Decathlon Kalenji OnMove

OnMove is the brand name of a family of GPS watches by Decathlon Kalenji.

Inspired by Renaud Schleck's work on a previous iteration of the watch, I'm taking apart an OnMove 500, documenting my hardware and software related findings here.

WIP WIP WIP WIP

Hardware components

  • Freescale MKL26Z256VLH4 microcontroller. Debugging available via SWD.
  • Macronix MX25L1606EZNI-12G NOR flash (capacity: 2 MB). Stores settings and presumably workout data. Connected via SPI.
  • Dialog DA14680. Presumably used to talk to the external heart rate monitor.
  • Unknown LCD. Connected via I2C.

See onmove500-pcb-back-annotated.png for some interesting test point locations.

Display

There's a sigrok dump of what seems to be the display's initialization sequence.

Firmware

  • There's a bootloader at offset 0x0.
  • The application firmware (firm500.frm) is put at offset 0x8000 in the MCU's flash.
  • The watch presents as a mass storage device on the USB. To update the firmware, copy firm500.frm to USB and press the backlight button to initiate the flashing.
  • The application firmware is "protected" with an 8 bit XOR checksum stored in its final byte. The bootloader(?) refuses to perform an update if that checksum does not match.

WIP WIP WIP WIP