[SOLVED] Unidentifiable SOC (ZKTECO Biopad 100, Windows Embedded CE)

Thread Starter

Ri5ux

Joined Sep 5, 2017
44
EDIT: This has been solved. The chip is an ARM 920T (Datasheet: http://pdf.dzsc.com/ARM/ARM920T.pdf)

Hey everyone, recently picked up a quite interesting device for cheap, because I thought it would be interesting to reverse engineer it and create something more useful out of it. I'm pretty sure the SoC/Processor in the device has been re-branded. I know the system is running Windows CE 6.0, but I'm currently trying to find a way to erase the software running within Windows CE in order to simply use Windows CE and add my own software, so I'm looking for any and all info I can get on it, including information on the processor which is apparently re-branded.

The device itself is a PayChex PX2500 Biometric Time Clock. Based on information I've gathered from tearing it down, PayChex also rebranded the entire unit. It's actually a ZKT ECO Biopad 100. ZKT ECO being a security based company, I'm not surprised it's rebranded... they want the device to be as secure as possible, but anyhow, I have attached pictures of the Biopad 100's embedded computer. The chip I am attempting to identify is labeled "Multi-Bio 600" with the "ZKTECO" brand stamped on it. 600 being the clock speed in MHz.

I'm thinking it might also be possible to identify the processor from within Windows CE, so my next step is going to be attempting to access the Windows CE desktop. ZKTECO also provides a "universal" SDK for this thing, not sure directly what that applies to.. yet, but I'll find out soon!

Any and all help is appreciated. Thanks in advance!

uploads%5CIMG_20180314_183251.jpg.jpg uploads%5CIMG_20180314_184229.jpg.jpg
 
Last edited:

Miah

Joined Feb 25, 2019
7
Any luck in this thing? I have spent most of the day playing with a unit that I recently received for next to nothing.
Do you know the any of the default passwords (maintenance or telnet)?
Did you get access to any part of the OS?
Do you have access to the windows SDK?
 

Papabravo

Joined Feb 24, 2006
18,456
These things are probably not worth the powder to blow them away. Having Windows CE 6.0 on any device is worse than having a bond with a negative interest rate.
 

Miah

Joined Feb 25, 2019
7
I have large code library that I would prefer to not translate to android so CE 6.0 still makes sense for my business needs.
If I can get access to this, or another presentation style CE device with biometric and Mifare 13.56mhz RFID, at the current ebay price point.
 

Thread Starter

Ri5ux

Joined Sep 5, 2017
44
Any luck in this thing? I have spent most of the day playing with a unit that I recently received for next to nothing.
Do you know the any of the default passwords (maintenance or telnet)?
Did you get access to any part of the OS?
Do you have access to the windows SDK?
I have around 10 of these units that I was going to use for projects, but without identifying that chip, or removing the flash and trying to read the filesystem on the flash storage (already tried that), I dont think there's a way to do it. I did find what appears to be a JTAG header on the daughter board, but I haven't had time to experiment further with that. If you'd like to do some experimenting with it, here's all the information I gathered on it:
Biopad100.png.png

Uploading it resized the image making it unreadable, here's a direct link to it: http://arisux.com/upload/uploads/photos/zkteco_biopad100/Biopad100.png.png
 

Miah

Joined Feb 25, 2019
7
tried to purchase one and they said that they are no longer available


What did data did you get when you desoldered the and read the NAND?
 

Thread Starter

Ri5ux

Joined Sep 5, 2017
44
tried to purchase one and they said that they are no longer available


What did data did you get when you desoldered the and read the NAND?
I was unable to retrieve any data. It was my first time reading a NAND, I was probably just doing it incorrectly.
 

Thread Starter

Ri5ux

Joined Sep 5, 2017
44
no luck on my side with desoldering. My first time also
Desoldering wasn't too bad on my end. Reading it was my issue. I need to get a proper flasher for reading from and writing to it, but I don't have enough interest to spend $50 on a NAND flash specific programmer.
 
Top