So since I last posted havent done much with this other than discover StickOS! A complete operating system with basic programming functions that runs on PIC32MX among others and it opens up the possibility of writing new firmware to restore basic functionality of this machine, i am very excited about it and just had to come and tell you all lol...
[url]https://rtestardi.github.io/StickOS/index.htm[/url]
At the moment i have flashed StickOS to the MCU and removed the broken BLE-112 module and also removed the RTC chip as needed the pins that the RTC was using on...
CuriousJohn
Ordained
Last Activity: 07-24-2024, 12:40 PM
Joined: 12-25-2018
Location: Britain
-
I was looking through an android app that connects to Bowflex Max M7 via bluetooth with it connected to a working machine and some useful info presented itself confirming there are two firmware's on this machine and have successfully extracted the Hex dump of the MCU PIC32MX however the firmware of the BLE112-A module remains elusive.
Here is the dump of the MCU firmware:
[URL]https://archive.org/details/bowflex-max-m-7-firmware[/URL]
The BLE112-A module contains a TI CC2540 chip with 128Kb of flash memory but its debug interface was locked when it was written...Leave a comment:
-
Here's a photo of the broken BLE112 i need firmware for, i took its cover of just now to scream at it and see if there really was anything that could be done but nope it has its own voltage regulator inside the chip.
[URL=filedata/fetch?id=3305883&d=1720545841][ATTACH=JSON]{"alt":"Click image for larger version Name:\t20240709_174505.jpg Views:\t0 Size:\t5.73 MB ID:\t3305883","data-align":"none","data-attachmentid":"3305883","data-size":"medium"}[/ATTACH][/URL]...Leave a comment:
-
Excitement of delivery of CC debugger turned to despair in quick measure today as it would not "go green" with this BLE112 which confirms its U/S after receiving 19v lol. The despair came on when i connected the cc debugger onto the header port of a working unit and got the green light instantly and was then thrown to into the dirt by Bowflex locking the debug interface, no info no hex dump GAME OVER
Any magicians out there know how to proceed? Bowflex dont supply Firmware anymore, i'm not even sure the company exists last i heard they sold up to Johnson health tec who...Leave a comment:
-
Hi, yeah your right im doing it for the challenge and learning being semi retired its a good time filler by the time im done with this i will have produced a half decent service manual or a bonfire lol and if successful every day i do some cardio on it i'm gunna screem i fixed you b1tch at the end of the workout lol.
This little console board has loads to teach with three different voltage supplies on it and three separate port headers, two for the PIC32 (ICSP & JTAG) and one for the BLE112 debug all of which is new to me. I was gutted when i found out about the complexity of...Leave a comment:
-
Ok folks i know your over there in the corner with your popcorn trying not to snigger openly lol but you know when you start something like this and reasonably think; i'll just ignore that BLE112-A module because if its broken (~it probably is having been on the same supply bus as the PIC32MX) i dont need blue tooth anyway and can just remove it...
Then you start looking at shift registers and there buffers to see why they are not driving the quad 7 segment led and all the other tri state leds on the board and you trace the data bus that goes smack bang into the BLE112-A and never...Leave a comment:
-
Exciting times today lol, have now observed slight changes on the LCD screen at power up self test but only slight in the top large 7 segment display portion, i like that it encourages the idea the LCD chip driver is naff, or maybe it is zebra woes lol
[ATTACH=JSON]{"data-align":"none","data-size":"medium","data-attachmentid":3298057}[/ATTACH]...Leave a comment:
-
Please report back any interesting findings if you can thanks.
Bowflex Max M7 firmware
[URL]https://archive.org/details/bowflex-max-m-7-firmware[/URL]https://Please report back any inter...firmware[/URL]...Leave a comment:
-
Thanks for that I tried it and it delivered a 1MB binary from a 1.5MB Hex dump for a 512KB flash space on the PIC32 though this was the best conversion i have seen having tried numerous tools including other versions of Hex2bin, there are things going on i dont understand with MPLAB and its HEX dump routine for e.g. according to the PIC32 data sheet the onboard flash is programed by the MCU's processor itself each address line at a time but anyway it seems despite having a JTAG header that function is stated to be turned off in this Firmware according to MPLAB (not aproblem for a new blank chip...Leave a comment:
-
Thanks and i know its been a very long week and a bit i eventually received my mouser order specifically the PIC32MX MCU which tbh ive not worked with before or really any other MCU so learning to extract HEX and then reverse the process in MPLABX IDE was a bit stress but new PIC32 onboard (not fun till new solder techniques learned) and programmed. Sadly not done yet looks like all shift registers fubar (assumption as VCC good and no logic probes etc but they are cmos 7v max lol) along with a Quad gate SOP and most importantly it looks like to my eager eyes the LCD driver flatpack also decided...
