atc1441

#include <stdio.h>
#include <stdint.h>
// Philips Sonicare NFC Head Password calculation by @atc1441 Video manual: https://www.youtube.com/watch?v=EPytrn8i8sc
uint16_t CRC16(uint16_t crc, uint8_t *buffer, int len) // Default CRC16 Algo
{
  while(len--)
  {
    crc ^= *buffer++ << 8;
    int bits = 0;
    do

atc1441

This data can be found after activation on the MCUs flash, it contains the DID, Token and BindKey, also the Mac can be found in flash:
00 00 <-ID
1C    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <-Length and data
01 00 
14    00 62 6C 74 2E 34 2E 31 34 30 68 66 71 6A 38 73 67 6B 30 30 <- Device ID
10 00 
1C    D7 74 84 57 B3 00 61 19 A4 49 EC 44 95 81 56 FF 4A 16 3E 88 C5 2C FA 2E 2A 9C D9 C3 <- The shared KEY?
      <--- Token -----------------------> <-------------  Bind Key---------------------->

atc1441

Key:
00 00 <-ID
1C    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <-Length and data
01 00 
14    00 62 6C 74 2E 34 2E 31 34 30 68 31 6B 65 37 67 67 63 30 30 
10 00 
1C    95 41 F9 2F D7 79 7C 1C CF CB F1 1C DA BF 6F 38 CC 40 3F 49 CD 0B 98 0D C6 AA 47 85 
04 00 

atc1441

OTA Start: 
00 FF 

OTA Start1: 
01FF

OTA Packets: 
block data                             crc
00 00 2680000000005d024b4e4c5430048800 1ca3

atc1441

import java.lang.Math;
public class HelloWorld
{
  public static void main(String[] args)
  {
        ParserData parserData1 = parser(new int[]{ 0x52,0x5D,0xD7,0x9F,0x00,0x31 },false);
   
    System.out.print("Flag:");
    System.out.print(parserData1.flag);
    System.out.print("\r\nSeconds in unix -40 Years: ");

atc1441

INITCMDS = [
  [0xFE],
  [0xEF],
  [0xEB,0x14],
  [0x84,0x40],
  [0x85,0xF1],
  [0x86,0x98],
  [0x87,0x28],
  [0x88,0xA],
  [0x8A,0],

atc1441

void oledInit() {
	nrf_gpio_cfg_output(23);
	digitalWrite(23 , 0);
  setGPIOforOLEDasOutput();
  digitalWrite(oledSCK , LOW);
  digitalWrite(oledRST, HIGH);
  delay(20);
  digitalWrite(oledRST, LOW);
  delay(100);
  digitalWrite(oledRST, HIGH);

atc1441

void init_display()
{
  unsigned __int8 temp_buffer[20]; // [sp+0h] [bp-38h]@1

  mem_clear(temp_buffer, 20u);
  temp_buffer[0] = -2;
  write_Command_Display((int)temp_buffer, 1u);
  temp_buffer[0] = -17;
  write_Command_Display((int)temp_buffer, 1u);
  temp_buffer[0] = -21;

atc1441

List with Compatible devices:

Look under About on the watch for the device Id.
looks something like this:

MOY-TEH5-1.7.7

the middle section is the interesting part, if that is in this list here
it has the compatible bootloader and the same pinout as pinetime for Display and External Flash

atc1441

const uint8_t bma421_config_file[] = {
  0x80, 0x2E, 0xFE, 0x00, 0x80, 0x2E, 0xF1, 0x01, 0xC8, 0x2E, 0x00, 0x2E,
  0x80, 0x2E, 0xFC, 0x00, 0x80, 0x2E, 0xFB, 0x00, 0x80, 0x2E, 0xFF, 0x00,
  0x80, 0x2E, 0xFD, 0x00, 0x80, 0x2E, 0x42, 0xB0, 0x50, 0x39, 0x21, 0x2E,
  0xB0, 0xF0, 0x10, 0x30, 0x21, 0x2E, 0x16, 0xF0, 0x80, 0x2E, 0xF2, 0x01,
  0x5D, 0x50, 0x5B, 0x52, 0x01, 0x42, 0x3B, 0x80, 0x41, 0x30, 0x01, 0x42,
  0x3C, 0x80, 0x00, 0x2E, 0x01, 0x40, 0x01, 0x42, 0x21, 0x2E, 0xFF, 0xAF,
  0xB8, 0x2E, 0x03, 0xB7, 0x80, 0x2E, 0x18, 0x00, 0x80, 0x2E, 0x18, 0x00,
  0x80, 0x2E, 0x18, 0x00, 0x80, 0x2E, 0x18, 0x00, 0x80, 0x2E, 0x18, 0x00,
  0x80, 0x2E, 0x18, 0x00, 0x80, 0x2E, 0x18, 0x00, 0x80, 0x2E, 0x18, 0x00,