One of the members of the SomethingAwful forum recently found a black project box on the street (as seen above), with no idea what the thing did. After (hopefully) making sure there were no explosives, [noapparentfunction] posted a picture online to see if someone could figure it out. According to them, this is what the chips are labelled as:
Center black IC: MICREL Y22758C; 0417
Long white DIP switch IC: CTS 206-12; T438
Small black microcontroller on right: 12C508A; 04/P1V6; 0437. Has a tiny “M-inside circle” logo.
From our experience, we recognized the PIC on the board, but without some more photos, it makes this mystery a little more interesting.
Right now their best guess is a garage door opener of some kind because of the 12 DIP switch part. Any HAD readers willing to investigate and weigh in? The game is afoot!
[thanks to Dave D. who sent this in]
@TheTruth
You understand most of the folks on here posted when there was only a single poor photo provided right? Folks were able to identify a garage door opener and a PIC controlled power supply. We probably should have been able to guess from the crappy construction that there were no additional connections on the backside. So its an old garage door opener tied to a power supply that appears to pulse every 10 seconds. So “beacon” or “foxhunt xmitter” are valid guesses.
The IC is probably a custom or an obsolete IC I can’t find another explanation. The PIC? Go and plug it in. Also check what kind of transistor/IC is the TO-220 package, if it’s a FET then is problaby a transmiter/receiver of some kind, but it looks more like a simple 7805 for the PIC. I would try getting the code out of the PIC and reassembling it. Try to find any reference of power supply, or just look at the PIC’s pinout and apply 5V.
Or it was just a student’s project. Also check if the PIC is actually a PICAXE, if you find a PICAXE, you can be sure that Big IC os obsolete and that was a students final project.
With the new pics, it is simple.
The small board is simple. 12v (or higher) Power input to a 9v Power regulator. From there, it powers the Pic through a transistor, and the Pic uses the other two transistors in a darlington pair to power the other board when the code commands it. The two pin switch/jumper provides for (assumingly) time selection. It’s a glorified 555 timer.
The other board is an off the shelf garage door opener, with the button soldered closed, so that it will always run once power is applied.
A simple logic analyzer (Led + Resister) would be able to show that’s all the pic board is doing.
This is obviously an iPad USB port…
It doesnt have arduino, therefore isnt worthy of hack a day.
Looks like a controller for ‘trapshoot’. Trapshoot was kinda like a video game popular in bars and pizza joints during the 70’s – 80’s. The controller was a black box with a button.
@Ivan: You can also go look at the datasheets linked in my comment instead of guessing..
To the people saying it’s RC: Show me a PM generator anywhere in this circuit, and explain how an air-coil is used to transmit a clean signal..
It’s a receiver..learn electronics..it’s two clock ICs and the rest is passive. The only thing that lime board could be is a programmable receiver or something to interrupt RF. The green board is obvious..
Also you can look at the couil and tell it’s very low frequency
The coil tells that it’s high(er) frequency, not low. Low frequencies require larger antennas/coils because at low frequencies the wavelength is greater. lambda=c/f (http://www.dxing.com/frequenc.htm)
Thanks for the links to the PCB pics.
I think a few of you guys are correct.
An educated/calculated guess:
The PIC board has two regulators. One a 7809 to power the generic 9V RF board, the other is a smaller 7805 equivalent for 5V for the PIC.
The PIC controls the 2N4403 transistor, notice the trace for 9V power entering the transistor and leaving to the wire connected on the RF board.
This can only mean that the PIC board is being used as a timer of some type. Also note that there are no other wires apart from the 9V and ground wires going to the RF board.
We can safely assume the RF board is a transmitter, since there are no ‘data’ lines connected to the board.
The RF was originally powered by a 9V battery when the push button was pressed; notice the power trace for 9V runs into the push button. The push button has since been shorted out, meaning the RF board transmits when power is applied to the 9V wire.
Basically the push button has been replaced by a PIC timer board.
Assuming the device was fitted to a car, we can expect the wires that were ripped out on the PIC board to be from the 12V battery. This more than likely had a switch connected in series if it was a RF gate/door opener.
A random thought:
It could have been a hacked homing beacon built by a teen/spouse. If the device is constantly powered. The transmitter would transmitted if the ignition was on. The receiver could be placed in the owners home. As soon as the car gets in range of the home, a buzzer would sound every 10 seconds as the car reaches home until the ignition is switched off. This would give the spouse/teen a chance to hide the mailman/pron before the person arrives home.
Well this has giving me a head-ache.
Oh, I forgot to add that the DIP switch is in the box, assuming the box is closed, the opertor would have no easy way to change the code for the transmitter.
That’s the power of the internet for you. Find an unknown device, post a few pics and someone is bound to have seen it before and can identify it.
I’ve seen it happen dozens of times and still think it’s awesome. The sheer power of it…
Try this:
Connect the input wires to a 12VDC source.
