Create our own tracker for $1!

[biemster]

While it's fun to search the online mall for cheap bluetooth trackers, wait for a month for them to arrive and hope that they contain a flashable chip, let's instead make our own!

The target is very tight: $1 in quantity 100+

I've found a couple candidates already, but definitely would love to see some more suggestions in the comments.

Ideas so far:

1. InPlay NanoBeacon IN100 as suggested by @Cyl0nius in Tracker running on single 1.5V coin battery #26
   https://inplay-tech.com/in100
2. AK1595 beacon tx only IC
   https://www.akm.com/us/en/products/bluetooth-low-energy-beacon/
3. Holtec Beacon transmitter BC7161 (likely needs a support mcu)
   by far the cheapest (~$0.2) if we can figure out how to omit the support mcu
   also might be difficult to source
   https://www.holtek.com/page/vg/BC7161
4. WCH CH592 / 582, CH32V208 or similar
   These are very cost effective (~0.5) and already have a findmy firmware here
   https://oshwlab.com/biemster/ch592tag
5. Telink tlsr825x
   Have very good support by @atc1441 and @pvvx for example
   but seem difficult to source
6. Ci24R1 + CH32v003
   Another broadcast only chip + mcu, readily available on LCSC

In conclusion I think the CH592 is the prime candidate due to it's availability at jlcpcb for example, and low price and passives count. However I would really like to experiment with the TX only AK1595 and BC7161 for example, since they would do only the bare minimum.

Any ideas or suggestions are definitely very welcome, as are suggestions for a good fab house since this will be my first such project!

[atc1441]

https://www.lcsc.com/product-detail/Microcontrollers-MCU-MPU-SOC_JieLi-Tech-AC6329C4_C5440081.html

[biemster]

https://www.lcsc.com/product-detail/Microcontrollers-MCU-MPU-SOC_JieLi-Tech-AC6329C4_C5440081.html

That one looks awesome, $0.35 even quantity 1! Have you ever programmed one of those?

[atc1441]

Its flashable, but its has a very bad deep sleep :( So not good for a tracker

[biemster]

aww that's a pity, I could not find that in the datasheet indeed

[pvvx]

Cheap keys on ST17H66B are fully mastered (https://pvvx.github.io/iSearching/)
The THB2 project uses SDK for GCC, modified by me and froloffw7, does not contain blobs. Has all sources in C for assembly. Full reverse engineering has been done.
The "KEY2" firmware contains an example of a ready-made BLE button for working in Home Assistant using the BTHome protocol.

BLE OTA is supported in PHY62x2BTHome.html.

---

Dependence of average consumption of a device of type "KEY2" on the BLE advertising interval:

Vcc 3.0V. RF TX Power up +0 dBm (10..13+ mA).

"KEY2" Power:
Sleep + RTC: 1.67 uA at 3.0V
Deep-Sleep + KEY (GPIO Int): 0.48 uA at 3.0V
Sleep + RAM + RTC + KEY (GPIO Int) - 3.1..3.3 uA at 1.8..3.3V
Active cycle of work with transmission of BLE advertising with BTHome data - 5 ms, average 7.2 mA (peak up to 18 mA).

Using Deep-sleep is inconvenient - loading the code and initialization takes up to 100 ms with an average current of 7.15 mA.
Similar to normal operation in sleep+RAM mode, average consumption will be obtained when operating in deep sleep mode with a BLE transmission period of 240 seconds.

[atc1441]

Also while 1,50$ and not 1$ this is quite unbeatable in a DIY solution, cheap plug of my FindMy Video :D
https://youtu.be/RPGuPyxdHVw

[biemster]

The ST17H66B is what started this project a couple years ago indeed :) Do you know any online pcb factories that still have them @pvvx ?

[pvvx]

https://aliexpress.ru/item/1005004397030802.html

$1

And similar...
There are more than 5 types of cases on Aliexpress.
The one in the picture is the cheapest.

---

Support for ST17H66B/PHY62xx operation in "LE Long Range" mode (this is BLE at a range of 500+ meters) has not yet been published in my SDK, but it has been implemented and tested for a long time. If I have time, I will publish such options as well.
I'm not very interested in Zigbee. Zigbee has too short a range compared to "LE Long Range" and high power consumption.

