Cheapest Bluetooth Low Energy Tag Teardown

Overview

This is one of the cheapest bluetooth low energy tags currently available. (aka iTag, MLE-15, Intelligent Bluetooth Anti-lost Tracking Tag Alarm Patch)
Purchased online for less than 4$.

It comes packed in a simple plastic bag. User manual and CR2032 cell battery are included.

The tag is slightly bigger than 2 Euro coin. Actual size is 38x38x7mm (1.50"x1.50"x0.28") and it's weight is 9 grams.
The device has one push button and a blue LED.

Software

The tag identifies itself as MLE-15, it's bluetooth address starts with unassigned OUI prefix FF:FF:80 (see FF:FF:80 lookup results here).
Below is the output of "hcitool leinfo" command:

$ sudo hcitool leinfo FF:FF:80:00:XX:XX
Requesting information ...
	Handle: 40 (0x0028)
	LMP Version: 4.0 (0x6) LMP Subversion: 0x4103
	Manufacturer: Telink Semiconductor Co. Ltd (529)
	Features: 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Both manufacturer recommended iTracing and open source iTracing2 applications works fine.

Teardown

Lets look what's inside.

The PCB

Click to view large images

The PCB is marked as "RB-FD02 Ver1.2 20151212". All components are mounted on a single side. There are six programming/debugging/testing interface pads: PIN10, PIN8, SWS, VPP, BAT+ and GND.

The BLE microcontroller is ST17H26 (ST17H26 / CH1549 / CG851G. 1X). The chip package looks like SSOP-16. Unfortunately I couldn't find the ST17H26 datasheet online.
Further investigation shows that based on LMP_CompID the chip is produced by Telink Semiconductor and there is only one SSOP-16 packaged BLE SoC in their product range - TLSR8263. But still no datasheet and SDK freely available.

The system is clocked by a 12Mhz crystal. Other components are: push button, piezo buzzer, 4 capacitors, transistor (1AMe), diode (S4), blue LED.

Conclusion

Due to lack of datasheet and SDK the hardware seems unhackable (not possible to reprogram the device to turn it, for example, into a bluetooth BLE beacon).
But BLE GATT interface generally is not a secret. For more details check the iTracing2 project on GitHub.