Post

My motorbike (Zontes GK350) has an instrument panel that can do a bunch of things, including screen mirroring through an app (Carbit ride). How did they make it?

The ref of this dashboard is 1164300-002000. It seems to be also used on the 350 T, R and X. The firmware is called AJ_B3-03, and internally it seems they called it "ZT350_IP_5". We are going to analyze the OTA firmware image I managed to obtain. How I obtained it is a story for another 🧵.

The image is 8mb long and contains the application code, the boot animation (BANI) and the "ROMA" which are the resources files. There is not a fancy FS like littleFS, there is basically a superblock the contains the file path, address and length. Boot anim are concatenated jpg images.

I made a ROMA extractor script btw gist.github.com/endes0/718d6...

So the main MCU is the Amt630hV100. There is little to nothing online about it. I found something on CSDN, but I was not able to download it. Besides the LCD, it seems that to this mcu is connected an MMC mem for the fw, an CMT2300A (for TPMS?) and another mcu that communicates to the rest of the 🏍️

And of course for the BT and WIFI it uses the Feasycomm FSC-BW121 (it uses the RTL8821CS). Fun fact, I was unable to find the fcc id and the MAC address of both BTs (le and normal) and Wi-Fi are fake/not registered! (34:FA:4A C0:FA:4A 34:C6:4A).

The software stack is an FreeRTOS plus + awtk (GUI) + FSC-Blueware (BT) + EC-SDK (screen mirror). The "architecture" is basically the awtk GUI obtains the all the information that it needs from a list of "global attributes" or communicating directly to the BT and EC sdk.

There are a lot of task running normally, most of them are from the different sdks and libs. Where all "the magic" happens is in the Mainboard task.