Announcement

Collapse
No announcement yet.

Bowflex nautilus firmware woes

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    #21
    Originally posted by CapLeaker View Post
    You are doing great! To convert a hex dump to bin that is easily accomplished in Linux.

    You mind uploading the dump? I'd like to see it.
    Please report back any interesting findings if you can thanks.

    Bowflex Max M7 firmware

    https://archive.org/details/bowflex-max-m-7-firmware

    Comment


      #22
      Exciting times today lol, have now observed slight changes on the LCD screen at power up self test but only slight in the top large 7 segment display portion, i like that it encourages the idea the LCD chip driver is naff, or maybe it is zebra woes lol

      Click image for larger version

Name:	bowflex Max M7 bad2.png
Views:	46
Size:	1.20 MB
ID:	3298057

      Attached Files

      Comment


        #23
        Ok folks i know your over there in the corner with your popcorn trying not to snigger openly lol but you know when you start something like this and reasonably think; i'll just ignore that BLE112-A module because if its broken (~it probably is having been on the same supply bus as the PIC32MX) i dont need blue tooth anyway and can just remove it...

        Then you start looking at shift registers and there buffers to see why they are not driving the quad 7 segment led and all the other tri state leds on the board and you trace the data bus that goes smack bang into the BLE112-A and never having encountered this before you pull that data sheet and it dawns on you that your dealing with yet another system on a chip with its 8051 processor, 128Kb flash and all the rest of it and then understand the PIC32MX is but one of 3 MC on this infernal max trainer console board and will likely require not only replacement but flashing haha with an expensive CC debugger you dont currently own? The only good news being you do have access to a working console unit to extract a binary or hex from....

        Meh, and oh joy.. 🍿

        And all of that after sourcing and ordering some rare ish LCD driver chips. Cost of new BLE112A + CC debugger = ⚠

        EDIT

        Cheap CC debuggers on fleebay, phew.... think ill start that after i finish this box. 🍿

        Comment


          #24
          Originally posted by CuriousJohn View Post
          Ok folks i know your over there in the corner with your popcorn trying not to snigger openly lol but you know when you start something like this and reasonably think;

          Meh, and oh joy.. 🍿

          And all of that after sourcing and ordering some rare ish LCD driver chips. Cost of new BLE112A + CC debugger = ⚠

          EDIT

          Cheap CC debuggers on fleebay, phew.... think ill start that after i finish this box. 🍿
          I do not envy you at all but I have to ask you did bite off more than you can chew because if I were doing this repair I would have just sold it as is now if it that you are taking it because it is challenging undertaking then I can completely understand this process because I have done this myself before but it is not fun while doing this undertaking but if somehow you manage to get it completely working correctly then you are going eventually enjoy the outcome

          9 PC LCD Monitor
          6 LCD Flat Screen TV
          30 Desk Top Switching Power Supply
          10 Battery Charger Switching Power Supply for Power Tool
          6 18v Lithium Battery Power Boards for Tool Battery Packs
          1 XBox 360 Switching Power Supply and M Board
          25 Servo Drives 220/460 3 Phase
          6 De-soldering Station Switching Power Supply 1 Power Supply
          1 Dell Mother Board
          15 Computer Power Supply
          1 HP Printer Supply & Control Board * lighting finished it *

          These two repairs where found with a ESR meter...> Temp at 50*F then at 90*F the ESR reading more than 10%
          1 Over Head Crane Current Sensing Board ( VFD Failure Five Years Later )
          2 Hem Saw Computer Stack Board
          All of these had CAPs POOF
          All of the mosfet that are taken out by bad caps

          Comment


            #25
            Originally posted by sam_sam_sam View Post

            I do not envy you at all but I have to ask you did bite off more than you can chew because if I were doing this repair I would have just sold it as is now if it that you are taking it because it is challenging undertaking then I can completely understand this process because I have done this myself before but it is not fun while doing this undertaking but if somehow you manage to get it completely working correctly then you are going eventually enjoy the outcome
            Hi, yeah your right im doing it for the challenge and learning being semi retired its a good time filler by the time im done with this i will have produced a half decent service manual or a bonfire lol and if successful every day i do some cardio on it i'm gunna screem i fixed you b1tch at the end of the workout lol.

            This little console board has loads to teach with three different voltage supplies on it and three separate port headers, two for the PIC32 (ICSP & JTAG) and one for the BLE112 debug all of which is new to me. I was gutted when i found out about the complexity of the BLE112 lol, Flashing the PIC32 is a doddle now i moved to using MPLABX PDE rather than IDE which is way ott as an introduction to this lol.

            The BLE112 seems to provide 5 x 8 bit shift registers with serial data and shift register clock all daisy chained but i dont know if those buses also going to the PIC32, there is also storage register clock i think does go to PIC32 only tbd today along with if badly soldered PIC32 causing both these shift register buses to be sitting at 3v or if that could be more likely the BLE112 shorting internally ( i think more likely lol but i didnt do well soldering the PIC32 in on a first time effort sort of thing) or even the shift registers damaged doing it as they also get VCC from the voltage regulator that popped its clogs dealing with 19v human error thing....

            Is the PIC32MX running? Not sure may well require functioning BLE112 to know. Is the BLE112 running, probably not its been exposed to 19v and is 3.6v max. Is the LCD chip running, it does its power on self test which demonstrates some segments not getting driven and they do change when power cycling but never shows data (from PIC32). I need to see if debug comms can be established with BLE112 and go from there among the other bits lol looking to rip BLE112 FW and replace the module, was going to remove and forget but nope, not that simple lol.

            I hope to avoid asking the mods to move this thread to the failed and pointless repairs section really. Its possibly a matter of self respect to i shall continue to beat this dead horse...

            Comment


              #26
              Excitement of delivery of CC debugger turned to despair in quick measure today as it would not "go green" with this BLE112 which confirms its U/S after receiving 19v lol. The despair came on when i connected the cc debugger onto the header port of a working unit and got the green light instantly and was then thrown to into the dirt by Bowflex locking the debug interface, no info no hex dump GAME OVER

              Any magicians out there know how to proceed? Bowflex dont supply Firmware anymore, i'm not even sure the company exists last i heard they sold up to Johnson health tec who make gym grade kit under Horizon brand apparently. Anyway its all obsolete isnt it, maybe a nice email to.... naaa defeat


              debug interface locked

              Comment


                #27
                Here's a photo of the broken BLE112 i need firmware for, i took its cover of just now to scream at it and see if there really was anything that could be done but nope it has its own voltage regulator inside the chip.


                Click image for larger version  Name:	20240709_174505.jpg Views:	0 Size:	5.73 MB ID:	3305883



                Comment


                  #28
                  I was looking through an android app that connects to Bowflex Max M7 via bluetooth with it connected to a working machine and some useful info presented itself confirming there are two firmware's on this machine and have successfully extracted the Hex dump of the MCU PIC32MX however the firmware of the BLE112-A module remains elusive.

                  Here is the dump of the MCU firmware:

                  https://archive.org/details/bowflex-max-m-7-firmware

                  The BLE112-A module contains a TI CC2540 chip with 128Kb of flash memory but its debug interface was locked when it was written so i dont at present have any way to extract it and Nautilus/Bowflex/Johnson health tec dont seem to be able to help so it really is GAME OVER unless anybody here knows of a way to dump the flash memory out of this thing i am going to investigate over the air ways via blueooth but its more learning and probably futile but as ever i live to find out.


                  Click image for larger version  Name:	Screenshot_2024-07-12-23-33-47.png Views:	0 Size:	147.6 KB ID:	3308356


                  Comment

                  Working...
                  X