# heystack-nrf5x

**Repository Path**: guixf_1_0/heystack-nrf5x

## Basic Information

- **Project Name**: heystack-nrf5x
- **Description**: 暂未测试是否可用的findMy for  nrf5X系列的固件源码。
- **Primary Language**: Unknown
- **License**: MulanPSL-2.0
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2025-09-25
- **Last Updated**: 2025-10-01

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# HeyStack-NRF5X - OpenHaystack Compatible Low Power Firmware

本仓库包含一种替代的OpenHaystack固件。它基于Nordic Semiconductor的SoftDevice。这种方法可能会延长电池寿命，据估计，使用CR2032电池时，续航时间可达三年！(See [this comment](https://github.com/seemoo-lab/openhaystack/issues/57#issuecomment-841642356)).

它基于[acalatrava的](https://raw.githubusercontent.com/acalatrava/openhaystack-firmware/main/README.md)固件，并进行了修复


## Supported Devices

- **nRF52810**: Tested on an original Tile Tag.
- **nRF51822**: Tested on an aliexpress tag.
- **nRF52832**: Tested with the YJ-17024 board (see link below).

其他nRF设备可能受支持，但未经测试。


这些AliExpress标签应与nRF52810固件兼容：

- [Holyiot NRF52810](https://s.click.aliexpress.com/e/_DdDyDp9)

These aliexpress tags works with the nRF51822 firmware:


这些AliExpress标签应与nRF51822固件兼容：

- [1: NRF51822](https://s.click.aliexpress.com/e/_De2JHyL)
- [2: NRF51822](https://s.click.aliexpress.com/e/_DdkWkyJ)
- [3: NRF51822](https://s.click.aliexpress.com/e/_DBp4icn)

This AliExpress tag works with the nRF52832 firmware:

这些AliExpress标签应与nRF52832固件兼容：

- [HolyIOT YJ-17024-NRF52832 Amplified Module](https://s.click.aliexpress.com/e/_DlpmE0n): [Manufacturer's documentation](http://www.holyiot.com/eacp_view.asp?id=299).
- [HolyIOT YJ-17095-NRF52832](https://s.click.aliexpress.com/e/_DCkw8LV)


### Available make targets

- `nrf51822/armgcc`: `nrf51822_xxac` `nrf51822_xxac-dcdc`
- `nrf52810/armgcc`: `nrf52810_xxaa` `nrf52810_xxaa-dcdc`
- `nrf52832/armgcc`: `nrf52832_xxaa` `nrf52832_xxaa-dcdc` `nrf52832_yj17024`

## Setup Instructions

Unzip the relevant Nordic SDK and a compiler and place it in the `nrf-sdk` folder:

```bash
gcc-arm-none-eabi-6-2017-q2-update/ # Migth work with newer versions
nRF5_SDK_12.3.0_d7731ad/
nRF5_SDK_15.3.0_59ac345/
```

### Compile the Firmware

```
make all # Compile all the supported devices and place them in the release folder
```


### Flash the Firmware

使用tools目录中的nrf-patch-log.py重新来进行修改密钥。
```
mv ./output ./3zw231
python tools/nrf-patch-log.py release/nrf51822_xxac_s130.bin 3zw231/3zw231_keyfile 3zw231/nrf51_firmware.bin
```

输出应该是类似这样的，
```
Patching nrf51_firmware.bin
Patched binary saved as nrf51_firmware_patch.bin
ELF file saved as nrf51_firmware_patch.elf
Operation completed successfully.
```

