So these went from checkout impulse item to clearance item. It seems the wave of bluetooth headphones that materialized in a hurry when the iPhones lost the 3.5mm audio plug got a little optimistic – sure, others would launch too, but everyone?

So since they’re in the $5 vicinity, I figured I’d see if perhaps the bluetooth could be hooked up differently. I want to remote control some arduinos. Sure, they sell bluetooth modules, as well as regular RF modules. But I also like opening things, and they’re not that expensive. So I went with it.

The actual device wasn’t so well stuck together. The rubber plugs on the end did hold it a little, but really, people aren’t nice to headphones. Then again, I’m sure it snaps back together well too, so..

Bright LEDs, one blue, one read. Single button, long press to pair, longer to turn off. The insides is pretty predictable – a mass integrated IC, onboard antenna, button, mic.. Nice caps on the ear output. In fact, it looks surprisingly well built. The cords are those “set silicon gel” with what looks like bare wires inside, but which is really varnished wire. It’s thicker than usual though, not like the olden days of audio wire, but not the thinnest humanly possible either. Little postage stamp size Li-ion claimin 70 mAh, which sounds sane. USB micro B.

Peeling off the battery (double stick tape, stuck enough to stay, but not so you start wondering if you’ll crack the battery) there’s a smattering of test pads and a board label, “SH820_BK3254(32pin)_V1.1 2016-09-18”. I’ve desoldered the earbuds for now, again noticing they were actually soldered on with enough solder. Nothing overkill, but this is something that’s usually woefully underkill unless it’s $50-$100-$934,383 “good audio” stuff.

Flipping it over, the IC claims to be a Beken BK3254QN320 CS6324CD. Given the last label, I’m guessing BK3254 for short. The crystal is a 26.00 MHz – slight cause for hope there’s a general purpose CPU here, but perhaps Bluetooth RF needs it for something.

So heading over to BekenCorps page, they do list it. “Highly integrated multimedia device” – yeah, ok, we’ll see – “BT transceiver, FM reciever (!), 1 or 4 wire SD-Card Interface (!!),  USB OTG (!!!) and high performance audio”. Ok, I saw.. Also onboard Vreg, Bluetooth 4.1, what I think are good RF and audio numbers, high signal to noise ratio ADC and DAC, I2C, SPI, UART, all the good BT audio protocols. Clinking around further, they’re sold on alibaba and ebay, and seem to also contain an IR remote module, six switches on individual GPIOs, ability to use anything as a GPIO. Possibly a DSP doing noise cancel or voice recognition – there are a lot of near models. Either way, this really is a “whatever you want” device, with everything that isn’t just plain headphones disabled. It even seems to have separately operating TX/RX BT so that it can set up mesh nets with more of itself. Very neat stuff.

But for all the bragging, I’m not seeing any dev kits. Just reference designs and very broad strokes descriptions. It’s also said to have an AT-command API on the UART interface. Digging around a few Russian hobby board and Chinese trade boards, it appears to be a drop-in pin-compatible option for Cambridge Silicon Radios CS8xxx line (or, possibly, a blatant Shenzen pirate version – depends on whom you ask – but in their defense Beken doesn’t pretend it isn’t compatible nor try to pass it as an actual CSR). What appears to be a near model here (Russian language) a hop away from an even closer model throws out a few names, like Casira Bluelab SDK, and some document names. Chinese boards mention that you’ll find the tools when you start looking for nearby models, and they’ll work mostly across all. Beken has a download page, but it’s passworded (and an ftp). Much of the surrounding forums and blogs seem to be too, usually at least signup, possibly “talk to your sales rep”, and almost always in Mandarin (or almost purely marketing). CSR, it turns out, has been bought by QualComm. Both have support areas, but again kind of keep it marketing unless you’re willing to show you’re a customer. Eventually I sign up at CSR, not claiming to be anything I’m not, but providing a business email address (per request) and phone/address. The modules I see on eBay actually look pretty tempting, if and only if there’s software, so.. really I kind of *am* looking for a rep. Either way, I find a toolkit, BlueSuite 3. No SDK as such, but a flash tool, several settings tools, clients, etc. They work, in fact they connect over the USB port that’s already there – very polite, usually they demand UART/I2C/SPI/whatnot and a lot of boards talk about how to get that up and running with an LPT port or a homebrew USB->SPI/I2C. It does seem that there is no onboard flash on this particular version, although it seems able to boot off an I2C eeprom if connected, and also seems to do flashing for that (fw updates, debugging, etc). Would have been nicer if it wasn’t BYO, but hey, this is still a lot of stuff I didn’t think would be here. Conflicting reports on the CPU (though it is there), but seems like an ARM/STP of some kind. Hopefully I’ll find more later.

One of the included clients connects directly as a console (to, it turns out, a COM presented by the USB device, \\.\csr0) that keeps saying “unknown command” at everything. I find a few one letters, like ‘r’ does a reset, “ar” blurts our “syntax: authentication_requested [ch]”. After some manual hunt and peck, I wrote a small python script that connects to it and tries all two letter combinations. I somehow manage to lose the notes on the *one* letter combinations, but hey.. Here’s a few so far:

“ar”, ‘syntax: authentication_requested [ch]’
“br”, ‘syntax: br t:lsa|mssp s:d|e|…’
“db”, ‘syntax: db Debug output disabled’
“ef”, ‘syntax: enhanced_flush ch pkt_type’
“fs”, ‘syntax: flow_specification ch f fd:o|i st:nt|be|g tr tbs pb al’
“hm”, ‘syntax: hold_mode ch hmmaxi [hmmini]’
“lt”, ‘syntax: lt ch tid:m|s o:… [n]* // lt ch [octet]+’
“pm”, ‘syntax: park_mode ch bmaxi [bmini]’
“qs”, ‘syntax: qos_setup ch f st:nt|be|g tr pb l dv’
“rc”, ‘syntax: read_clock ch wc:l|r’
“rd”, ‘syntax: role_discovery [ch]’
“rr”, ‘syntax: read_rssi [ch]’
“rt”, ‘syntax: rt rt:… [a1 [a2 [a3]]] (see rtfind)’
“sb”, ‘syntax: sb clk’
“sm”, ‘syntax: sniff_mode ch smaxi [smini] sa st’
“sr”, ‘syntax: switch_role ba r:m|s’
“tp”, ‘syntax: truncated_page ba // truncated_page ba psrm:r0|r1|r2 clock_offset’
“d”, “syntax: disconnect (defaults: last user_ended_connection) // disconnect ch
// disconnect ch r:uec|lr|atpo|af|urf|ukns”

Some commands cut the echo, or otherwise change behavior of later commands, so it’s not perfect. Still in the process of organizing it more. Will return! Good times, :-)