I now have the Joel Osteen Joel Osteen Inspiration Cube (as it's called on amazon).
It's an all-in-one device that can play Inspirations and Sermons and apparently also act as a speaker (Bluetooth, I think? or maybe just aux cable)

It's got Daily Inspiration, Sermon, Daily Affirmation, Digital Display, Favorites, Easy On/Off (I'm tired of hard to use power buttons), and Speaker.

and partially transparent Joel Osteen, but they don't list that as a feature.

Unless that's Mr. Strength. I don't know.

Inspirations on the side.
"Get In Position For Increase" is some questionable grammar, but I'm interested in Change Your Name and Get Rid of Old Names and Don't Let Others Name You.

I know a bunch of trans people who would agree with those. Good to see Mr. Strength is an ally.

The other side has Weekly Sermons
"Your Words Become Your Reality" sounds like the tagline to a 1990s Virtual Reality movie.

It's by "Ideavillage", 2020.
And proving they didn't run the naming past any teenagers, it's code-named the JOCUBE

Listen to Joel deliver...
messages of faith, hope and strength.

-1 points for not using the oxford comma, but also what's up with the ellipsis? were we supposed to expect it was gonna be recordings of him delivering pizzas or amazon packages?

Time to open the packaging.
As expected, it's not actually a cube.
It's one of those weird truncated cubes so it can sit an an angle.

I don't know why it has a "REMOVE BEFORE USE" sticker covering up the power and headphones port

It charges using microUSB, and they helpfully told you the voltage of it, in case you accidentally use a 12v microUSB cable that shouldn't exist.

WELCOME TO JOEL

oh hey, the battery has charge.
It immediately tells me to look at the instructions and set the date, though.

The bottom.
I don't know why it has the little nub there.

FCC stuff, 2020 Ideavillage, JOCUBE, FCC 2AJKH-JOCUBEWTFC, and "30201".

The back of the device looks like a fabric speaker grille. Not sure if there's one or two speakers under here, there's plastic right behind it and it's too opaque to see even with a flashlight.

It comes with a 1 amp USB adapter and a USB A to Micro USB cable.

It's got a manual and a quick start.
I like how you hold down "INSPIRATION" to set the clock.

If the battery ever dies, you gotta set the date and time again.
So they didn't include a back-up battery... cheapskates.

Here's what all the buttons do.

And another name: the OSTENCUBEQSG0612720MW

to pair with your phone, just hold down the DAILY AFFIRMATION BUTTON for 3 seconds.

I love that sentence.

And the manual has a big long list of all the contents.

Press Play to Save?
No Joel... Jesus Saves.

So after you've configured the clock, when you power it on it just shows you the date and time.

then after a couple of seconds, it switches to "Inspiration 304 Ready"

And it just so happens that today, October 30th, is the 304th day of the year.

Wait, it has 365 daily inspirations, right?
This year will have 366 days, it's a leap year. What's it do then?

Anyway when you turn it off, it says "Goodbye".

I'm disappointed they didn't customize that to something more biblical.

Although I'm not sure if this thing has any customization to the firmware at all. It might just be different buttons, and as far as this thing is aware, those buttons are labeled like "Menu" or whatever.

I guess it's gonna have to have some custom firmware to implement the date=preloaded-track feature.

Anyway I set the date to December 31st, the 366th day of this year.
if I don't post again after this, it's because it exploded and blew up my house

well that's a boring answer

oh yeah, look:
they included a special Leap Year inspiration for exactly this reason.
10$ says they wouldn't have thought about that if this device hadn't come out in a leap year.

What's it like when you use it as intended?
Eh. As expected. It's just playing an mp3 file.

Available devices: THE CUBE

every muscle in my body is telling me to not push OK

of course a side effect of it just being a bluetooth speaker means I don't have to work very hard to provide a Surprise with it

It's got a little blinky light when charging.
And apparently the data pins aren't connected: it doesn't show up as a flash drive or anything when plugged into a PC. Shame.

Anyway, under the rubber pad (for friction, I suppose) is a HIDDEN SCREW, but it still doesn't want to come apart. This is gonna end up being a destructive teardown, I'm afraid...

Pulled off the speaker fabric. There's one big grille and one big speaker.

Yeah, just one speaker.

Behind the speaker we can spy an 18650 battery but no more screws to undo. I think there's some more behind the top cover...

Yup! Prying off the "Joel" overlay reveals three more screws.

And we're in!

Thankfully the battery and speakers have connectors and aren't just soldered onto the board, so they're easy to detach. That battery is, yes, an 18650, 1200 mAh.
Apparently made in July of this year.

And the other side.
Oh, wow, is that what it looks like?

Yeah, that's a microSD card glued into a socket.

I pried the glue off carefully

And it pops right out!
It's a no-name 4gb card.

To no one's surprise, it shows up as a 4gb FAT32 partition.
Imaging it now...

oh my sweet banana flavored jesus IT HAS A VIRUS

I don't know what the fuck is going on with this drive.
all the files are marked hidden, there's a directory with... no name? an autorun file, a .nil file, a desktop.ini file and a Thumbs.db file?

either they were trying very hard to hide files from anyone who breaks open their device and tries to steal the mp3s off the glued-in microSD card, or they had no idea what they were doing. or both.

yeah apparently that directory is named 0xA0, which is win-1251 for non breaking space.

