Posts Tagged ‘hack’

Ipod fm transmitter mod

March 22, 2014

Final product

I had an Ipod FM transmitter, tonight, and I wanted an android one.  I fixed it.  This is my method and the specifics for this model.  The main reason I couldn’t just buy one is because I have an otterbox defender on my phone which is great for protection but eliminate most docks.

The original state

This dock is the Belkin TuneBase FM model F87176 (mostly there to get indexed by search engines because when I searched for a hack for it I didn’t find anything).  Opening it up I find a whole pile of test points very well labeled, interesting things like RX_IRQ, C2CLK, C2D, LCD_D0, a bunch of voltages and a bunch of others (pics in the album).  I didn’t touch any of them.  I’m sure there’s something cool there, maybe the interface between the 8051 (not kidding) and the fm transmitter, maybe the screen’s display (almost certainly), maybe even something more interesting.  I can’t imagine what I would add to this with that data, so I just filed it away for later.  The first thing I did was pin out the ipod connector:

really bad picture

Luckily the connector was less blurry in person and pith the help of I worked out what all the pins did.  One of the things I noticed was that I couldn’t change the station when the ipod wasn’t plugged in which told me that the ipod was probably connecting a pin to ground (connecting the ground pins together is what it looks like from an analytical point of view) and I determined what one it was.  When I shorted those pins together I could trick the dock into letting me control it without an ipod attached.  The grounds get all connected, the 5 volt output that went to the ipod now goes to the android phone and the analog audio inputs go there too.  The challenge now is to make the android phone output audio on it’s usb connector.


The phone I have now is the Samsung Galaxy S4 (t-mobile)and it’s similar but not identical to the S3 and previous galaxy phones.  I found it here that the samsung phones set the mode with a resistor on the id pin (some of them do a massively more complex scheme, which is awesome but not relevant here).  The pin numbering is laid out here for left and right audio (It turns out that this dock outputs something on the order of two amps which is great for navigation).  The S4 specific data is… somewhere, but the main point was that car mode and desk mode got combined.  The final pinout had a 365k ohm resistor between ID and GND, I used a 5% 360k and it worked fine.

The test setup piped audio to my speakers and worked perfectly.  After that I soldered up the car dock to the adapter (power and all) and tested it in my car.  I can’t overpower the obnoxious station near me, but on empty bands it works ok.  It’s a bit more quiet than I would like but whatever.  After I cut the ipod connector off I widened the connector hole for the usb micro connector and glued it in place with the phone plugged it.  Once it wouldn’t move much I finished potting the connector.  Now I had a car adapter, but since usb micro connectors are the shittiest connector on the planet full stop I decided to bend a bit of sheet metal into a holder to prevent side stresses when I drive around corners.  Glued that on and now it’s done.  Very simple hack, but some people don’t have the experience to know how easy it is.  The documentation is a bit sparse, but I’ve got some keywords and sources so I think this can probably be accomplished by anyone.

LCD monitor repair (again)

January 19, 2014

OK, so this is one of those days that starts with big plans and gets derailed seemingly because those plans were so well thought out.  I come from a group of people that spend their days just repairing things because they’re there.  We have taken it in stride to develop techniques for repairing commonly thrown out items and apply our experience to new items as we get a hold of them, but we rarely document our work or share our knowledge beyond the confines of our lab.  This is the story of what happened when I tried to document what I figured would be a routine repair on a common model LCD monitor.

I never know what to put in this text

Our Patient

The monitor (as you can see) is a Dell 1907FPt 19″ widescreen LCD monitor.  The first thing I recommend when you have a device of any kind to repair is to look up that model (or series) and see if anyone else has encountered problems with it.  Hopefully you’ll run across a helpful blog post of someone who took the time to explain the steps they took to debug and fix theirs, so you can cut down on the time it takes to fix yours.  I, of course, didn’t do that.  I have no idea what the common failure modes of this monitor are and what the commonly accepted fixes are, so I blazed my own trail to some hilarious consequences.  Seriously, do as I say, not as I do.  For every blog entry of a moderately successful hack/repair I have there are a dozen failed ones that could usually be avoided by spending some more time researching and less time breaking things.  In the future I hope to post my failures with notes for future pioneers, but my successes are usually still around after the fact so photos are easier to take (since I almost never take them during the event, but months after).

