Security researchers have demonstrated an unusual way to dump smartwatch firmware by abusing the watch face mechanism and reading memory back through the screen’s pixels, reviving an optical “blinkenlights” style data-leak technique first described for networking gear in the early 2000s.
The attack targets a low-cost smartwatch powered by a JieLi AC6958C6 SoC. It demonstrates how seemingly harmless display features can become powerful exfiltration channels when firmware parsers lack proper bounds checking.
From OTA Reversing To Screen Abuse
Initial analysis focused on extracting the firmware via JieLi’s proprietary over‑the‑air (OTA) update service exposed over Bluetooth Low Energy (BLE), using the vendor’s Android OTA app and reverse‑engineering its mutual authentication scheme.
The app generates a 16‑byte random challenge and verifies device responses with a native routine backed by a hardcoded Bluetooth E1 legacy authentication function, fixed 16‑byte key, and a static pseudo‑address 11:22:33:33:22:11 inside libjl_ota_auth.so.
Researchers replicated the algorithm in Python, confirmed they could complete the handshake, but discovered that the OTA API supported only firmware upgrades, not read‑back, thereby eliminating this as a direct dump path.
Attention then shifted to the watch’s custom dials, which are delivered as binary blobs over BLE with a small protocol: a header frame containing magic bytes 0xAB 0x06 0x28, a chunk count, and a Dallas 8‑bit CRC, followed by multiple 16‑byte data chunks tagged with 0xAB 0x29 and a chunk index.
By capturing dial uploads in PCAP, reconstructing different faces, and performing a differential analysis, the researchers mapped the file format: a fixed header followed by region descriptors that define on-screen elements such as hours, minutes, battery graphics, and images, each with coordinates, dimensions, and offsets within the blob.
Reviving Blinkenlights To Dump Firmware
Crucially, the firmware trusted these offsets without sufficient bounds checks, allowing a dial to point to an RGB565 image region at memory outside the dial buffer.
When such a malicious dial is set, the firmware blindly treats the referenced memory as pixel data. It pushes it to the TFT controller, causing the screen to display what appears to be random or “garbage” pixels that are, in fact, raw SoC memory.
This created a modern variant of classic blinkenlights attacks, in which data leakage originated from link LEDs on network equipment but now flows through a high‑resolution smartwatch display.
To turn this into a practical firmware dump, the team first characterized the display bus by soldering fine wires to the screen connector and using a Raspberry Pi Pico overclocked to 200 MHz as a 100 Msps logic analyzer.
By sampling on the rising edge of the 25 MHz display clock with a minimal PIO program, they reliably captured serial traffic to the NV3030B TFT controller.
They decoded standard commands: 0x2A and 0x2B to set column/page ranges, followed by 0x2C for pixel transfer.
Custom dials rendered a top‑of‑screen marker containing sync words (0xa5a5a5a5), deadbeef delimiters, and the target memory address, allowing the host to locate full frames in captures and associate each image block with the corresponding memory range.
A Python toolchain then automated the process: one script continuously collected hex dumps from the Pico over USB, extracted pixel payloads for full-frame updates, validated the sync markers, and saved each recovered memory slice as firmware‑dump‑0xXXXXXXXX.bin, based on the encoded address.
A second script processed these partial dumps in order, concatenating them into a contiguous 2 MB firmware image that matches known JieLi layouts, thereby enabling disassembly and deeper analysis of the fake health measurements and display routines.
The work highlights how low-cost microcontrollers, weak parser validation, and legacy cryptographic designs can combine to create unexpected high‑bandwidth side channels.
It emphasizes that modern embedded designs must treat display paths as sensitive data surfaces rather than merely cosmetic outputs.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
