featured on irq5 test

Cloud-Enabling a Bathroom Scale

Thu, 25 Sep 2014 01:04:00 +0000

Last week as I was making my rounds at the supermarket, I came across this digital bathroom scale on sale. With some membership card, the discount was almost 50% and at S$16, I thought that was a pretty good deal. It is “wireless” in that it has a separate display unit that could be detached from the scale itself. This bathroom scale had “HACK ME” written all over it.

It turns out that this bathroom scale is the EB9121 made by a Chinese (OEM?) company called Zhongshan Camry Electronic Co. Ltd (or simply Camry). The box specifically mentions that it uses infrared for transmission, and given that I had some experience looking at IR signals, I thought it would be rather straightforward.

The Cost of Fixing an Old iPod

Thu, 03 Jul 2014 01:43:00 +0000

My decade-old 4th generation iPod decided to blue screen on me, literally.

I love old stuff and I’m rather attached to this very first Apple product that I purchased 10 years ago. So I decided to turn to iFixit, the well-known DIY repair store for Apple products, for a replacement LCD screen.

Exploring HDMI CEC

Sun, 27 Oct 2013 03:38:00 +0000

Consumer Electronics Control (CEC) allows control of AV devices that are connected via HDMI. This is the feature of HDMI that enables your TV to automatically turn on and switch to the correct input when you switch on your set-top box, for example. It also allows you to control your set-top box using the TV remote (in some cases).

Electrically, the CEC bus is a single-wire bus that is shared between all HDMI devices, thus any CEC message can be received by all connected devices. Each device then claims one or more logical addresses on which it will receive direct CEC commands.

One interesting feature in the HDMI CEC specifications is Remote Control Pass Through, which allows button presses on the remote control to be passed through to HDMI-connected devices. I thought this feature could be used to unify the various remotes in my living room.

However, not all CEC devices are created equal. As usual, some manufacturers will deviate from the specifications, and/or introduce some quirks in their implementation (as you will see later). They also love to brand CEC with their own funky name, such as SimpLink or Anynet+.

Raspberry Pi as a CEC Bridge

As a quick and dirty way to check out the capabilities of my TV, I used a Raspberry Pi which has a HDMI connection that can be software-controlled. This also meant that I didn’t have to build my own CEC transceiver circuit.

Decoding BCARD Conference Badges

Sat, 13 Apr 2013 01:28:00 +0000

Last month, I had the opportunity to fly halfway around the world to attend RSA Conference 2013. Everyone was given a lanyard and badge which contains your information entered during registration. When you visit booths, they can then scan your badge to collect your information and follow up by sending you spam.

The scanner varies across different booths, but mostly it’s an Android device that ran a custom software. Since it had a large NXP logo, let’s try to read it with the NFC TagInfo app. Looks like the tag identifies itself as a NDEF message but the data is gibberish.

Hacking Functionality into ASUSWRT Routers

Mon, 10 Dec 2012 00:10:00 +0000

This weekend, I spent some time to replace my aged Linksys WRT54G wireless router, which is running DD-WRT. The WRT54G is slow by today’s wireless standards and since I sync my iOS devices wirelessly, the speed was getting quite unbearable. When I bought my Macbook Pro in 2007, it already has draft 802.11n support and fast-forward to 2012, my iPad (1st generation) and iPhone 5 both support the 5GHz band.

The ASUS RT-N56U wireless router ranks up there on wireless performance, and the “feature” I was really after was a router that can run an alternative firmware such as Tomato or DD-WRT. The really good news is, I figured out how to get the functionality I wanted while still using the official ASUS firmware.

For proper reviews and better photos, you might want to check out these other reviews:

SmallNetBuilder: ASUS RT-N56U Black Diamond Dual-Band Gigabit Wireless-N Router Reviewed
FoxNetwork: ASUS RT-N56U or hardware NAT acceleration
(I quite like their professionally taken product photos and their reverse-engineering work)

Read on to find my short review, as well as how you can run your own programs on the router without using a third-party firmware.

The Apple 30-pin Dock Connector

Mon, 25 Jun 2012 23:45:00 +0000

The 30-pin dock connector first appeared on the iPod 3G in 2003, and has been on all iPods, iPhones and iPads ever since, with the sole exception of the first generation iPod Shuffle. The first gen Shuffle looks like a thumbdrive (or what some would call a pen drive) and used a USB male connector, whereas the first and second generation iPods had a FireWire port at the top.

iPod Accessory Protocol

Since its introduction, Apple made several minor modifications to the electronics interface of the dock connector, but the physical connector itself remains unchanged. Collectively, this and the communications protocol is called the iPod Accessory Protocol (iAP).

