A closer look at the hardware.

Opening the toothbrush

Thanks to iFixIt we got it open fairly quickly. The bottom cap has the following information

Bottom cap of Philips Toothbrush

The FCC ID is 2ADZNHX68 and tell us that it’s using 13.56 Mhz, so NFC. Based on Cyrill’s information, that’s used for saving the toothbrush run time.

The whole disassembly looks like this.

Philips Sonicare gutted and displayed

SOC

The best shot of the SOC I found is here

Microscope closeup of the main chip

The chip is a Cypress CY8C4146AZI-S433, now acquired by Infineon. The product page gives us some fun details

Parametrics CY8C4146AZI-S433
Flash 64 kByte
SRAM 8 kByte
Frequency max 48 MHz

The datasheet is available on the product page and has more details.

Pads

While there’s an absurd amount of pads exposed – and all of them very very nicely labeled – the big 8 stand out as obviously useful.

Photo of the 8 flash pads 
┌─────────┬─────────┬─────────┬─────────┐
│         │         │         │         │
│  SPDAT  │   Rx    │   VDD   │   Vpp   │
│         │         │         │         │
├─────────┼─────────┼─────────┼─────────┤
│         │         │         │         │
│  SPCLK  │   Tx    │  SGND   │   GND   │
│         │         │         │         │
└─────────┴─────────┴─────────┴─────────┘

SPDAT and SPCLK hint at SWD debug lines, Rx and Tx as UART and then voltage and ground.

Note from the future: Aaron had the same pads on his Sonicare 3100 and was able to dump the flash.