Tearing down the Star Wars Battle Drone toy from Propel

To some fanfare, the Star Wars battle drone toy range was launched recently. We got hold of one today and as the first step towards finding security flaws with it, took it apart to ID components, chips and test pads.

We didn’t even fly it first: straight to screwdrivers!

Unboxing it is impressive. The mounting for the drone lights up and plays Star Wars tunes. A little annoying when you’re sat in a busy pub though!

But flip it over and all 25 screws that hold it together are obvious:

It didn’t take much to get the case prized apart:

And now we can get a look at the board:

And here’s the underside, complete with what are probably I2C test pads just right of centre (SCL/SDA):

Going closer on a microscope, here’s the chip with a white dot in close up:

That’s an STM32, so should be easy to read.

The chip with a yellow dot nearby had another component stuck to it. Not easy to get the adhesive off, so it’s a bit of a messy image. It turned out to be a Beken BK2425 2.4GHz transceiver:

And here’s a close up of the chip on the underside:

A 6-axis motion sensor from TDK InvenSense.

Moving on to the controller, this was a lot more interesting:

Going closer we see several test pads, likely UART:

On the controller boards, we can see the following chips.

A Beken BK3431 BLE module:

An interesting ARM chip:

This also on the controller board; what appears to be a JL microcontroller, but I haven’t identified the module yet:

A Microchip EEPROM flash module. Wonder if this has the firmware on it?:

What next?

After some careful soldering, we can start identifying the various interfaces, looking for consoles or other routes to extract the firmware

Here’s the controller board ready to go. Watch this space!