---

https://aliexpress.com/wholesale?SearchText=ST17H66

---

The cheapest chips that can be ordered in our country from official suppliers are chips from WCH.
There is no need to publish projects - all SDK variants from WCH are available in the public domain.
Some WCH chips have been used in my production for a long time (in industrial production). But these are not public projects.
(In industrial production, the price of electronic components is the last thing to be considered. There, other criteria are more important, which are far from being used for household purposes...)

[pvvx]

The cheapest CH582M.
Broadcaster is the default test case from the WCH SDK. (Tested in 2022)
Broadcaster - BLE advertising only, no ability to connect or respond to scanning.

RF TX 0 dbm. In the example from the SDK changed: HAL_SLEEP=1, DEBUG - disabled, #define DEFAULT_ADVERTISING_INTERVAL 4800 (3 sec), DC-DC enabled.

On TSLR825x with similar parameters (3 sec, 0 dB) the average current is less than 5 µA, sleep is less than 1.8 µA (32 KB RAM is constantly active), the maximum peak during transmission is about 7 mA.

[pvvx]

It is worth remembering that for beacons like iSearching and similar, the BLE advertising period should be 1 second. But there is not a single SoC that can last 1 year on CR2032 in this mode.
With pulse consumption (pulses up to 8 mA), the capacity of the average CR2032 is only up to 100 mAh. CR2032 batteries costing more than the key fob itself have a slightly higher capacity.

CR2450 will work more than 2 years, only due to lower internal resistance (lower voltage drop under 8 mA load).

As a result, the price of the chip is completely unimportant if CRxxxx batteries are used. It will cost less than the price of the battery.
Cheap alternative only 2xAAA.

Another solution is to install a large capacitor in the power supply chain (more than 100 uf). But for a capacitor with a large capacity and low leakage, the price is already equal to or higher than the SoC price :)

The target is very tight: $1 in quantity 100+

When shipped with battery and 1 year of operating time = Impossible goal at the current technological stage of manufacturing cheap SoCs (if you are not in China) :)

[pvvx]

https://www.lcsc.com/product-detail/RF-Transceiver-ICs_PHYPLUS-PHY6222AAQC_C2836482.html

Qty.	Unit Price	Ext. Price
1+	$ 1.7501	$ 1.75
200+	$ 0.6788	$ 135.76
500+	$ 0.6538	$ 326.90
1000+	$ 0.6428	$ 642.80

:) :) :)

THB2, BTH01 - They can be less than $1.5 each on Aliexpress.

---

In WCH SDK, working with "LE Long Range", "PAwR" (new Bluetooth standards v5.4) is only available for CH32V208.
"LE Long Range", "PAwR" and standard encryption of BLE advertising in BT5.4 completely kills Zigbee.

Previously, several WCH LinkW (CH32V208) were purchased on AliExpress for $1.5, including shipping.

[pvvx]

TLSR827x Find My Network Accessories SDK Developer Handbook

[pvvx]

pvvx/THB2#94

[biemster]

That looks awesome @pvvx ! Very interested in the st17h66 BLE Long Range mode.

[pvvx]

In the "Coded PHY" mode, the PHY chips have problems - the RF part slows down. The delays do not fit the specification. This affects the switching speed of the RF part TX-RX... But FindMy does not use reception.

(In the chip, the IRQ from the radio frequency part (mode PHY Coded) arrives with a delay - another error in the PHY62x2/ST17H66 chips. This affects the processing of the BLE connection request. The CPU does not have time to process the request in time, since the IRQ arrives with a delay. But this seems to have been cured...)

---

And where can I find a full description of the format of the data transferred for FindMy?
The available descriptions and the provided sources are more like a game of kindergarten.

[biemster]

Do iDevices still register those broadcasts? I remember reading somewhere that even if an iPhone/iMac is able to do coded phy, it will not report findmy broadcasts sent in this mode.

[biemster]

And where can I find a full description of the format of the data transferred for FindMy? The available descriptions and the provided sources are more like a game of kindergarten.

