Cheapest Bluetooth Low Energy Tag Teardown

Overview

This is one of the cheapest bluetooth low energy tags currently available. (aka iTag, MLE-15, Intelligent Bluetooth Anti-lost Tracking Tag Alarm Patch)
Purchased online for less than 4$.

Bluetooth Low Energy Tag Package

It comes packed in a simple plastic bag. User manual and CR2032 cell battery are included.

Bluetooth Low Energy Tag size compared to coin

The tag is slightly bigger than 2 Euro coin. Actual size is 38x38x7mm (1.50"x1.50"x0.28") and it's weight is 9 grams.
The device has one push button and a blue LED.

Software

The tag identifies itself as MLE-15, it's bluetooth address starts with unassigned OUI prefix FF:FF:80 (see FF:FF:80 lookup results here).
Below is the output of "hcitool leinfo" command:

$ sudo hcitool leinfo FF:FF:80:00:XX:XX
Requesting information ...
	Handle: 40 (0x0028)
	LMP Version: 4.0 (0x6) LMP Subversion: 0x4103
	Manufacturer: Telink Semiconductor Co. Ltd (529)
	Features: 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Both manufacturer recommended iTracing and open source iTracing2 applications works fine.

Teardown

Lets look what's inside.

Inside Bluetooth Low Energy Tag

 

The PCB

PCB of Bluetooth Low Energy Tag - front sidePCB of Bluetooth Low Energy Tag - back side
Click to view large images

The PCB is marked as "RB-FD02 Ver1.2 20151212". All components are mounted on a single side. There are six programming/debugging/testing interface pads: PIN10, PIN8, SWS, VPP, BAT+ and GND.

The BLE microcontroller is ST17H26 (ST17H26 / CH1549 / CG851G. 1X). The chip package looks like SSOP-16. Unfortunately I couldn't find the ST17H26 datasheet online.
Further investigation shows that based on LMP_CompID the chip is produced by Telink Semiconductor and there is only one SSOP-16 packaged BLE SoC in their product range - TLSR8263. But still no datasheet and SDK freely available.

The system is clocked by a 12Mhz crystal. Other components are: push button, piezo buzzer, 4 capacitors, transistor (1AMe), diode (S4), blue LED.

Conclusion

Due to lack of datasheet and SDK the hardware seems unhackable (not possible to reprogram the device to turn it, for example, into a bluetooth BLE beacon).
But BLE GATT interface generally is not a secret. For more details check the iTracing2 project on GitHub.

 

Comments

Hi, Is there any Windows 10 software for this or similar tags?

I couldn't find such software, moreover my findings show that It's even impossible to pair this device with Windows.
Windows 10 thinks it's a keyboard.

MLE15 Bluetooth Tag Windows 10 Pairing
Try again, and make sure your keyboard is still discoverable.

This hardware is pretty simple, it has 1 alert peripheral where you can send 0x01 to turn beep ON and 0x00 to off beeping, and also you can read battery service from device, that's all. just code a simple C program and use it.

Could you provide more details how you read the codes from the device and how you were able to controll/ connect to it?

if you know BLE protocol you can make one with Redbear lab modules

I tried it with BLE scanner app. when I set alert service with ox01 or 0x02 or 0x03 nothing happens.

Hello! I have a BT controller and I was searching this IC datasheet.
Here is it: http://www.docin.com/p-1814309628.html

Byeee! :)

Thank you!
Does anyone know how to download complete single pdf file from that site?

Not likely to be reprogramed. there are other chips 8266, 8261 etc are flash based. You can find some tools in Github. data sheet should be at their website.

wow thanks thats interesting i have both devices too :)

sws (single wire slave) and guess needed swm (single wire master) NOT by Telink(need to be amend in previous message), by LENZE! (page 60)

http://www.docin.com/p-1814309628.html

datasheet from 2016/7/7 Ver. 2.0.0 http://www.docin.com/p-1814297477.html
for ST17H26, ST17H28, ST17H29, ST17H30, ST17H38

Уважаемый,не поможете ли мне вывести контакты кнопок на провод для подключения как простой не блютузовский джойстик? Если правильно понимаю то этого сделать не возможно из за конструкции микроконтроллера. Дело в том что мои аппараты не видят этот джойстик. Вот и хотел его подсоединить ОТГ кабелем. Как думаете подойдет ли такая идея?