Monitor the red/black “output” with a multimeter (or better yet, an oscilloscope with a slow sweep), or watch the LED hanging off the transmitter board.
Watch for a minute for a pattern.
Power down.
Change the setting on the 2-bit dip switch.
Power up, and watch for a different pattern.
Rinse and repeat 2 more tiwes.
I’m guessing that one setting simply turns the output on continuously. #2 may be transmitting morse code (likely a callsign). #3 would be a callsign with a long transmit period. #4 would be a callsign with a shorter transmit period.
Or just the callsign is sent, but more or less often depending on the switch settings.
Well here’s an idea for a prank:
Get a generic replacement garage door opener and hack it to send a different code each time while extending it’s transmission range with a tuned antenna.
-then leave it in the middle of a dense neighborhood.
Over time it should hit enough codes as it cycles through to annoy and mystify quite a few people!
(but you didn’t hear it from me)
Wow utterly amazed at the inability of most people to not be able to use google. It took them forever to figure out what the VR was and where the battery went.
I know what it is, I know what it does, look up the chips and look at the wiring. Someone was trying to make a device to screw with someone by making their garage door go up and down over and over and over.
I get a kick out of the idiots claiming it’s for scanning amex cards and other silly crap.
DIP switch is in the box
I love how people are blindly calling it a ‘Garage Door Opener’ without taking the time to read the first line of the article:
“The outside is all plastic with no visible inputs, only a red LED.”
Clearly it’s not a device that needs human input, leading me to believe it is a tracking beacon of some sort. Could be a DIY foxhunting target or even a makeshift vehicle tracker. Really no way to tell without more info.
@fartface
+1
That seems to be the correct answer. Something simple to fit in the memory space of a 508, yet nicely evil in purpose. It was probably tossed out once the “target” had to replace the burnt out garage door opener :)
I saw this and rofl cuz its mine. I dropped it when I was on my bike I was trying to hack garage doors with it.
I put it together by mixing tons of other g-door opers that were homemade…
Well let me just say it didn’t work so I’m back to the drawing board and this time I’m going to make a belt holder also for it…
Please email me with any questions that you may have at makerofdesign@yahoom.com
Harry: I know what this is…
Harry: This is an espresso machine.
Harry: No, no wait. It’s a snow cone maker.
Harry: Is it a water heater?
It’s a Time Machine
It’s our latest iphone prototype, please send it back immediatley!
You guys are so clueless and missed the whole phreaking/blue box days.
This is some homemade garage door scanner put together by some high school trouble makers.
The box is powered by the car’s 12V. There is an LM337 or whatever on the daughter board to step down to 5V or 9V or whatever the PIC can handle. I suspect the RF Micrel part can handle 9V, but who knows.
The PIC probably runs through all the door codes.
So some teenagers are driving around looking for houses they can break into the easy way and steal shit and get out without sign of even being there. They probably saw a cop driving behind them and flipped the shit out and chucked it out the window. Because this box would probably be major FCC charges, etc.
I suspect the PIC has wire on the bottom under the board the is controlling the “press” button in the center that normally transmits radio. But some dumb goon can even handle taking decent photos or getting correct part number.
This has links to all the pictures of the boards up close and the backs.
Also a write-up of what the box is doing. Seems too many links to post as a comment here.
http://pastebin.org/245153
The PIC is sending 9V to the garage remote board in place of what would normally be the 9V battery and a push button which sends the 300-400MHz garage door signal for a single DIP setting code (apparently every 10 seconds).
Here are the possible usages:
– Drive around and find houses that use that single code (out of possible 256 codes). Possibly they change the code every day on their drive to work and can find every house using this older garage door technology.
– It is tuned into one house and it annoys them by opening and closing the garage door every 10 seconds (But, the victim could just change the code DIP settings)
– It is a beacon for some HAM game of fox and hounds
– The PIC is sending pulses for some type of message programmed on the PIC like morse code or some spy or terrorist message that can be received by someone with right equipment (very cheap to build)
Maybe it is just a bunch of stuff thrown together in a project box to confuse people. or a wireless communicator sent back in time to listen on our thoughts and beam them to the future, though the project box is a bit misleading.
But it is probably a range extender or automated garage door opener that fell out of the guys car. How disappointing.
it is in-fact a garage door opener, it has a HIGH gain output, this is because the high output scrambles speed detecting devices such as the ones police use!….
why is this…?
because it works on the same fq as the speed detector/ cameras etc…. and acts as a scrambler…. the different settings are for testing different signals…
It is a garage door opener which has been modded to scan the 12 possible codes using the PIC. I had built one using a 4040 12-Bit Binary Counter IC, and a 55 Timer IC (shielded from RF stage in Metal casing). It only worked on the Genie Garage Door openers. They could have used the PIC to store the working combination to be downloaded after its’ test. You could add an extra RF stage at the output to get higher gain through the coil antenna, but watch out for part 15 and 97 with the FCC.