I actually do not know of any official documentation of this, although oems can get "Works with Apple FindMy" for their tags so it must be somewhere?

[pvvx]

I don't use Apple devices. None of them suit me in terms of functionality.
So I don't know anything and can't check. I don't even want to have Apple devices for testing.

[atc1441]

I don't use Apple devices. None of them suit me in terms of functionality. So I don't know anything and can't check. I don't even want to have Apple devices for testing.

Same :D

The FindMy is only reverse engineered as there is no official doku available

[biemster]

yup same here too :) although I did buy a mini for testing, which turned out to be useless

[pvvx]

nRFConnect:

Device data used:

The Key used is simply a random sequence of numbers.

[pvvx]

A MAC address with 0xC0 (bits 7 and 6 in "1") in the first byte is a random MAC address. And it should be marked as Random in the BLE advertising data. But there is no mark in the BLE packet flags, if you look at the FindMy "childish writing".

[biemster]

yeah they are really abusing the mac address to get some extra bytes there

[pvvx]

But they don't put a mark in the flags that it's "Random MAC"?

Why then isn't "Extended Advertising" used - the length of the message is in kilobytes...
Apple only use older Bluetooth v4.2 chips in its devices?

The FindMy is only reverse engineered as there is no official doku available

There are still a lot of questions.
It turns out that this is not a complete "reverse engineered", but only a basic one, without analyzing the simple BLE format.
Need to wait until they finish this or give an example of a full BLE ad package, not just a portion of the transmitted payload (PDU).

[biemster]

I was thinking to have something like this built: https://oshwlab.com/biemster/ch592tag

[biemster]

The ceramic antenna actually is much more expensive than I thought (0.4), exchanging that for a PCB one will result in 30 assembled modules for EUR 40 (which is 1.33 per tag, not bad!)

[pvvx]

There is no button - without it, it is difficult to work with such a sensor. You can't update it, you can't change the key...
A ceramic antenna usually has a worse operating range than an antenna correctly routed on a printed circuit board (size matters).

[biemster]

I knew I forgot something!

[pvvx]

@pvvx Oh, they are compatible with the Lenze and therefore your browser tool. good to know

This PB-03M module can work in Zigbee too. But there is no Zigbee SDK for it yet.

I can't find a Zigbee SDK for the PH62xx series.
Only DeepSeek evasively answers the question:
Does the P622ZB2S module installed in the Tuya ZigBee "Mini Smart Switch" device work on the ZigBee protocol?
DeepSeek's answer:
The P622ZB2S module used in the Tuya ZigBee "Mini Smart Switch" device does work on the ZigBee protocol, despite the fact that it is based on the PHY6222 chip, which is originally oriented towards Bluetooth Low Energy (BLE). This is possible because the manufacturer (in this case Tuya) implemented ZigBee support at the software level using the PHY6222 chip.

[biemster]

@pvvx Oh, they are compatible with the Lenze and therefore your browser tool. good to know

This PB-03M module can work in Zigbee too. But there is no Zigbee SDK for it yet.

@natschil was actually able to do a bit of Zigbee as he wrote here: biemster/st17h66_RF#7

[pvvx]

Sending and receiving RF RAW packets with different types of Phy is not at all interesting. These are the basic functions of any RF SOC and they are available in any SDK, except for Espressif chips. :)

Full zigbee router implemented on Phy6222

This means that MATTER can also be programmed.

PS: On https://www.elektroda.com/ someone has access to Tuya and posts various SDKs and sources. But there is only WiFi :(

[pvvx]

@atc1441
https://chat.deepseek.com/ : Who is ATC1441?

ATC1441 appears to be a username or handle associated with an individual who is involved in the development or modification of firmware for electronic devices, particularly flash memory tools like the "Transcend RDF5" or similar devices. This person has shared custom firmware and modifications that enable additional features or improve the functionality of these devices. The modifications often include enabling Wi-Fi capabilities, adding support for different types of flash memory, or improving the overall performance of the tools.

