Chinese Chasofon AN1 Smart Watch Bashny.Net

Hello, fans of Chinese and not very gadgets. I am sure many podnadoel this endless stream of faceless tablets, especially, for example, companies like google draw in price and quality trims its Nexus, making the acquisition of another Chinese know-Gnehm tablet dubious undertaking.
Guarantee - in this review of the tablet will not. While all are looking forward to a new wave of portable gadgets, namely "clever" hours from companies Apple, Motorola, LG, and others, the Chinese do not become long pull and urgently released their version of smart watches, which sample and fell into my hands.

Meet, 100% know-Gnehm Chasofon - SmartWatch AN1.
Spoiler: at the end of the review it will get hacked. I>

History h4> If you have ever made a review of anything Habre, then be sure - sooner or later you knock in a personal kind and offered to tell the Chinese Habra about a particular gadget, with a choice ogo- On a wide, except for tablets, as you know, on their dismal warehouses no useful things for no IT specialist. A Chinese survey plates, the more Habre - ignoble deed, since 2012.
But this time fartanulo: Cute girl invited me to look at their watches and smart, if interested, make a review. Of course, because the topic of wearable gadgets worries me a long time, but here such a case fell to evaluate the Chinese approach. April 23 sent via Singapore, May 19, at our post, quite quickly. Most photos are clickable.



Figure 1. Well they filled the declaration. Hopefully the contents
cherished boxes drags on more than a MP4 player for $ 0.06. i>

Set and Specifications h4> With the characteristics of a strange situation: the store's website, on the box, and in fact, the characteristics differ.

OS Android 4.0.4, on the box and is listed in the firmware 4.1.1 < Processor 1GHz, Single Core, MT6515 ARMv7, graphics: OpenGL ES 1.1, PowerVR SGX 531, AnTuTu score: 5855 Memory td > 512M RAM, 4GB NAND (marking such that is available about 512M - half on / system and / data) Screen 2 & quot ;, 320x240, capacitive TFT (5 points) Contact GSM, EDGE, GPS , FM, Bluetooth 3.0, WiFi b / g / n (chip MT6628) Tr> Slots and ports microUSB, microSD, SIM Dimensions 60 x 41 x 15, 72g with battery (900mAh, Lithium, 3.7V) The specification on the box