@Commodore_Nut: You’re actually wrong, no PIC on this entire circuit can generate the PM codes. Also like I’ve said before it’s blatantly obvious from the air coil that it isn’t a transmitter.
There is a big pile of fail in these comments -.-
I was going to read the list of comments to be sure I wasn’t stepping on someone else’s idea, but then I found out that there’s 130+, so screw that.
http://forums.somethingawful.com/showthread.php?threadid=3304594&userid=0&perpage=40&pagenumber=2 <<<–Better pictures
There seems to be a bit of debate over the antenna being able to transmit or receive or whatever, but as far as I can tell, going off of estimations and bullsh*t, it's an RF transmitter. To what, one can only speculate, but with the limits of the PIC, my guess is that it uses the 12-switch DIP to address (duh.) and transmits a signal every 10 seconds.
I was going to tell you what I thought it was, but the more I look at it, the more confused I become. Unless I drew my diagram wrong, there's no way this should work. Like, at all, but clearly it does, so I'm lost.
@the_truth… Most who post here are posers that really know nothing about electronics and they refuse to learn it. they wanna just “hack yo!” so they bumble along and get lucky once in a while all without knowlege.
OPEN BOOKS people! LEARN TO USE GOOGLE people….
It is a scanning garage door opener. I actually made something very similar to this for my first electronics project. The board with the inductor-looking antenna is from a Genie remote. The daugherboard incrementally outputs a code from 0 to 2^(12) – 1 and the rf circuitry will output the required EM signals.
Its another model of a new product “lost” by apple, done to generate buzz about their next product. In this case it’s a model of the new ipad+, no screen, but it opens up a world of possibilities…
lol new apple iBox
@The_Truth is right – the abundant technofail in HaD comments is seriously depressing.
@Flux
“The Antenna looks like it’s made for a rather low frequency – somewhere around or below 1MHz probably.”
Serious Fail. That’s a *UHF* oscillator, ’bout 300MHz at a guess.
@xorpunk
“and explain how an air-coil is used to transmit a clean signal..”
“Also you can look at the couil and tell it’s very low frequency”
“it’s blatantly obvious from the air coil that it isn’t a transmitter.”
Fail. Fail. Fail. It’s blatantly obvious you don’t have a clue or are trolling. Buy a copy of the ARRL Handbook and Lrn2RF.
Here’s somebody who does;
@derpderp
“The PIC is sending 9V to the garage remote board in place of what would normally be the 9V battery and a push button which sends the 300-400MHz garage door signal for a single DIP setting code (apparently every 10 seconds).”
It is obviously a UHF device from the coil, most likely a simple modulated/gated oscillator of the Colpitts form. See;
http://talkingelectronics.com/pay/BEC/Colpitts_Oscillator.gif
Since all 12 DIP switches are connected directly to the Y22758C it is likely that these are for setting the transmitted code. Those who think it’s scanning all the possible codes need to ponder why it appears to have a *code setting switch* that would be inaccessable in normal use.
Anyone who has been inside a simple RC car controller should recognise the general form.
As an avid foxhunter I seriously doubt it is a fox transmitter simply because the signal strength and stability would be insufficient (osc transistor size, no crystal control) plus Foxhunt ‘mitters don’t transmit complex codes, frequency appears unmodified from original, etched numbers show it is a *commercial* PCB.
WHY somebody decided to repackage their short-range remote control transmitter only they can say, but for use on a motorbike sounds reasonable.
And with a bit more Applied Google I found;
“Garage door opener” … “390MHz” … “12 dip switches” … “Right now I’m working on trying to find the datasheet for the component inside my garage door transmitter. It’s made by Micrel, with a part number of Y22758C.”
http://forums.radioreference.com/general-scanning-forum/29203-programming-idea-use-scanners.html#post215136
and
http://forums.radioreference.com/general-scanning-forum/29203-programming-idea-use-scanners.html#post215848
Bingo!
So who’s for the first slice of humble pie then?
I challenge anyone in these comments to transmit clean pulse modulation with this air coil design.
I was the first one to find the data-sheets and post links..nothing on this circuit can produce PM. Not sure under what logic I’m the one with “fail”..
@Roly: You might want to get out of your mommas basement, and get some fresh air, cause you’re not seeing my above comment where I link to datasheets and explain the circuit and components. You comment and those forum posts are mega-fail. Prove me wrong.
Guys you are all idiots.
This is a older GENIE type transmitter. It uses eight DIP switches to pick a code/channel and transmits RF using the Micrel part.