If you are looking for specific information about ATC1441 or their work, it would be best to refer to forums, GitHub repositories, or other online communities where firmware modifications and electronic device hacking are discussed. :)

And DeepSeek takes me for a group of people. 8-)
It's time to teach AI to hack electronic toys...

[sonman]

I want to solder a battery on the PB-03. Which one is easy to solder 03, 03F or 03M?
Can I use the Board Kit PB-03F-Kit to programm multiple Chips without soldering ? Looks like 03M-Kit is plugable ? Which hardware do I need to programm the chips ? I have currently only a (chinese) ST Link.
Where can I find the SDK for the chip (PHY6252) because I (maybe) want to write my own firmware ?

[biemster]

@sonman from the looks of it the F is the easiest to solder on? But you can of course see that with the quickest of internet searches. If you have more detailed questions about which module suits you best it's probably advisable to contact the manufacturer directly (ai-thinker), they are know to respond nicely to developers.

For programming you just need an UART, those cheap USB - UART dongles will do fine but you could also use any uart available on a single board computer. Excellent firmware with SDK, code and flasher can be found here: https://github.com/pvvx/THB2

[pvvx]

I want to solder a battery on the PB-03. Which one is easy to solder 03, 03F or 03M?

https://docs.ai-thinker.com/en/blue_tooth_pb

Can I use the Board Kit PB-03F-Kit to programm multiple Chips without soldering ? Looks like 03M-Kit is plugable ? Which hardware do I need to programm the chips ? I have currently only a (chinese) ST Link. Where can I find the SDK for the chip (PHY6252) because I (maybe) want to write my own firmware ?

Since the official PHY website has been in an unclear state for the second year, I copied everything assembled on BLE/Zigbee PHY chips to https://github.com/pvvx/PHY62x2.

To work with PHY chips you will need Keil. This IDE requires purchase.
A free SDK version for building on GCC without any blobs is hosted at https://github.com/pvvx/THB2. But it is edited for my project.
biemster and others use Keil.
To translate the PHY SDK to GCC, we had to make a lot of changes to the source code fragments collected from all over the Internet. This work was done by me and froloffw7.

ST-Link requires reprogramming to "J-Link OB" work with SEGGER utilities. And some SEGGER patches so that the reprogrammed ST-Link works with all types of chips. This violates all SEGGER licenses and is only available in "hacker" forums and not in English.

Officially it is possible to reprogram ST-Link to work with OpenOCD. But it is a slowdown, etc. :(

[biemster]

biemster and others use Keil.

initially i did yes, but for a couple years already i moved to gcc as well, in https://github.com/biemster/st17h66_RF

[pvvx]

initially i did yes, but for a couple years already i moved to gcc as well, in https://github.com/biemster/st17h66_RF

It is clear that this is without XIP Flash, power management in sleep and without BLE stack.

[phoffi]

@sonman

I want to solder a battery on the PB-03. Which one is easy to solder 03, 03F or 03M?

i have a couple of PB03M here - fine to solder, but i think they are all easy to solder (not too small pads).

Can I use the Board Kit PB-03F-Kit to programm multiple Chips without soldering ?

no, the module itself is soldered on the kit (you must solder the cables or just use some pogopins)

Looks like 03M-Kit is plugable ?

no, it is soldered too. (But i have the same problem and will create a 3D printed programming solution - will post it here when it is finished ;) )

[pvvx]

The PB-03x has a PHY6252 installed. It does not have a "Reset" signal.
In the PB-03x-Kit, "Reset" is performed by disconnecting the power supply.

But the capacitor is set to 10 μF.

And it discharges in a few minutes if you flash a program like FindMy.
If you make a programmer from PB-03x-Kit, you need to install a resistor to quickly discharge this capacitor... Or unsolder this capacitor...
I am really tired of waiting and holding the "RST" button when programming these kits...
It is necessary to hold the button longer than the programming process itself. :)

[pvvx]

https://aliexpress.ru/item/1005007872523957.html ~$3

Apple FindMy firmware (FullFlash) from FindMy-QMD-v1 (ST17H65B).

