You ever notice that these tend to come in packages full of other stuff you shouldn't be eating either?

this one came with a vibrator. so unless you're trying to literalize "go eat a dick", I recommend you don't eat it

for the people wondering why I bought a vibrator, lemme explain that it has a touchscreen

Char ging
Completed

this vibrator has terrible kerning

It's got a surprisingly long boot time for a vibrator.

which is another thing I don't say much

You'd think with all the functionality of A SCREEN you'd be able to do better than naming your vibration modes just "Mode 1" through "Mode 6"

so if you swipe left you get to "DIY mode", which... isn't most uses of a vibrator some kind of "DIY mode", really , when you think about it?

Swiping right gets you through the 6 different modes.
They have these little curves on screen, which do not correspond to how it vibrates AT ALL

Those little wiggles in the top left represent how hard it is vibrating, in that given pattern. You swipe up and down to go from 1 to 3.

There doesn't seem to be a way to pause it except for turning it off (or going into the DIY configuration screen), which is why all the pictures are a tad blurry: it's vibrating in my hands while I try to take the pictures

It's got a little "jewel" in the necklace, which is a button. it's both the power button and the "back" button, to get out of the DIY menu.

I'm not really sure what the "DIY" mode is for. You have the menu can you can turn different modes on and off but it seems to just give you the same 6 modes? it doesn't toggle between them or anything.

Peeling back the silicone

Screws! that's a good sign.
I was afraid they would have just glued the whole thing together

The specs in the manual.
720mAh seems kinda low.

And it's out.

The screen has two ribbon cables. I think the bigger one is for the display, and the smaller one is a touch screen.

The battery has a little thermistor looking thing looping around it, presumably to prevent overcharging

And here's the main board

The thermistor is hooked up to N+/N-. I had to disconnect the MOTO ones, and the other 4 go to the battery or the charging port.

There's F- and F+ which aren't used, I wonder what those are for? Maybe there's a fancier version of this device which uses the same PCB

The PCB identifies itself as HK116-MB-V1.0
20180920, which is surprisingly far back. I thought this was a relatively new product, but maybe not.

The tin can is a GHKQ00200945 (that's what the QR code is)
Or a DG-HK116-10a-m or WTL41219.
None of those lead anywhere.

The other side of the board... wow we have a lot of pins here.
We've got SDA/SCL (which is the I2C protocol), RX/TX (serial), and some other pins: DP, DM, VCHG, and KCOLO

This P20A is an LDO voltage regulator

I don't think it's intentional but "GHKQ" has a lot of results and they're all japanese porn involving... superhero uniforms?

I hope the battery is supposed to be this puffy

The good news is that I haven't killed it yet. It still runs, and doesn't seem to notice that the vibrating part of the vibrator is missing.

I also detached the battery and I'm moving it away from things I don't want to burst into flames.

A little bit of hot air, and we're in!
And it's a Mediatek ARM chip!

I couldn't find a MT6261MA datasheet, but I did find a MT6261D datasheet.
It's a ARM7 chip designed for mobile phones!, with built in USB and SD support, with a bluetooth and audio and FM radio and GSM support.

it can do all this stuff and you put it in A VIBRATOR?

THIS THING CAN DECODE H.264 VIDEO

There's another chip near the power cables, labeled GM5JJ.
No results for that.

and what I'm assuming is the oscillator is labeled H269L. No results.

OK one of the labeled test points on the board makes more sense now: KCOLO is actually KCOL0, as in Keypad Column Zero.
I don't know why they needed to break that one out specifically. Maybe a debug key?

@Pineapplepunnk found the GM5JJ chip.
It's a SGM42507A motor controller.
https://www.yoycart.com/Product/616917760950/

I'm wondering if that P20A might be a serial flash chip? because the datasheet I'm looking at doesn't have any onboard storage.
(It's possible the MA version includes it and the D version doesn't)

So I found this writeable and associated youtube video, which is based on an S8 Data Line Locator spy device, using the same CPU.

They have documentation on how to use Fernvale to dump the ROM & flash!
https://blog.threatrack.de/2017/11/11/s8/ 

so by soldering onto those 4 pads which are probably USB, I can probably hook this up to a linux machine and talk to the bootloader that way. I can then send an alternate firmware which dumps the original ROM & flash chip (wherever it is)

Another post about the same chip (in another device), found by @jeri_claire, which mentions that the JTAG is messed up, and also dumps the original boot ROM using the vibration motor.
https://www.sodnpoo.com/posts.xml/mediatek_mt6261_rom_dumping_via_the_vibration_motor.xml

@jeri_claire also pointed out that this chip has onboard support for vibration, because it's for a cell phone.
so it might be driving the vibrator as if it's a fucking ring tone

Removed the LCD module to see if I could just talk to it directly.
The front panel says ZD997-YQ. As you might guess, that leads nowhere

And the ribbon cable seems to say YT01060D1_V03? Nothing for that.

The board does mention "LCM" for the connector.
The datasheet does mention LCM, and "2 lane LCD modules"

which suggests it may use DSI, Display Serial Interface.
That's the same video connector the Raspi uses.

The connector seems to be 15 pins.
two lane DSI is at least 6 pins, plus another 2 for power? so that'd be entirely possible, especially considering 5 of these appear to be commoned

also that DSI connector on the raspi? it's 15 pins. just in a different form factor.

it's not exactly the same but this Watch LCD looks pretty similar