Unbricking and Reflashing the Ubertooth One Clones

So I recently purchased a Ubertooth One finally for a project I’ve been working on and off on for many moons. Since they are basically sold out everywhere and I try to avoid Aliexpress/Alibaba as much as possible (with some exceptions of course).

So I purchased it through Amazon which was surprising as I usually would go through Ebay. But Prime shipping, which I guess means the same vendors from Aliexpress sent Amazon a handful of them which is great!

Here is the exact one I ordered: LINK

Now you’ll see all kinds of information about people warning you and none of them sold on Amazon by 3rd parties have good reviews.

Well to start, the NooElec Aluminum Enclosure & EMI Shield, Black, for Great Scott Gadgets Ubertooth One & Yard Stick One (LINK) does not fit so great lol. I’ll keep the case and hope it fits my Yard Stick One clone.

Anyway, after plugging in the Ubertooth One I noticed that it is not recognized by Linux, OSX or Windows.

I attempted to follow the instructions on the wiki to enter DFU mode to no avail. LINK

But it did have some lights on, so something is working?

After some googling I found a great thread on the Ubertooth Github which covers this issue and the types of Ubertooth One knockoffs now that they aren’t being made by Great Scott anymore. LINK

The one I purchased turned out to be the second one in the pic, minus the extra plastic he has under it.

So following ukoda’s instructions, you can just use UART and reflash the bootloader to get it working again to get into DFU mode. Original LINK

So let’s go over that process as I’ve confirmed it works!

First install some perquisites:

apt install lpc21isp libusb arm-none-eabi-gcc make

Next clone the Ubertooth GitHub repo:

git clone https://github.com/greatscottgadgets/ubertooth/

Now lets enter that directory and go to the bootloader folder within firmware:

cd ubertooth/firmware/bootloader

Now compile the bootloader:

make

Now you have to put the Ubertooth One clone into ISP mode:

Pin #	UART Adapter	Ubertooth One	Type
Pin 1	GND	GND	Held Low
Pin 2	GND/IO#	ISP	Held Low
Pin 3	N/A	N/A	N/A
Pin 4	TX	RX	Fluctuates-ish 1.4v-ish IDLE
Pin 5	RX	TX	Fluctuates 3.2v IDLE
Pin 6	GND/IO#	RESET	Held Low

I originally tried with Bus Pirate v5 (LINK) and didn’t work.

so I then tried with a USB-C TTL cable (LINK) and it worked perfectly!

I did have ISP and RESET connected to a waveshare multiple protocol adapter (LINK) just to two of its GNDs to keep those pins low but that isn’t needed if you have another way to keep them low.

The proper boot procedure:

1. Keep TTL cable unplugged, but set up probes
2. Plug in the Ubertooth One Clone
3. Touch probe held low to Pin 2 (ISP)
4. While keeping Pin 2 Probe touching, touch and then remove probe held low to Pin 6 to reboot

Now run the command:

lpc21isp bootloader.hex /dev/ttyUSB0 230400 4000

And it should flash successfully!

Now you can unplug the serial cable and remove all probes

Now unplug the Ubertooth One and plug it back in (FYI I used a powered USB hub that wasn’t connected to anything to give it power while flashing the bootloader but it isn’t needed to do that)

Then surprisingly in my case, it was already seen as a Ubertooth One and had the latest firmware on it! (Firmware version: 2020-12-R1 (API:1.07)

Lets walk through confirming that though.

lsusb

You should now see

Bus 001 Device 009: ID 1d50:6002 OpenMoko, Inc. Ubertooth One

Note the 6002 meaning it’s in regular mode.

You can use the v arg to confirm this:

ubertooth-util -v

Which should return the firmware version:

└─# ubertooth-util -v
Firmware version: 2020-12-R1 (API:1.07)

and then:

ubertooth-specan

To make sure it isn’t RF locked or anything else.

should show something like:

└─# ubertooth-specan
0.002335, 2402, -47
0.002335, 2403, -49
0.002335, 2404, -45
0.002335, 2405, -46
0.002335, 2406, -47
0.002335, 2407, -48
0.002335, 2408, -44

If it does, then you’re good to go!

Last one I’ll cover, you can use:

ubertooth-btle -n -U0

To dump some BLE beacon info!

So to conclude it seems that they’re just being shipped with some corrupted bootloaders.

Hope this’ll give you confidence to make that purchase and get yourself one!

END TRANSMISSION