=========================================================
PHY62x2/ST17H66B/TG7100B Utility version 08.02.25
---------------------------------------------------------
Connecting...
PHY62x2/TG7100B: Release RST_N if RTS is not connected...
ST17H66B: Turn on the power...
Chip Reset Ok. Response: b'cmd>>:'
Revision: b'00136085 6222M005'
FlashID: 136085, size: 512 kbytes
PHY6222 - connected Ok
Reopen COM6 port 500000 baud... ok
Flash Status: 0x00
Flash Serial Number: 4250305330343717

UART log:

SDK Version:00030009
[REST CAUSE] 2
 FW Version: 0x0001071e
C1_version :10 03
gSensor SC7A20 !!!!!!!
SC7A20_INIT
Compiled: Aug 20 2024 15:38:20

 ab same
  retry_time =0 A=7a73 B=7a73 check_sum= 7a73 Serial Number:fe bb ff 4b 76 25 99 e5
####  power on reset  #####
5e 99 52 43 b4 ff AD_CAL[815 7f1]
1-3297V-0-Bat=0-cnt=0
1-2778V-5-Bat=0-cnt=0
1-3281V-3-Bat=0-cnt=0
1-3146V-8-Bat=0-cnt=0
1-3154V-10-Bat=0-cnt=0
1-3222V-10-Bat=0-cnt=0
1-3260V-5-Bat=0-cnt=0
1-3244V-5-Bat=0-cnt=0
1-3269V-5-Bat=0-cnt=0
1-3248V-5-Bat=0-cnt=0
1-3284V-5-Bat=0-cnt=0
1-3247V-5-Bat=0-cnt=0
[GAP ROLE 1]
reset bd addr

 get bt addr: 5e 99 52 43 b4 ff

 BT MAC: ff b4 43 52 99 5e
stop adv
ADV Pairing
[GAP ROLE 2]

[pvvx]

Received modules PB-03M and PB-03M-Kit.
I found a broken PB-03M-Kit right away. Replaced the module in it - works.
In PB-03M-Kit there is a PHY6252 chip with Flash 256KB, and in PB-03M modules - 512KB.

Revision: b'0012600b 6222M005'
FlashID: 12600b, size: 256 kbytes
Flash Serial Number: 007f002082a8978a

Revision: b'00136085 6222M005'
FlashID: 136085, size: 512 kbytes
Flash Serial Number: 4250305539373611

[phoffi]

as i mentioned before, here is my programmer solution for 3D print and housing with CR2032 holder:

STL Files:
PB03M.zip

[biemster]

as i mentioned before, here is my programmer solution for 3D print and housing with CR2032 holder:

STL Files: PB03M.zip

That looks awesome!

One minor nitpick, the antenna does not really like all that metal from the cr2032 behind it. If you have range issues with this very neat build you might want to focus on that. But all in all great work!

edit: in the next iteration you might just rotate the module 180 to get the antenna out of the metal backplane from the cr2032?

[phoffi]

Thanks @biemster for your great tips. now i rotated 180 degrees, much better dB levels on my mobile.
Updated case is here:

STL: PB03M_Case_v2.zip

[Systm21]

Nice work @phoffi, maybe a version for a Module with a CR2045 (holder) would be cool, i bought much of them for the OpenEpaperlink and have some left over at the moment.

Your 2032 holder also elready exists for 2045 cells.

[Systm21]

What are your experiences with the PB03(m)(f) modules? I've been testing the TB-03F from @atc1441 for a while now and they give a lot of feedback. Lots of feedback with what feels like more accurate results. The error detections are also not more than with other modules.
I even find better data than the "expensive" nrf modules.

[pvvx]

What are your experiences with the PB03(m)(f) modules?

On TB-0x (TLSR825x) it is possible to achieve lower battery consumption than on PB-0x PHY6252.

Datasheet:

Deep sleep with 32KHz RTC and SRAM retention:

• TB-0x (TLSR8250) - 1.4 uA
• PB-0x PHY6252 - 13 uA

---

Found a faulty module PB-03M

(I tore off the cover along with the antenna components...)

[magnets110]

does any firmware for these cheap modules support multiple keys/key rotation?

