Doing Logic Analysis To Get Around The CatGenie’s DRM

The CatGenie is an amazing device to watch in action, basically a self-cleaning litter box for cats that even does away with the need to replace the litter. It’s comparable to what the indoor flush toilet is for humans compared to maintaining a composting toilet. However, there is a problem. It uses costly soap cartridges which have to be replaced because an RFID reader and a usage counter prevent you from simply refilling them yourself.

CatGenie and Arduino
CatGenie and Arduino

[David Hamp-Gonsalves] reverse engineered the electronics so that he didn’t have to pay for the cartridges anymore. This has been done before and one of those who did it created a product called the CartridgeGenius, but it’s made and sold as a parttime project and there were none in stock. The cartridges have an RFID tag and another solution which we’ve covered before is to replace the RFID reader board with an Arduino. That’s the solution [David] adopted. So why write this post if this isn’t new?

The RFID reader board communicates with the rest of the CatGenie using I2C and he needed to know what was being transmitted. To do that he learned how to use a cheap logic analyzer to read the signals on the I2C wires, which makes this an interesting story. You can see the logic analyser output on his blog and GitHub repository along with mention of a timing issue he ran into. From what he learned, he wrote up Arduino code which sends the same signals. He and his cat are now sitting pretty.

What he didn’t do is make a video. But the CatGenie really is amazing to watch in action as it goes through its rather complex 30-35 minute process so we found a video of it doing its thing, shown at 3.5x speed, and included that below.  If you’re into that sort of thing.

[via Adafruit]

36 thoughts on “Doing Logic Analysis To Get Around The CatGenie’s DRM

          1. We got a deal on a reconditioned “Litter-Robot III Open Air Connect” (what a mouthful) and it’s been working great so far (several hundred cycles). The WiFi features are of dubious value but the scooping has been flawless. The litter is kept so fresh now both cats have taken to playing/rolling inside to clean their fur. No I2C or RFID hacking required….

          2. Mine has the ability to run manually, run automatically between certain times, run automatically any time of day, or run automatically every x number of hours. I used to have it set such that it’d run after the cat used it, but only from 8am to 5pm (it’s somewhat noisy so I didn’t want it running at night), mine has motion sensors in it and it only runs the cycle after it hasn’t detected any motion for I think 10 minutes, so if one cat used it and then the other cat used it, it would wait. I ended up having to turn the automatic mode off completely, our one cat LOVED watching it run, so she’d jump in it, and then sit on top and wait for it to run, and just sit there watching it. Our new house doesn’t have room in the bathroom, and the upstairs where I have the cat boxes doesn’t have a drain or water supply, so I can’t use it without doing some plumbing :-P

    1. Sometimes I accidentally locked one of my cats up in a room (cat sneaks in, you do not notice and close the door or the wind closes the door of the room, while cat is in) and the cat toilet is in the entrance area. Only one time the cat peed on the carpet, when I was away for nearly 14-16hrs. So either I have extremely patient and loving cats or cats do normally not need to do the business extremely urgent.
      Although I would not have expected that thing to take 35minutes. That’s more time than I need to completely clean out , wash and refill the two cat toilets manually (what I do every several weeks).

  1. I got a catgenie 120 standing next to our toilet and we (and our cat) couldn’t live without it any more. With a touch of a button the unsightly cat deposits are whisked away :).
    That being said. I was thinking more radical as to flash the Catgenius software onto the 16F PIC and adding a ESP8266 to serial command my own washing program over a wifi served web page. Or perhaps trough a pi Zero with a webcam …. :|
    Waitaminute! Adding IOT to the cat litter box?? Stop me! What am i doing?!
    But thanks for enduring the beeping and writing this up. Might just be easier than what i had in mind ;)

  2. Could he read RFID tag into the file and program it again in the tag after cartridge is refilled? Does device save list of spent tags? In that case (maybe) it would be possible to reverse data stored in tag and make as many unique tags as you want.

    1. It’s RFID, very simple stuff. If it’s storing scanned tags, find the chip it’s stored on and cut the leg of the write enable pin or if that’s all that chip is doing cut the VCC. More often than not those things are set up to fail unlocked even in things like car radios where it shouldn’t be that easy.

      1. Sure, if you have access to device’s insides and can access SPI/I2C bus that’s one way to go. But other option with making suitable RFID cards could be useful if opening device is not an option (warranty and stuff).

        1. What’s the verdict on those warranty seals? I heard they were pretty much universally unenforceable and only existed to trick the ignorant into not trying. Of course it might involve going to court to actually get them to honor the warranty properly, so maybe not worth the effort for most.

      2. Author here: In this case the usage counts are on the RFID tag but simply preventing writes doesn’t work as the main board does the write and then does a read to verify that it was decremented. It will brick if the decrement failed.

        1. Thanks for sharing your work! I actually have a CartridgeGenius, but was looking to improve upon it and your writeup should go a long way in getting me started. I want to add emulation for the maintenance cartridge as well, and add a ‘passthrough’ mode to allow the machine to read the cartridge like normal.

    2. The damn thing was designed to rob you of your money and trap you into needlessly overpaying for supplies. They regularly update their machines to prevent hacking, “fixing” previous hacks.

  3. The company is rude and those carts suck. They send you broken ones often $25 ea!) Then blame you when they don’t work. I for one welcome any alternative to having to give them a penny they don’t deserve. Kudos to these people making it happen. The next thing they should fix is move the water inlet pipes to be below the AC inlet that causes all the overheating and potentially firey situations I’ve read about. Burning plastic and poop probably smells great tho.

    1. Lol nice thread ad jack. You need to try that thing with actual cats cause I guarantee they’re going to fling those pellets all over. You can already see them in one shot between the wall and the unit.
      Sick guitar riffs tho

  4. > another solution which we’ve covered before is to replace the RFID reader board with an Arduino.

    Replacing the RFID reader board with an Arduino is what *this article* is about.

    That link is for an older model CatGenie without RFID at all. The Arduino is used to reprogram the cartridges to reset the count on them. The Arduino doesn’t replace anything on the machine.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.