Now, having opened more than my fair share of Dell monitors I thought I’d itemize just what steps are involved.  First you need to remove any visible screws, this usually just consists of the four phillips head bolts on the back (seen above).  Next you need to insert a spudger (yes that’s a technical term, look it up) into the gap between the monitor back and the bezel.  That separation into two pieces is the entirety of the plastic casing on this model.

seriously, adding content in secret? I already have a title and caption, what else can I possibly add to this image in this way?

step one

tabs exposed

keep going, almost there

and there you go, dis-assembled

Once you get the back off of this monitor you will inevitably hear a clatter as something falls to the floor and hides among the junk there until you figure out what exactly was missing so you know what to look for.  What you are looking for is a small plastic button and spring that retains the base to the monitor.  The button is a Dell thing, they have brackets on their stands that allow you to use your monitor with only that stand and not that of another Dell monitor.  These stands are “tool-less” which is slang for “our main consumer base can’t operate a screwdriver”.  The monitor itself has VESA standard mounting holes, but the stands are mostly useful for the monitors with which they came (although I may explore the hacking I have done on these stands in a later post).

The button and spring, free without the back

carefully remove this ribbon cable and the double-stick tape that holds it to the monitor casing

Now we need to just keep removing screws and remember where they came from.  You can usually ditch the shielding if you don’t care about potentially harmful interference as covered in FCC part 15.

remove one cover over the inverter wires

and the other

remove the inverter wires from one side

and the other, while you’re at it remove the screws that hold the monitor to the controller board housing on both sides

the panel without any controller, power supply, or inverter

now remove the screws that hold the heatsink to the casing

screws seen here (note they are flat, they mount flush with the panel

power supply board has had it’s screws removed

mains plug with screws removed

screws in question

Not pictured (I know, with all these pictures I forgot one) is the removal of the logic board’s retaining screws and the mounting hardware for the d-sub connectors (VGA and DVI, although DVI’s not a true d-sub).

controller board

Here is the controller board.  There were no bad caps on it, which is a shame since that would have been an easy fix (unless the problem caused a chip failure).  On the bottom are the ports exposed to the outside.  DVI, VGA, USB-b, and a dual stack USB-a.  This particular monitor has a four port usb hub built in (which I’ll go into later).  The port on the right side of the board is for a two-usb port daughter board for the hub (only passives if anything).  The ribbon port on the right is for the front panel controls (bonus points to those of you who remembered that ribbon from earlier).  It is noteworthy that different versions of Dell UltraSharp monitors use different pinouts for the cable with different numbers of features, but they all seem to use the same size cable and connector so they are interchangeable as far as that goes (buttons have different functions, or no function at all).  The port on the left is for power input (it could be pinned out, but I didn’t as they’re usually labeled).  The top port is the LVDS signals to the LCD panel.

close up on VGA and DVI port electronics.

So, the three chips here are two i2c EEPROMs and one chip that I assume is the receiver for the VGA signal.  The eight SOT-23 packaged devices to the left are probably FETs being driven by the differential signalling on the DVI port (the same as the monolithic analog receiver for the VGA port.  The EEPROMs are of note because they hold the EDID information for each port, they tell the computer that’s connected to the monitor what resolutions are supported.  The noteworthy fact is that these type of EEPROMs are massively useful as they’re easy to reprogram and use in things like PCI network cards, motherboard BIOS chips, and USB peripherals.  The chip with the little white sticker on it is probabbly the i2c EEPROM that holds the settings for the Genesis main controller, setting what the settings on the LVDS panel are.

This is interesting to me because you can now buy generic LVDS driver boards and inverters to make use of that surplus laptop LCD panel and I have this thought that I could re-purpose one of these drivers to be used on a different panel.  This phenomenon changes the standard answer to the question of “I can hook the composite signal of my n64 to this old laptop panel” from “No.” to “Maybe.”.

USB hub

So, this circuit is interesting, it’s a USB hub.  The USB hub is entirely separate from the controller that drives the LCD except for power.  I have in the past had good results tracing out the power for the circuit seen here and cutting power to the rest of the board to use it as a stand-alone hub.  The thing about powered and un-powered hubs is that in most of the hubs I’ve seen is that the 5 volt power is hooked directly to the input 5 volt line on the USB-b port.  The un-populated chip on the upper right side of the board is probably another one of those ubiquitous i2c EEPROMs that would hold the USB Vid:Pid pair (as seen in that older article on the logic analyzer).

Here is the problem, the backlight doesn’t work.  The symptoms are that when you power it on one of the coils fizzes and then the over-current protection kicks in and kills it.  Presumably the coil had shorted, so I did the inadvisable and replaced it with an inexact replacement coil.  That coil fizzed as well, so I figured there was a problem further upstream.  Probably a broken FET that’s passing too much voltage or something, but I never found that out.  My solution was… very hackish.  I replaced the inverter with a new one.  A new one salvaged from an HP film negative scanner lightbox.  I don’t have pictures of that, but the inverter is exactly the came as one out of one of those blue inverter boxes from the mid 00’s that drove the ever classy blue cold cathode tubes (you know, the ones that are really shitty quality and explode periodically).

crazy solution being tested

In this picture I have removed the coil (no more arc-ing (fizzing)) and powered the inverter from the 12 volt out put designed for the amplified speakers that are an optional extra for this and most model Dell monitors.  The problem is that the backlight still shut off after a few seconds.  Time for some more fast-and-loose hacking.

underside of working inverter

So, without tracing out the circuit here I can see a bunch of diodes and resistors tied to the high voltage section of the transformer.  The thing I can assume from here is that a network like that can be used to sense the voltage (through dividers) and waveform (through dividers or zeners) of the output of the step-up transformer.  This type of closed-loop control is advisable so you can shut down parts of the circuit without blowing anything up.  It is also the enemy of simple hacks like this.  Let’s look at the section I modified.

lobotomized is more like it...

