Kindle Oasis protocol analysis
Disclosure: I work at Amazon, but nowhere near Lab126 where these bad boys get engineered. I'm acting on my own accord using technology that anyone can have themselves. I have no internal information about these and am doing it out of my own curiosity. (Yes, that's a leadership principal, so there!)A few bits of 28 AWG wire, some tape, and I made a very crude breakout system for the Kindle. I had read elsewhere that the general pinout is like this:
- Ground
- I2C
- I2C
- Battery
- Ground
The grounds are isolated. I'm guessing that pin 1 is the reference for the I2C bus and pin 5 is the battery ground.This led to me hooking up the system to the scope:So, to note here I'm probing yellow as pin 2, blue as pin 3, and battery as pink (though I turned it off on the display since it was just noisy). All of these are referenced to pin 1.Sure enough! Pin 3 is clock while 2 is data!There's a crap-ton of pickup on the signal. With the lights turned on it was even worse. It was good enough to get a decode though.I've not had a chance to dive into this, but here's a raw dump of the data stream:
Bus Definition: I2C | |||||
Time | Repeat Start | Direction | Address | Data | Missing Ack |
1.26E-03 | Read | 55 | D1 10 | ||
3.12E-03 | Write | 1B | 4F | ||
4.25E-03 | X | Read | 1B | 25 55 04 | X |
6.64E-03 | X | Read | 55 | D1 10 | |
8.47E-03 | Write | 55 | 14 | ||
9.91E-03 | X | Read | 55 | 00 00 | |
1.18E-02 | Write | 55 | 6 | ||
1.30E-02 | X | Read | 55 | 6C 0B | |
1.48E-02 | Write | 55 | 0C | ||
1.60E-02 | X | Read | 55 | D3 04 | |
1.79E-02 | Write | 55 | 12 | ||
1.91E-02 | X | Read | 55 | B8 04 | |
2.09E-02 | Write | 55 | 2C | ||
2.21E-02 | X | Read | 55 | 63 00 | |
2.40E-02 | Write | 55 | 2A | ||
2.52E-02 | X | Read | 55 | 00 00 |
Lots of chatter on address 0x55. I've not had a chance to guess what might be there. But there's certainly a lot of activity going on there.When I get back from my vacation I'll set up a trace to see if anything other than 0x55 gets any action.