GOPRO HERO8 Teardown
Posted by Mark Kirschenbaum on
A quick summary of the design wins for the GoPro HERO8 (J-Bay). No significant electronic differences between the HERO7 and the HERO8. However small changes in hardware can make huge impacts on the system reliability and stabilization.
- Updated IMU (inertial sensing)
- New power subsystem including yet unknown change to battery. This allows them to "boost" the processor / LDDR. The battery may have a higher discharge rate or temperature tolerance. (TBD)
- Faster MIMO enabled WiFi chipset
- Slimport driver for video over USB-C
Mechanical
- Replaceable integrated mounting pegs
- Fiberglass or some woven technology enclosure. This thing gets hot!
- Better microphone placement
- 17% lighter and smaller (when compared to HERO7 with the frame)
- Side mounted battery and card
- No replaceable lens. Lens protectors and snap on PolarPro lenses available shortly.
Code Names & IDs
Codename: JBay
ID: 0xA66
Model: 50
Model: HD8.01
Socionext SC2000A custom (GP1) |
Imaging Processor |
Accelerometer / Gyro pair 6-axis sensor. Two new direct interrupts into the GP1. GoPro HERO[6,7] used BHA250 hub and BMI160/BMG250. |
|
NEW Atheros QCA9377 |
High performance, low power single-stream 11ac MU-MIMO and Bluetooth 5 in a single chip solution. |
Sony IMX277 |
Sensor 12MP 44fps max @ full res, 1/2.3, 1.55 pixel size, SLVS-EC 8Lane |
Apple MFI | For Wi-Fi Accessory Configuration (WAC) |
UBlox UBX-M8030-CT | GPS Receiver u-blox M8 GNSS chip, WL-CSP47, Standard grade |
NEW Analogix ANX7816 |
SlimPort transmitter for Display Port over USB-C |
Active Semi ACT9150 |
PMIC (Power Management IC) for Socionext. Power supply, charging, and LED control. |
NEW Active Semi ACT88326 |
PMIC Dedicated 0.9v regulator for VDDCore and possibly LDDR of GP1. Believe this allows them to boost the clock of the system. |
Sitronix st7570 | Front Display 128 X 129 Mono LCD |
FocalTech ft6306 | Touch Panel Controller with display produced by JDI, NVD or US Micro |
Sitronix st7796s | 320RGB X 480 dot 262K Color TFT |
Microchip SAM L22 | USB-C PD / Accessory Sentinel / Battery authentication / Reset Handler / RTC Always "on" 64Kb Encrypted bootloader & app Still authenticates Battery and SHA204 as before |
Pericom PI3USB9281 | Protecting against bad chargers, detecting power, usb pin muxing. |
DSP Group DBMD4 | "Ultra Low Power Always-On Voice Activation for Any Device" |
Jiangxi Lianchuang Electronic Co. (LCE) Lens la068a | Lens Manufacturer |
eMMC | TBD |
LPDDR3 K3QF3F30BM |
2GB CM0/CA7 Frequency 100/600Mhz PoP on GP1 |
Battery | Li Ion 3.85V 1220mAh 4.70Wh SPJB1B R-41047830 Chem-ID 0x3948 TI Fuel Gauge type '3' Possibly: BQ27Z561-R1 |
Observations
GoPro did fix the wifi password generation schema with now 57^16 combinations of passwords! First shipment does not have the new scheme so you will have to re-connect your camera once it goes to 1.20.00 as the password has changed.
Generation Example
The RTC seems to be active for alarms. This means you don't need external device such as CamDo Blink-x to do super long time lapse. Not sure if they will expose this to the end customer, but it is in the firmware.
The Media Mod "Borg" will communicate to an external Conexant CX20811 ADC. Speculatively a Cypress USB-C PD, ATSHA204 and a Pericom USB BC2.1 switch.
The Slimport will pass though the unused superspeed pair over the USB-C bus and coverted to HDMI via an Analogix receiver.
"Klingon" is still in its infancy so it's unknown what this accessory does.
Parakeet - The drone and gimbal interface seems abandoned.
Third party support seems active although the developer program has been mothballed years ago.
'autoexec.sh' appears to be disabled
The accessories authorize via original ATSHA204 keys. GCCB/GPTunnel seems for the most part unchanged. Seems the handler is not called at this release.
Possible next generation cameras code names are:
Kelpies Camera Model 53
Caves Camera Model 54
Debugging
If you unlock the SD Card by sending the USB Vendor extension 0x9002 and then send a file named 'MTP_TO_CDC.TXT' in the same connection, USB will switch to CDC mode. From there, with your favorite serial terminal, you can use gpRTOSConsole to communicate to the RTOS or make changes to the linux file system.
Battery
It's confirmed that there is a new TI Fuel Gauge on the GoPro HERO8. The new battery also has a different CHEMID which means its impedance track is different than previous batteries. It appears they are using a TI BQ27Z561-R1 Battery Gauge with SHA-256 encryption vs SHA-1 in the past. I doubt these devices are hardened and a side channel attack should make clones available shortly.
You can see the protection circuit of the Li-ion is different on the HERO8 Battery (left) than the HERO5 Battery (right) Looking back, I think it may be a clone. I'll update with a new image shortly.
I've never quite seen the component marked 'e' on the positive rail and believe it's a PTC or similar protection device. Current detection appears across two 0.005 resistors on the low side. There are new spark gaps on the DQ and Thermistor lines.
Cell Information
HERO8 Battery | HERO[5:7] | |
Manufacturer | ATL | SDI |
Model | A531129 | ICP113130AA1-2 (1220mAh) |
Description | LiMn2O4 (Co,Ni)/carbon, 4.4V, -20C | LiMn2O4 (Co,Ni)/carbon, 4.4V, -20C |
Chemical ID | 3948 | 3779 |
Vqdis_min | 3761 | 3765 |
Vqdis_max | 3815 | 3808 |
SOC_min, % | 24 | 25 |
SOC_max, % | 40 | 38 |
Rhf,mOhm | 63 | 104 |
Rhf_lo | -200 | -113 |
Rhf_hi | 49 | -123 |
Qmax | 5180 | 1342 |
Ra0_charge | 207 | 0 |
My apologies, I believe the HERO5 battery(right) in the image may be a clone.
Repository
Some of my tools and sanitized logs are located on Hypoxic's GoPro HERO8 GitHub Repo
Be sure to checkout our complete physical GOPRO MAX Teardown.