POK3R RGB Notes

POK3R RGB Notes

General

• Holtek HT32F1654
  • ARM Cortex M3
  • 64KB Flash
  • 16KB SRAM
  • 64LQFP
• GD25Q41
  • 4Mbit SPI Flash

Firmware

Version Address: 0x3000 Firmware Address: 0x3400

Firmware VID/PID: 0x04d9/0x0167 Bootloader VID/PID: 0x04d9/0x1167

Updater

The updater contains two firmware updates, US and EU layouts, again encrypted twice. The firmware encryption now spans the entire update, rather than just part like the POK3R updater. This encryption is a simple XOR with a 52-byte key.

I thought this encryption would be harder to break, but it took longer to reverse the format of the updater data than to crack the key. The key was upgraded from the previous updater, to a random 52-byte key. Since parts of the firmware are predictable, and XOR is easily reversible, the key was easy to determine.

The Windows program version string info identifies the company and copyright as "Cooler Master", and also names the program "FWUpdate.exe".

PCB

Marking: CYKB167_D_V03 20151221

Header CN3

This is a 100mil SWD debug header. To use a debugger, you will likely need to make a custom adapter cable, and solder something to this header.

• Pin 1: 3.3V?
• Pin 2: SWDIO
• Pin 3: SWCLK
• Pin 4: nRST
• Pin 5: GND

Header SEL3

• Pin 1: BOOT1
• Pin 2: GND

Header SEL4

• Pin 1: BOOT0
• Pin 2: GND