Dump build.prop

 & lt; code class = & quot; bash & quot; & gt; # begin build properties # autogenerated by buildinfo.sh ro.build.id = IMM76D ro.build.display.id = ALPS.ICS2.MP.V1.18 ro.build.version.incremental = eng.lt.1395940871 ro.custom.build.version = 1395940871 ro.build.version.sdk = 15 ro.build.version.codename = REL ro .build.version.release = 4.1.1 ro.build.date = Fri Mar 28 01:23:10 CST 2014 ro.build.date.utc = 1395940990 ro.build.type = user ro.build.user = lt ro .build.host = ubuntu ro.build.tags = test-keys ro.product.model = AN1 ro.product.brand = XINGHAN ro.product.name = F9-2S ro.product.device = F9-2S ro.product .board = XINGHAN ro.product.cpu.abi = armeabi-v7a ro.product.cpu.abi2 = armeabi ro.product.manufacturer = XH_F9 ro.product.locale.language = zhr ro.product.locale.region = CN ro .wifi.channels = ro.board.platform = # ro.build.product is obsolete; use ro.product.device ro.build.product = F9-2S # Do not try to parse ro.build.description or .fingerprint ro.build.description = fise15_ics2-user 4.0.4 IMM76D eng.lt.1395940871 test-keys ro.build.fingerprint = alps / fise15_ics2 / fise15_ics2: 4.0.4 / IMM76D / 1395940871: user / test-keys ro.build.flavor = ro.build.characteristics = default persist.sys.timezone = Asia / Shanghai # end build properties # begin mediatek build properties ro.mediatek.version.release = ALPS.ICS2.MP.V1.18 ro.mediatek.platform = MT6575 ro.mediatek.chip_ver = S01 ro.mediatek.version.branch = ALPS.ICS2.MP # end mediatek build properties # # system.prop for generic sdk # rild.libpath = / system / lib / mtk-ril.so rild.libargs = -d / dev / ttyC0 # MTK, Infinity, 20090720 {wifi.interface = wlan0 # MTK, Infinity, 20090720} # MTK, mtk03034, 20101210 {ro.mediatek.wlan.wsc = 1 # MTK, mtk03034 20101210} # MTK, mtk03034, 20110318 {ro.mediatek.wlan.p2p = 1 # MTK, mtk03034 20110318 } # MTK, mtk03034, 20101213 {mediatek.wlan.ctia = 0 # MTK, mtk03034 20101213} # MTK, TeChien {ro.media.enc.hprof.file.format = 3gp ro.media.enc.hprof.codec.vid = m4v ro.media.enc.hprof.vid.width = 720 ro.media.enc.hprof.vid.height = 480 ro.media.enc.hprof.vid.fps = 30 ro.media.enc.hprof.vid .bps = 3400000 ro.media.enc.hprof.codec.aud = amrnb ro.media.enc.hprof.aud.bps = 12200 ro.media.enc.hprof.aud.ch = 1 ro.media.enc.hprof .aud.hz = 8000 ro.media.enc.mprof.file.format = 3gp ro.media.enc.mprof.codec.vid = m4v ro.media.enc.mprof.vid.width = 352 ro.media.enc .mprof.vid.height = 288 ro.media.enc.mprof.vid.fps = 30 ro.media.enc.mprof.vid.bps = 990000 ro.media.enc.mprof.codec.aud = amrnb ro.media .enc.mprof.aud.bps = 12200 ro.media.enc.mprof.aud.ch = 1 ro.media.enc.mprof.aud.hz = 8000 ro.media.enc.lprof.file.format = 3gp ro .media.enc.lprof.codec.vid = h263 ro.media.enc.lprof.vid.width = 176 ro.media.enc.lprof.vid.height = 144 ro.media.enc.lprof.vid.fps = 30 ro.media.enc.lprof.vid.bps = 384000 ro.media.enc.lprof.codec.aud = amrnb ro.media.enc.lprof.aud.bps = 12200 ro.media.enc.lprof.aud. ch = 1 ro.media.enc.lprof.aud.hz = 8000 # MTK, TeChien} # wifi.tethering.interface = ap0 # ro.opengles.version = 131072 wifi.direct.interface = p2p0 dalvik.vm.heapgrowthlimit = 64m dalvik.vm.heapsize = 128m # Encrypt phone function ro.crypto.tmpfs_options = mode = 0771, uid = 1000, gid = 1000 ro.crypto.fs_type = ext4 ro.crypto.fs_real_blkdev=/emmc@usrdata ro.crypto. fs_mnt_point = / data ro.crypto.fs_options = noauto_da_alloc ro.crypto.fs_flags = 0x00000406 # audio ro.camera.sound.forced = 0 ro.audio.silent = 0 # USB Config Type ro.sys.usb.storage.type = mtp, mass_storage # USB MTP WHQL ro.sys.usb.mtp.whql.enable = 0 # Power off opt in IPO sys.ipo.pwrdncap = 2 ro.sys.usb.storage.type = mtp, mass_storage # # ADDITIONAL_BUILD_PROPERTIES # fmradio.driver.chip = 3 ril.external.md = 1 ro.sf.hwrotation = 0 ril.current.share_modem = 1 launcherplus.allappsgrid = 2d launcher2.allappsgrid = 3d_20 curlockscreen = 2 ro.mediatek.gemini_support = false drm. service.enabled = true fmradio.driver.enable = 1 mediatek.wlan.chip = MT6628 mediatek.wlan.module.postfix = _mt6628 dalvik.vm.mtk-stack-trace-file = / data / anr / mtk_traces.txt ro. config.notification_sound = OnTheHunt.ogg ro.config.alarm_alert = Alarm_Classic.ogg ro.config.ringtone = Backroad.ogg net.bt.name = Android dalvik.vm.stack-trace-file = / data / anr / traces.txt & lt ; / code & gt;  pre> 

