Doing Logic Analysis To Get Around The CatGenie’s DRM

sigrok I2C screenshot

The CatGenie is an amazing device to watch in action, basically a self-cleaning litter box for cats that even does away with the need to replace the litter. It’s comparable to what the indoor flush toilet is for humans compared to maintaining a composting toilet. However, there is a problem. It uses costly soap cartridges which have to be replaced because an RFID reader and a usage counter prevent you from simply refilling them yourself.

CatGenie and Arduino
CatGenie and Arduino

[David Hamp-Gonsalves] reverse engineered the electronics so that he didn’t have to pay for the cartridges anymore. This has been done before and one of those who did it created a product called the CartridgeGenius, but it’s made and sold as a parttime project and there were none in stock. The cartridges have an RFID tag and another solution which we’ve covered before is to replace the RFID reader board with an Arduino. That’s the solution [David] adopted. So why write this post if this isn’t new?

The RFID reader board communicates with the rest of the CatGenie using I2C and he needed to know what was being transmitted. To do that he learned how to use a cheap logic analyzer to read the signals on the I2C wires, which makes this an interesting story. You can see the logic analyser output on his blog and GitHub repository along with mention of a timing issue he ran into. From what he learned, he wrote up Arduino code which sends the same signals. He and his cat are now sitting pretty.

What he didn’t do is make a video. But the CatGenie really is amazing to watch in action as it goes through its rather complex 30-35 minute process so we found a video of it doing its thing, shown at 3.5x speed, and included that below.  If you’re into that sort of thing.

[via Adafruit]

53 thoughts on “Doing Logic Analysis To Get Around The CatGenie’s DRM

          1. We got a deal on a reconditioned “Litter-Robot III Open Air Connect” (what a mouthful) and it’s been working great so far (several hundred cycles). The WiFi features are of dubious value but the scooping has been flawless. The litter is kept so fresh now both cats have taken to playing/rolling inside to clean their fur. No I2C or RFID hacking required….

          2. Mine has the ability to run manually, run automatically between certain times, run automatically any time of day, or run automatically every x number of hours. I used to have it set such that it’d run after the cat used it, but only from 8am to 5pm (it’s somewhat noisy so I didn’t want it running at night), mine has motion sensors in it and it only runs the cycle after it hasn’t detected any motion for I think 10 minutes, so if one cat used it and then the other cat used it, it would wait. I ended up having to turn the automatic mode off completely, our one cat LOVED watching it run, so she’d jump in it, and then sit on top and wait for it to run, and just sit there watching it. Our new house doesn’t have room in the bathroom, and the upstairs where I have the cat boxes doesn’t have a drain or water supply, so I can’t use it without doing some plumbing :-P

    1. Sometimes I accidentally locked one of my cats up in a room (cat sneaks in, you do not notice and close the door or the wind closes the door of the room, while cat is in) and the cat toilet is in the entrance area. Only one time the cat peed on the carpet, when I was away for nearly 14-16hrs. So either I have extremely patient and loving cats or cats do normally not need to do the business extremely urgent.
      Although I would not have expected that thing to take 35minutes. That’s more time than I need to completely clean out , wash and refill the two cat toilets manually (what I do every several weeks).

  1. I got a catgenie 120 standing next to our toilet and we (and our cat) couldn’t live without it any more. With a touch of a button the unsightly cat deposits are whisked away :).
    That being said. I was thinking more radical as to flash the Catgenius software onto the 16F PIC and adding a ESP8266 to serial command my own washing program over a wifi served web page. Or perhaps trough a pi Zero with a webcam …. :|
    Waitaminute! Adding IOT to the cat litter box?? Stop me! What am i doing?!
    But thanks for enduring the beeping and writing this up. Might just be easier than what i had in mind ;)

  2. Could he read RFID tag into the file and program it again in the tag after cartridge is refilled? Does device save list of spent tags? In that case (maybe) it would be possible to reverse data stored in tag and make as many unique tags as you want.

    1. It’s RFID, very simple stuff. If it’s storing scanned tags, find the chip it’s stored on and cut the leg of the write enable pin or if that’s all that chip is doing cut the VCC. More often than not those things are set up to fail unlocked even in things like car radios where it shouldn’t be that easy.

      1. Sure, if you have access to device’s insides and can access SPI/I2C bus that’s one way to go. But other option with making suitable RFID cards could be useful if opening device is not an option (warranty and stuff).

        1. What’s the verdict on those warranty seals? I heard they were pretty much universally unenforceable and only existed to trick the ignorant into not trying. Of course it might involve going to court to actually get them to honor the warranty properly, so maybe not worth the effort for most.

      2. Author here: In this case the usage counts are on the RFID tag but simply preventing writes doesn’t work as the main board does the write and then does a read to verify that it was decremented. It will brick if the decrement failed.

        1. Thanks for sharing your work! I actually have a CartridgeGenius, but was looking to improve upon it and your writeup should go a long way in getting me started. I want to add emulation for the maintenance cartridge as well, and add a ‘passthrough’ mode to allow the machine to read the cartridge like normal.