“modified” board

So, of note here is that I removed pretty much everything.  The red stuff is glue used to hold the components down before they were soldered in (or maybe to take the mechanical stress off the solder).  This part of the board was gutted and I assumed I’d have to feed the signal from the other inverter to the sense circuit for this one.  I didn’t.  It just works.  Who would have figured.

I was debating putting that quote in this text, but I get few enough views as it is I can't afford to waste a joke

you’ve had some cowboys in here…

The final configuration, complete with plastic sheet for insulation and hot glue for adhesion.

It works!

That’s it.  That’s how a simple post on a “standard procedure” repair became a Frankenstein’s monster post.

“Computer” speakers

June 26, 2013

This is a very old one, maybe I’ll update with an approximate date later, but it has to be before 2006.  So, I’m a smart ass, and so are my friends, for the most part.  We had a pair of computers that were close to absolutely useless, some old HP pavilion compact towers.

 They were absolute crap, no good for anything, but for some reason we got the crazy idea to turn them into a set of speakers.  So we did just that.  First we stripped the cases of all the computer bits.  Then we stripped the cases of all plastic bits. Then we stripped the cases of all internal riveted-in metal bits.

We turned these into metal rectangular prisms.  Once we had the cases prepped we needed a donor amp and speakers.  The amp was sourced from an old pair of speakers that came with a Pentium 4 era eMachine desktop, the speakers were surplus paper cone car speakers.  No, we didn’t match the impedance, yes they were probably both 8 ohms.

Now we have speakers whose magnets can seriously affect CRT monitors and cases that fit them pretty well, now how do we put it all together? Duct Tape!

That’s black duct tape, this adventure pre-dates gorilla tape

Here they are assembled, they worked wonderfully until we gave them away to a friend.


The rest of the photos are here.


Replacement power supply build

June 20, 2013

I say build, it’s more a mod.  A long ,long time ago in a college town far away I helped a friend move into his frat house.  After I did this one of the housemates gave me an old monitor and power supply simply because he didn’t need it.  I gladly accepted it, but when I checked to make sure it was the right power adapter I noted it was a 12v 1a one, the display called for a 16v 3a one.  Now, I don’t know exactly the audience I have (yes I do, it’s web spiders) but I’ll tell you right now: there’s no way that will work.  I mentioned this at the time, but was assured that that was the adapter he always used for it (no it wasn’t).  My persistence at wanting this thing to work may seem misguided, but here’s the thing: this isn’t a computer monitor, it’s a TV.  Now I know what you’re thinking  that’s worse right? Right.  But in this case I don’t want better, I want more.  This TV (Phillips 20pf5120/28) has a cable tuner (useless), a composite input (expected), an s-video input (expected, but appreciated), a component input (cool! my first component input), and a dvi input (what?).  The DVI input can only do a resolution of 640×480 (and only digital), but it’s a 20″ 4×3 LCD TV, what more can you expect?  Let’s look at the specs for a new power adapter, shall we? 16v DC: that’s not too hard, if it were 12 or lower you could use a linear reg on a computer power supply to get that, but it’s not too bad.  3a: here we have a problem; that much current usually warrants the power supply to be inside the device it’s powering so those are a bit hard to come by, or at least they were.  I say that because we are now in the era of scrap laptops.  Yes, that’s right, laptop computers are being thrown out left and right for all manner of faults: broken screen, dead battery, won’t boot, broken power adapter (more on this later).  The thing about laptops is that they take a lot of power, sometimes upwards of 4.5a.  The problem now becomes the voltage.  Laptops generally run off of somewhere between 18.5v and 20v to charge their lithium ion batteries.  Let’s see what the junk drawer has to offer.

image taken post mod

We have a nice 19v 3.25a laptop power supply: perfect! Ok, there’s still that voltage problem; there are two ways to tackle this: a switching regulator, or a linear regulator. The switching regulator is a much more efficient design, but requires parts I did not have on hand.  The linear regulators could not pass enough current (1.5a max) but that’s ok, we’ll just put 2 of them in parallel to get that extra current through.