如果出错，检查下载的固件

- 刷入固件
```shell
cd 3zw231
openocd -f ../518openocd.cfg -c "init; halt; nrf51 mass_erase; program nrf51_firmware.bin; reset; exit"
```
`openocd.cfg` 来自 [51822 openocd.cfg](https://github.com/pix/heystack-nrf5x/blob/master/nrf51822/armgcc/openocd.cfg) 和 [52810 openocd.cfg](https://github.com/pix/heystack-nrf5x/blob/master/nrf52810/armgcc/openocd.cfg)
刷机成功的输出应该如下
```
Open On-Chip Debugger 0.12.0 (2023-10-02) [https://github.com/sysprogs/openocd]
Licensed under GNU GPL v2
libusb1 09e75e98b4d9ea7909e8837b7a3f00dda4589dc3
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "hla_swd". To override use 'transport select <transport>'.
Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
Info : clock speed 1000 kHz
Info : STLINK V2J43S7 (API v2) VID:PID 0483:3748
Info : Target voltage: 3.274766
Info : [nrf51.cpu] Cortex-M0 r0p0 processor detected
Info : [nrf51.cpu] target has 4 breakpoints, 2 watchpoints
Info : starting gdb server for nrf51.cpu on 3333
Info : Listening on port 3333 for gdb connections
Warn : target was in unknown state when halt was requested
[nrf51.cpu] halted due to debug-request, current mode: Thread
xPSR: 0x61000000 pc: 0x00011480 msp: 0x20003550
Info : nRF51822-QFAA(build code: H0) 256kB Flash, 16kB RAM
Info : Mass erase completed.
Info : A reset or power cycle is required if the flash was protected before.
[nrf51.cpu] halted due to debug-request, current mode: Thread
xPSR: 0xc1000000 pc: 0xfffffffe msp: 0xfffffffc
** Programming Started **
Warn : Adding extra erase range, 0x0001cc70 .. 0x0001cfff
** Programming Finished **
```

- 如果刷机失败，报错 `Contrl-AP`，是因为 nRF52xxx 有写保护，防止读出固件和二次写入，可以[使用 J-link 编程器解除 nRF52xxx 写保护](nRF52xxx_disable_AP.md)。然后重新用 ST-Link 刷机

- 为了测试是否成功刷成定位标签，可以使用 [AirGuard app](https://github.com/seemoo-lab/AirGuard/releases) 扫描 Apple/FindMy 设备，如下图
![AirGuard1](../images/ST17H66/AirGuard1.jpg)
![AirGuard2](../images/ST17H66/AirGuard2.jpg)
点击 Locate Tracker 还能看信号强度，根据蓝牙信号强度确定标签的室内位置（如果你有很多定位标签分不清的话，这个功能很实用）



The device can be flashed using a STLink V2 programmer. The programmer should be connected to the SWD pins on the device. The following command can be used to flash the firmware:

```bash
cd nrf51822/armgcc
make clean
make stflash-nrf51822_xxac-patched ADV_KEYS_FILE=./50_NRF_keyfile
```

```bash
```

To compile the firmware for the nRF52832 with the YJ-17024 board configuration, use the following command:

```bash
cd nrf52832/armgcc
make clean
make stflash-nrf52832_yj17024-patched ADV_KEYS_FILE=./50_NRF_keyfile
```

### Flashing with Raspberry Pi

If you're using a Raspberry Pi for flashing instead of a STLink V2 programmer, you can change the OpenOCD configuration file. Toggle between the configuration for the STLink V2 and Raspberry Pi by modifying the OpenOCD script.

Locate the configuration line in your `openocd.cfg` file:

```bash
source [find interface/stlink.cfg]
```

To use a Raspberry Pi for flashing, comment out the STLink line and uncomment the Raspberry Pi configuration line:

```bash
# source [find interface/stlink.cfg]
source [find interface/raspberrypi2-native.cfg]
```

This change allows you to use the Raspberry Pi GPIO pins for flashing your device instead of the STLink programmer.

