to save power, and wakes up the device at regular interval in its own designated time slot to listen to the radio briefly if the base station is trying to address it, then receives the pricetag image via radio and copies it to the flash and updates the screen if needed, then goes back to sleep. IIRC, the time slots are, from 0 to 255, with 256 being the broadcast address, and the last HEX byte in the serial number sticker is also its timeslot number.

The only juicy part in the FW, if you can find it, would be the waveform for the e-ink display, as those are e-ink confidential most of the time for some bizarre reason. It's not like there are no waveforms already on the internet for displays like that, but e-ink likes to keep the really good waveforms for themselves and their best customers.

Thanks for the trip down memory lane. Good times.

[braunboffel]

> e-ink likes to keep the really good waveforms for themselves and their best customers.

Any real evidence for this?

[redfast00]

Thanks for the information! I think I know who you are, and I understand why you chose to comment with a throwaway handle ;)

[blutack]

Some of the marketing mentioned private keys so I stupidly assumed a per transmission negotiation mechanism but of course they probably just mean "symmetric key". A per tag key extraction would be annoying though presumably. The PUK mechanism is very interesting, I'm interested to see what you find in the firmware...

For the display, this poster has something similar and talks about a datasheet - there's even a pinout for the flex cable (and it's supposedly SPI) [0]. It's for the 2.6" version not the 2.7 though so might be totally different. A comment on the post (by this person [1]) claims that they have working cleanroom CC2510 code that drives the display but who knows.

Great project anyway - I look forward to part two (and what you find on that flash chip)!

(Edit: sorry if you know this already, but there's a manual for the labels themselves [2] implying the setup page is permanently stored in one of the 4 slots - hopefully in that external flash chip)

0: https://epongenoir.blogspot.com/2017/10/

1: http://andreiprojects.blogspot.com/

2: https://fccid.io/2ACQM-EDG1-0260-A/User-Manual/User-Manual-5...

[redfast00]

Thanks for the interest :) If you have an RSS feed reader, you can add our RSS feed, so you'll automatically get the next blog posts https://zeus.ugent.be/feed.xml