————————————————— ENG —————————————————
Hello everyone, and special thanks to BIOS for sharing the APPOTECH SDK collection!
I have been reverse-engineering the Retekess V115 / Tivdio V-115 / Audiomax SRW-710(S) FM/MW/SW/MP3 pocket radios (128x64 LCD). Along the way I sorted every AppoTech/Buildwin SDK, datasheet and tool I could find into one catalogued archive. Here is what came out of it.
1. Which chip is in these radios?
The LQFP48 chip has only the AppoTech logo (date code 1551). It is the AX2220 die, sold as the AX2227: the AX2227/AX2226 user manual literally contains the table "Project ID AX2220 → AX2227 (LQFP48) / AX2226 (SSOP24)". The firmware layout matches the AX2227 BT-box SDK byte for byte. Radio IC: AKC6951(55). Flash: 2 MB SPI NOR.
2. UI assets fully extracted
[list]
[*]GBK→Unicode table + 16 px font (27,324 glyphs, GBK coverage; Korean slots are empty placeholders)
[*]257 UI images (boot logo "Kaide 凯隆电子", welcome / Bye Bye, tuner digits, band labels FM/MW/SW1–SW9, battery, EQ…)
[*]All menu strings in 3 languages (简体中文 / English / español). The menus are pre-rendered bitmaps, so I wrote a cell-grid OCR → 100% of strings recovered as text.
[*]Screens rebuilt from the SDK drawing code; the FM tuner screen matches a photo of a real V115 pixel for pixel.
[/list]
Fun facts: Retekess "V1.4" has exactly the same code as Tivdio "V1.2" (only 2 version-label bitmaps differ). The Spanish menu is a word-by-word machine translation ("Humor picante" = Playmode, "róbalo" (the fish) = LowBass). The old SRW-710 firmware still has leftover SDK modes, including "TomCat" (Talking-Tom voice changer), EBook, parental control and calendar.
3. The UI is Buildwin's stock LCD kit
198 of 257 images are pixel-identical to the CW6687 SDK res.BIN (same order); the menu bitmaps come from Buildwin's MenuEdit.exe. So the same UI art appears on many cheap players. The SDKs contain a full 128x64 LCD reference product (USER_CW6687E_LCD12864 / USER_CW6686E_LCD12864) with the MenuEdit source text (232 strings × 3 languages), the screen code and the LCD wiring. The same image kit (259 images) is byte-identical in 20 SDK copies and is even reused on the 32-bit AX315X/CW6690. The menus are rendered with Buildwin's own 7/13 px font (CW6693 ships its ASCII part as font_res_02.bin). Of the radio's menu strings, only 13 in the SRW-710 are not stock (SAVE FM, LOCK KEY, LOCK BM = lock the tuning knob, Review 3–10 s, Please insert TF).
4. AX vs CW, and the CPU architectures
One company (AppoTech HK / Buildwin = 建荣集成电路科技（珠海）), one 8051 core called AXC51. "CW" = the Bluetooth line. Register maps: AX2227 = AX1006 (100%), CW6680E ≈ AX2227 (97%). Across the SDKs there are 4 architectures:
[list]
[*]AXC51 8051 @48 MHz, IAR EW8051 7.20H: AX107X/AX207X/AX2070, AX2227, CW6685/86/87/88/91, CW665X (BLE)
[*]8051 + 32-bit DSP dual-core: CW6626D/E, CW6693 (CW6693F: DSP with FPU)
[*]Andes NDS32 32-bit RISC+DSP @120 MHz, Code::Blocks nds32 GCC: AX315X (AX3153A/3155A), CW6690G
[*]OpenRISC 1000 (or1k-elf-gcc 4.9.1): AX3233 (drone/mini-DV), AX3268/3278 (WiFi video), AX3272 (car DVR)
[/list]
5. How the 8051 SDKs build and why dumps are scrambled
IAR → hexscript.exe (bank mapping) → makecode.exe (packs code + table/font/res/menu/mp3res/btinfo) → app.cod → MPTool writes it over USB → the chip itself encrypts the image with the customer USER_ID → "export" reads back the encrypted BIN for production. That is why the code region of every dump is scrambled while the resources are plain.