The design of the linear regulator circuit is simple, we use a fixed voltage linear regulator and a voltage divider made out of two specially chosen resistors to set the voltage to whatever we want.  For this one I just pulled out my phone and used electrodroid, but the calculation is simple to do if you want.  The heatsinks are mandatory since I’m running these regulators at the ragged edge of their tolerances.  There you go, a 16v 3a dc power supply that will give you second degree burns if you handle it wrong.

I swear I build these things better when they aren’t just going to be used by me

Billy mouth billy bass hacking

June 15, 2013

Well, here’s a classic: hacking the old Billy M0uth Billy Bass!  This is an absolute classic, it seems like everyone and their tin dog has done this one.  I picked this thing up at a garage sale, the only intention I ever had was to hack it (who really wants this thing wailing at them?).  Well, let’s get to it.

First things first, the mouth was broken… unacceptable! Let me tell you this thing is a pain to get open, the plaque is fine, but the fish itself… they must have heat sealed it on or something, it looks like a ship in a bottle, like it was assembled inside the skin.  To finally free the mechanics from the skin I put a slit down the back of the tail about 2 or 3 inches long.  Once I got it open it was obvious the plastic had just sheared, lacking patience for 3d printers I decided to just superglue it back together.

Once I got that glued together I shaved some plastic to get it to fit (I had glued it a bit too tight) and installed it.

stuck some paper to it with glue…

That pretty much fixed the mouth.  When it breaks again (and it will) I’ll model and print another couple brackets.  Now that that’s done, let’s examine the ASIC.  ASIC stands for Application Specific Integrated Circuit, that means someone designed a specific chip to do this exact job.  In very small runs these are usually FPGAs (Field Programmable Gate Arrays) because of the cost involved in creating an ASIC.  In small runs they are usually like this, what we in the biz call “epoxy blobs”, they just bonded the silicon wafer to the PCB then covered it with epoxy.  In larger runs they are made into standard package ICs.  Epoxy blobs cause such a headache for hackers because the only way you can identify what’s under there is by dissolving the epoxy around the silicon wafer and just looking at.  The more reasonable and down to earth way of identifying what’s in the chip is known as “black boxing” it.  That involves looking at what the chip does, how it reacts to inputs and when it gives certain outputs.  By using a bit of logic you can determine basically what a chip does (while it’s still in the circuit preferably) without needing to know exactly how it does it.

This is the ASIC in question, helpfully it’s on its own PCB mounted perpendicular to the main PCB.  My solution for figuring this one out was to mount the ASIC on 0.1″ headers and stick it on a breadboard, run a ribbon cable and another 0.1″ header and jumper all of them together.  After testing that it behaved the same, I started changing things.  First I verified where ground was (by tracing it out).  Once I had a reference I found (what I assume to be) a relatively stable/regulated 3.3v source.  The next thing was watching what the lines did when the various motors triggered.  That was the single longest time I listened to the built in audio… and I never will again.  The button and CDS cell each seemed to generate analog voltages on two of the pins… kinda.  I say analog voltages, but they’re probably supposed to be digital, but there’s some variance in them, so I use them as analog.  The audio line I left off since I have yet to try to implement this.  Two of the lines I haven’t figured out what they do, but they don’t seem to matter.

Before taking on a project like this I usually say to myself “which will be easier, strategically modifying existing circuitry to suit my needs, or ripping it out and putting in my own?  I usually come to the conclusion that I could certainly build my own controller with a digital input, analog imput, l298d for the motors, but all that work is done for me here.  There is even a nice sorta regulated voltage I can run off of.  In this specific case it was easier for me to ignore how the circuit works (because it’s a mess of resistors, caps, diodes, and bjts) and just try to emulate the ASIC than design a circuit to do this job.  The main reason was that I didn’t want to spend a motor driver IC on this project if I didn’t have to.

The next thing is the brain.  The microcontroller is a key decision, the part that pushed my decision on this one was the voltage, the circuit seemed to run on about 3.5v so that meant I could use an arduino, but only if it was running at 8Mhz (which I didn’t have set up) or I could use an msp430 from one of the launchpads I had kicking around.  I’m not familiar with programming for the msp430, but luckily there is a project to program the launchpads with wiring code (what the arduino uses): Energia.  Slapping the msp430 on it I quickly built this small sketch to showcase all the inputs and outputs.  My eventual plan with this is to get a serial link working so it’s just another peripheral you can interface to with whatever program you want (maybe an ROS module? but that’s an idea for a future project bleeding in).  All images can be found here.