 Specification NAND   





 Layout NAND  

 & lt; code class = & quot; objectivec & quot; & gt; [PART] blksz: 2048B [PART] [0x0000000000000000-0x000000000003FFFF] & quot; PRELOADER & quot; (128 blocks) [PART] [0x0000000000040000-0x00000000000FFFFF] & quot; DSP_BL & quot; (384 blocks) [PART] [0x0000000000100000-0x00000000003FFFFF] & quot; NVRAM & quot; (1536 blocks) [PART] [0x0000000000400000-0x000000000041FFFF] & quot; SECCNFG & quot; (64 blocks) [PART] [0x0000000000420000-0x000000000047FFFF] & quot; UBOOT & quot; (192 blocks) [PART] [0x0000000000480000-0x000000000097FFFF] & quot; BOOTIMG & quot; (2560 blocks) [PART] [0x0000000000980000-0x0000000000E7FFFF] & quot; RECOVERY & quot; (2560 blocks) [PART] [0x0000000000E80000-0x0000000000F9FFFF] & quot; SECSTATIC & quot; (576 blocks) [PART] [0x0000000000FA0000-0x0000000000FFFFFF] & quot; MISC & quot; (192 blocks) [PART] [0x0000000001000000-0x00000000012FFFFF] & quot; LOGO & quot; (1536 blocks) [PART] [0x0000000001300000-0x000000000139FFFF] & quot; EXPDB & quot; (320 blocks) [PART] [0x00000000013A0000-0x000000000FE9FFFF] & quot; ANDSYSIMG & quot; (120,320 blocks) [PART] [0x000000000FEA0000-0x0000000011C9FFFF] & quot; CACHE & quot; (15360 blocks) [PART] [0x0000000011CA0000-0x0000000011C9FFFF] & quot; USER & quot; (0 blocks) & lt; / code & gt;  pre> 

For information: MT6515 processor is an absolute counterpart MT6575, The only difference is the absence of 3G in 6515. MT6575 was released in 2011, and the market has got to the top of 2012. The operating system is specified as AN1 everywhere Android 4.1.1, even in the firmware, but in fact there there is Android 4.0.4 ICS, which was released in 2012 the same year. 



The device is available in 5 different colors: black, white, pink, gold and white gold with black. As you can see, my chances of getting an overview of the device on the normal color is 20%. On the other hand, the chances of getting exactly the same pink, therefore I am infinitely grateful for the gold. SWAG! 



 



 Figure 1. In summer, hand literally boils beneath them.  I> 

awolf:
PPC nafig it is you do
Do not tell me what was going to use as a clock
they also can kill

xlab:
This watch, as they still use
Do not chop firewood same
Wait a minute though ... blockquote> 25,279,091

41,654,150


Figure 2-3. The standard contents of the box: a subject, headphones, cable, power adapter, manual in broken English. I>

26,667,353

11,575,717


Figure 4-5. Button Vol +, button back, plastic cap usb, speaker, seen a hole for the camera i>

Cap for usb consists of a rigid plastic, immediately began to move away and become absolutely useless - had to be removed. The strap is made of silicone rubber, pulls well (if desired, you can apply a tourniquet).

71,259,654

56,488,570


Figure 6-7. The button home, power button on the other side of the housing. The battery is removed very easily under it is a slot for cards microSD and SIM. I>

Jack audio jack is missing, bundled earphones were microUSB, they also act as an antenna for the FM-radio. Best use - cut in half, and the remaining piece of wire used as an antenna, the radio will operate at the same time through the speaker.

69,015,624

69,719,806


Figure 8-9. Worn on the wrist of a music box conditional Uncle Vasya. I>

72,549,668

35,226,264


Figure 10-11. The TFT screen is barely drags, but still clearly visible. Ideally, of course, at night. I>

The screen behaves like any similar family of TFT - different angles inverts the colors in the sun it can be seen bad, there grit, stains glow. TTX do not know about. Backlight can not be adjusted.



