Reading Data from an Unwilling Blood Pressure Monitor

Wait 5 sec.

Given the modern trend of interconnecting anything and everything, we have no doubt that somebody sells a blood pressure monitor that will push its measurements out to all sorts of cloud services on your behalf. We’re equally sure that doing so requires you to sign up for some new account or service, and that there may even be a subscription cost hiding in there as well.Looking to record his vitals on his own terms, [Tomasz Burzy] set out to modify a basic blood pressure monitor so that it would send its data out over WiFi. He succeeds in the end, but as is so often the case around these parts, the journey ended up being just as interesting as the final destination.Optically detecting which LCD segments are activated.His initial idea was to tap into the monitor’s PCB with his logic analyzer. He quickly found a test point that let him pull the raw value from the unit’s pressure sensor, and with a little massaging, he even got some code running that turned that into a fair estimation of his actual blood pressure. But it didn’t quite match what the display showed, and doing some research, he found that these monitors generally employ some unknowable Secret Sauce to derive the final result from the raw data.Efforts to intercept the final number from the device’s main chip before it was sent off to the display driver were stymied by the fact that it was the display driver. The unit was so well integrated, presumably to drive down the cost, that there was a single IC handling essentially all aspects of its operation. So much for the logic analyzer route.In the end, [Tomasz] took the nuclear option and used a camera mounted to the top of the unit to pull data off the display optically. But instead of a full-fat computer running some computer vision software, he’s able to pull it off on an ESP32-CAM module. How? Because he knows exactly where each segment of the LCD is, he simply needs to check a set array of coordinates in the camera’s image to see if they are lit up or not. This greatly reduces the complexity of the task, and brings it within the capabilities of the lowly microcontroller.Although we love the idea of developing hacker-friendly medical devices that give up their data without having to jump through so many hoops, we appreciate the effort [Tomasz] put into this, and think it’s a fantastic example for similar reverse engineering efforts.