No related posts.

Explorer 16 Development Board

• Hack1 – Use the built is ICSP connector on the board itself, instead of running around for a RJ11 – ICSP cable. Its been there since the earlier revisions of the board. One thing to remember though is that the slickscreen numbers on the connector are reversed. Pin1 is Pin6. All you need is a 6 pin header.
• Hack2 – Program the chip without using an ICSP programmer. Use the “forgotten” onboard programmer. [R]afal Waniurski managed to come up with a firmware for the programming micro( a PIC18F4550 ). All you need is an external programmer to initially program the chip and your ready to program your main controller. [P]hil details the type of USB connectors required for this operation.
• Hack3 – Power your development board through the USB port rather than the power jack. All you need is two Schottky diodes. Not that connecting to USB port allows for a maximum of 200ma draw. If you are connecting additional PICTail boards( like the graphics board), you may need to use the dc power jack.

  No related posts.

  ]]> http://www.machinegrid.com/2010/06/microchip-explorer-16-development-kit-hacks/feed/ 0 http://www.machinegrid.com/2009/03/digital-picture-frame-hacking-roundup/ http://www.machinegrid.com/2009/03/digital-picture-frame-hacking-roundup/#comments Sun, 08 Mar 2009 07:29:57 +0000 bluehash http://www.machinegrid.com/?p=787 With all the nice hacks on digital picture frames scattered around the web, I decided to put them all in one place for reference. Due thanks to all the hackers out there who put their work out for everyone to see. It’s the joy in reverse engineering. For some of the hacks I’ve included a compressed file with the code and webpage archived in case the original site goes down. If you are the author an would not like it, please let me know.
  
Please read : If you would like to be notified of new frames being hacked, leave a comment below and check the “subscribe to comments” box.
  

  PHILIPS Picture Frames
  [v]incent was able to display his images directly to the frame by writing a little script which prepends a binary header to the JPEG file. There is a detailed writeup on how he reverse engineered the picture frame format.

  Detailed info:

  • Models: 7FF1AW, 7FFICMI
  • Webpage[Archive]
  • jpg2frame Script

  

  SAMSUNG SPF-83v Frames
  The frame parses feeds and regular html pages for images and displays them. You can use the frame’s i-net-functions to serve it data.
  [t]obe from Infolexikon uses PHP to gather data and writes it all to an image using gd. These images are then pushed to the frame at regular intervals.

  Detailed info:

  • Webpage
  • Script-[Original][Archive] Thanks for the update [d]p
  • Buy – Amazon – Samsung SPF-87H 8-Inch Touch of Color Digital Photo Frame

  

  CEIVA Picture Frames
  The CEIVA runs on a Cirrus Logic Maverick(EP7212) controller. It’s based on a ARM720T core with 2Mb Flash and 4Mb DRAM.
  Initial hack done by [c]olin. The frame runs on Linux. Necessary patches and images are provided. [b]rad keeps a worklog here
  New code can be loaded via a serial port on the PCB through a simple level converter.
  



  Detailed info:

  • Models : Not Specified
  • Webpage
  • Webpage and Code [Archive]

  

  KeyChain Displays
  [j]eroen from Spritesmods maintains a wiki of compatible keychain displays with his firmware hack. He and a couple of guys regularly update it with new displays. Most of the displays use the SITRONIX ST2205U controller in them. I tried my hand in doing the same with the Hannah Montana Vu-Me photo frame. I got close, but bricked it in the end.
  Their code is maintained at Google code

  Detailed info:

  • Models:
  • TomTec
  • Coby DP-151SX/DPKEY
  • HK unbranded
  • Keypix
  • Dealxtreme SKU5218
  • Innovage
  • Dig-291
  • Innovalley
  • Webpage
  • Wiki
  • Google code

  

  DIGITAL SPECTRUM MemoryFrame
  The MemoryFrames run on WindowsCE5. [r]etoor from mozy.org managed to crash the frame using a keyboard, mouse and following a sequence. The frame runs on an ARM920T – a 32bit Arm9 processor. The following is an excerpt from his “YouTube’s more info…” link:
  …”Basically you need both the mouse and keyboard plugged in, scroll down past the “Settings” option, scroll back up, and click the word “Settings” with your mouse. There is no enter key on the keyboard so you have to click the mouse….”
  

