Inside the Triki motion controller and a bit of reverse engineering
TL;DR
- The Triki motion controller uses a Nordic nRF52810 BLE SoC and a mysterious SF 248 MEMS sensor.
- The PCB also carries exposed programming pads and a 1MB Macronix MX25R8035F flash chip that appears mostly filled with FFs.
- Reverse engineering used an Android phone, Bluetooth logging, USB debugging, ADB bugreport output, and Wireshark analysis of the Bluetooth logs.
- The BLE communication runs over Nordic UART Service (NUS), which revealed commands for starting sensor data transmission and turning on the built-in LED.
- The nRF52810 is locked, the pinout remains unconfirmed without a J-LINK programmer, and the SF 248 sensor still lacks a clear datasheet or online reference.
Generated by the language model.
Hi everyone, today I’d like to show you the inside of the controller Tricks , which has become the flagship product of the green amphibian retail chain. It allows you to play games via the chain’s dedicated app.
As we can see in the photo above, at the heart of the device is the SoC chip nRF52810 from Nordic Semiconductor, an energy-efficient Bluetooth Low Energy (BLE) microcontroller based on the ARM Cortex-M4. It is very popular in small IoT devices and wireless accessories. The chip is locked, and to unlock it, you need to erase its contents.
Typical applications of the nRF52810:
Quote:Bluetooth locators (beacons, tags)
Motion and activity sensors
Smart buttons and BLE remotes
Fitness trackers and wearables
Smartphone accessories
BLE keyboards and mice
Smart locks
Temperature, humidity and environmental sensors
Gaming gadgets using BLE
The MEMS sensor is the SF 248 (probably LSM6DSL) ,
On the PCB, there are exposed programming pads,
Interestingly, the board also features a FLASH memory chip, according to a dump from the user’s GitHub Piwencjusz R80B..... R80X..... ( 1MB Macronix MX25R8035F ) with some very interesting content; apart from the header shown below, the rest is filled with nothing but ‘FFs’, which might give us plenty of scope for DIY projects.
Time to reverse-engineer the BLE protocol and find out ‘how it all works’.
To eavesdrop on the communication, all I needed was an Android phone, an app dedicated to the controller, Bluetooth logging and USB debugging enabled in the developer options, and ADB on the computer, so that after listening in, a report could be generated from the system using the command:
adb bugreport c:\log.zipOnce the report is complete, an archive should appear log.zip on the C: drive. The Bluetooth log is located at: \FS\data\misc\bluetooth\logs .
It’s plain sailing from here – just import it into Wireshark and analyse it.
Summary:
I’ve managed to find out that communication takes place via Nordic UART Service (NUS) – which command to use to start data transmission from the sensors, or even to light up the built-in LED.
Below are some example videos of what we’ve managed to achieve so far:
PS Everything I’m presenting here was done for educational purposes. I really like this gadget and think it’s worth popularising.
PPS I’ve added a few interesting facts from the user Piwencjusz GitHub
Useful links:
mipix wrote:
GitHub kawaczek
GitHub koksny
GitHub Wojtekb30
GitHub Ciol8
GitHub Maku-hub
GitHub egortar-pi
GitHub Diego7120
GitHub ekl3m
GitHub kumpelstachu
Comments
Well, I’ve got to say it’s great that you’ve given it a go, even using artificial intelligence. It’s the end result that counts, and you’ve achieved success. You get a thumbs-up from me. [Read more]
Hi, I’ve also started playing around with my Triki and (with the help of AI, too) I’ve written some simple code that displays graphs from the gyroscope and accelerometer. It might be useful to you as well... [Read more]
Cheers for sharing the mods! There’s no shame in using AI – it’s a handy tool, so you’ve got to make the most of it! A really cool YouTube channel! Who knows, maybe thanks to the amphibian we’ll get the... [Read more]
A direct answer to the question These tricks can be viewed not as a ‘game controller’, but as a ready-made, cheap wireless BLE module with an IMU motion sensor, an LED and a button or buttons . In... [Read more]
@pkaczmarek2 what do you think? Are we writing a library, or rather coding a vibe? :) I wonder how many of these they’ve sold and are selling; I suspect that before long everyone will have one in their... [Read more]
Cheers, once I’ve got hold of the sensor, I’ll get to work on it. I’m planning to turn it into an acceleration sensor for resistance training at the gym – i.e. Velocity-Based Training – plus a mobile ... [Read more]
Great, once you’ve made it, share it in the DIY section – you don’t need to share the code if you can’t; what’s more important are interesting applications and practical projects. The cool thing about... [Read more]
I’m glad to see some response to this thread. @gulson, on the day of the launch, you could snap it up for one zloty once you’d met the conditions (it’s possible the offer might happen again). The situation... [Read more]
Thanks for the info – it’s actually on AliExpress. You know, if you tell the Chinese bloke, he’ll just slap something else on there straight away ;) I reckon they chose a better IMU after testing it.... [Read more]
Hey! From a YouTube video by the user ‘Ziemniak’, you can learn that Triki is designed and assembled in Poland :) https://www.youtube.com/watch?v=6QjR_PVkIWY Best regards, Paweł [Read more]
@ciolololo I’ve checked this code and something isn’t quite right. Attached is the code for debugging, live parameter preview and log generation that I used a few days ago. [Read more]
Does ‘assembled’ mean that every component is soldered, or does it mean that a ready-made electronics module is inserted into the casing and then heat-sealed into a blister pack? :) Because the video... [Read more]
How about making a drone controller out of this? ;-) [Read more]
I think that today’s drone controllers offer better handling, accuracy and safety. But wouldn’t it be interesting to have a ‘mouse’ like that for giving slide presentations, where pressing it would highlight... [Read more]
Here’s some information about this device: https://www.reddit.com/r/Polska/comments/1txi9uz/kontroler_triki_z_%C5%BCabki_czy_kto%C5%9B_pr%C3%B3bowa%C5%82/ https://github.com/AND-Y0/TrikiReader htt... [Read more]
@mipix, thanks a lot for those links; I’ve added some extra information to the post. [Read more]
I was wondering what sort of rubbish Żabka was promoting – some sort of controller for those daft games in their app. But it turns out we’ve got a pretty cool gadget here, with ‘open’ communication. You... [Read more]
I’ve had a look at various projects on GitHub and I like the solution from kumpelstachu Link (3D orientation). I can’t wait for the wizards at elektroda to get to grips with this topic. [Read more]