Initially, they introduced different resistor values on the “accessory detect” pin when they allowed third-party companies to make docks and car adapters. At that time, the dock connector mainly had audio in and line out functionality (connected to the back of the docks), as well as a serial interface for remote control via the dock. The serial protocol was largely reverse-engineered by maushammer (website no longer accessible) and this guy here (I think he’s called Christoph but it’s not on that page). This was also used by car manufacturers to allow iPod playback control from buttons on the steering wheel.

When Apple released the iPod Video that was capable of playing videos in 2005, they added video out (composite and S-video), as well as an authentication chip to allow only authorized docks and cables to receive video out (including audio). Soon enough, China caught up with their release of “authorized” accessories, which contain the authentication chip that can be re-purposed for other use.

authentication chip Authentication chip (image from thice.nl)

Presumably, that was also when they added USB support for iAP, which I’m pretty sure also requires an authentication chip. USB support would allow a host to communicate and control the iPod through a USB cable. My car stereo correctly recognizes the iPhone as an iPod over a USB cable.

The iPod Camera Connector was also introduced for the iPod Photo and iPod Video in 2005. This was a small “dongle” that has a dock connector on one end and a USB port on the other. Oddly, according to an Everymac article, later iPods released in 2006 do not support this accessory any more. It is unknown if they somehow switched the USB interface to host mode, or if they used a separate chip to emulate this.

In 2008, charging via FireWire was no longer supported with the introduction of the 2nd generation iPod Touch and 4th generation iPod Nano. The pins dedicated to FireWire in the dock connector are now unused.

mdns-repeater: mDNS across subnets

Sun, 02 Jan 2011 03:51:00 +0000

Update 21-Sep-2011: Added an Installation section and updated the binaries on Bitbucket.

As you may know, I have a couple of Apple devices. Apple is fond of using Multicast DNS (mDNS) for their service discovery. The recent addition to these services being AirPrint (wireless printing service) and AirPlay (wireless audio/video streaming) from your iOS devices.

My home is setup in such a way that the wired and wireless networks are on 2 separate subnets. mDNS uses a multicast address that is “administratively scoped”, meaning the packets will not travel across subnets. I tried fiddling around with iptables rules and looked around for how I can route these packets across the subnets, but to no avail.

There is another solution - a repeater daemon that sits on the router and repeats packets between the 2 subnets. Avahi is used to provide mDNS services and it has a reflector mode that does exactly this. A more lightweight solution was TiVoBridge, which supposedly performs the same task but it’s much smaller. I tried to compile and set up TiVoBridge, but it required a config file and I couldn’t really get it to work the way I wanted it to. There’s an even lighter-weight solution called SAY, but it uses libpcap.

Enter mdns-repeater - a small Linux daemon that does exactly what I want it to do. I have a Linksys WRT54G which runs dd-wrt. This program was intended to be compiled for and installed on the Linksys router. As with all other programs that run on the router, it requires no configuration.

The default dd-wrt configuration has 2 interfaces - vlan1 for the WAN interface and br0 for the wireless interface (and 4-port switch). The program accepts the arguments vlan1 and br0 and begins repeating packets from vlan1 to br0 and vice-versa. I can now get my iOS devices to detect wired servers like a print server for AirPrint.

mdns-repeater is released under GPLv2. Feel free to change it to repeat whatever protocol you want. Patches to add functionality and bug fixes are welcome. You can contact me via bitbucket.org, or if you clone the repository my email is in the commits.

Programming the ATtiny10

Thu, 15 Jul 2010 22:03:00 +0000

Recently I wanted to use a really tiny, low pin-count microcontroller for a project, so I decided to buy a few Atmel ATtiny10 to experiment with.

To get it working, I would need a compiler and a programmer. I like working with Atmel chips because they have cross-platform development tools. The Arduino IDE that I’ve been using comes with avr-gcc and avrdude, both of which are really awesome open source tools for compiling and uploading code to the microcontrollers. If you just want the tools without the Arduino IDE, you can get the WinAVR package.

However both of these tools do not work with the ATtiny10 yet. I do not expect a C compiler, but even the GNU assembler that comes with avr-gcc still doesn’t support this chip. avrdude recently added support for uploading to the ATtiny10, but only through the STK or AVRISP programmer, which I didn’t want to fork out money to buy.