    2. The damn thing was designed to rob you of your money and trap you into needlessly overpaying for supplies. They regularly update their machines to prevent hacking, “fixing” previous hacks.

  3. The company is rude and those carts suck. They send you broken ones often $25 ea!) Then blame you when they don’t work. I for one welcome any alternative to having to give them a penny they don’t deserve. Kudos to these people making it happen. The next thing they should fix is move the water inlet pipes to be below the AC inlet that causes all the overheating and potentially firey situations I’ve read about. Burning plastic and poop probably smells great tho.

    1. Lol nice thread ad jack. You need to try that thing with actual cats cause I guarantee they’re going to fling those pellets all over. You can already see them in one shot between the wall and the unit.
      Sick guitar riffs tho

  4. > another solution which we’ve covered before is to replace the RFID reader board with an Arduino.

    Replacing the RFID reader board with an Arduino is what *this article* is about.

    That link is for an older model CatGenie without RFID at all. The Arduino is used to reprogram the cartridges to reset the count on them. The Arduino doesn’t replace anything on the machine.

  5. Love our CatGenie I’m no rocket scientist so pretty sure you guys though of this but is it possible to rewrite the RFID chip in the cartridge rather than the reader?

    Remember that 40 pound box of scoopable litter turns out to be over 160 pounds of used litter… That’s the weight of three 50 pound bags of dog food …

  6. can you build rfid scanner around the window and log which cat is entering, then measure the weight when the cat enter and weight after the cat exit, which equal the solid waste or liquid waste and track cat health…

  7. Thanks for this article, I consider it a great public service and you should feel good for sharing. Corporate America is always trying to stick it to us and we should stick it back.

    Here’s my little contribution…

    I looked around to find out what the ingredients are in the cartridges we are bypassing. Though the ingredients should be listed on the label because your cat could ingest it, it is obviously in the interest of the manufacture to keep it as much of a secret as possible. Though I suspect is like Coke’s Trade secret recipe of water and caramelize sugar recipe that this one could be easily have a Pepsi or a bobo brand substitute. Through a lot of research and a little detective work the Australian Cat genie website gave me all the answers I needed.

    On the frequently asked questions page the following is written:

    Q: “Is the cat genie litter and solution safe for my cat if accidentally ingested?”

    A: “…Catgenie refill solution uses the same ingredients used for sanitizing veterinarian operating and examination areas.”

    Boom!Makes sense, they’re not a chemical company! They make an admittedly pretty good appliance and ride a side scan using rfid drm to Make a sucker out of you. They stole the idea off of the printer/cartridge companies.

    They buy wholesale vet sanitizer solution To fill the little plastic boxes and slap an RF ID tag. Get a gallon of commercial grade vet sanitizer on Amazon for $15/gallon.

    imagine if a vet hospital had to buy sanitizer at the CatGenie cartridge prices??One $35 cartridge Could barely wipe down an examination table.

    I love the product but this rfid feature and is a complete money scam. They know it and we were smart enough to figure it out so hold your heads up high!

  8. would anyone be interested in flashing an Arduino and then selling it to me I do not have any experience doing this but am looking into buying a new cat genie in the near future

  9. Is there any chance anyone has come up with a hack for the original Model 60 CatGenie cartridges? I am on my very last cartridge and just got the warning that I only have 10 more uses and they don’t even make them anymore. So, the end of this cartridge will render this CatGenie useless. For the record, I have 3 others as I have 7 cats, but they use all of them. I hate to throw out a perfectly good CatGenie just because I can’t get an more cartridges …

    1. Sue I can modify the mainboard but there’s a ton of time involved in that. I’m currently looking at $150+ a board/machine for parts and time. May be cheaper in the future if I can have my own boards printed up. Either way don’t throw them away. I’m sure someone will come up with a simpler hack on it. Maybe I will but I’m not a hacker. I just tear out the CPU and install my own.

  10. I really desperately need some help with my Catgenie. I bought my 120 unit, litter and 4 sani-cartridges second hand about 3 months ago from someone moving. It was a great deal and worked well until a few weeks ago. Now it stops completely after it fills with water. I am getting error code 2. I have learned if I pick up the motor just far enough for the lights to go out and immediately put it back down, it starts working again and finishes the cycle. It takes literally two seconds. I have taken it apart completely twice last week and cleaned it hard, I have cleaned the hoses to check for clogs and cleaned the mesh, I have opened the housing to remove dust, and finally I have run a maintenance bag. I called customer service and they said I need a new rubber ring on the intake hose. They would not give it to me or let me buy it unless I provided sanicartridge receipts for 6 months! I obviously don’t have them and think it is pretty rough that I can’t get help on something bought second hand! I really doubt the rubber ring is the problem, but would buy it from the hardware store if someone could tell me the size
    . If anyone has dealt with this, I would be so very grateful for any pointers! Thanks!

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.