Pocket TV upgrade

June 13, 2013

the victim

So, adding to my growing list of projects where I add features to things that should have had them from the start, I bring you: composite input on a pocket TV.  This particular TV (Casio TV-890) was made useless by the Digital broadcast television switchover, it has no jack to put in an auxiliary signal, and thus can’t be used at all.  So, since we all know the world runs on some sort of composite video signal (or can be made to) let’s crack this thing open and find us some signal paths.  Maybe we’ll check the pads coming off of the RF can first, maybe look up part numbers for a video chip, maybe…..oh, well that was anticlimactic

unpopulated jack

So, a similar model has a three conductor 3.5mm jack with spdt switch built in.  Presumably this is for video/audio and, yup, it is.  The next question is where am I going to find one of those jacks? how do you even source a part like this? Well, I just so happen to have one, no idea where it’s from but I have one close enough.

salvage part

Now, some of you may notice mine is a dpdt switch, yup, and I only have to re-locate one capacitor to make it fit.

moved a cap (always with the cat5…)

But, there’s another thing.  On the underside of the board there are two zero ohm resistors jumping the contacts that would normally be connected on the jack that isn’t present (for reliable operation they should be removed, otherwise you’re back feeding the RF stuff, or getting signal mixing).  What I mean by that is: these types of jacks sometimes have, say, 5 pins when you might think they only need 3.  Obviously you need audio, video, and ground (or left, right, and ground in the case of an audio application) but what are the other 2 pins for? They’re pass through audio lines.  Think back to a set of speakers that stops playing when you plug headphones in, that’s what’s going on.  When you don’t have headphones in, the audio gets routed through the pass through pins into the speakers, but the physical act of plugging in headphones breaks the connection and the audio is routed to your headphones.  This is used in the opposite way, in the sense that you are routing a signal into the TV, rather than out.  The use of a separate switch may be to cut power to the RF components so power isn’t wasted while they are not in use.

two tiny zero ohm resistors that are clearly jumpering pads meant for a jack

Well, what can I say? It’s not much of a hack. It works, or, it did.  I think I was slimming it down for use as a portable screen for something or other and I broke it, so there isn’t a picture of it working, but I swear it did.  Oh well, at least I got to tell people how to upgrade theirs.

entire album

Modded slug

June 12, 2013

This is in no way an original project, but I’m publishing it because I think some of the things I did were pretty neat.  A long long time ago Linksys released the nslu2, a network atatched storage device.  That’s cool, let’s open it up to see what it has inside.  TTL level serial port, cool, I put a header on it, and broke it out to the ftdi friend standard with a pigtail though a hole in the case.  Overclocking? yes please! just remove resistor R83, it’s that simple to double the clock speed.  now you’re cooking with gas at… 266Mhz. Ok, this is a bit of an old device.  What else do we have…. more USB ports? ok, I can break those out, but first what’s with this one port that doesn’t allow flash drives? it has no power line soldered to it… what? Ok, there’s a set of pads for a fuse like the other port has, but it’s not connected.  Maybe it’s to make sure their cheap power brick won’t crap out on them? No matter, solder a jumper and it’s done, add another 3 ports and they’re all broken out.  The thing is, I didn’t have 3 nice USB ports at the time, but I did have an old USB PCI bracket that’s normally used to break out motherboard USB ports.  No problem, just grab some pin header and a scrap of PCB (these pin headers tend to fall apart if not soldered to something sturdy.  Now I have a total of five powered USB ports.  Now, about that power adapter… This thing runs on 5v, and after tracing the power rails I find that it’s unregulated all the way out the USB ports, so I dig out a monster 5a 5v supply, graft on the right barrel jack and we’re in business.

new ports soldered in, pretty cleanly

Ok, now that we’re done with the hardware (all that I did anyway) let’s move on to the software.  I’ll admit that I had modded this thing, put it on a shelf and forgot about it for a while, the only thing I remember was insisting that I had to have the most capable linux install on it (a debian derivative) and it had to be a fully featured linux box (a configuration nightmare compared to what I finally used it for).  So I have a modded slug that I want to re-mod to have Unslung on it, a derivative of the stock firmware that allows those extra usb ports.  All the tutorials say to “use this utility and it’s easy”, bah, I have a serial terminal, no need to mess around with blind boots, and all this crap.  With my experience modding FONs and other embedded linux devices I’m actually more comfortable with redboot, a tftp server and raw commands.  Following the tutorial listed here I got it installed and booting in no time.  I can’t use it as a general purpose webcam server or network connected speaker system, or whatnot but it’ll make a good NAS.

big boy

There’s another interesting feature of the nslu2 has, a strange one, a USB device port.  Now, I can’t really say what I’d use it for, but it’s there and I haven’t done it yet (I may never).  There is a mod to auto power on the slug using a capacitor (The same hack can be done with a desktop, I think) but I haven’t done that mod, mostly because I have real servers… also does this thing not respond to WOL packets?  Now, looking at what people have done, using it as a network attatched power switch and stuff, they all seem to use usb connected devices to trip FETs or relays… what about the activity LEDs? can you not manually control them like on the WRT54g or the FON?  Some pretty fantastic things have been done with these devices, as a EE I tend towards the really cool hardware, like using the I2C bus to talk to low level devices directly, adding more RAM and flash, and the fact that there is a second RX and CTS only serial port in there somewhere.  Check out the wiki, it has so much covered on this neat little gadget.