Figure 12. SWAAAAG! I>

Pricing and Availability h4> No coupons and ref-links I have for you is not, and the price in my opinion, biting - 4300rub. Buy this model can in TinyDeal (There are other models of normal color to black even worth the discount). On DealExtreme contains incorrect specifications from the box and on the photos in hours confused top and bottom, so there I will not give references. Let learn to examine their goods.

The software and firmware h4> As I wrote above, the device costs Android 4.0.4. Check out this simple: First, you can see the dump build.prop (under the table of characteristics) and find the assembly identifier

  ALPS.ICS2.MP.V1.18  code>  pre > Secondly, you can poke a few times on the line with 4.1.1 in the settings and catch the Easter eggs from 4.0.x: 



 



 



 Figure 13-14. About Phone.  I> 



The firmware is almost AOSP, with slight modifications in the direction of reducing the weight and ease of use on the screen 2 & quot ;. Standard android - no more, no less. Next will be only selected screenshots. 



 



 



 Figure 14-15. Lock screen and the desktop (set  clock MIUI ).  I> 



 



 



 



 Figure 16-18. 3 screens embedded applications. Also SuperSU.  I> 



From the built-in applications include the following: 

Dialer 2 - alternative standard dialer, appears correctly on the screen, 2 & quot ;, screenshots on Fig. 19-20; File Manager - handy provodnichok, is able to see hidden files and open files from the card to the respective applications; CameraMX - sided multifunctional application as a camera, a screenshot on Fig. 23. Examples of the photo you do not want to see; One Shot - at start CameraMX opens and takes the shot without question. Spy feature; Sound Recorder - easy to use voice recorder, writes in .amr. Spy feature; Icon with hieroglyphs - stopwatch screenshot on Fig. 24. When I took the device out of the box, there was found more apps with similar names and even more strёmnym content, but after resetting all the data they disappeared somewhere, and therefore were not built;
 



Figure 19-20. Appearance and convenience dialer I definitely like. I>





Figure 21-22. Inbound and outbound call. I>





Figure 23-24. CameraMX with premium filters (in-app purchases). Some semblance of a stopwatch (with banner). I>





Figure 25-26. Messages and contacts. I>





Figure 26-27. Mail application. By the way, can be used in all seriousness - check messages very convenient. I>





Figure 28-29. Does. Despite the size of the screen, touch screen performs its function extremely well. I>

The browser works smoothly scaled canvas loose, video opens directly on the page or in a separate annex, a short demonstration in the video below.



The review is not related to video.





Figure 30-31. Gallery and Music. Music application works correctly even with .m4a from iTunes. I>

Embedded Google Play No, probably to save space and to get rid of google-probes. Installing GApps manually can only be taken into account that the version of android - 4.0.4 and SDK - 15. On / system section, the place is small, should be placed selectively. I'm not a fan of google services in their hours i>, so I decided that I'll manage a forum 4PDA and Yandeks.Store.





Figure 32-33. Yandex.Store, work correctly on a 2 & quot ;. The status of installed applications (as usual). I>





Figure 34-35. Reading PDF (performance is normal, but on 2 & quot; 320x240 - perversion). Maps. I>





Figure 35-36. There is support for A-GPS. GPS test went smoothly - satellites quickly found, even though I was inside the room near the window. I>

As for video playback, the MK6575 is not explicitly drawn. Sample resolution 720x304 walked with noticeable lags in standard video player, VLC and MX Player (with active HW Decoding). Therefore, if necessary, see a movie on the clock, you should convert the pre-screen resolution (320x240). Just keep in mind that the active use of resources CPU / GPU battery holds about 2-3 hours.





Figure 37-38. Battery consumption in standby mode (left overnight). Benchmark CPU / GPU in AnTuTu. I>



A little phreaking h4> Before you do lewdness firmware and carcass Chasofon should get dumps NAND, while the device is still alive. The first thing to rutanut system if you have not done it - I personally rutanul once pulled out of the box. Framaroot copes with its task.





Figure 39-40. SuperSU installed, the access request is working. I>

Now you should use the kitchen Mtk Droid Tools , created by our compatriot.