WHY WOULD YOU NAME A DIRECTORY THIS

that nil file is also a virus.

apparently one of the domains the virus uses to communicate with the command-and-control server is "suckmycocklameavindustry .in"

nice to have that stuck in a Jesus Cube

thankfully python can easily copy the files out of the unnamed directory

Inside that directory, there are... more directories! Just one for each of the types of thing the device does.

Inside those... a bunch of MP3 files.

I loaded one up in Audacity to get the metadata, but do you notice anything weird about it?
I mean, besides the fact that it's stereo and composed for a mono speaker?

yeah it's like a third of a second long.

I tried slowing it down to 10% speed and... uh... yeah.

yeah, I think these aren't actually mp3s. or they are, but they're encrypted.
I ran "file" against them and none of them showed up as mp3s.

The files look pretty random in a hex editor. no obvious headers or structure. So I'm guessing encryption.

I gotta run get lunch but I'll resume hacking on this thing afterwards.

So while the audio files were getting imaged, I took the rest of it apart.
The display is a single module, probably one of the HD??? ones.

It's got two blobbed ICs on the back (booo)
1602-5 and 200705AAY... apparently this is a HD44780-based module.

The main PCB, other side.
It calls itself a WB-309-YF5321A-AMP, Version 1.2, date of 2020-04-17.
Bunch of little tactile switches for the buttons.

The one chip on the bottom is a TP4056.

That's a battery charger.
So it manages taking the power off the USB and safely charging the 18650.

On the other side of the PCB, it's got 3 chips, microSD connector, and that weird blob on the left.

The weird blob is around the headphones port and microSD.
Maybe they added it for some waterproofing? or RF interference?

The big chip is an AB (A3?) EHDB14C9A UE2638 2020 .
No results on google, sadly.

This is an NXP 8563T. It's a real time clock.

The tiny chip is a CHIPSTAR CS5250E, that's an audio amplifier

ok this is interesting. so I picked one of the files and I'm noticing a pattern here.
See how it's the same two bytes, back to back? then it changes.

the pattern changes around 0x1000, 0x1200, 0x1400, etc.

in other words, every 512 bytes. That's a sector size.

so I wonder if this might be using a sector-based XOR encryption method, and it's using a 16bit key that changes based on the sector

I put that file up on the internet archive for if anyone wants to hack on it:
https://archive.org/download/i-365-its-simple-things-to-god/I365It%27s%20Simple%20Things%20To%20God.mp3

the encryption isn't the same per-file, either.
like the A001You Are Blessed.mp3 file has 0x5719 around offset 0x300, but A002God's Supernatural Favor.mp3 has 0xA3BA at the same offset.

So either it's basing it on the filename, number, or there's a key embedded in here somewhere

but here's something to test: what if I put my own mp3 on there, unencrypted? maybe it'll figure out that it's not encrypted and play it fine.

huh. you can change into that directory.

Yep. It can load unencrypted mp3 files.

And yeah, it appears to find the file by looking up "I304*.mp4", so if I rename the file, it'll show a different title on the screen

and @lunasorcery pointed out something I should have realized: I can determine if the encryption is file/number based by simply renaming them around and seeing if they still play.

And they do!

so it has to get all the info to decode a file from the file itself.

(or it has some hash->key) listing in the microcontroller)

I think I'm gonna write a script to look through these files and figure something out.
Like, in A001, the first definite key I see is 5719, followed by E36F.

Does 5719 ever get reused as a key? and if so, is it followed by E36F?

@tababodash brought up the idea of looking up the mac address.
I had to pair it to a windows machine to get the mac address, but it only gives me a "unique ID" instead of a mac address.

weirdly, googling for the prefix of that unique ID?
it pulls up the bible.

you might also notice that 4142 is "AB", as in this AB:

in any case, I confirmed on my phone that the unique ID is the mac address, and stuffed 414231 into a couple of mac address lookup sites.

They all came back with nothing.

although @tababodash also pointed out we can just look at the FCC filings: https://fccid.io/2AJKH-JOCUBEWTC/Test-Report/Test-Report-4789324

which say it was manufactured by "Wonders Technology Co., Ltd"

They've done a bunch of other bluetooth speaker devices. And one of them uses a chip with the same number of pins, the ATS2819S.

That's an Actions ATS2819, which is an all-in-one bluetooth microcontroller.

but after looking at the datasheet... it's not it.
See, this here? the antenna is hooked up to that pin.

and on the ATS2819, that's GPIO0/SD0_CMD, not one of the RF pins.

BTW, since someone asked, I threw a few more files into the upload:
https://archive.org/download/i-365-its-simple-things-to-god

And we've got a manufacturer for the IC! it's Bluetrum! https://twitter.com/nxmq99/status/1322345335293906945

I think this might be the chip:
AB521A.
it's a 48-pin LQFP48 bluetooth microcontroller, designed for TVs?
http://www.bluetrum.com/product/ab5321a.html

this is why I think it might be it.
5321A.

Apparently it's a RISC-V core.

sadly I can't find any datasheets for the bluetrum chips

I guess I can always email them and ask for the datasheet.

done.

@nxmq99 found a example circuit for that chip, which does match the RF pin: https://twitter.com/nxmq99/status/1322348896073490439

and if that's right, this thing DOES have USB-DATA support, it's just not soldered to anything out of box.