Feed on
Posts
Comments

About a month ago I was working on fixing a bug when writing 1Mbit flash saves back to a GBA cart when I decided to plug in a “24 in 1” Flash cart to see if it had flash memory as the save option (it doesn’t, it has 512Kbit SRAM) but when I saved the SRAM and then re-read the header something strange happened, the game title changed to another game. I tried it a few more times and could replicate it fine, turns out there was another bug, I was switching banks (512K to 1M) even for SRAM carts too. This is just a quick post about my findings.

After some quick investigation of what was happening when switching banks on the Flash cart, I narrowed it down to the 0x2AAA, 0x55 command which could be run by itself to switch the game title. I started testing bits on that address and byte, I found that if you gave it a wrong address or byte, it could potentially lock up and only give you the same game title over and over again or the game title could have a random character or two.

I found that at address 2, you could write the high bits of the byte and it would switch banks, like 0x10, 0x20, but it didn’t change all the time. Later on I played around with writing any number to it and it would change on even numbers. Address 0 and 1 didn’t seem to do anything. See a bigger list here of addresses / game titles here: Address-to-game-titles

(more…)

Read Full Post »

Today we’ll be taking a look at the Netcomm NB1300 Rev2 ADSL Ethernet Modem which is an 10/100 Ethernet & USB ADSL modem, quite an old one back from 2003 and a bit dusty too.

 

Two screws later and we’re in.

Looks like the layout is pretty relaxed, lots of space left over. We’ve got a fair few electrolytic capacitors which are all branded Teapo, we have a single chip solution and interestingly there’s a VCXO. Date code is 35th week of 2003.

(more…)

Read Full Post »

With the LiPo battery fires I hear from time to time, I thought it might be a good idea to build a temperature monitor when charging LiPo batteries. Ideally you would put a little case over the battery with the temperature sensor inside (a low cost thermistor would do) and then if the temperature rises by approximately 15C from when you switch it on then it should alarm you.

Whether the batteries get noticeably hot when they are about to pop is something I will need to test one day (I’m sure they would to some degree) but if they do pop, I have heard that pieces can potentially go everywhere so it’s best to contain the batteries when charging.

(sneak peak)

I decided to go with an ATtiny24A which would have enough pins for 6 thermistors, a buzzer, a shift register to control the LEDs and it will be powered by a LiFe 14500 battery.

Once the battery is inserted, it should read all thermistors to check if they are connected, get the base line temperature and then begin to monitor the connected thermistors. If no thermistors are connected at the start, any thermistor that was connected becomes disconnected or the temperature rises by about 15C, it should indicate which one it was and turn the buzzer on.

(more…)

Read Full Post »

A quick one today, we’ll be looking at the Huawei E220 HSDPA USB Modem which is a USB modem, kind of similar to the Telstra one shown a few weeks ago except it only supports 3G (and not NextG) networks with no external antenna support.

A few plastic clips and 1 screw later and we’re in.

This time we did have some RF shields around all of the important chips. We seem to have a large 22mF (22000uF) 4.5V supercapacitor, I think this one is the largest I’ve seen on any PCB, this board must have some serious current spikes. There’s a Samsung logo on the PCB so I’m guessing they designed this board. There are a few little RF chips about.

(more…)

Read Full Post »

You might already know that it’s possible to backup your Gameboy camera’s memory to a save file and extract the images / convert them to BMP using a program called GBCameraDump. I had a request from a user asking if there was a way to automate this whole process. There are products which I didn’t know about such as the BitBoy which saves the images to SD card without a PC which is very handy if you use the GB camera very frequently as it can only store 30 images.

I took a look into this request as automating it could make it be as simple as plug in GBxCart RW with the GB camera, run a single file and it’ll do the rest. First thing was to take a look at the source of GBCameraDump, the author mentioned that GBCameraPic.cpp was the important file to look at. I was hoping at first that there might be an way to easily convert this GUI program into a command line program so I could call it after dumping the save game.

It looks like the images in the save file start at 0x2000 and are in multiples of 0x1000. The source didn’t look too complicated however it appears that they are using the Bitmap library (TBitmap) which seems to be included in the compiler they used Borland Cbuilder5 (found by opening the .obj file).

I was starting to take a look at this all and my options, I started thinking that it’s just a BMP file, surely I could just figure it out without a library right? So I started to play around with the BMP files that GBCameraDump created and the GB camera save files too, changing one bit here, noticing what changed, changing another bit there, etc, here’s my findings – (more…)

Read Full Post »

From the last part, we looked at the client/server interaction, server communication with the ESP8266, used an EEPROM to keep an event log/sensor names and added a RTC. Today we’ll add a simpple admin page to set things like the RTC, sensor names/types, email addresses for which we’ll also have the ESP8266 send us email alerts plus have a look at a PIR interference issue, various other small improvements/fixes and a quick look at PCBs and 3D printed case; a lot to cover!

The PCBs arrived a few days after I posted the last part so I built them up and tested them, it all seemed to work apart from the door sensor, 2 traces were touching each other (my mistake) so I just cut the track and re-wired it.

The Zippy 700mAh LiFe battery I was originally planning to go with went out of stock so I went looking for other LiFe options, turns out there is a 600mAh 14500 size which just fits a AA battery holder. If I had of re-done the PCB I could have made it a bit bigger to fit the AA holder on the back. Pricing wise, it costs a bit more ($10 for 2) but for the form factor that it offers I think I’ll stick with it.

