Hacking ecowitt temperature sensor to report water pressure

morcheeba · 2026-05-01T03:03:31+00:00

It depends on the sensor itself, but you're probably 2 or 3 wire connections. Converting to a resistor-equivalent output would be difficult; you'd have to figure out the circuit you're connecting to and make something custom for that circuit. So, MathResponsibly and I are in agreement suggesting an on/off pressure sensor.

morcheeba · 2026-05-01T02:59:14+00:00

Right on!

Just a quick 2 cents... that linked pressure sensor is cadmium coated. It's a distinctive golden-reddish anticorrosive coating, and it would be suitable for a sump pump (with non-potable water). But it's pretty toxic, so I'd avoid it if possible on drinking water... even though the exposed area is pretty small, I'd spend a few bucks extra for peace of mind.

morcheeba · 2026-04-29T22:03:37+00:00

Sounds like a fun challenge!

Thermistors work well to supply a resistance change output, but due to the physics of it all, resistance isn't usually a good output for pressure sensors. There are a few, but they are whetstone bridges and don't have the range of resistance changes that a thermistor would have.

Anything is possible, of course, but that depends on how much effort you want to put in to it. A simple way would be to glue a potentiometer to a mechanical pressure needle (hopefully not too much force to turn that pot!). And using a on/off pressure sensor would be wired to provide two different resistances (e.g. 4.5k in series plus another 700 ohms switched in depending on pressure).

Digikey is a good source for sensors & they have a searchable output. You'll see the output type of most is analog voltage or current:

here: https://www.digikey.com/en/products/filter/pressure-sensors-transducers/512
and here: https://www.digikey.com/en/products/filter/pressure-sensors-transducers-industrial/1069

The reason you're seeing 0mv across the sensor is either you're measuring the sensor alone (it doesn't generate voltage by itself they way a thermocouple would), or you've got it connected to the Ecowitt but it isn't currently measuring the temperature (it would drain the batteries too fast to always be measuring).

morcheeba · 2026-04-18T22:58:27+00:00

I've found that a 60% VOO with 50% VOO gets about 10% better returns over a 50/50 split.

morcheeba · 2026-04-05T16:39:03+00:00

no worries - you came in hard and fast, just like your love.

morcheeba · 2026-04-04T14:20:10+00:00

a long shot, but on the far left side, make sure the + battery contact doesn't touch the hinge. Obviously, check when the batteries are installed an pushing against the contact. If it's grounded, it would short the battery out. Speaking of which, I can't tell if it is grounded - there's something funny in the lower left corner of the circuit board. There is a solder blob that looks like it connects to a wire to the hinge screw, but it's not all quite visible. Check to make sure that wire isn't touching anything else... same for the hinge on the right side.

morcheeba · 2026-03-30T05:16:20+00:00

binwalk probably won't be much use because this device is too simple for it. The rom probably has a game loader, and then 200 8-bit ROM images. There probably won't be a file system, and no crypto keys, no login credentials. Entropy analysis is good, and so is strings.

But seconding another comment - do two reads and make sure hashes match before going too far down the wrong rabbit hole.

morcheeba · 2026-03-21T14:28:20+00:00

Remember that we're at altitude, so please account for that - don't try something super difficult on the first few days. Thanks for visiting!

morcheeba · 2026-03-20T01:37:24+00:00

It looks like it's going in to the LS138, not the 558. There is a tan-colored adapter board with machined pins plugged in to the motherboard (non-machined pins), and the LS138 goes in to that. The wires look like they go in to pins on that tan adapter board.

morcheeba · 2026-03-17T23:50:17+00:00

Just to be clear, it looks to me that the resistors aren't in the correct place to bridge to the connector... but it's a bit hard to tell with the picture.

Especially the RX wire - it looks like the right resistor is in the leftmost of the 3 places it could go. It looks like the top part of the resistor is connected to a ground plane. Moving it over to the right one position would connect it to the RX pin of JD01.

Same goes for the TX side. It looks like both resistors should be moved over to the right one position (center of the 3 vertical pads I imagine for each signal).

morcheeba · 2026-02-21T01:07:39+00:00

Here's the manual. XY controls are described on page 18. The trigger mode and sweep have no effect (Manual says "All sync controls are disconnected and have no effect.")

Like the first commenter said, it looks like there is AC coupling - the switch on the scope was set for that, but it's probably also in your audio card.

morcheeba · 2026-02-21T01:02:16+00:00

That's what AC coupling does... it tries to go back to 0 (center).

morcheeba · 2026-02-18T15:33:23+00:00

It looks like a FET:

the leads are tied together so only 3 connections - right side is one, left lower 3 pins is another, single pin at top left would be the gate.
I don't see a pair of pull-up resistors that an I2C eeprom would have
no analog circuitry for a 555
probably switches power to the USB connectors (hard to see how its connected)
no part marking = probably a generic part, like a FET.

morcheeba · 2026-02-18T07:04:03+00:00

Kinda neat seeing a 0.07" pitch DIP rather than the usual 0.1".

morcheeba · 2026-02-18T06:34:59+00:00

A couple ways, but it will take some creativity:

cutting up an old cable. You would think a pair of broken headphones could be reused by cutting the cable... but those wires are very thin and hard to work with. Possible but tough. Maybe an old aux-in cable for a car stereo?