  Detailed info:

  • YouTube
  • Buy – Amazon

  

  JUICEBOX Digital Frames
  [j]oevennix managed to rip out the LCD from a Juicebox and enclose it in his own custom frame. He didn’t have the mp3 kit at that time( although you can get it online), so he soldered a SD card slot into the cartridge connector. His webpage is down. The following is an archive of his work.

  Detailed info:

  • Archive
  • Pdf

  

  If you find this interesting or have some new ideas or links on frames, please post in the comments. Don’t forget to Subscribe [email]for more followups and hacks. To get updates on this page, subscribe to the comments below.

  
  

  No related posts.

  ]]> http://www.machinegrid.com/2009/03/digital-picture-frame-hacking-roundup/feed/ 25 http://www.machinegrid.com/2009/02/hacking-the-hannah-montana-photocube/ http://www.machinegrid.com/2009/02/hacking-the-hannah-montana-photocube/#comments Tue, 10 Feb 2009 14:11:52 +0000 bluehash http://www.machinegrid.com/?p=628 Things with LCDs are very interesting. I found a Hannah Montana Digital Photocube on sale and decided to look what’s inside it. Good for a day of hacking :)

  First a description:

  • Storage capacity: 8 M bit (Up to 70 photos) Resolution: 128×128 dpi
  • Display: 1.5-inch color LCD
  • Supported File Format: JPG (JPEG),BMP, GIF, PNG, & TIF
  • Power: 2 xAAA batteries (not included)
  • USB Ports: Mini-USB 1.1 interface

  Searching around the net produced a lot of work done by Sprite. He and a couple of guys maintain a wiki containg information about hacked lcd keychains. Most of the keychains that have been hacked contain a ST2205U Microcontroller. With this information I proceeded ripping apart my photocube. This was what was inside:

  

  A 1Mb A29L800( datasheet ) flash chip and a micrcontroller hidden behind a big black blob along with the LCD, buttons, USB port and an on-off switch. With some reading on Sprite’s blog and modifyng his script a little, I was able to verify that the microcontroller was indeed a ST2205U. If you browse through main.c, a function is_photoframe checks if the controller is a ST2205U. So I inserted a printf(“Response : %s\n”,buff) to verify if the chip gave back the correct string, which it did.

  /*
Checks if the device is a photo frame by reading the first 512 bytes and
comparing against the known string that's there
*/
int is_photoframe(int f) {
int y,res;
char id[]="SITRONIX CORP.";
char *buff;
buff=malloc_aligned(0x200);
lseek(f,0x0,SEEK_SET);
y=read(f,buff,0x200);
buff[15]=0;
printf("Response : %s\n",buff);
// fprintf(stderr,"ID=%s\n",buff);
res=strcmp(buff,id)==0?1:0;
free_aligned(buff,0x200);
return res;
}

  I’ll try documenting my steps going further. It’s in Linux( RedHat ) since I work on it, and you could do the same using a linux live cd.

  1. Unpack Sprite’s hack from here. You will need to install libgd if you don’t have it. As root install gd-devel. Please read the README file in the unpacked directory. It’s written for a reason.

  yum install gd-devel

  2. Then as a user type “make” in the unpacked directory. This will compile the hack to give you the “phack” binary.
  

  3. Now connect the photocube and turn it on. You will see “USB Connect” displayed on the screen. Open a terminal on your linux machine and type

  dmesg | tail

  This will give you any hardware information that occurred last. You will see the following:
  

  If you see something like:

  4096 512-byte hdwr sectors (2 MB)

  then your close. Also note where your cube is mounted so you can access it. If you look at the pic above it says “Attached scsi removable disk sdg”, which means that the cube is mounted at /dev/sdg

  4. Now to hack the firmware.
  WARNING : Anything you do after this is at your own risk.

  Type the following as root in your terminal, using the mount point which you got from step 3.

