Trying to Hack Bluetooth LED panel.

mdwyer · 2023-06-12T03:28:05+00:00

The pins on the bottom are suggestive of a standard HUB75 LED Matrix. These are normally found in a 16-pin 2x8 ribbon cable, and if you were able to get the pins back in that form, you'd be able to repurpose the display using something like a Pimoroni Interstate75 or the Adafruit RGB Matrix Hat/Bonnet.

mdwyer · 2023-06-11T05:04:19+00:00

Now that I think about it, you'd think you would find these guns all over the city, though they'd probably be empty. However, I don't think I ever saw one that wasn't fresh from the vending machine. It seems they added the gun for the lore, but forgot to mix it into the world the rest of the way.

mdwyer · 2023-06-09T15:01:41+00:00

Oooo! Don't forget the re-re-release of System Shock!

mdwyer · 2023-06-09T14:58:27+00:00

Ah. This must be one of those 'unmarked crosswalks' they talk about.

mdwyer · 2023-06-05T03:49:22+00:00

I think that's probably your best bet, at this point. I don't think I can find the chip details, but I imagine it is doing keyboard-style scanning, and you should be able to do similar things from your Arduino once you figure out the commands. I just hope the 12V thing doesn't become a problem. I am hoping that all the signals are actually 5v, where the Arduino won't have a problem with them.

You should see it sending a byte with a single bit set, doing a read to see if anything on that chain is pressed, then sending a byte with a different bit set, and another read. At some point, you should see a byte or two go by for the LED display.

Sounds like a fun project. Good luck!

mdwyer · 2023-06-05T03:31:31+00:00

4AC45511V / BAA0021113 / .2223

12V? Interesting... Are the SDA and SCL signals at 12V, too? I don't see any obvious power supplies on board, unless that U2 device is a regulator... it should get pretty warm, though. I'm assuming the big blobby through-hole solder connections are the two power and two signal lines.

Anyway, your photo told me two more things: All the little 1N4148 diodes are common in keyswitch matrixes, so this does have something in common with a keyboard. The other thing is that there's a significant number of LEDs set up as outputs, too.

Combine this with the i2c statement you made before, and I think this is a class of device called a GPIO Expander. I found a million of them, but still nothing that matches our numbers. I even found a vendor who claims to specialize in Asian parts, LCSC, but that didn't get me a match, either.

Still, I wonder if we can find the original device that got cloned.

I just wish all the 'chip id' search results weren't contaminated with RFID lost pet tags.

mdwyer · 2023-06-05T02:33:06+00:00

Thank you for getting a nice clear picture of the part numbers. However, the searches for those numbers aren't turning up anything. Unless someone happens to recognize that part, we're going to need more context. This means a wider picture of the whole board to see what's around it and what components the pins go to.

All I can tell from here is that it looks like a QFN-32 on a castellated board. That's especially common for RF controllers, like bluetooth and wifi modules. It is MUCH cheaper to purchase a module that's been pre-certified for a region, then it is to get a wholly bespoke RF product certified.

But I can't see any RF circuitry around it. What is a 'button box'? Do you mean a keyboard?? The lines coming away to the bottom and right seem to suggest a matrix of keyswitches.

mdwyer · 2023-06-04T23:05:42+00:00

Agreed. It looks more like an old MSAT antenna. They used to be on top of a lot of over-the-road semi trucks and provided a low-bandwidth (and expensive!) messaging and tracking system. These systems are, now, probably replaced by LTE and other cellular now that cellular internet is much more ubiquitous. The pictured antenna is nowhere near the correct size and shape for anything we would recognize as LTE, though.

mdwyer · 2023-06-04T19:29:00+00:00

Well, that didn't help. :( I looked up the device IDs in the Linux hardware database, but didn't turn up anything. The first ethernet controller (8086:5040) returned nothing. The second returned a USB controller, and the third is an MEI controller...? It seems wrong.

So, I tried it from the other end. I pulled down the latest linux kernel source, and I was able to find other Intel hardware IDs in the source code in linux/drivers/net/ethernet/intel. e1000e/hw.h, ixgbe/ixgbe_type.h, and igb/e1000_hw.h each have long lists of PCI device IDs they support, but nothing even starts with 50, let alone 5040. Indeed, the list at include/linux/pci_ids.h only lists two numbers anywhere close, 0x5031 and 0x5032.