[biemster]

does any firmware for these cheap modules support multiple keys/key rotation?

that is very easy to implement, but due to low demand not done yet. except the nrf51 FakeTags by @dakhnod if i recall correctly

[magnets110]

Yes the nrf51/52 firmwares support key rotation. I am using this on nrf52810 https://github.com/pix/heystack-nrf5x
But the nrf modules are £7-10!

[biemster]

@magnets110 currently I'm porting the CH59x firmware to ch32v003fun in cnlohr/ch32fun#534 for use in https://github.com/biemster/qible, when that is done it is really trivial to have key rotation (since it will also rotate between Apple and Google FMD networks). Those modules will be just slightly over $1 each, so if you are looking for cheap those will be the way to go.

[magnets110]

I have a holyiot 21014 nrf52810 ($12) and a Zigbee smart button ($4) with TLSR8253. The nrf52 with 3s advertising frequency and tslr825 on 2s

The nrf52 gets 3x as many location reports/day as TLSR module and gives better range in my testing

[pvvx]

on nrf52810 https://github.com/pix/heystack-nrf5x

The nrf52 gets 3x as many location reports/day as TLSR module and gives better range in my testing

In this example, the maximum possible transmitter power for nRF is set to +8 dBm.
The battery will last a couple of months.
In the TLSR825x variants, the transmitter power is set to 0 dBm. The maximum for TLSR825x is +10 dBm. But at +10 dBm, the CR2032 battery cannot provide enough current for long and will also run out after a couple of months.

The nRF52 and TLSR825x series chips differ little in characteristics (current consumption). In a dream TLSR825x, for Findmy the current will be 1.3 μA, when transmitting 0 dBm - 7 mA, when transmitting +10 dBm - 25 mA

And let me remind you - the antenna in the modules from Tuya is very poorly made.

---

According to these measurements: seemoo-lab/openhaystack#57 (comment)
the average CR2032 battery will give a maximum of 40% and the module will turn off:

1. The peak current is specified as 16 mA (this is transmission at +8 dBm). As the CR2032 discharges, the supply voltage under load drops due to the increase in the internal resistance of the CR2032. And after a short time of operation from such a current, it will begin to fall below the minimum operating voltage of the nRF chip.
2. A very high consumption was measured in sleep mode. Something is very bad or incorrectly described in the code. It should be two times less.

As a result, with this approach, you can expect no more than 80 mAh (+25С!) from an average-priced CR2032. And even less from cheap CR2032.

[sonman]

The nRF52810 supports max +4dBm according to docs.

[pvvx]

nRF52840: -20 to +8 dBm TX power, configurable in 4 dB steps

The nRF52810 supports max +4dBm according to docs.

https://github.com/pix/heystack-nrf5x/blob/master/ble_stack.c#L36 -> powers[] = { 8, 7, 6, 5, 4 }

So it's even worse. 16 mA at +4 dBm!

Chinese chips are winning.

[magnets110]

nRF52810 +4dBm shows 8mA in the docs. Is that just the radio, excluding other parts?

https://docs.nordicsemi.com/bundle/ps_nrf52810/page/_tmp/gluon/autodita/CURRENT/parameters.id_current_radio.html

[pvvx]

nRF52810 +4dBm shows 8mA in the docs. Is that just the radio, excluding other parts?

Yes

Radio transmitting @ 0 dBm output power, 1 Mbps Bluetooth low energy mode, Clock = HFXO 10.5 mA

Plus, let's not forget about the DC-DC error in the nRF52 series. :)

But the main thing is that all values ​​in nRF documentation are marketing ones. To find out the exact value, you need to carefully read the documentation and check the provided graphs, not the tables. And in tables always look at the footnotes and measurement conditions. They usually differ from those actually used. :)
In the end, they are not lying, but these values ​​are not applicable to real conditions.

[magnets110]

Another TLSR8253 is the ebyte E104-BT12LSP. Has anyone tested?

docs

datasheet (pdf)

$2.35 with choice shipping https://www.aliexpress.com/item/1005007537045339.html

$2.12 with free standard shipping https://www.aliexpress.com/item/1005002984811386.html

cheaper than the tb-03 modules if you only want a couple