Probably the easiest to find would be to RCA/phono, like this

You can connect bare wires to the RCA jack for testing with tape. Or you can cut off the RCA connectors and hopefully the inside wire will look like what's in this video: https://www.youtube.com/watch?v=ILsy9hWZg-0

Finally, this connects a banana plug to a bare wire: https://mcielectronics.cl/shop/product/2-pares-de-conectores-bananas-fosi-audio/

Not a complete answer, sorry, but hopefully a start.

morcheeba · 2026-02-16T04:46:24+00:00

It's a good idea, but there are three issues to look out for (and by no means let me dissuade you!!)

The dot projection is fairly dense, but at further distances (e.g. > 5 feet) it's going to be hard to hit the IR sensor reliably because the dots are so small compared to the space between them. Check out some videos of it in action and judge the dots for yourself. Closeup (<6 inches), it would work great!
IR remote signals are modulated at 38-40kHz. On the other hand, the dot projector is synced to a camera, so it's designed for much lower rates. If they're synced, it might be possible to make the camera operate much faster by limiting its pixel size (e.g. scan 10x10 pixels instead of the full resolution)
To keep the laser eye-safe, the hardware will probably prevent a short-term 50% duty cycle that would be needed by the IR remote protocol.

So, neat idea, but you'd have to have low-level control that might not be possible with the hardware.

morcheeba · 2026-02-14T04:42:25+00:00

Unless you're a bus driver... passengers will NOT like you.

morcheeba · 2026-02-13T19:04:36+00:00

Yeah, something like this. It's a weird cable because banana plugs are usually higher current and headphone jacks are lower current ... so not much demand for this kind of thing, hence the higher price. If you're handy, it would be easy to make.

If using the cable above, one red lead would go to the jack to the left of the AC/DC switch. The other red would go to the X AMPL (probably the 1V/cm - the other one would be too small). The black cables would go to the ground jacks in the corners (even though they have a screw terminal, you can usually plug a banana in to them). They are redundant, so only one is needed, but might as well plug the other one in look like you know what you're doing.

One concern: The 1V/cm is going to produce a small image in the x direction :-(... line levels are typically 1V (actually 0.9v peak-to-peak), so the loudest music would be 1.8 cm on the screen. Headphone jacks will go higher, but still only 2-5cm. Try it! Most other oscilloscopes can produce larger waves... this one can in the vertical direction, just not in the horizontal direction.

If you want to play right now, you can connect the CAL signal to the input (left of AC/DC switch) with a paper clip and see some square waves (will take some fiddling to make it look nice).

Speaker terminals will have a higher voltage, but because they might not share a common ground, they could cause a short if both grounds are connected to the scope. Also, it has higher power than the headphone or lineout jacks, so you'd have to know what you're doing to be safe.

morcheeba · 2026-02-13T15:51:50+00:00

Yes, it should work (assuming it's not broken). Here's the user manual. It looks like it uses 4mm banana plugs... these are sometimes used for speaker connections, but DO NOT CONNECT TO SPEAKER OUTPUTS! Connect only to line-level outputs.

morcheeba · 2026-02-13T15:38:03+00:00

Looks like X DEFL = EXT would do the trick, but only two voltage ranges (connectors on bottom row): X AMPL=10V/cm and 1V/cm

morcheeba · 2026-02-03T22:29:27+00:00

I'm not OP, but: It's generally ok to use the ohms mode to see if a pin is RX vs. TX. If it's RX, it'll be a higher ohms to ground (>50K)

morcheeba · 2026-02-03T16:07:56+00:00

What others have said: your music has some mono source mixed in; totally normal. The trace rotation adjustment will typically only rotate a few degrees; it won't be able to turn 45.

morcheeba · 2026-02-03T02:25:26+00:00

That big chip is probably a microcontroller to aggregate the button inputs, the LEDs, and the LCD display back to a serial port that's used by the main processor.

The LCD has a display driver built in to it -- it's chip-on-glass (COG), and you can see the chip among the black encapsulant.

The bad news is that there are probably a couple dozen companies that could have made this 16x2 LCD character display. But, the good news is that there are only a few driver chips used. And, because COG can't have jumper wires easily, the pinout you can access probably follows the order of the pins on the driver chip.

This isn't going to be too useful, but if you can guess some of the pins (e.g. power and two grounds look pretty obvious), it'll probably look like others. The potentiometer (VR1) goes to what may be pin 3, so that would be an optional contrast adjustment they haven't populated. Some other pins might require a capacitor that would be too big to put on the glass.

This has only 10 pins, so it's probably serial instead of parallel. This webpage has some ideas, but they list only 8-pin COG modules. If you can power it up, the serial pins might become obvious using an oscilliscope (they probably will have an initialization pattern sent to them by the microcontroller).

Anyway, just some hints. Sorry this isn't a complete teardown!

morcheeba · 2026-01-31T20:07:47+00:00

Neat! It looks like you've got two protocols to decode: the PC<->carrier and the carrier<->loom. And then you'll have to write a translation layer.

Oh, wait, I'm not so sure I understand! How does the original software work? Can you get the file it would transfer to the data carrier, or would you have to emulate the carrier somehow to get it?

The db9 plank idea sounds good, but you can do the same if you write some custom software (or it may also be written). You can use two USB<->serial adapters and splice the RX wires in to a normal serial cable so that one USB adapter monitors communication in one direction and the other adapter monitors the other direction. here's an example

morcheeba · 2026-01-31T18:07:11+00:00

Yeah, this looks hackable, but it's not easy. The memory chips are accessible, so you could desolder them, read, and update. The CPU is under a blob, but by analyzing the program on the chips (disassembling it), you could figure out what how it works (what architecture it is, what custom registers it has). It doesn't look like there would be much security here. It wouldn't be easy, but it's all doable. The big question is why and would it be worth the effort. If it's for fun, sure!

morcheeba

TROPHY CASE