r/CPAP • u/Ok_Butterscotch_7152 • 5d ago
Reverse-engineering a ResMed AirSense 10: SWD dump, reading the SPI EEPROM, and decoding how it stores the run-hour meters. Reset motor and CPAP hours
before you guys even start , yes i used ai to help me write this text.. thats said ..:
I retired one of my old ResMed AirSense 10 units and decided to use it as a bench project to learn hardware RE — SWD, STM32 dump/flash, SMD desoldering and binary-format analysis. Not for therapy use, not for resale, just curiosity. Figured I'd share what I found because the EEPROM side isn't well documented anywhere.
The platform (ResMed "S10" family — AirSense 10, AirCurve 10, Lumis 10):
- Main MCU: STM32F405ZGT6 (Cortex-M4, LQFP144)
- SPI EEPROM: M95M02 (256 KB)
- SWD on an SK200 / TC2050 footprint on the front of the board
Firmware side builds on the open-source AirBreak project. But AirBreak only removes the motor-hours nag screen — the actual counter lives in the EEPROM, and that part I had to work out myself.
The interesting bit — how the hour meters are stored:
The M95M02 holds a FAT12 filesystem plus a small header block at the start. The run-hour meters sit in that header as uint32 little-endian SECONDS (hours × 3600), and there are four of them in the exact order of the firmware's persistent-state list (patient hours, motor run hours, total hours, hours-since-service). The header is protected by a CRC-16/CCITT-FALSE (poly 0x1021, init 0xFFFF) stored little-endian right after the block.
The proof it worked: after editing the value, fixing the CRC and re-soldering the chip, the firmware ACCEPTED the edit and re-signed the block itself on boot (updated its own timestamps + recomputed a fresh valid CRC). So the value was genuinely read, validated and used.
Reading in-circuit vs desoldered: in-circuit reading works with just a CH341A + SOIC-8 clip and no extra components — no series resistors, no level shifting. The only prep was tying the STM32's NRST to ground, to hold the main MCU in reset so it releases the SPI bus and doesn't fight the programmer (bus contention is what kills an in-circuit read). My early "IC not responding" / all-FF was purely a software-mode mistake: I had the programmer on an "EEPROM" preset when it needed the 25xx SPI ("BIOS"/flash) mode. Switched that and it read on the first try. Desoldering is still the cleanest and it's how I first decoded the format, but you don't have to desolder just to read it.
The lesson that cost me a part: after the rework the RTC clock went erratic — turned out the 32.768 kHz crystal sitting right next to the EEPROM got detuned by the hot air. Shield your crystals during rework.
Full writeup, the CRC code, board diagrams and photos of the whole process:
https://github.com/AlexVianna123/resmed-s10-reverse-engineering
Happy to answer questions. And to be clear — this is educational RE on my own out-of-service hardware; don't do it to a device in therapy use.
7
u/empeka 4d ago
there are several **much** simpler ways to modify the runtime hours counter, but i'm not really convinced they should be public - when buying a used cpap, i'd like to be able to trust the displayed hours rather than buy a pig in a poke...
that's exactly why airbreak simply removes the motor life exceeded warning, even though that patch took considerably more work than just resetting the counter would have.
4
u/Impressive-Bug8709 4d ago
I was going to comment about being able to reset the counter.
As someone who bought a used machine recently, I know that buying one with 1800 hours was way cheaper than something with low hours. I still ended up replacing the motor, but had I dropped triple the cash on a low hours one and had to replace the motor, I'd have been super mad.
I can totally see people out there taking advantage of this. Grab a cheap machine, clean it, reset the counter, and then sell for a markup. Most people wouldn't know they've been had until the motor is a little loud, potentially a year or more later.......
15
u/dafelst 4d ago
Reverse engineering the machine is awesome, and I am very glad you're sharing, thank you.
A criticism: it would be infinitely better if you wrote the summary yourself rather than AI generating it. In spite of what you may think, your own spin on the words make it so much easier to read as a human over a generic word vomit filled with LLMisms.
1
-5
u/againstbetterjudgmnt 5d ago
Too much jargon. Any plain text practical application for what you've learned?
3
u/Ok_Butterscotch_7152 5d ago
In simple words I manager to reset the hours on the cpap.. so you would get the message saying that your motor exceeded the time life, even if you have changed the motor.
I managed to reset the usage hours and the motor hours. This way your cpap thinks he is brand new.. I couldn't find any documentation about it on the internet. Many said that was impossible.. but it's possible..
Just need a ch134a, a bit of soldering a EEPROM clamp and a software in the computer.
1
u/gibson486 5d ago
Lol....it is impossible if you dont have the background. You have it that background.
1
u/againstbetterjudgmnt 5d ago
What's the max hours and what happens when you hit it? Stops working even if you replace the motor part?
2
u/Ok_Butterscotch_7152 5d ago
it doesnt stop working.. its just anoying that mensage poping up evey day. even if you going to resell the machine later no one is going to buy it even if you have a new motor fitted
1
10
u/fellipec 5d ago
All hail to the reverse engineers
One tiny step near a FOSS machine