The PIC could hypothetically cycle through all the codes but that would require using another GPIO on the PIC to send a signal to a MUX or somehow toggle the eight DIP settings and there would be eight wires soldered there (yes there are 12 DIPs and four are used for other controls, there were eight code settings back then, 256 possible frequencies)
The PIC is doing exactly one thing. It drives a pnp to control the red wire that goes the the GENIE board. It basically sends 9V to the GENIE board which is soldered on so it always transmits when the PIC sends power to it.
The GENIE board is transmitting on one channel of the older style 300-400Mhz garage remote transmitter.
And yes, the PIC does have the ability to send PWM by turning the GPIO on and off. It isn’t a great way to modulate a signal but it would work in exactly the same way I can use a light switch on my wall to send morse code through my bedroom lamp.
To the idiot that thinks it is anything other then a garage door remote, many many of us have seen this exact board. It is exactly an older type GENIE remote. And yes it is only using one frequency and from the goon who found it, it appears to pulse the transmit every ten seconds.
@derpderp: Thanks for attempting to enlighten us and defend the transmitter guesses, but there is just one problem which I guess I should of mentioned: AS THE DATASHEETS SHOW THERE IS NO GPIO ON EITHER OF THESE CHIPS :D :D :D
Next failed analysis please :)
BTW as has been confirmed the no-datasheet chip is a clock generator with a programmable flash, and once again no GPIO :D :D :D
xorpunk:
The PIC16C508A datasheet (40139e) calls its input/output pins GP0-GP5, and there are pictures of the package pin-outs on … let me find it … where is it? I saw it a minute ago… Page 2.
You may be confusing transmitting pulses at 300MHz through a coil (indeed a difficult task) with modulating (on off keying : OOK) a 300MHz RF carrier with a pulse train at 10Hz.
Old saying: It is better to be thought the fool, than to open your mouth and remove all doubt.
Have a nice day.
@xorpunk: First you said a datasheet proved that the Y22758C has no gpio, then You confirmed, without a datasheet, that it is a clock-gen.
Reliable source you are not. You are the only idiot who thinks it is a clock generator.
its a very funny sound making computer
if u press the button it will explode ur ass up in the air dont press it.
sometimes it can be used as a mixture or a grinder too
at night it can be used as a dildo have fun with it
@xorpunk
“..center button cleares memory.”
And it is clearly solder-bridged on the PCB underside … why? To make sure the non-existant memory doesn’t get contaminated with any nasty data? ROFL.
@xorpunk
“and explain how an air-coil is used to transmit a clean signal..”
Open your ARRL (or RSGB) Handbook, any edition. A mod-osc doesn’t have to be “clean” to work (which is why devices like these have severe legal limits on their ERP).
@xorpunk
“Also you can look at the couil and tell it’s very low frequency”
A *two* turn coil on a plastic former? With tiny disc ceramic caps? The link I gave establishes that, as expected, this *transmits* on *390MHz*. That’s UHF, not “low frequency”.
@xorpunk
“my above comment where I link to datasheets”
You *don’t* actually link to the Y22758C datasheet, and there’s a good reason for that.
“Y22758C:doesn’t exist it’s a clock-gen”
A non-existant “clock generator”. Riiiight. In what you continue to assert is a *receiver*/data logger in the face of clear evidence that it’s a (hacked) standard garage door remote transmitter?
Perhaps you would like to explain where you got the idea that air core coils can’t be used in transmitters, and that the modulation has to be Phase Mod. (on second thoughts, don’t bother)
@xorpunk
“Prove me wrong.”
f0 = 1/2 pi Sqrt(((u0*K*N^2*A)/l)*C)
QED
I eagerly await publication of your “Cavity and Stripline Techniques at VLF”.
Is it the internet? Does it weigh anything? lol
http://www.youtube.com/watch?v=iDbyYGrswtg
It’s a FBI
I’m certain
Well, since everyone here can’t stop arguing long enough to actually figure out what the hell it is I guess we’ll never know.
I think I have solved the mistery. Here in Spain tobacco vending machines are blocked to prevent children under 18 to buy tobacco wich is banned by law. The waiter at a bar or restaurant unblocks the machine with a RF remote control on demand of a client. This is annoying for the waiter so someone has solved the problem with this box that automatically unblocks the vending machine every few seconds.
One person had mentioned 433 Mhz. Isnt that a frequency of wireless doorbells and wireless light switches …
Has anyone yet thought this might just be something someone put together and left lay just for fun? It could be nothing more then two cheap junk boards (Garage door opener and a kids toy) soldered together?
Why do I think this? Because I use to do this same thing when I was a kid. Why? Sometimes chaining stuff together and leaving it out for someone to find is more fun then actually making something useful. (Sometimes).
I built one of these it is a pulsing RF beacon Used for cover surveillance. the dip switches set the freq, it can be tracked with a receiver set to the same freq. the it sends a pulse every 30 sec to conserve power. I posted the schematic online over a year ago (the site is offline now)