This post is a follow up on my review of the AVDS-03 at Tweakers (Dutch).

  1. Intro
  2. Inside out
  3. SoC features
  4. Serial on CON1
  5. Downloads
  6. Related stuff

Intro

About year ago I badly needed to find myself a small bluetooth speaker to listen to music in the shower. Obviously it had to be waterproof and have okay sound. And a low price tag. I found the Avanca AVDS-03 which looked nice and it matched all my requirements. Especially when I got at a 50% discount. ?

The first day was awesome. This little device has pretty amazing sound, there is even bass! Easy controls, nice looks, and it sticks to the wall! Wow! Untill the suction pad let go and the speaker fell to the hard tiled floor. Dead! Not in pieces, but still Dead! Holding the power button produced a clicking sound from the speaker but no leds turned on and it would no longer connect to my phone (yes, the iPhone 5S is shower-steam proof). That day that started so beautifully soaked in unlimited bliss turned into a dark thunderstorm of eternal sadness.

Till my toolbox and soldering iron popped up and said ‘hey look! dead tech! let’s open it up and see what’s inside’. They started unscrewing the screws and disassembling the assembly. Actually, no it didn’t go like that. I had to do it all by myself, but you get the idea! As it turned out opening the case is pretty easy. Just three black Philips screws and once they’re out you simply lift the backside to reveal the world inside.

Hacking the Avanca

Inside out

Once you peek inside you quickly spot the green PCB, a battery, the speaker, the barrel jack for charging and a bunch of wires. There’s a lot of empty space and technically they could have made the whole package half the current size. But I’m guessing the air inside is needed to form the bass sound. What peaked my interest are two special parts. First there are the three holes at the bottom-right of the PCB marked with CON1 and the central chipset marked ‘RDA 5851S’. The CON1 is probably a serial port for debug and programming. The RDA5851S is a SoC packing a lot of cool features. On the back of the PCB is the keypad, mic and the red and blue leds.

 

The PCB is properly fixed with small Philips screws, no glue or weak snaps that always break. Only the speaker is glued onto the backside for waterproofing and you generally never have to take it out anyways. Just unscrew the board and lift it out. The rubber keypad is aligned in the casing with two tiny holes and has a indentation around the edge for waterproofing. As it turned out the keypad was not aligned properly. When it fell onto the floor the pad shifted a bit, causing the keys to constantly press down on all buttons at the same time. Essentially it cause a reboot loop in the software which caused the clicking sound from the speaker.

The battery is marked FEX 602035P and 3.7V at 400mAh. Easy to replace and not really expensive either.

SoC features

The system-on-chip consists of the processors, controllers, communication and does basicly everything that requires programming. The programming is also already included by the manufacturer, so all Avanca really had to do was design the case, the PCB layout and fit it all in. And they did a awesome job at that. My goodness, this device is very waterproof and still easy to repair. And I don’t know many brands that provide this level of hackability on small portable devices.

 

Hacking the Avanca

The cool features from the datasheet:

  • Two processors; a 312 MHz CPU and a media processor
  • SD/MMC-card controller
  • Stereo DAC at 48 kHz and 16 bits
  • AUX in and out
  • Bluetooth 2.1+EDR
  • USB 1.1 with charging capability
  • FM receiver

Yes, you read that right. They could have fitted a micro USB port instead of the barrel jack, so we wouldn’t have to take the special charging cable with us. Everyone already has a few micro-usb cables anyway. Oh well.

And the device could have had a SD card reader, a second speaker and a FM radio? According to the datasheet there is a full featured FM tuner onboard. All you need to do is find the right pin on the SoC and solder an antenna onto that pin. They did the same with the bluetooth antenna, so why not for the radio? Mysteries.

There is probably a lot more this cool chip can do, but my tech insight does not go that far.

Serial on CON1

Now to the other interesting section: the three small holes marked CON1 on the PCB. One of them has rectangle shaped solder while the other two are round. The rectangle one is usually the GND pin and the other two have to be TX and RX. I hooked up my PL2303HX serial-to-usb stick, but the pins didn’t stay properly connected inside the holes. To resolve that I soldered a three-pin header into the holes and now can firmly connect the wires. After playing a bit with the connectors finally the leds on the serial started blinking so there was definitely data streaming in. As it turned out the hole at the top is GND, in the middle is RX and bottom one is TX.

Hacking the Avanca

My soldering skills.. the 3 pins is the header

With the app SerialTools I received only a string of gibberish the moment I powered on the Avanca speaker and nothing else happened. No response on button presses, command input, bluetooth events, media controls or connecting the charger. Only this weird string of seemingly random unicode. In HEX it spelled:

<00><D3>%<0E><02><09>s<FA>5<FF>E<A3><18>!Zo<F8>U<A3><8F><CB><00><00><00><00>

With the iHex app I tried different charsets and finally with UTF16 Little I got this:

팀Ȏ降ꏿ辣

That looks like a combination of Korean and Chinese which is more reasonable as RDA Microelectronics is based in both China and South Korea.

According to Google Translate is Korean for ‘team‘ and 降 辣 means ‘spicy‘ in Chinese. So maybe the chip was developed by Team Spicy? I have no idea..

My guess is the serial console simply writes one line about the software maker and version and then stops. The real output could have moved to the USB controller or maybe even serial over Bluetooth. I’m going to play with that later. For now this is a dead end.

I reassembled the device and it works perfectly again. ?

To be continued…

Downloads

RDA5851S datasheet

(145 B) ▼ Download

Categories: Hacking

Leave a Reply

Your email address will not be published. Required fields are marked *