Hack a Broken Smartwatch: Reverse Engineering & Custom Firmware Guide

Upcycle a discarded commercial smartwatch into an open-source development board powered by the Nordic nRF52832 SoC.

Hardware

Old/broken smartwatch with an nRF52832 SoC, 1.69" SPI LCD module, LiPo battery

Flashing & Debug

Mini JTAG/UART debugger tool, ESP32 development board (for DAP unlocking)

Probing & Assembly

Digital multimeter, soldering iron, thin jumper wires, flux, and solder

Software

VS Code, Nordic nRF SDK, OpenOCD, Adafruit nRF52 Bootloader (.hex)

Carefully disassemble the smartwatch casing to expose the internal PCB.

1. Clean off adhesive or shielding tape to locate the main microcontroller.
2. Identify the SoC package markings (confirming the Nordic nRF52832).
3. Locate the surrounding hardware: power delivery/charging IC, battery leads, onboard gyro/accelerometer, and display ribbon connector.

Because schematics are unavailable for commercial consumer wearables, map connections manually:

1. Set your digital multimeter to Continuity / Short-Circuit Mode.
2. Match display connection pads to their corresponding pins on the nRF52 package. Note down SPI lines: SCK, MOSI, CS, DC, and RESET.
3. Trace the onboard gyro sensor traces by visually following PCB routes and testing accessible test pads.
4. Identify the SWD/JTAG debug access points (SWDIO, SWDCLK, GND, VCC) on the board.

Factory nRF52 chips generally have Access Port Protection (APPROTECT) enabled, preventing external writes.

1. Connect the smartwatch SWD pins to the ESP32 programmer.
2. Run the ESP32-DAP utility to clear the factory write protection flags from the chip registers.
3. Verify that the debug interface returns an unlock/success confirmation.

source file : https://github.com/derdacavga/Nrf52832-Unlocker

1. Solder thin jumper wires between your mini JTAG debugger and the smartwatch SWD test points.
2. Download the compatible Adafruit nRF52 bootloader .hex binary.
3. Launch OpenOCD in your terminal and flash the bootloader image onto the nRF52832.
4. Power cycle the board to verify the new bootloader initializes.

Adafruit Bootloader: https://github.com/adafruit/adafruit_nrf52_bootloader

OpenOCD: https://github.com/openocd-org/openocd

1. Open the Nordic nRF SDK inside VS Code.
2. Select a baseline sample project (such as a Bluetooth Low Energy peripheral LBS demo).
3. Map your newly discovered display and sensor pin definitions inside the board configuration header.
4. Compile the project to generate a .hex binary. (file in ProjectName\build\ProjectName\zephyr\zephyr.hex)
5. Flash the binary to the board using OpenOCD or Vs code nRF terminal.

1. Connect the larger 1.69" SPI LCD to the mapped display pins on the smartwatch PCB.
2. Power the device and verify that the screen initializes properly with your custom UI/graphics.
3. Open a BLE scanner on your phone to confirm the smartwatch advertises over Bluetooth.