For the 3D printed case, I made something as small as possible that would fit the PCB, PIR sensor and a slot for the antenna that pokes out. I ended up putting the LiFe battery on the back of the PCB anyway with a cutout that fits it. If you look at it front on, it doesn’t look too bad, but from the side, it does look a bit bulky but it’ll do. The LED is on the bottom left of the PCB, kind of hard to see with the case on; you could use transparent material but I didn’t have any, so I made a little hole and inserted a plastic light pipe which does the trick. Later on I think I’ll paint the cases.

(more…)

Read Full Post »

Just a quick one today, we’ll be looking at the Card Star Thermodrucker thermal printer, a low cost parallel thermal printer, I wonder how old the design is as it has a parallel port. I picked it up on Ebay about 2 years ago now to use for address labels when mailing out items. There seems to be low cost USB thermal printers for not that much more.

With the printer I got a parallel to USB cable and an overseas AC adapter rated for 9V AC at 300mA, I’ve been wanting to change the adapter for something else, so we’ll have a quick look at doing that too.

A few clips later and we’re in. We can see the thermal print head and motor sit above the PCB, held in place by 2 screws/risers, the print head connects via a flat flex cable and the motor just through some wires. There are some decent sized capacitors, Richey 1000uF 25V and Richon 1000uF 6.3V and we have zener diodes on some of the parallel port data lines. The PCB date code is 03/97!

(more…)

Read Full Post »

From the last part, we looked at how to use the Atmel ATSHA204A device for random numbers / HMAC with a private key so that the client could verify what the server sends and vice versa. Today we’ll test the client/server interaction, have the server talk to the ESP8266, add an EEPROM to keep an event log/sensor names, RTC plus I’ll briefly touch on FHSS for the Si4432.

For the client, we can stick with the ATtiny84 (or ATtiny841 which I have a few spare) and for the server I’ve gone with an ATmega168, both the client and server have an ATSHA204A device with the same private key as each other. In terms of security, it’s not the best if physical access is obtained, a client could be taken away and still have access to the system and act as a server, the best thing to do in that case would be to re-key the private key.

Client side

After combining the ATSHA and Si4432 code, we can have a look at the client check in. We run the random number command function for which I’ve added the option of using _delay_ms or the watchdog timer for low power consumption. We do the usual clearing of FIFOs and interrupts, set the request type as check in and send the random number to the server.

Strangely enough if you clear the interrupts before you load the packet and turn the transmit mode on, the Si4432 will set the interrupt low straight away so it will seem like an interrupt occurred before the packet was even sent. Turns out you have to set it right after you turn the transmit mode on and it works fine. Edit: This is because we need to reset Register 06h. Interrupt Enable 2 to 0, default is 0x03 (Enable Chip Ready and Enable POR)

I’m now using Si4432 interrupts when receiving or sending a packet which allows the ATtiny to sleep during that time and wake up on a pin change however we don’t want to keep the Si4432 listening for too long. After some trial and error I found that using the watchdog to sleep for 128ms + 32ms + 16ms gives us just the right delay for the server to generate the HMAC and for us go into receive mode when its close to sending us the HMAC. I measured that it takes about 9ms after the packet is loaded for the packet to be sent (i.e enpksent is 1).

(more…)

Read Full Post »

Today we’ll be looking at the BenQ 21.5″ E2200HD LCD Monitor which features a 1080p display, HDMI / DVI / VGA inputs, speakers and a headphone jack. This one stopped working one day, I’ve had it for 8 years so decided to take it apart to see what was wrong.


(forgot to take some pictures of it before I took it apart, so here’s a stock image)

After a couple of tough clips and removal of the stand, we’re in. There was a metal cage holding the power and logic boards but it was just stuck on with some shielded tape, no screws whatsoever which was odd. Powering it up by the power button, I can see the power LED turn on for a fraction of a second, does this 2-3 times before it no longer lights the LED.

(more…)

Read Full Post »

From the last part, we looked at using the Si4432 module for communication between the sensors and server with the ESP8266 Wifi module as our web server. Today we’ll look at the Atmel CryptoAuthentication ATSHA204A device which will let us use truly random numbers and use the HMAC function with a private key (stored securely on the device) which means no hashing libraries will be required for the ATtiny.

The way I intend to use the device is for it to return a 32 byte random number which we can change 1 byte of so the server and client can communicate with that 1 byte, feed it into the device which will generate a HMAC from that random number and a private key.

There are plenty of other use cases described in this Atmel PDFs:
Atmel-8794-CryptoAuth-ATSHA204-Product-Uses-Application-Note
Atmel Crypto Products REAL.EASY Training Manual 2Q2015 r6

I’m using the I2C version which should be quicker to access and easier to use than the the 1 wire version, should save us a little bit of battery life too. Before we hook it up to the ATtiny, we need to test it so we’ll be using the Arduino, there are one wire library examples out there but none for the I2C version. Atmel also has some libraries available for the CryptoAuthentication product suite however there was a lot of functions and jumping around so the only code I used from that library was the CRC function.

The device contains 3 zones:
– 16 data slots where you can load a 256bit key to each slot
– Configuration zone includes allows you to set how the data slot keys can be used, whether the keys can be read/written, a counter to provided limited use of the data slot keys, the unique serial number and programmable I2C address to name a few.
– One time programmable (OTP) zone contains 64 bytes that can be used as read only memory.

The configuration zone and data slots/OTP can be locked to block any writes to them, this is useful if you don’t want keys re-programmed and disallow how each data slot can be used. In order to write to the data slots, the configuration zone needs to be locked.

(more…)

Read Full Post »

« Newer Posts - Older Posts »