NDSA Sensor Firmware Explorer

Connect

Turn the sensor on (press its button), then tap Connect sensor and choose it from the list. The default name is WMETRIX. Or plug it into this computer with a USB data cable and tap Connect by USB cable (pick CP2102N / usbserial).

The simulator is a pretend sensor that follows the firmware's rules. Use it to practise. It never touches a real board. A second button, Simulator: locked board, pretends the board is not enrolled.

Activity log

Nothing yet.

Device name

Now: - locked until enrolled

Up to 9 plain characters. Saved in the board's settings memory. It probably shows in Bluetooth searches after the board restarts (my reading of the code).

Measuring ranges

Now: accelerometer -, gyro - locked until enrolled

LED

always open Find which board is which.

Orientation zero (tare)

locked until enrolled Makes the way the sensor is lying right now the zero point. The test code does this before every recording.

Sleep

always open Switches the motion chips off and puts the board to sleep. It disconnects. Press the sensor's button to wake it.

Enrollment

Status: -

An enrolled board accepts the locked commands and firmware updates. Enrolling saves a hash in the board's settings memory. The token is worked out from the board's own address (see the Security tab).

What can and cannot be changed

1. Pick a firmware file

A .bin built from this project, such as the delivered 0441225001NDSA V1.0 20261021.bin. It is read in this browser only.

2. Send it to the sensor

Checks that must pass first:

Idle.

Going back (reload an older version)

Pick the older .bin in step 1 and send it the same way. The board does not keep the old one for you in a form you can fetch, so keep every .bin you flash. The delivered build is your baseline.

Modify the firmware

1. Open the source folder 0441225001NSDA V1.0 in a terminal.
2. Edit the file (table below).
3. Build it. You need ESP-IDF 5.4.1:

   idf.py build

4. The new file is build/0441225001NDSA.bin.
5. Pick it in step 1 above, check the results, and send it.

Manual checklist (if you use another tool)

The vendor's Android demo app (NDSA APP V1.0 20261021.apk) also does this on its OTA page.

Back up the sensor's settings

Reads the name, address, versions, ranges and all three calibrations, and saves them as a small file. You need an enrolled board for the calibration part.

Restore settings from a backup

Back up the firmware itself

What you can do

1. Keep the delivered file. Check it on the Firmware tab: size 684,464, MD5 0a7d7a7585055331c3480fb4c98408a7. It is the vendor's known-good build.
2. Copy the whole chip over a USB cable. This also saves the calibration, name and enrollment, which a firmware file does not contain. It needs the board's programming pins. The schematic was not delivered, so ask the vendor whether a header exists.

Commands (ESP-IDF 5.4.1 ships esptool.py; newer versions call it esptool with read-flash / write-flash). Replace PORT:

esptool.py --chip esp32 -p PORT -b 460800 read_flash 0x0 0x800000 ndsa_full_backup.bin

Put a full backup back:

esptool.py --chip esp32 -p PORT -b 460800 write_flash 0x0 ndsa_full_backup.bin

Smaller pieces (settings memory only, or the two app slots):

esptool.py --chip esp32 -p PORT read_flash 0x9000 0x5000 nvs.bin
esptool.py --chip esp32 -p PORT read_flash 0x10000 0x330000 app0.bin
esptool.py --chip esp32 -p PORT read_flash 0x340000 0x330000 app1.bin
esptool.py --chip esp32 -p PORT read_flash 0xE000 0x2000 otadata.bin

Hardware check

What this firmware is

The program that runs inside the ExerMetrix sensor board. It reads a motion chip, works out the orientation, and sends it to the phone or browser over Bluetooth. It can also receive a new copy of itself over Bluetooth (an "OTA" update).

Chip

ESP32, 8 MB flash, 40 MHz

Built with

ESP-IDF 5.4.1 (CMake project 0441225001NDSA)

Bluetooth

BLE only (NimBLE), one connection at a time, MTU up to 512

Default name

WMETRIX (max 9 characters; can be changed)

Version numbers

Firmware 1.0, hardware 1.0 (hard-coded in main.c)

Motion chips

LSM6DSOX (accelerometer + gyro, 104 Hz) and LIS2MDL (magnetometer, 20 Hz)

Orientation

Madgwick filter, sent as a quaternion

Button

GPIO 35, active low. Wakes the board from deep sleep and sends press/release to the app

Delivered build

1.0, built Oct 21 2026 09:46:42 with IDF v5.4.1-dirty

What is in the source folder

Tap a file to see what it does.

The 8 MB flash, divided up

From partitions_two_ota.csv, the layout the build actually uses. Tap a block.

Why two app slots?

The board runs from one slot (app0 or app1). An update is written into the other slot. Only after the file's checksum matches does the board switch over to it. If the transfer fails halfway, the slot it was running from is untouched.

What lives in the settings block (NVS)

From the code, the board saves these in a block called storage: the magnetometer, accelerometer and gyro calibration, the orientation zero point (tare), the device name, and the enrollment hash.

Two Bluetooth services

NDOF commands

Send to FEC7. First byte is the code.

Data packets (56 bytes each)

Two streams use the same 56-byte record in a different field order. Values are little-endian 32-bit floats; the last 4 bytes are the board's time stamp in milliseconds.

Enrollment: why a board can ignore your commands

1. At power-up the board checks whether it is enrolled (a hash is saved in its settings).
2. If it is not, it still advertises, but the locked commands are ignored and writes to the OTA service are refused.
3. To enroll, send command 0xF1 followed by an 8-byte token. If the token is right, the board saves the hash and unlocks.

The token is the first 8 bytes of SHA-256( "ndof_key" + the board's 6-byte Bluetooth address ). You can work it out for any address below, or use the Enroll button on the Settings tab for a connected board.

Not tested on a real board.

What the code itself says

Serial (cable) text commands

115200 baud. Every line starts with AT and replies end with OK or ERROR.

Calibration, as the firmware does it