  ./hackfw.sh /dev/sdg

  You will see the following as checks are made and eventually an error:
  

  Sprite’s script makes a backup of the firmware and an image of the memory. It however says that “The hack won’t work for my Firmware.” When I looked into the script, it looks if my cube’s firmware is same as Sprite’s when he hacked his keychain, which is an entirely different product.

  dd if=fwimage.bin bs=256 skip=58 count=2 of=fwbit 2>/dev/null
#check for all FFs Md5sum may not be _the_ tool for that, but it works OK.
if ! md5sum fwbit | grep -q de03fe65a6765caa8c91343acc62cffc; then
echo "No room at the location we want to place the hack!"
echo "This specific hack won't work for this particular firmware, I'm sorry."
exit 1;
fi

  I did not have anything to loose, so I commented it out to bypass the check. Just put a “#” to comment out code.

  5. I ran the script again (run as root), this time it went through the whole flashing process, till I rebooted

  

  6. The script ends with “No Photoframe found here”. Turn off, Disconnect, Turn On and the Connect the photoframe. Get the mount point as in step 3. Type the following as root.
  

  You should see the following on the LCD
  

  The script allows a maximum of 10 characters. Another example
  

  
  

  I was however unsuccessful in getting PNGs or JPEGs uploaded to the device. That’s when I bricked my cube trying different memory addresses. It doesn’t even turn on now. I’ll update when I get my hands on another one. If you have any questions or comments, you could enter them below. Thanks for reading and don’t forget to Subscribe for more followups and hacks.

  No related posts.

  ]]> http://www.machinegrid.com/2009/02/hacking-the-hannah-montana-photocube/feed/ 10 http://www.machinegrid.com/2009/02/taking-apart-the-spy-video-atv-360/ http://www.machinegrid.com/2009/02/taking-apart-the-spy-video-atv-360/#comments Mon, 02 Feb 2009 04:45:17 +0000 bluehash http://www.machinegrid.com/?p=477 I finally took apart the Spy Video which I got for a very good deal. I wanted to see if it would serve as a good platform for a robot and if the drive system could be upgraded. The most difficult part was taking apart the wheel hubs. The interesting part in the hubs design is that a better motor can be attached to it. The following sequence shows me taking the vehicle apart. Might come in handy for hardware hackers out there.

  1. Various views of the vehicle.
  
  

  2. Remove all the screws from the bottom of the vehicle, including the tracks.
  

  3.Remove the top shell slowly. Don’t pull on it. You will need to disconnect the camera, antenna and mic headers to get it free.
  

  4. Once the top shell is free, the circuit board and the drive system is visible. There is a bank of FETs for the motors. The board is very well labeled.
  

  5. To take apart the drive system, loosen the screws around the orange box. Then unscrew the black tab keeping the wires from the orange box secure.
  

  6.Taking apart the wheel hub is a chore, but possible with pliers, a small glass jar, some flame and some strength.First, remove the stopper from the shaft. Use pliers and strength:
  

  Remove the large gear and everything between the gear and the stopper. Now again using pliers, remove the torque check gear:
  

  Remove all the stuff after that including the orange cap with the three screws. Once the orange cap is removed, the black cover on the other end of the wheel can be removed:
  

  Now for the interesting part. The wheel hub is dead set into the shaft and we need to remove it. Make sure you have a small jar, like below, ready. Choose one such that it’s mouth is small enough only for the shaft to go in. Ignore the gears on the shaft in the picture. You should be having just a blank shaft with the black hub and orange cap on.
  

  Make sure you have the orange cap on. Now heat the shaft with a flame for around 30 seconds. This is just to soften the hub’s hold on the shaft. Holding it over the flame too long is going to melt the plastic.
  

  Now while the shaft is still hot, place the shaft as shown below and hammer the other end down.
  

  The shaft should come out after a few bangs. The wheel is now disassembled:
  

  7. Why all this? I can now use a hub adapter and attach the ATV’s stock hub to a better motor.
  The following hub adapter is from Lynxmotion. I will need to drill new holes to match the adapter.
  

  If you are interested, check out your local Target store or you could try Amazon:
  

  Thanks for looking. Any questions, ask in the comments.

  No related posts.

  ]]> http://www.machinegrid.com/2009/02/taking-apart-the-spy-video-atv-360/feed/ 4