pretty comprehensive wiki

fantastic pictures

Upgrading the tl866cs, or: misadventures with PICs

June 12, 2013

So, as the story usually goes: I bought the crippled cheaper version and dropped way too much time upgrading it. This time it’s the tl866cs EEPROM programmer. but this thing is much more than that, it does reading and writing of EEPROMs, sure, but it also does avr, pic, 8051, PLDs, all sorts of stuff. The part that sold it for me was that… well, what do you think this programmer is? it’s a micro with IO expanders (or at least buffers), and digitally configurable voltage regulators. so, crap-tons of IO, definable power and ground pins… this thing can test piles of logic chips! all you have to do is apply input signals, take output signals, check against a known good and report faults. So it also tests 7400, 4000, and even ram chips. So this thing is an absolute godsend, it has tons of chips in the database, hex editor built in, configurable pretty much anything.

Now, on to the differences in the versions. I bought the tl866cs variant which has the 40pin zif socket, but no ICSP connector. Don’t get me wrong, it has the cutout, has all needed passives, just needs the header. The full version is the tl866a, what I wanted to upgrade to. Now, as far as I can tell this is an original Chinese design: I don’t know of another programmer in a similar form factor, they have their own GUI (unlike the Saleae I modded the other day). They are understandably hesitant to release any schematics, firmware, or even what chip is driving the entire thing.

Let’s start with the chip. They have scraped the part number off of the package (rotary tool of some kind) and apparently thought this was enough. I won’t even go into the brute force method which starts with the USB Vid is licensed to microchip if I’m not mistaken and they have this wonderful thing these days where you can sort by package to get all possible PICs in that package, then trace power, ground, ICSP, and crystal and you have the family, if not the exact chip (oops, I guess I got into it). The really hard way involves acid and building a complete picture of all it’s specs based on the silicon die, but we’ll save that for military ASICs (You can’t hide from us!). The easy way is to ask around other people who bought it (they are probably electrical engineers/hobbyists, who else buys no-name Chinese stuff like this) and find someone who can read the slightly less worn away chip they got in theirs. Now we have the one unknown part we can proceed to reverse engineer a schematic pretty easily. I know it’s time consuming, but luckily we can outsource that job to people on the internet with more free time than us.

bottom featuring shaved IC and it’s ICSP header… facepalm

Just a side note on the construction: this board is designed fairly well, I only have a few gripes. It seems fairly obvious that these PCBs are machine assembled and the final product is hand assembled. They use standard 0.1″ pin headers to connect the boards and solder wires to hold them in place. My main gripe is not the wires, they’re redundant grounds, my gripe is those darn LEDs, they are on long leads that go all the way through the boards and solder in the bottom. You’re already putting in all those pin headers, you can’t put in 4 more pins!?

modular pin headers… thank god

Ok, now that we have the hardware, let’s move on to the software. This is where I got hung up, bored, and let someone else do it. We’ll start with my attempt. First thoughts: different USB Pid for each model (so very wrong). we’ll skip my pawing at the minipro files looking for plaintext and move right on to the fact that someone actually discovered that there is a bootloader that takes firmware updates, the firmwares are encrypted, and the bootloader checks them on boot to see if they match. They also decrypted them, reverse engineered the bootloader, created an application to generate bootloader and whole firmware unencrypted hex files with user settable IDs…. duuuuuude, so much work, such nice documentation.

my original serial and dev codes

Now, looking into the future, there is also talk about creating custom chip libraries and chip testing/programming algorithms…. I envision a utopia future where there is a crowdsourced effort adding chips to the library, maybe even designing better hardware (using digital pots to get finer power control than 8 distinct voltages). but I digress…

