🔬 Vape Pimp Speedrun

N32G031-based vape → pocket console. Novo 6 · Raz TN9000 · Kraze HD7K & clones.

graph LR
    A["🔓 OPEN<br>Teardown + clean<br><i>spudger, IPA+gloves</i>"]
    B["🔌 CONNECT<br>USB-C SWD tap<br><i>CC1=SWDIO, CC2=SWCLK<br>3.3V ONLY!</i>"]
    C["📥 DUMP<br>OpenOCD flash<br><i>0x08000000<br>64KB MCU, 1MB SPI NOR</i>"]
    D["🎨 MOD<br>RGB565 bitmaps<br><i>80×160 px, big-endian<br>Pillow</i>"]
    E["📤 FLASH<br>SPI/SWD write<br><i>TL866 / CH341A<br>flashrom</i>"]

    A -->|"⏱️"| B -->|"⏱️"| C -->|"⏱️"| D -->|"⏱️"| E

    style A fill:#4a9,color:#fff
    style B fill:#49a,color:#fff
    style C fill:#69c,color:#fff
    style D fill:#e9973f,color:#fff
    style E fill:#a882ff,color:#fff

🧤 GLOVES MANDATORY · 🔋 DISCONNECT BATTERY FIRST

🧠 HW Overview

graph TD
    HW["📋 HW SPECS"]
    MCU["🧠 MCU<br>N32G031K8Q7<br>ARM Cortex-M0 · 48MHz<br>64KB Flash · 8KB SRAM"]
    SCR["📺 Screen<br>0.96″ 80×160 IPS TFT<br>ST7735S or GC9107<br>4-wire SPI"]
    FLS["💾 Flash<br>GT25Q80A 8Mbit (1MB)<br>bitmaps, puff counters, config"]
    CEL["🔋 Cell<br>13450 Li-ion ~1700mAh<br>UNPROTECTED · puncture = 🔥"]
    COI["⚡ Coil<br>N-ch MOSFET driver<br>latch HIGH = fire hazard ☠️"]

    HW --- MCU
    HW --- SCR
    HW --- FLS
    HW --- CEL
    HW --- COI

    style HW fill:#69c,color:#fff,stroke:#357,stroke-width:2px
    style CEL fill:#f44,color:#fff,stroke:#a00,stroke-width:2px
    style COI fill:#f80,color:#fff,stroke:#a50,stroke-width:2px

1. 🛠️ Teardown

🔥 PULL GENTLY: Do NOT puncture the 13450-size 1700mAh lithium-ion battery! Puncture = Thermal runaway = fire.

🧤 E-liquid has nicotine (toxic and absorbs through skin!). Use 99% Isopropyl Alcohol to clean the logic board and wear nitrile gloves!

2. 🔌 SWD Tap

The USB-C SWD Hack: Hardware engineers often wire the SWDIO and SWCLK debug lines directly to the unused CC1/CC2 pins on the USB-C port!

graph LR
    subgraph USB["🔌 USB-C Port"]
        CC1["CC1"]
        CC2["CC2"]
        GND_U["GND"]
        VBUS["VBUS 5V"]
    end
    subgraph PRB["🔬 Debug Probe"]
        SWDIO["SWDIO"]
        SWCLK["SWCLK"]
        PGND["GND"]
    end
    subgraph MCU["🧠 N32G031"]
        PA13["PA13"]
        PA14["PA14"]
    end

    CC1 -->|"data"| SWDIO -->|"debug"| PA13
    CC2 -->|"clock"| SWCLK -->|"debug"| PA14
    GND_U -->|"common"| PGND
    VBUS -.->|"LETHAL"| PA13

    style VBUS fill:#f44,color:#fff,stroke:#a00,stroke-width:3px
    style CC1 fill:#4a9,color:#fff
    style CC2 fill:#49a,color:#fff
    style PA13 fill:#6a6,color:#fff
    style PA14 fill:#6a6,color:#fff
    style SWDIO fill:#4a9,color:#fff
    style SWCLK fill:#49a,color:#fff

