Scott Vanderlind


everything happens so much


Hardware Things: Killing, Reviving, and Owning an Amazon Dash Button

I'm sure you're familiar with the Amazon Dash button. It's a nifty little WiFi gadget that orders things from Amazon with a single button press. Turns out, it's got a STM32F2 microcontroller on the inside, and can be gently massaged to do other things by using the standard ST dev toolchain.

Using my STM32F3discovery dev board (which I got for free forever ago!) I got familiar with the hardware, the software, and programming from my Mac using Eclipse. Eventually, following the lead of some awesome peeps, I tacked on some wires to the st-link SWIM interface points on the Dash button's motherboard.

I'm not very good at soldering things this small.

Killing the Dash Button

With the Dash Button connected to the st-link interface on the discovery dev board, I tried to launch the debugger.

┌─[✗]─[scottvanderlind@Helen]─[~/dash]  
└──╼ st-util
2015-06-06T19:22:31 INFO src/stlink-common.c: Loading device parameters....  
2015-06-06T19:22:31 WARN src/stlink-common.c: unknown chip id! 0  

What gives? The st-link interface is definitely talking to the chip, but it reports itself with a chip id of 0. My roommate Donny thinks that Amazon had modified the chip id in firmware to prevent nosy people from connecting to the debugger. A reasonable suggestion, which he confirmed by ERASING the Dash's firmware.

┌──[scottvanderlind@Helen]─[~/dash]  
└──╼ st-flash erase
2015-06-06T18:37:09 INFO src/stlink-common.c: Loading device parameters....  
2015-06-06T18:37:09 INFO src/stlink-common.c: Device connected is: F2 device, id 0x20036411  
2015-06-06T18:37:09 INFO src/stlink-common.c: SRAM size: 0x20000 bytes (128 KiB), Flash: 0x100000 bytes (1024 KiB) in pages of 131072 bytes  
Mass erasing............  

At that point, the (now empty) Dash button was happy to talk to the debugger.

┌─[✗]─[scottvanderlind@Helen]─[~]  
└──╼ st-util
2015-06-06T18:24:29 INFO src/stlink-usb.c: -- exit_dfu_mode  
2015-06-06T18:24:29 INFO src/stlink-common.c: Loading device parameters....  
2015-06-06T18:24:29 INFO src/stlink-common.c: Device connected is: F2 device, id 0x20036411  
2015-06-06T18:24:29 INFO src/stlink-common.c: SRAM size: 0x20000 bytes (128 KiB), Flash: 0x100000 bytes (1024 KiB) in pages of 131072 bytes  
2015-06-06T18:24:29 INFO gdbserver/gdb-server.c: Chip ID is 00000411, Core ID is  2ba01477.  
2015-06-06T18:24:29 INFO gdbserver/gdb-server.c: Target voltage is 2917 mV.  
2015-06-06T18:24:29 INFO gdbserver/gdb-server.c: Listening at *:4242...  

So there's that. That left my Dash button inoperable, though, and we didn't think to dump the firmware before erasing. Powering the Dash up at this point resulted in no visual feedback. :( RIP in peace, Dash.

The setup.

Reviving the Dash Button

As luck would have it, the awesome peeps I mentioned did think to dump the firmware of their Cottonelle-variety Dash button. I was able to write the bin back to mine, and it seemed to somewhat revive it. When powered up, the LED pulses red a few times, then goes solid and seems to hang.

Not sure quite what that means, maybe I'll try again later.

┌─[scottvanderlind@Helen]─[~/dash]  
└──╼ st-flash write Cottonelle.bin 0x08000000
2015-06-06T18:37:36 INFO src/stlink-common.c: Loading device parameters....  
2015-06-06T18:37:36 INFO src/stlink-common.c: Device connected is: F2 device, id 0x20036411  
2015-06-06T18:37:36 INFO src/stlink-common.c: SRAM size: 0x20000 bytes (128 KiB), Flash: 0x100000 bytes (1024 KiB) in pages of 131072 bytes  
[... blah blah blah ...]
2015-06-06T18:41:01 INFO src/stlink-common.c: Flash written and verified! jolly good!  

Owning the Dash Button

This is perhaps the most exciting part. I have been able to run my own code on Dash. I modified the standard blink demo program for the STM32F2 to cycle through the red, green, and blue states of the Dash's RGB LED, shown here:

Getting this code running on the device was tricky, mostly because of my unfamiliarity with the toolchain and flashing and all that good stuff. I worked out a pretty reliable way to do it though:

  • Use Eclipse to generate a project of the proper format. In this case, I used the blinky example code, but you can also create a blank project.
  • Open build directory in a terminal window (ie, DashBlink/Debug) and build the project manually:
    • make clean
    • make
    • At this point, the default project makefile will spit out the program in various states of compilation. .elf, .hex, .siz, etc. We need to build a .bin to write to the device.
    • arm-none-eabi-objcopy -o binary DashBlink.elf DashBlink.bin
  • Finally, we can flash:
    • st-flash write DashBlink.bin 0x8000000
    • For good measure, I reach over and tap the reset button (sometimes flashing doesn't trigger a reset).
  • I wrapped all of these commands into a single make directive, make flash.

What's next?

The STM32F2 line of chips are like, WAY powerful. You can generate audio with them. They have USB OTG. When the Wifi module, button, and microphone in the Dash get figured out, a ton more possibilities will present themselves for repurposing it as an 'Internet of Things' device.

If you didn't manage to get a Dash button/get enough Dash buttons to hack on, there's a module that's pretty similar to the Dash that you might find interesting. It's the EMW3162, featuring the same STM32F205 ARM core and Broadcom wireless chipset. It has an actively developed WICED SDK for networking, a ton of GPIO, and a very attractive $10 price point.


comments powered by Disqus