boost converters on the left

OK, now I have a firmware image to write to the PIC, all I need to do is whip out the pickit3. Oh, I don’t have one. pickit2? Nope, hmm, I have something for PICs around here… AH! here, a microchip mplab ICD 2. Ok, no problem install mplab, and visual studio? I don’t care, whatever, just install it. OK, now how do I set it up? uh, ok, select programmer, blah, blah, error… huh? Well the programmer failed the self test, but nothing’s plugged in to it and it says it passed the test in the settings menu. Uh, we’ll just ignore that. now connect it, import the hex, set the config bits from the hex, aaaaand crap. it can’t recognize the PIC. I don’t know why, the voltages are all fine, it says it’s supported, please work? No, ok, well screw you too mplab. how about some 3rd party pic programming tools. None support this hockey puck of doom. Ok, fine, just use the easy serial programmer. It’s only like five components and I’m in a well stocked lab and… want WHAT now?! an 8.2v zener? no I don’t stock those. hmmm, how does this even work… OH GOD, uh, we’ll just forget how they’re doing that voltage regulation… and floating grounds… ok, here’s a more sane one, still needs a 12v zener, that’s ok, I actually have those. Get it all breadboarded up and find out that my 3rd party client supports the PIC18f87j50… with only one of the many compatible programmers he listed. Fine, what else? ok, here, a parallel port programmer, it doesn’t get any more simple. so I need a 74<cough><cough>05, yeah, I’ve got one somewhere, I’m sure it’ll work just fine. Oh, hmmm, it says I need a Vpp of no more than 3.6v, and I think I need logic levels to match. fine, I’ll just lower the voltage on this buffer chip…. crap. it doesn’t go low enough. This is the point where I considered breaking out the textbooks to build level shifters out of BJTs to get the right voltages (I would have already built a pickit2 clone as they can be programmed with the serial thing, if I had the right model PIC for the brain). I just know these chips will work out of spec, what is it Scotty said? “A good engineer is always a wee bit conservative… at least on paper”. Ok, let’s do it. Doesn’t detect programmer… crap. well, it’s breadboarded up, I’ll just… oh… that’s how it checks for this simple programmer, it uses a free input pin to sense the inverse of one of it’s own signals and twiddles it to be sure that, yes, it really is seeing it’s own tail wag. and the pin fell out. Ok, back in, click button, YAY! the programmer is recognized. ok, connect the PIC… one of the pins isn’t used… the one with the bjt… nope, I don’t care anymore, leave it off, keep on trucking. Dump the chip. well, it’s not throwing an error, and it seems to have autodetected the PIC. (yes, hooking up a programmer is exactly all it takes to bypass the ‘scratching off the number’ routine since they LEFT AN ICSP HEADER FOR THE MAIN PROCESSOR OPEN AND PINNED OUT RIGHT). Ok, well, it read something, mostly blank, must be the DRM flag set. Now write the-WARNING CONFIG BITS NOT SET IN THE HEX-. Yeah, they are. No seriously, I open up mplab and import the hex and they’re right there. <sigh> check flag… set flag… check flag… set flag… ok, all are finally set, let’s program. Programming, cool. Errors with verifying, not cool. Well, dump it again, see if it still hasn’t been programmed. No, there’s something different there, quick see if it matches the code I tried to write! huh, slightly different formatting, whatever, where’s the USB cable, plug it in, aaaaaaaand……… SUCCESS!!!!! it is now a TL866A! ok, box it up, now where did I put that AVR ICSP header adapter I made like a month ago…. and it works, no support for the atmega1280 or 2560, but it’ll come, maybe, eventually. this took…. 6 hours, maybe 7? whatever, now I have a decent PIC progammer, never need to do that again.

the setup that finally worked

no, it’s not cracked in half, but it does have 5 or 6 pins repaired with solid core wires.


EEVblog thread with all the wonderful info (starts on page 5 or 6)

programmer I used

software I used

rest of the pictures

Saleae Logic clone build

June 11, 2013

So, I wanted a logic analyzer, and I wanted it cheap.  After hearing about the Saleae Logic I was excited, after all what is a logic analyzer but a pile of IO and some nice software.  The thing is, the rate at which you may want to take samples can be much greater than the transfer speed of, say, USB 2.0.  The cool thing about the Saleae Logic, USBEE, Braintechnology USB-LPS, and presumably others is that they use the Cypress FX2 chip.  The main benefit of this chip is that it has an enormous 4 Kilobyte FIFO buffer attached to ports B and D.  That means it can take a huge number of samples really fast.  That chip is really weird, well, it’s the first I’ve heard of having to push firmware to a chip upon plugging it into a computer.  This means that any software that wants to use a peripheral based on this chip can simply push fresh code on boot to the processor, allowing firmware upgrades to be as easy as software upgrades for the client software.  This also means that any software is free to push it’s code to any peripheral and try to use it.  This could be problematic if you end up trying to output into a one-way buffer chip or anything else since the associated hardware could differ wildly from devices utilizing this chip.  The way around this is to have an I2C EEPROM that has the usb Vid:Pid on it, allowing authentication of peripherals to the software.  This method can pragmatically be used for protection, or used for DRM (I think you see where this is going).

overview with crappy cable

There is an open source logic analyzer project known as sigrok that has a client for many different logic analyzers, and a sub-project fx2lafw which is a firmware for FX2 based logic analyzers.  They have a wealth of information about various logic analyzers, especially the FX2 variants.  Some of the stuff I found most interesting was the details on which eeprom and buffer each device uses. Since I am planning on using this chip as a logic analyzer, and as such will be connecting it to foreign/unknown hardware I think an input buffer is pretty important.  I went with the ST DVIULC6-4SC6 because that’s what the Saleae used, it’s fantastically simple, it’s just a diode array used to tie any over voltages to the power rails, so you just tap it right on to your data lines, not through.  The benefit of these is that they’re designed for ESD and can respond even with signals switching at up to 1.65Gb/s.  Now the other thing the sigrok site has for input protection is series resistor values.  Clamping diodes protect from voltage, but series resistors protect from current.  While they don’t actually list the resistor values, they have detailed pictures with which you can actually read the smd markings… except the Saleae uses packages without markings <sigh> whatever, I used 4.7k 603 package ones between 2 pads on a standard perf board.