# USB-C Debug Accessory Mode: CC1→SWDIO | CC2→SWCLK | GND→GND
# ⚠️ 3.3V ONLY — 5V probe = dead MCU | Need breakout + 5.1kΩ pull-downs
openocd -f interface/stlink.cfg -f target/n32g031.cfg \
  -c "init; halt; dump_image fw.bin 0x08000000 0x10000; exit"
# Got 0xFFFFFFFF? → FMC read-protection ON 🔒 → chip-erase (loses factory FW)
# Alt: SRAM injection via ISP (BOOT0 pin) or UART bootloader

3. 📥 FW Extraction

flowchart TD
    A(["🔬 Connect SWD"]) --> B{"halt + dump?"}
    B -->|"got data"| C["📊 Ghidra/IDA"]
    B -->|"0xFF..."| D{"🔒 FMC Locked"}
    D -->|"nuke it"| E["💣 Chip Erase"]
    D -->|"bypass"| F["💉 SRAM Inject"]
    D -->|"alt"| G["📡 UART Boot"]
    E --> H["⚠️ Factory FW Gone"]
    H --> I(["📤 Flash Custom"])
    F --> J["🔓 RAM Bypass"]
    G --> J
    J --> C
    C --> K["🗺️ Locate Bitmaps"]

    style A fill:#4a9,color:#fff
    style D fill:#f44,color:#fff,stroke:#a00,stroke-width:3px
    style H fill:#f80,color:#fff
    style E fill:#fa0,color:#000
    style I fill:#4c9,color:#fff
    style K fill:#69c,color:#fff

🔒 FMC Lock? If the memory dump gives you endless 0xFFFFFFFF, the Flash Memory Controller (FMC) is locked. You’ll need SRAM injection via ISP mode or a Whole Chip Erase (destroys factory firmware forever).

4. 🎨 Display Mod

Pixel Format: RGB565 — 16-bit color (5 bits Red, 6 bits Green, 5 bits Blue) stored in big-endian layout. 🌈

flowchart LR
    A(["🖼️ PNG"]) -->|"Pillow"| B["📐 80x160"]
    B -->|"convert"| C["🎨 RGB565"]
    C -->|"pack BE"| D["📦 out.bin"]
    D -->|"desolder"| E["🔧 SSOP Adapt"]
    E -->|"program"| F["💾 TL866/CH341A"]
    F -->|"resolder"| G(["✅ Custom LCD"])

    style A fill:#69c,color:#fff
    style C fill:#e9973f,color:#fff
    style D fill:#a882ff,color:#fff
    style G fill:#4c9,color:#fff

# PNG → RGB565 binary (big-endian!) — flash to GT25Q80A via TL866/CH341A/flashrom
from PIL import Image; import struct
img = Image.open('custom.png').convert('RGB').resize((80,160))
open('out.bin','wb').write(b''.join(
    struct.pack('>H',((r>>3)<<11)|((g>>2)<<5)|(b>>3))
    for y in range(160) for x in range(80) for r,g,b in [img.getpixel((x,y))]))

5. 🖥️ LCD Init

sequenceDiagram
    participant MCU as MCU
    participant LCD as LCD

    rect rgb(68, 207, 110, 0.1)
        Note over MCU,LCD: Reset Phase
        MCU->>LCD: SWRESET 0x01
        Note over LCD: 150ms wait
        MCU->>LCD: SLPOUT 0x11
        Note over LCD: 500ms wait
    end

    rect rgb(83, 223, 221, 0.1)
        Note over MCU,LCD: Config Phase
        MCU->>LCD: COLMOD 0x3A 0x05 (RGB565)
        MCU->>LCD: MADCTL 0x36 (orientation)
        Note right of MCU: Bit3 = RGB/BGR swap
        MCU->>LCD: CASET 0x2A (col range)
        MCU->>LCD: RASET 0x2B (row range)
    end

    rect rgb(168, 130, 255, 0.1)
        Note over MCU,LCD: Activate Phase
        MCU->>LCD: DISPON 0x29
        MCU->>LCD: RAMWR 0x2C + pixels
    end

SWRESET(0x01) → SLPOUT(0x11) → COLMOD(0x3A,0x05=RGB565) → MADCTL(0x36) → DISPON(0x29)

• 🔄 Red/blue swapped? XOR MADCTL with 0x08 (bit 3 toggles RGB↔BGR). Don’t rewire.
• ⬛ Black border/offset? Set CASET(0x2A)/RASET(0x2B) — try _colstart=0x01 or 0x1A.
• 🔲 GC9107 blank? Must send unlock 0xFF→0xA5 before any command. Init may start 0xFE/0xEF/0xEB.

