Observations on Level-5 Touch NFC Reader

First of all, this is a Bluetooth Low Energy device, detected as "L5_TOUCH_RW".

Using NRF Connect app, you can see which service it offers; It has 5.

• Generic Access (contains Device Name, Appearance, Peripheral Preferred Connection Parameter)
• Unknown Service 1 (the characteristic that has the property "READ, WRITE NO RESPONSE" is the NFC tag info this has detected)
• Battery Service (Self-explanatory)
• Device Information (Self-explanatory)
• Unknown Service 2  (contains 4 characteristics, which I assume is its serial number and other information)

My test unit has this information shown on the app:

• L5_TOUCH_RW (device name)
• [576] Generic Keyring (Appearance)
• Everything set to 0 (PPCP)
• Tag's data, which in my case was 00 00 04 a6 41 9a 7b 2b 80
• 108% (Battery Level)
• Realtek BT (Manufacturer Name)
• Model Nbr 1.0 (Model Number)
• RTKBeeHardwareRev1.0 (HW Revision)
• Toytec FW1.0.1 (FW Revision)
• Toytec SW1.0.2 (SW Revision)
• 00 01 02 00 00 03 04 05 (System ID)
• RTKBeeIEEEDatalist (IEEE 11073-20601 Regulatory Certificate)
• 0 (PnP ID)
• ac ab fa 33 37 07 (0xFFD2, Bluetooth device UUID)
• 4c 32 "L2" (0xFFD3)
• 5e 31 "^1" (0xFFD4)

And according to Furui NFC-PM5, the tag's contents are as follows:

It seems to agree on the first 4 (minus 1) bytes, but then it starts reading something else.

Interesting Hardware: TOMY Level5 NFC Reader

The local shop had a clearance sale and I bought a bunch of this device for about $0.90 each! It was intended to be used with Nintendo 3DS (3DS LL/2DS) and some select smartphone games bearing a specific logo, created by Level-5 Inc.

Of course, the first thing I did after returning home was to take it apart.

Inside, you can see two distinct modules, one in black and one in green.

There's a 0-ohm link acting as a fuse. The green NFC module says "FES05 Module WASHOW SIC9311" (and a Japanese HF certification sticker with code "AC-16073"), and the Bluetooth module bears the code "TNT_MBL_M". The Bluetooth module uses XF2480A, and according to some listings on Alibaba, it's from iFlyTek. It also bears the Realtek logo.

Japanese radio authority does not keep records of the devices they certify public (unlike FCC), so searching for them was a straight dead end. For your information, it has the code "TOYTECBTM2017 016-200150", which probably stands for "TOY TEC Bluetooth Module 2017".

Remember the WASHOW module? Turns out, it's actually the maker of this module and SIC9311 is the chipset it uses (from Silicon Craft, a Thai company). A blog exists (http://nfcmaker.blogspot.com/2018/02/blog-post.html) that has the information on that module, but unfortunately, all of the links on the page are dead and there is no archive of this file available on the Internet Archive. I did leave a comment on their post asking about whether or not they have the files, but I'm not holding my breath on whether or not they'll ever respond.

There are screenshots and photos of the module in question, which verifies that this is the correct source:

Not much info on the Bluetooth module itself, other than some odd page saying "Oh yeah, our $1000 device can totally read and write to this chip!".

If anyone has more info on this module (either the Bluetooth module or the RFID reader module), please let me know.

Some more observations:

This company seems to have partnered with the Japanese app called "The Snack World" in 2018 according to the Facebook post. Moreover, this reader can ONLY read and write the NFC tag, not general RFID tags (such as ones which can be read with the almost universal RC522 RFID reader module), which severely limits its usefulness. See the screenshots below:

(Obtained through Archive.org Web Archive. Fetched from the link on their Facebook post - The pen shown up there is also NFC-enabled, and apparently contained the link to example code)

(The "Japanese toy factory" seems to be referring to TOMY)

(This app is the app that works with this product.)

(This is the project which uses SIC9310, a very close version to the chip I want to find the library of.)

Considering that this can only read NFC tags, I'm thinking of gutting this toy and putting in a more universal RFID reader in it.

Review of JLCPCB's service

Disclaimer:

This review is sponsored by JLCPCB and the board was manufactured and shipped free of charge.

However, the contents of this review has not been doctored, monitored or otherwise influenced by them. That is, I'm not paid to make this review.

All parts of this review is honest and reflects only my perspective without any outside pressure.

Now, with the legal stuff out of the way, let's begin.

So I have been contacted by the people at JLCPCB, a printed circuit board (and related product) manufacturing company based in Shenzhen, China, about this review.

I, of course, said yes since I had a PCB I really wanted to have it manufactured. (guess what it is -- a little medallion)

I made the design in KiCad and generated the Gerber files (and drill files) based on their tutorial, which is on their page. (https://support.jlcpcb.com/article/44-how-to-export-kicad-pcb-to-gerber-files)

The first designs were not processed because the errors were caught during the auditing process:

Their support representative was very kind and informative, and told me exactly what to do to have the design manufactured without problem.

I increased the bridge width and did what they suggested, and it was approved.

The page also has a progress meter which tells you what process is being done, which is handy. It's like watching a 3D model of yourself being printed on a 3D printer. Or seeing a CNC mill doing its job the first time.

After a bit of dum-de-dum-ing and finger twiddling, the process finished.

And after a bit of waiting (again), I receive a mail:

And the first thing that went through my mind was: YES! WHOOHOO!!!!

Then nearly immediately (in terms of business days) I get another email, this time from DHL.

(They provide some offers -- The green PCB is $2, and they have free shipping on first order. You can enjoy fast 3-day express shipping on your brand-new project!)

And after few days from that, I receive the boards in a nice package:

Inside was a double-wrapped package containing the finished PCBs, once inside the bubble mailer package and once in the vacuum-pack.

Here's the separated PCBs -- The quality is really really good. The bottom part looks messy because I didn't put enough holes there and it actually made it difficult to snap the board without breaking it in half or damaging it, so I had to basically saw it off.
I made a mistake with CH340G footprint, but it actually made it possible to show how accurate their PCB manufacturing process is:

The footprint is SSOP-20 and it fits perfectly there. Of course, there is no SSOP-20 CH340G, so it was only there for testing.

Here I zoomed into the logo - the "Wild Hunt" text is about 0.8x1.0mm per letter.

Also here, I zoomed onto the one of the corners:

All the text is 0.8x1.5mm in size, and the pads are quite small at around the size of a sesame seed.
The lines are very sharp and they will actually warn you if it's beyond their capability (you can test this by using their Gerber viewer)
The board is very solid, too. This will certainly last for quite a while even in humid places.

I have yet to test the board (because the parts are not here), but I can say they take solder very well, they have no apparent manufacturing errors, the pads are exactly like what the Gerber file said it was, the spacing was dead-on, and the artwork resolution is phenomenal.

---

Super accurate double-layered board for $2?* That's some price you couldn't easily beat!

They also provide lots of thickness options, with 0.6~1.6mm boards provided with no additional cost. (0.4mm and 2.0mm boards will have some additional engineering fee)

You can also order a SMD solder paste stencil alongside your PCB order if you are gonna use reflow oven to quickly make many boards (for events such as DEFCON!)

You can also order electronic parts straight from their other shop (called LCSC) if you provide them with BoM. They will find the parts (if they have it in their catalogue) and ship it to you.

Use the code JLC6...