close up of my hackery

My original plan was to break out all 16 pins of the FIFO (prots B and D) so that I could have a 16 channel logic analyzer, but ST only samples one of each part and only had 2 variants of the ESD chip, so… I’ll do that later if I really want it.  Now I just needed to figure out the EEPROM problem.  I bought the Lcsoft CY7C68013A Mini Board off of ebay for ~$15 it comes with an EEPROM on it and a jumper to set the address of the chip, the problem is the chinese company used an EEPROM with 16bit memory addressing and put it at the address where the Saleae looks for an EEPROM, except the FX2 needs an EEPROM with 8bit addressing at that address, and the Saleae won’t look at the address where the FX2 will allow a 16bit addressed EEPROM.  Basically, while they tried to create a knock off, they failed.  I know they tried to create a knock off because I dumped the 24c128 they had on the board, it had the right USB Vid:Pid on it for the Saleae.  Well, it’s fantastically easy to find EEPROMs of the required interface as they are used all the time as the DDC chip in any VESA compatible display (VGA, DVI, or HDMI ports each have one) to communicate to the computer what resolutions a monitor is capable of.  There is a way to use the Cypress tools to reprogram the EEPROM if you don’t have any other tools to do it, but I just used my tl866cs, fantastic programmer (trying to upgrade it to a tl866a).  I salvaged a few from the logic board of a long dead and smashed LCD, wrote them with the required bytes and voila! we have a Saleae Logic.  but that’s not enough, oh no, I need to make this better than retail.  How about making it also a USBEE ZX? well, kinda.  I have yet to figure out what pins on the FX2 map to the Trigger and Clock on the USBEE ZX.  Also, I have some sources that say the USBEE ZX is not as picky about the EEPROM type as the Saleae is.  And I needed to solder a jumper from the board to the protoboard since 5v isn’t broken out on the headers (for the GND, 3.3v, 5v header).  So, I grabbed another EEPROM, burned in some new Vid:Pid bytes and hey! it works too!

yeah, I soldered a wire, boo hoo

Fabrication took place in my signature style: using whatever I had lying around and not bothering to etch a board.  Don’t get me wrong, I can etch a board in a few hours with the tools at hand, I just didn’t feel like it.  “But they’re surface mount chips” I hear you cry.  “But I don’t care” I respond.  Some people invest in rework stations and reflow ovens, all I need is a really, really fine tip on my iron.  Not for this project though, a regular fat tip will do just fine.  “How can you solder those chips down? the pin pitch isn’t right”.  Ok, fine, scrape off 2 circles of copper and straddle it with the EEPROMs tack the corners and the 2 center pins on each side aren’t soldered to the board.  “But you have 2 EEPROMs…”.  Do I even have to say this one? Stack them, wire all pins in parallel except the SDA line, switch that one with the jumper.  “Ok, fine, but the SOT23-6 don’t stradle like that, ha!” Ok, fine, shave off half a pad, straddle the middle pin over that space.  “Hey, you should get some 30 gauge kynar wire for that, works great”.  I’d love some… oh, you’re not offering? well then, scrap 40pin IDE cable it is.  Some fantastically cheap 0.1″ female headers from ebay (not breakaway, but at these prices I can sacrifice a pin every time I want to shorten them), scrap male headers from an old motherboard, and a jumper from a dead IDE CD drive, and a bit of nearly new protoboard, now I’ve got a logic analyzer.


8 channel logic analyzer + ground pin

jumper to select which EEPROM

in line resistor protection

diode clamp protection

GND, 3.3v, 5v header (on the USBEE)

power button

Things I missed/messed up:

USBEE trigger and clock pins

ground pin should be on other side (to match Saleae)?

PORT D (remaining 8 pins for use with sigrok)


’C0-A9-08-05-00-84-23-00′. this is the VID:08A9 and PID:0005 for the USBee ZX device. ‘C0-25-09-81-38-1B-00-00’. This is the VID:0925 and PID:3881 for the Saleae device.

PORT B[0:7] => Saleae[purple:black] (I think that’s the correct order)


list of FX2 devices in sigrok

my board

what I’m trying to emulate

the other one I’m trying to emulate

original inspiration (gave me the EEPROM info in the comments)

gave me the Vid:Pid

lots of useful info, just not essential to my project

how to write the EEPROM if you don’t have any other way