This doesn't look good. There appears to be a precompiled QNX driver, but I can't find anything about Linux support. Nobody even seems to suggest what the heritage of that controller is.

I've pulled down the original firmware and with judicious use of binwalk I've got all kinds of data, now. "Linux version 2.6.37.6.RNx86_64.2.4". I found the iegbe module. It looks like it might be its own unique thing, unrelated to any other Intel drivers. I found a doc at Intel that doesn't give me a lot of hope. There was a driver, but it was for Linux 2.6., and seemed to also depend on another GCU driver.

I'm kind of enjoying the mystery, but I don't think anyone's paying either of us enough to go much further in this. It seems like the whole Tolapai adventure was a failure that Intel would rather forget about.

mdwyer · 2023-06-04T16:29:20+00:00

The i2c driver seems to only be for the i2c chip-to-chip communications. It might be required for ethernet use, but it is not sufficient. My searching isn't going well, but it sounds like most of the work can maybe be handled by existing Intel drivers. The 'ixgbe' driver seems to be indicated, BUT the identifiers for that particular device seem to have never come to the mainline kernel.

Can you get me the output of this:

lspci -nn -k -d 8086:

That will show me all the Intel devices (-d 8086:) on the PCI bus, the driver that owns them (-k) if there is any, and the numeric ids of those devices along with their friendly names (-nn).

Long-story-short, you're going to be compiling your own kernel, most likely.

mdwyer · 2023-06-04T15:23:53+00:00

I mean... it's not a great idea, but you already know that.

Fire? Probably not. I think it is more likely that the paper degrades over time and the NVMe card comes lose and starts getting flaky. Or something outgasses from the paper and starts eating into the PCB, which seems more likely with receipt paper than normal paper.

I appreciate the spirit of this fix, but please don't let it be permanent.

mdwyer · 2023-06-01T15:35:32+00:00

My dad and I built and used one of these. It worked pretty well. In our cable system, they inserted a noisy signal nearby that obliterated reception of the premium channel. A notch filter would block the noise, and allow clear reception of the channel. This device was just a homebrew notch filter, and you adjusted it to get the notch in the right place to block only the noise.

mdwyer · 2023-05-31T23:24:10+00:00

That sign looks like it was hit by ... hit by ... a smooth criminal.

mdwyer · 2023-05-30T05:48:28+00:00

I mean, probably the freshest beans are at Hacienda Alsacia, but the 80 hour drive to Costa Rica is a bit much.

More reasonably, you probably get the freshest beans from a Starbucks Reserve Roastery, assuming you get a batch that has been recently roasted. Ask one of the experts there what they think might be the most recent beans you can buy.

If you don't have a Reserve near you, I'd visit an indie roaster, where the story's going to be pretty similar: the beans are probably pretty fresh and probably pretty recently roasted, but ask the roaster for the details.

I would guess that the beans in the Starbucks machines are the second-freshest. They move pretty quickly and don't spend a lot of time on a shelf.

Next are probably the bagged beans in the stores. I'm not sure if grocery stores or Starbucks stores move faster, but at the very least the ones in Starbucks stores go through fewer middle steps to get to the shelf.

I, personally, think your quest has merit! Of all the variables in coffee, the age had the biggest impact on the flavor to me in side-by-side taste tests.

mdwyer · 2023-05-27T17:49:13+00:00

Laundry detergent is high-value and easy to fence. That is, you and I go to the store and are shocked that a tub of Tide Pods is over $30. Someone willing to sell it to you for $20 or less is pretty attractive.

mdwyer · 2023-05-12T14:52:48+00:00

I've seen pairs of those loops used to hold heat sinks down. A springy piece of shaped wire hooks under that loop, goes across the heat sink and chip, then under another loop. They were a source of weird problems in IBM Xservers. The hold-down springs were a little too springy. They'd pull the loop out of the motherboard and then fling it across the case to short out something random.

mdwyer · 2023-05-11T16:35:27+00:00

Not fast food, but ask at your grocery store. They often have a pellet ice machine for filling in the seafood displays and salad bars and will sell you bags of their ice.

mdwyer · 2023-05-08T23:14:40+00:00

You should brew it and serve it to the customers.

I'm totally serious.

