Part 2 - Ultimate Ears Wonderboom Gen1 Reverse Engineering - The Rebuildening

As long as I have been taking things apart I have been accused of not putting them back together...

Let those claims be put to rest! I thought having a speaker that shut itself off was annoying? the one thing worse is a speaker that sounds like horse s***. I put up with that for about 3 weeks.

I still never probed the ABC pins, I never did more work trying to get console access to the Airoha SoC. The recent vulnerabilities in other Airoha chips make me think future interrogations to the firmware itself can be done over Bluetooth. The awful sound quality of the speaker while taken apart directly agitated me into re-assembly of the entire speaker. I kept re-assembling until it sounded newer than 1952 and, well at least I get to show off the other half of my skills.

Let's take a second and cheers to the parts of this process only a human can do (For now). My parents taught me to do everything to the best of my capabilities and take pride in my work, I hope that's reflected in my reassembly!

I got a new toy.

A hot air station, I've been needing one for years. Absolutely amazing improvement.

I first learned how to solder with a similar prosumer Chinese knock-off soldering station and hot air station at an electronics repair shop where I worked when my dad told me I, "wasn't allowed", to work in a restaurant for free food. After I left my job there I got my own soldering station and have progressively gotten used to using it for more and more inconvenient tasks purely because I am capable.

Super glad to have the right tools for the job this time though, I'm done taking the 10% chance of needlessly destroying my stuff, because at the end of the day I'm still only skilled enough to do it 90% of the time.

I started by once again liberating the Wonderboom's flash chip. Little did it know, it was about to be sealed back into its eternal tomb.

This flash chip's last dance

After that I unbent the pins on the flash as best I could (Do remember it was soldered to solid-core copper mortal bindings).

Next, I cleaned up the traces on the motherboard and removed my headers.

I did scorch the bottom of the board removing my headers but not too badly. Learning lesson, a little too much mass for the iron tip I was using, win some, lose some. I'll take 5% off my score for the aesthetic damage.

The starting point for re-assembly after all is said and done

I got to work with my new hot air station after getting the board back to baseline. I added flux and the flash quickly adjusted back to it's home once it got hit with ~700f.

Flash re-installed

After that, the hard part was over!

I just started putting it assembling it in reverse, I put the motherboard back in it's top-shell enclosure:

Motherboard is back in it's home

This is where the astute amongst me will notice the slight aesthetic burns by the debug pins. A.K.A. where I cranked my soldering iron to 820f to heat up my headers instead of letting cool to switch irons...

I added the audio driver daughterboard next

Daughterboard re-installed

Suddenly I was 80% done after reconnecting the battery, charger, speaker, and subwoofer wires back to their respective headers.

80% assembly, open top shell showing the speaker wires connecting to headers

Now, I want to clarify here.

My original intention was not to completely put this thing back together. I'm still trying to hack it and there's heavy odds it's Bluetooth exploitable, regardless the optimization here was only to get back to normal ✨sound quality✨. These speakers are quite amazing and that's why I've owned it a decade after all.

One of the really interesting thing about audio devices: Acoustics matter.

Like a lot. A WHOLE lot. It gives me an absolute new respect for ordinary speakers, and it also explains why a device that's purely innocuous can have hardware security that's annoying to deal with. It does seem like a lot of care went into every aspect of this device.

And that's all reverse engineering is. Win some, lose some. Learn always. Never Stop.

Learning about acoustic engineering just was not what I expected. But I'm not mad!

Here's what I mean:

Now that sounds AWFUL when you know how these speakers are supposed to sound.

Funny enough it was simply never designed to sound good opened up like this.

The major acoustic design here? A complete seal. Simple, I got around this to make it bearable by stuffing it with tissue. But without a complete, SCREWED DOWN TIGHT seal to the device, you lose pretty much all bass and ~30% of the volume itself.

There's a strange moment to realizing how complex you have to make seemingly simple things sometimes, and how complex they have to be engineered, to even get 4 speakers in a shared housing sounding good to begin with.

Note the difference:

STAGGERING difference, and at this point we were 90% assembled!

90% assembly

All that was left was re-adding the top cover:

Complete assembly

At this point I'm not sure when I'll want to mess with this device again, it has taken too many hours of my bench time for too little payout.

Any future exploration will probably be geared towards Bluetooth exploits of this device, and I hope my journey can help someone along the way!

As always, if you have any info to help me further in this project, reach out to [email protected]!