DT78

DT78 Smartwatch Reverse Engineering

• DT78 with ESP32 PCB video
• DT78 ESP32 firmware

https://github.com/user-attachments/assets/8dc41542-3ad4-4554-a023-f22332daad98

Firmware

Analysis of the firmware using binwalk analysis

Firmware v8.05 and update procedure for iOS in chinese language here

HS6620 Dumping JTAG

BLE Protocol

• commands

• types

<!-- More info at this [`blog`](http://www.biego.tech/dt78) -->

SPI flash

• Watch faces

Hardware

• FPC Connectors pinout

Datasheets

Main IC - HS6620D

Flash Chip - XT25F128B

Touch IC - CST816S

TFT LCD - GC9A01A

ESP32

LCD Touch Test

This arduino code dt78_lcd_touch_jpg interfaces the LCD and touch screen with an ESP32 board. Images will be displayed from SPIFFS and can be scrolled using the touch screen.

LCD Touch Test video

Client

This arduino code dt78_ble_client creates a client on the ESP32 board that connects to the smartwatch

Control lights using the watch Video

Server

This arduino code dt78_ble_server creates a server on the ESP32 board that emulates the services and characteristics of the DT78 smartwatch and connect to the WearFit 2.0 app

Android App

Since this watch only supports notification from a few apps in the WearFit 2.0 app, I modified this code DT78-App-Android to send notifications to the watch