Firmware Updates

Downloads json information on firmware from

Parameter %1 (hardware version) is one of:

Note that only ev2_4, bigboard, v1_5 and v2_0 seems to work currently. EV 2.4 is the kickstarter and early backers shipping version (along with hacker special version) - Bigboard is the original large test version. v1_5 is the currently shipping version.

Parameter %2 is one of:

ev2_4 and v1_5 have nightly as well as release, and bigboard only has release.


Json format

The json for each firmware has two entries. One for recovery and one for normal. An example for the release firmware for ev2_4 is shown below:

   "recovery": {
       "url": "",
       "timestamp": 1356919500,
       "notes": "Official Recovery Firmware",
       "friendlyVersion": "v1.5.2",
       "sha-256": "1ca285d65d80b48b90bab85c5f9e54c907414adffa6f1168beec8aac5d6f32a2"
   "normal": {
       "url": "",
       "timestamp": 1358897692,
       "notes": "Pebble OS v1.7.1",
       "friendlyVersion": "v1.7.1",
       "sha-256": "8cd22fbb9a5f2e3637c44c6de44ab2e0c470b431d00536a3ac284e5e4fc3a0d7"

Known Firmware Versions

These are firmware versions posted to the nightly at various times. The url that is being checked is:

PBZ updates

Each pbz file is simply a zip file containing zero or one system_resources.pbpack, a manifest.json and tintin_fw.bin. The tintin_fw.bin is a raw binary that the pebble runs directly. (placed at 0x0 on the flash memory).

The system_resources.pbpack is a proprietary file format specifically for the pebble. At this point, I'm unsure whether the app reads it or the pebble reads it. The file contains a number of images and fonts used by the pebble, such as watchface icons or the first-run screen.

I haven't quite nailed down the format yet, but what I have is here (all offsets are inclusive):

Address Description


Number of resources


CRC of 0x101C-EOF (all resource data without header)


Timestamp - unknown purpose


Version string (see below)


Resource entries (See below)



The resource entries starts at 0x1c and consists of the following four fields (offsets are from start of each entry segment):

Address Description


Index of resource


Offset of resource


Size of resource


CRC of resource

The file contains three different types of data:

Now you can extracting resources using pebble-firmware-utils

It must be noted that in newer firmware versions (from 2.0-BETA1) the format is slightly changed: there is no more Version string, so all the remaining parts are shifted by 16 bytes. To unpack such files you may use updated utility from repository fork

Tintin firmware file

The tintin_fw.bin is a 'raw' binary for the STM32F205 cpu in a fairly standard Cortex M-3 format. It should be noted that there is a custom bootloader at the primary entry point of the CPU. At present time, we do not have a dump of this bootloader, but we know that it loads the tintin_fw.bin at the address 0x8010000, after which the reset vector table is pointed at this address, the stackpointer is setup and the PC register is loaded with the entry point.

For firmwares v3.0-dp entry loading address was 0x8000000. For v3.0 it is 0x8004000.

In practice this means it has a structure similar to the following (each element is one unsigned integer, e.g. 4 bytes):

Offset Description
0x0 Address of stack top
0x4 Entry point of binary (memory/flash address)
0x8-0x180 Interrupt handlers
0x198-end Code & resources etc

Disassembling the file

Some minor notes on disassembling.

Device Connections to STM32F205 cpu

The accelerometer appears to be connected to I2C1.