Reverse Engineering an nRF52832 Smartwatch: Custom Firmware

The Concept & Hardware Discovery

Commercial wearables often end up in e-waste bins when batteries fail or software support ends. During a previous teardown project, I examined an old broken smartwatch and discovered a fully functional Nordic nRF52832 SoC onboard, alongside an integrated gyro sensor, SPI display connections, and battery charging circuitry. The challenge was clear: revive the hardware from complete scratch with zero documentation.

Reverse Engineering the Pinout

Without schematics, the first phase required blind hardware mapping:

• SPI Display Lines: Using a multimeter in continuity mode, I matched the known display pin headers to the respective pins on the nRF52832 IC package.
• Integrated Gyroscope & Power: Traced the inaccessible ball/pad traces of the onboard gyro sensor and mapped the charging circuit connections step-by-step.

Bypassing Write Protection & Flashing the Bootloader

Factory nRF52 chips in commercial wearables are typically locked with Access Port Protection (APPROTECT).

• Unlocking the Chip: Wired the board via JTAG and utilized the ESP32-DAP protocol to clear the chip's internal write protection register.
• Bootloader Installation: Once writable, flashed the Adafruit nRF52 bootloader using OpenOCD via the mini JTAG debugger.

Custom Firmware & Display Upgrade

With the bootloader established, I configured a custom firmware environment using the nRF SDK inside VS Code:

• Built and verified peripheral BLE communication using Nordic's LBS (LED Button Service) reference implementation.
• Upgraded the original small panel to a larger 1.69" SPI display using matching driver commands.
• Verified device discoverability over Bluetooth and initial graphic rendering on the display.