We use the option Backup (1) i> to copy blocks from all sections of NAND. The option (2) i> Recompress downloaded blocks format perceived SP Flash Tool. The option (3) i> automatically generates and sews CWM recovery . Login button in recovery mode is VolUp, simply hold it and when you turn on the device until the CWM.

The process of downloading the entire family MTK, and mt6575 particularly occurs because: preloader - & gt; uboot - & gt; kernel. Accordingly, preloader does start initialization, reads markup NAND and jumps at uboot. Depending on the reason for inclusion (usually, plug the cable, ...), uboot boot continues or not. Preloader responsible for drawing the charge indicator and logo until uboot decides what to do.

Preloader is also responsible for NAND firmware with the utility SP Flash Tool , which is used roughly the Chinese factory . In older models, Mediatek, piercing made through UART, but in our case, everything happens quickly and through USB.
The interface SP Flash Tool


For NAND flash parts, turn off the device, press the «Download» and connect the cable. During cable connection Preloader obnaruzhaetsya program and the process begins. All parts are automatically cling of scatter-file generated in MTK Droid Tools (MT6575_Android_scatter.txt). However, the description of the NAND layout must match the actual markings on the device. In the case of a mismatch of the security program and notifies an error to write to a log that is not matched.
Current markup NAND at Smart Watch AN1 (taken from the log UART)

 & lt; code class = & quot; bash & quot; & gt; part PRELOADER size 0 40000 part DSP_BL size 40000 C0000 part __NODL_NVRAM size 100000 300000 part __NODL_SECCFG size 400000 20000 part UBOOT size 420000 60000 part BOOTIMG size 480000 500000 part RECOVERY size 980000 500000 part SEC_RO size E80000 120000 part __NODL_MISC size FA0000 60000 part LOGO size 1000000 300000 1300000 part __NODL_EXPDB size A0000 part ANDROID size 13A0000 EB00000 part __NODL_CACHE size FEA0000 1E00000 part USRDATA size 11CA0000 D920000 & lt; / code & gt;  pre> 

Thus, in the presence of backups and still alive preloader - the device is not killed. In the case bungle preloader, in mt65xx has a special  meta-mode , until they came to check it ( fortunately), but this mode is invoked ways either a) VolUp pinching when connecting usb cable, or b) a special circuit test pin to the ground. 



And then I could not resist. 



 29,867,886 



 

+  partial photo back side  (there is nothing interesting). 



The cheaper the device is made, the easier it is to disassemble. The body has been fastened completely occupies 8 identical cross head screws, after which he collapsed unscrewing itself (himself). Inside, as it turned out, do not use the traditional hot melt glue or some yellow tape. All peripherals neatly on shelves and pressed against the housing top. On the same side of A are located all we are interested pins. Firstly, according to the same  for example mk6577 , activating meta-mode pin is on the right at the corner and labeled as  KCOLO  i>. Second, there are pins  tx4  i>,  rx4  i>,  tx1  i>,  rx1  i>, one of them clearly responsible for UART. At random revealed that  tx1  i> and  rx1  i> in the lower right corner. 



 17,409,644 



  51,503,417 



 



The battery can be cut with a knife and then provodochki from UART would display without interference battery. Now to this NЁH on hand more questions from others. 



Kernel boot line a.k.a. param line: 

  console = tty0 console = ttyMT0, 921600n1 root = / dev / ram nand_manf_id = 0xad nand_dev_id = 0xbc uboot_ver = 2010.06 uboot_build_ver = MAIN2.2.ubt.2274 lcm = 1- nt35582_mcu_6575 fps = 4732  code>  pre>, which means you need to configure minicom on baudrate 921600. My pl2303 with quartz like handles. After downloading communicate with uart tx / rx possible through / dev / ttyMT0 and nothing will stand in the way. 

Log in boot mode preloader (after connecting the cable): http://pastebin.com/9Qe9H9Z6 Log load in standard mode (after pressing the power): http://pastebin.com/0XtVkSzj