6. 👾 Custom FW

graph TD
    subgraph SDK["📚 Community SDKs"]
        A["ColorLCDVape-RE"] -->|"memory maps"| C["⚡ Custom FW"]
        B["Vaporware SDK"] -->|"display API"| C
        D["RAZ-RE"] -->|"HW pinouts"| C
    end

    C -->|"compile"| E["🔧 arm-gcc"]
    E -->|"flash"| F["📤 SWD Write"]
    F --> G(["🎮 Pocket Console"])

    subgraph SAFE["🚨 Safety Critical"]
        C -->|"must have"| H["⏱️ Timer ISR"]
        H -->|"kills"| I["🔌 MOSFET Off"]
        C -->|"must have"| J["📊 ADC Watch"]
        J -->|"triggers"| K["🔋 LVC Cutoff"]
    end

    style H fill:#f44,color:#fff,stroke:#a00,stroke-width:3px
    style J fill:#fa0,color:#000,stroke:#a50,stroke-width:2px
    style G fill:#4c9,color:#fff
    style I fill:#f44,color:#fff
    style K fill:#fa0,color:#000

⚠️ THE COIL OF DEATH: If you write your own C code and your MOSFET pin latches HIGH by accident, your coil will melt, the pod will catch fire, and the battery will vent. ALWAYS code a strict hardware-timer-backed thermal cutoff limit! ⏱️🚨

🛡️ Safety Pattern

// MANDATORY: hardware-timer-backed coil cutoff — main loop bugs CANNOT override
#define MAX_FIRE_MS 10000   // 10s hard ceiling
#define MIN_VBAT_MV 3000    // 3.0V low-voltage cutoff
 
void init_safety(void) {
    GPIO_ResetBits(GPIOA, COIL_PIN);              // default: coil OFF
    TIM_SetAutoReload(TIM3, MAX_FIRE_MS);          // ISR kills MOSFET
    TIM_ITConfig(TIM3, TIM_IT_Update, ENABLE);
    ADC_AnalogWatchdogThresholdsConfig(ADC1, 0xFFF, MIN_VBAT_MV);
}

📦 Deps & Tools

🚨 Gotchas

🏗️ Full Architecture

graph TB
    subgraph L1["🔓 Physical"]
        A["📦 Device"] -->|"pry open"| B["🔧 Teardown"]
        B -->|"99% IPA"| C["🧹 Clean"]
    end

    subgraph L2["🔌 Debug"]
        C -->|"expose CC"| D["🔌 USB-C Break"]
        D -->|"3.3V"| E["🔬 SWD Probe"]
        E -->|"connect"| F["💻 OpenOCD"]
    end

    subgraph L3["📥 Extract"]
        F -->|"halt"| G{"🔒 FMC?"}
        G -->|"unlocked"| H["💾 MCU 64KB"]
        G -->|"locked"| I["💣 Erase"]
        I -->|"blank MCU"| J["🆕 Fresh"]
        F -->|"SPI read"| K["💾 Flash 1MB"]
    end

    subgraph L4["🎨 Mod"]
        H -->|"disasm"| L["🔬 Ghidra"]
        K -->|"extract"| M["🖼️ Bitmaps"]
        M -->|"Pillow"| N["🎨 RGB565"]
        N -->|"program"| O["📤 Flash SPI"]
    end

    subgraph L5["👾 Custom OS"]
        L -->|"understand"| P["📝 Write FW"]
        P -->|"safety!"| Q["🚨 ISR Guard"]
        Q -->|"deploy"| R(["✅ Done"])
    end

    style I fill:#f44,color:#fff,stroke:#a00,stroke-width:2px
    style Q fill:#f80,color:#fff,stroke:#a50,stroke-width:2px
    style A fill:#69c,color:#fff
    style R fill:#4c9,color:#fff
    style G fill:#f44,color:#fff

🗺️ Visual workflow map: NovoModCanvas →