### Makefile Variables Summary

This section describes key Makefile variables you can adjust to customize the firmware:


- **HAS_DEBUG**: 控制调试日志记录；设置为1表示启用，设置为0表示禁用（默认）。Controls debug logging; set to `1` to enable or `0` to disable (default).
- **MAX_KEYS**: 定义支持的最大键数；Defines the maximum number of keys supported;
- **HAS_BATTERY**: 启用电池电量报告；设置为1表示启用，设置为0表示禁用（默认）；Enables battery level reporting; set to `1` to enable or `0` to disable (default);
- **HAS_DCDC**: 启用DCDC模式；设置为1表示启用，设置为0表示自动选择（默认）；Enables DCDC mode; set to `1` to enable or `0` to for automatic selection (default);
- **KEY_ROTATION_INTERVAL**: 设置密钥轮换间隔（以秒为单位）（默认为3600秒，即3分钟）；Sets the key rotation interval in seconds (default is 3600 * 3 seconds);
- **ADVERTISING_INTERVAL**: 调整蓝牙广告间隔；0（默认值）使用标准间隔（1000毫秒，可调至20毫秒）；Adjusts Bluetooth advertising interval; `0` (default) uses the standard interval (1000ms, down to 20ms);
- **BOARD**: 指定自定义板配置；默认为custom_board（参见custom_board.h），但可用您所用板的配置进行覆盖。例如，对于nRF52832设备，请设置BOARD=yj17024。Specifies the custom board configuration; defaults to `custom_board` (see `custom_board.h`), but can be overridden with your board's configuration. For example, set `BOARD=yj17024` for the nRF52832 device.
- **ADV_KEYS_FILE**: 指定包含要烧录到设备上的密钥的文件。Specifies the file containing the keys to be flashed to the device.
- **GNU_INSTALL_ROOT**: GNU工具链的路径；例如：../nrf-sdk/gcc-arm-none-eabi-6-2017-q2-update/bin/Path to the GNU toolchain; eg: ../../nrf-sdk/gcc-arm-none-eabi-6-2017-q2-update/bin/

### Debugging with strtt

The firmware supports using strtt for displaying debug logs. To enable this feature, compile the firmware with `HAS_DEBUG=1`:

```bash
cd nrf51822/armgcc
make clean
make stflash-nrf51822_xxac-patched MAX_KEYS=500 HAS_DEBUG=1 ADV_KEYS_FILE=./50_NRF_keyfile
```

This will activate debug logging, which can be viewed using `strtt`.

### Using Black Magic Probe

The firmware can also be flashed using a Black Magic Probe. The programmer should be connected to the SWD pins on the device. The following command can be used to flash the firmware:

```bash
cd nrf52832/armgcc
make clean
make bmpflash-nrf52832_yj17024-patched ADV_KEYS_FILE=./50_NRF_keyfileZ
```

### Using RTT monitor

You can use the RTT monitor to see the debug logs. The following command can be used to monitor the logs:

```bash
make bmpflash-monitor
  BMP /dev/serial/by-id/usb-Black_Magic_Debug_Black_Magic_Probe__ST-Link_v2__v1.10.0-1151-g3fe0bc5a-XXXXXXXX-if00 (monitor)
  minicom -c on -D /dev/serial/by-id/usb-Black_Magic_Debug_Black_Magic_Probe__ST-Link_v2__v1.10.0-1151-g3fe0bc5a-XXXXXXXX-if02
Target voltage: 3.35V
....
```

In another terminal, you can monitor the logs:

```bash
minicom -c on -D /dev/serial/by-id/usb-Black_Magic_Debug_Black_Magic_Probe__ST-Link_v2__v1.10.0-1151-g3fe0bc5a-XXXXXXXX-if02
<info> app: last_filled_index: 249
<info> app: Starting advertising
<info> app: ble_set_mac_address: D3:7F:6F:DA:64:78
<info> app: ble_set_max_tx_power: 8 dB failed
<info> app: ble_set_max_tx_power: 7 dBm failed
<info> app: ble_set_max_tx_power: 6 dBm failed
<info> app: ble_set_max_tx_power: 5 dBm failed
<info> app: ble_set_max_tx_power: 4 dBm
<info> app: Rotating key: 59
<info> app: last_filled_index: 249
[0.000] <info> app: Starting advertising
[0.000] <info> app: ble_set_mac_address: XX:XX:XX:XX:XX:XX
```