Leave a comment:
-
MCU removed and S/C resolved.
Next problem after installing new PIC32 is tp flash it with already achieved extracted HEX dump of working board. Believe it is possible to upload the HEX dump back to the MCU in MPLAB X IDE.......? Currently struggling to convert it to a Bin anyway so more learning next week when MCU delivery arrives glad to report its not protected or encrypted according to configuration bits menu from MPLAB...Leave a comment:
-
Bowflex Max M7 console board power distribution and stuff
[URL=filedata/fetch?id=3291001&d=1718463252][ATTACH=JSON]{"alt":"Click image for larger version Name:\tBowflex_Max_M7_console _power_diagram.png Views:\t4 Size:\t3.28 MB ID:\t3291001","data-align":"none","data-attachmentid":"3291001","data-size":"medium"}[/ATTACH][/URL]...Leave a comment:
-
Thanks for the tips folks the IPA CC CV method is pretty cool i bought a USB pwoer supply with CC CV function for cheapish much cheaper than a bench psu anyway and it worked.
...Leave a comment:
-
I agree, my next step is to restore the BUK only and see if everything but what is fed by U18 voltage regulator (fed from BUK) is happy. Then i have the task of checking all coupling capacitors to every chip on the bus as there is nothing else i can find to suspect but as i said i really do feel the cpu is done as its the weakest point having lowest maximum voltage tolerance of all chips on the bus and most connections to ground and bus (think ohms law with loads in parralel) but to determine that none destructively is the prize and i am now considering injecting current controlled 2.85v down...
Leave a comment:
-
Thank you for the tips i have IPA on hand so will think about that one and these days bench psu are not to expensive and it would be a sound investment.
I am glad to say by the weekend I should have access to a working console unit but one thing i did learn yesterday after trying one out for the first time on another machine miles away is the cpu sends the entire thing to sleep in 5 minutes so all leds and the lcd are cathode controlled by the processor and there are transistors scattered about performing this function. I know its theory of operation but it all helps to understand...Leave a comment:
-
Its a great idea with the limited kit i have i did that already, a thermal camera would knock out the park but now im at the price of just buying a new console for £520 and thats no fun at all....Leave a comment:
-
I dont do this very often so i dont have a bench PSU on hand though i might get one and a way to measure micro ohms sounds good but alas i have never tried that either because i dont have the kit (at present). I did not find the specific regulator I was looking for on mouser, im sure there are plenty that are compatible but i refer you to opening statement in this reply but i do appreciate you looking in and laughing, can you show me where i asked for help to find the fault? All i need is firmware really can you help with that?...Leave a comment:
-
Hi folks. I will post a board photo later tonight when i have time and maybe treat you to a diagram of my reverse engineering of the power distribution on this board...
I was thinking about this situation last night in bed trying to get to sleep that i never measured the resistance between vcc and gnd of the pic32 icsp port headers that are soldered onto the board and i got up today its the first thing i did as the kettle boiled for morning coffee to see if there is a chance the 512KB integrated flash in the chip survived the over vault situation but sadly not this to is measuring...Leave a comment:
-
There is still a short somewhere after the voltage regulator (removed) that is fed by the BUK measured as 0.7 ohm to ground the smd cap smoothing the output to GND was open i was hoping short but hey ho and this line supplies cpu among others i think its supposed to be 2.85v with something like 3.3v coming into it from the BUK. Ive probed about and figured out the power distribution on this board and removed the odd cap for testing my guess is the short is in the CPU as it has the most connections to the regulator and ground and it has the lowest tolerance max voltage of all the components fed...
Leave a comment:
-
Bowflex nautilus firmware woes
Hi Folks i dont post much but i have need today please read on and maybe we can get these things sorted.
I am on a health drive and last week bought a Bowflex max M7 to push on with my desire to get fitter but it was bought with a none functional "console screen" though the screen is dead the machine still works fine you can adjust the resistance manually like a bicycle brake adjustment it is cable fed but i want the programs and heart rate/calorie functions for my health drive. A new console is available but im getting quoted £520 or thereabouts and Bowflex as of yet have...
No activity results to display
Leave a comment: