MoniCard Studio & BLE Bridge
Click or Drag & Drop Media Here
Wuthering Waves Preloaded Shorts 35 Characters
MoniCard Media Ready!
About MoniCard — Deep Technical Teardown & Architecture
Physical Board & Silicon Teardown
The MoniCard Gen 1 is an ultra-compact wearable animated badge / digital pass powered by a modern heterogeneous dual-core SoC from SiFli Technology:
| Component | Designation / Part # | Technical Details |
|---|---|---|
| Main Board | mc001a2 |
High-density 4-layer FR4 PCB with perimeter NFC antenna loop and 8 rear RGB status LEDs. |
| Processor (SoC) | SiFli SF32LB523UB6 Marking: sf32LB5231 UB6606 PF5S54.00 |
Dual-core ARM Cortex-M33: • HCPU (High-Performance Core): up to 240 MHz, runs RT-Thread OS, LVGL GUI & video decoder. • LCPU (Low-Power Core): 96 MHz, dedicated to BLE 5.2 baseband and protocol stack. • Integrated 8 MB PSRAM, hardware EZIP graphics decompressor, AES-256 & SHA-256 accelerators. |
| Display Panel | zhj280y 12v-b03 fx | 2.8-inch TFT LCD, 240 × 320 portrait resolution, 3:4 aspect ratio, vibrant saturated color profile. |
| Display Controller | Sitronix ST7789V | Driven over high-speed SPI / DBI interface (ST7789V_GMT024 driver in RT-Thread BSP), PWM-controlled backlight. |
| Physical Controls | SW2 • SW3 • SW1 |
Three rear tactile switches (viewed from back, left to right): • SW2 (Left): Media cycle / Previous / Boot-strap input. • SW3 (Middle): Power On/Off (3s hold) / Display sleep toggle / PMIC wake. • SW1 (Right): Tap-to-Share / NFC profile card manager / Peer discovery. |
| Factory Test Header | 4 Exposed Side Pads | 3.2~4.7V (Raw battery rail) • RX (SoC UART RX) • TX (SoC UART TX) • GND. Operates at 1,000,000 baud for factory programming and ISP ROM unbricking. |
| Sensors & NFC | Accelerometer + ST25 Dynamic NFC | 3-axis accelerometer for gentle/strong shake/swing detection, near-field screen-to-screen business card exchange. |
NOR Flash Layout (flash2 / mpi2 @ 0x12000000)
The system boots from an SPI NOR flash attached to the mpi2 memory controller. Partition layout extracted from ptab.json and ROM bootloader tables:
| Offset | Size | Partition Name | Description / Execution Target |
|---|---|---|---|
0x12000000 |
32 KB | FLASH_TABLE (ftab) |
Security configuration header (SECF magic 0x53454346), master flash partition table, and public key store. |
0x12010000 |
64 KB | bootloader |
Secondary bootloader patch area; determines whether to launch main application or jump to DFU loader. |
0x12020000 |
3.0 MB | HCPU_FLASH_CODE (main) |
Main user firmware (vector table @ 0x120702bd), RT-Thread RTOS, ST7789 display driver, media renderer, and SiFli BLE services. |
0x12320000 |
384 KB | DFU_FLASH_CODE (dfu) |
Standalone DFU V2 loader subprogram (vector table @ 0x123350bd). Reboots here during OTA to unpack and flash chunks. |
0x12380000 |
1.15 MB | DFU_DOWNLOAD_REGION |
Staging buffer where incoming OTA packets are received before being verified and committed. |
0x124A0000 |
3.0 MB | fs_region (fs_root) |
User media file storage (LittleFS / FAT). Stores user-uploaded GIF animations, MP4 loops, and business card profiles. |
0x127A0000 |
16 KB | dfu (FlashDB) |
Persistent Key-Value store tracking OTA progress, session state, and rollback recovery flags. |
0x127A4000 |
16 KB | ble (FlashDB) |
Bluetooth Key-Value store: device MAC address, bonding keys, and RF calibration data. |
SiFli DFU V2 OTA Package Specification
Official MoniCard firmware packages (e.g. MoniCardA_v2.2.0_090417.bin) use the SiFli DFU V2 container format validated by Dalvik bytecode in classes.dex:Ldk;->v:
Image 0 Chunked DEFLATE Compression
The HCPU partition (1,637,456 bytes decompressed) is split into 160 consecutive chunks of 10,240 bytes (10 KB). Each chunk is individually compressed with raw DEFLATE (wbits=-15) and prefixed by:
Root Cause of the "98% OTA Hang"
Reverse-engineering the companion app (Lwx0;->v) reveals that the transfer loops sending packets (string 0x7f110258: "Sending update content") until 98%. At 98%, transfer is 100% finished. The device severs the BLE connection to boot into DFU_V2_LOADER and decompress chunks. Because the MCU reboots, the app UI stays at 98% awaiting reconnect. After installation, the device shuts down, expecting the user to wait ~10 seconds and press the power button to turn it on (string 0x7f11024e: "Update finished. Press power to verify").
Bluetooth Low Energy GATT & Serial Protocol
The MoniCard operates over SiFli's proprietary BLE Serial Service. macOS/Chrome renders UUID bytes reversed:
| Role | Canonical SiFli UUID | Observed Reversed Hex Prefix | Properties |
|---|---|---|---|
| App Service | 00000000-0000-0070-7061-5f696c666973 |
sifli_app (73 69 66 6c 69 5f 61 70 70) |
Primary Service |
| Serial Service | 00000000-0000-0000-6473-5f696c666973 |
sifli_sd (73 69 66 6c 69 5f 73 64) |
Serial Profile |
| Serial Data Char | 00000000-0000-0200-6473-5f696c666973 |
Handle 21 (Max write: 512 bytes) | Read, Write, Notify, WriteWithoutResponse |
Packet Framing (Binary Transfer Mode)
Hardware ISP Recovery / Unbricking Guide
Because the primary bootloader is in hardware ROM on the SF32LB523 silicon, the badge cannot be permanently bricked. If an OTA write fails, the ROM enters UART download mode waiting for handshake commands:
| Board Test Pad | USB-UART Adapter (3.3V) | Description |
|---|---|---|
GND |
GND | Common ground reference. |
TX |
RX | Badge Transmit $ ightarrow$ Host Receive. |
RX |
TX | Badge Receive $\leftarrow$ Host Transmit. |
3.2~4.7V |
Leave open if battery or USB-C connected | Direct battery rail. Never apply 5V! Max 4.2V. |
Flashing Command Line (Official SiFli UartBurn)
Using the official manufacturing flasher (ImgDownUart.exe) and the RAM ISP driver (ram_patch_52X.bin):
This flasher loads the RAM patch into internal SRAM, bypasses corrupted NOR flash, erases sectors, and programs stock factory firmware (MoniCardA_v2.2.0_090417.bin) in under 15 seconds.