6. Answers to questions in this thread
[list]
[*]@gvan (CW6693F + P25D16H): the firmware goes into the CW6693F itself. The CW6693F-UM-130 says "Built-in 4Mbit FLASH", and the package table marks the CW6693F as "MCP flash: YES". It also has "SPI interface for SPI flash & sensor", so the external P25D16H is extra storage (prompts/recordings), not the program flash.
[*]@SerzhBSV ("Buildwin Media-Player", VID_1908 PID_2070): in the video-chip MPTools (AX3233/AX327X DeviceLib.ini), the string "BuildwinMedia-Player 1.00" = class AXISP, Isp=1, i.e. the boot-ROM download (ISP) mode. PID 0x2070 matches the AX2070 (AX207X family, lib_ax207x(b).r51 contains "AX2070"/"AX2070B"). Try the AX107X/AX207X SDK V024 and its AXIDE / AX2070_IDE tools. (Inference, not tested on your board.)
[/list]
7. The archive
Everything is sorted into one library with a catalogue (chip, version, date, pages and a short description per item):
[list]
[*]01_Datasheets: ~130 AX/CW user manuals and product specs + AKC6951 + S25FL216K
[*]02_SDK: 14 SDKs, renamed as chips_project-version_date (AX107X V023/V024, AX2227, AX315X/CW6690, AX3233, AX3268/3278, AX3272, CW665X, CW6685/86/76, CW6687 (2015 + V027), CW6688, CW6691 bundle, CW6693/6626 bundle)
[*]03_Hardware_Reference_Designs, 04_Tools (MPTool, MP3RESTOOL, BT_TOOL, MenuEdit, OTP bootloader 1.1.8, build tools), 05_Guides_and_AppNotes (Chinese guides with English names), 06_Firmware_Dumps, 07_Community_Projects
[*]SDK_GUIDE.md: how the SDK works (banked 8051 model, config system, tasks, resource formats, build → flash flow)
[/list]
Note: several archives from the collection had been re-packed on a Russian-locale PC, so Chinese file names had turned into garbage like "T¦+ў" (GBK→CP866→CP1251 best-fit). I wrote a decoder that reverses it: 173 names repaired, with a log of original → new names.
Download:
[list]
[*]Library (SDKs, datasheets, tools, schematics, guides, ~2 GB): SDK/Library
Password: 302181(For koofr/the hosting)
Password: 1111(for the rar itself)
[*]Research pack (full write-up README, my tools: OCR, extractor, screen renderer, name repair; all extracted UI images/screens/GIFs, ~30 MB): Research pack
[/list]
I dont remember if i put a password on this one,in case it wants one, try 1111
a16 / arzam16: your appotech-re repo is credited and included.
Questions and corrections welcome!
Photos:
Figure 1, the mainboard of SRW-710.
Figure 2, the radio itself(SRW710/AudioMax variant,presumably the first variation)
Figure 3, the recreated photo of the FM Mode.(Top, photo from the device. Bottom,PC Render,by me)
Figure 4, screen/UI Sheet(Created by me,wasnt able to create all of them,but the sdk's do have the UI Resources etc.)
Figure 5, all 257 images from the radio(By me)
Figure 6, the standard Buildwin image set with names(CW66xx res kit)
Sources;
https://swling.com/blog/2016/12/troy-re … -srw-710s/ (Figure 2, the radio/AudioMax photo)
https://github.com/kosilko/srw710 (Figure 1 and the firmware dumps with additional info)
https://github.com/Jeronimo17/Retekess-V115 (firmware dumps)
https://github.com/IliyaZak/Retekess-v115-firmware (Found this one right now,i didnt have time to analyze,but it has details about the hardware)
https://github.com/Edragon/buildwin (The AX2227 BT‑box SDK (resource formats, lcd.c, build tools), the CW6687 SDK (UI kit, MenuEdit, screen code, TomCat), the AX/CW datasheets, MPTool/MP3RESTOOL/BT_TOOL, schematics.)
https://github.com/arzam16/appotech-re (Voice-prompt and BT‑info formats, MPTool USB protocol notes)
A fun fact;
i dont own the radio itself 
still, i was able to reverse-engineer this far.
Thanks to everybody mentioned here(also non-mentioned peoples too ).
In short,i was tired 
Отредактировано barbaror4 (2026-10-17 23:27:17)
- Подпись автора
Türkiye