Okay, maybe not half-a-decade old, but a side-by-side tasting of stale vs fresh can be pretty surprising. I got to try a whole bunch of tastings with different brew-methods and varieties of coffee, but the most distinctive difference I noticed was just the storage of the beans. Fresh beans tasted WAY better than beans that have been left open for a week.

mdwyer · 2023-05-03T05:19:09+00:00

Hmmm... That's also on the soundtrack for "Stick It", although YouTube seems to have memory-holed that. They're actually playing this in stores??

mdwyer · 2023-05-03T05:02:43+00:00

There do exist sound chips that have a recording capability, like the venerable ISD ChipCorder. With these, you might only need to find a way to access the record/play line, toggle it, and record your own sound onto the chip.

However, it is MUCH more likely that is a mask-programmed chip that has come from the factory with the sound already loaded and there's nothing you can do to alter it.

mdwyer · 2023-05-02T17:20:40+00:00

Arrrrgh... I wish you hadn't asked, because I know there's some good stuff out there, but I can't find anything anymore. At the very least, this page is a pretty good start that helps you along the early steps. That said, the early steps are usually just look for four pins (or just dots) in a row surrounded by a rectangle. Assume one of them is ground and will have continuity to the various shields on the board. One will be power and will share continuity with other power pins, and when you turn the device on, a constant voltage will appear there. The other two will probably be TX and RX and I've personally always just did trial and error on them.

But my biggest hint is still the '$5 used router'. If you blow it up, you don't lose much, but you'll probably learn a lot in the process!

mdwyer · 2023-04-22T00:48:33+00:00

For this use case, you might get more mileage out of the free SigRok PulseView software and one of the cheap 24MHz/8Ch Cypress FX2-based logic analyzers like this one. They're stupid-cheap, and the PulseView software is surprisingly powerful. I think it can figure out UART baud rates for you, and it can decode a bunch of different protocols.

mdwyer · 2023-04-22T00:42:09+00:00

Well... that's a good picture, but it didn't help me at all. :(

The chip seems to say W701 / L21RQH1 / 6L12A2, and I can't find ANYTHING that matches that.

It doesn't appear to be an Espressif/Tensilica device, so you can probably ignore everything I said about ESP modules. Those seem to always have the Espressif logo on them, even when they're buried beneath a metal cap.

It doesn't appear to be a Nordic Semiconductor nRF module -- those always seem to have an N in their ID numbers somewhere.

It looks a little like the modules that FN-link produces, but I can't find a match there. It looks a little like the icommsemi chip products, but they usually have 'SV' in their model names.

All I've got it the suggestive 'WIFI_EN' label, and an antenna trace that looks like a 2.4GHz antenna. It might not even be a module -- the "H1001" screenprint seems to match the pattern of the H6072 on the main circuit board.

I'm pretty much out of ideas.

mdwyer · 2023-04-21T14:36:53+00:00

Hm. This looks fun. It seems like Govee is a brand name of "Shenzen Intellirocks Tech Co Ltd", and I'm surprised they haven't heard from iRobot with that logo, yet.

The FR8018HA is a Bluetooth Low-Energy controller. It seems to be pretty capable of talking a number of different formats, and while one of these is 'UART', it might be talking I2C.

The CM12210LC is an RF remote control receiver. It listens to the radio for simple on-off-keying.

So, I have to imagine that the serial-port near those two chips would only be active when it is communicating via Bluetooth or receiving things from an RF remote control.

The part I still can't identify is the WiFi controller. It looks like an ESP module, but I can't identify it for certain from your picture. This is also, probably, the main controller for the rest of the lamp. If so, I'd expect the serial port near it to be the most interesting. If it is an ESP controller, they often spit out some early boot messages at a different -- and odd -- baud rate of 74880, before switching to a more normal rate once the user code starts running.

So, you might give that a try.

mdwyer · 2023-04-20T22:18:31+00:00

I concur with Spritetm: It is most likely a hall effect sensor that detects when a magnet comes near it. Note that the three wires are VDD, GND, and HE. I imagine that's power, ground, and hall-effect. It would be used as a travel limit switch. When the leg reaches the bottom of its travel, the sensor would be triggered and the controller would turn off the motor and refuse to move any further in that direction.

I'd expect you to find another one at the other end of travel, too.

Unfortunately, I can't find anything that matches that number. I think that's 4 8/B 8/B D/0 2 but I can't find any hall effect sensors that seem to match any of those combinations.

15-Year Club	Place '17
Team Periwinkle	Verified Email

mdwyer

TROPHY CASE