Coby DP-151SX Hacking
January 3, 2009 5:59 pm ProjectsRecently I obtained two Coby DP-151SX digital photo keychains to see if it is possible to hack the device. The answer is yes. These devices can be purchased for as low as $9, and I thought they might make a good source of color LCD displays. There is a project to hack small photoframe devices such as these, and they have already developed some tools to hack the firmware and display dynamic images (such as an MP3 player status screen) using the USB connector on the device. The Wiki at the previous link is a good resource.
Below is a photo of the disassembled device. Click the photo to see the Flickr notes annotating different parts of the device.
The specs of the device are as follows:
- LCD: Varitronix COG-C147MVGA, 128×128, chip-on-glass (COG) integrated controller with white LED backlight.
- CPU: Possibly the ST2203U 65C02-compatible device with built-in USB engine.
- FLASH: Spansion S29AL008 1Mx8 NAND FLASH memory.
- Battery: 180mAh 3.7V lithium ion rechargeable.
The ST2203U uses a 65C02 processor core with several peripherals: a DMA engine, FLASH memory controller, real-time clock, LCD controller (not used in the Coby device), and a USB engine. It has an onboard mask ROM, but this appears to be disabled on the Coby device. Since resistor R12 is jumpered with a zero-ohm resistor, the ST2203U boots from the external memory. If R13 was jumpered instead, then the device would boot from the internal memory. Apparently the program that comes with the Coby device has the ability to download new firmware through USB. I’m tempted to write my own firmware for this creature, but the lack of an ICE along with a decent toolchain has deterred me.
The device has a built-in battery charger. I have not yet attempted to reverse engineer it yet. The lack of inductors makes me think it’s a linear charge circuit.
The most interesting part, at least to me, is the LCD screen. It has a built-in controller which appears to be similar to or compatible with the PCF8833. Varitronix, of course, does not provide data on this particular LCD display. Based on a little reverse engineering (since many of the control lines are shared with the memory chip) I was able to figure out a pinout:
- VCC (3.0V, but it probably works at 3.3V too)
- GND
- Unknown. Connected to the COG IC but is not driven as an output. This may be the OTP programming control pin.
- NC (but can be connected to the COG IC with a jumper on the flex cable, J1)
- CS# (Chip Select)
- D/C# (Data/Command)
- RD# (Read)
- WR# (Write)
- RST#
- D0
- NC
- D1
- NC
- D2
- NC
- D3
- NC
- D4
- NC
- D5
- NC
- D6
- NC
- D7
- NC
- LED Cathode
- LED Anode
The next step is to detach the LCD and wire it up to a breakout board. Then I can connect the breakout board to a microcontroller and attempt to communicate with it.
Tube Time » Blog Archive » Coby DP-151SX Hacking - LCD Extraction and Interrogation :
Date: January 7, 2009 @ 8:37 pm
[…] Hacking – LCD Extraction and Interrogation January 7, 2009 8:37 pm eric Cleverness, Projects In this previous post I disassembled the Coby DP-151SX digital picture frame. This device is very hackable, and includes […]