Ghidra Used To Patch Fahrenheit Into An Air Quality Meter

Even though most of the world population couldn’t tell you what room or body temperature is in Fahrenheit, there are some places on this globe where this unit is still in common use. For people in those areas, it’s therefore a real hassle when, say, a cheap Chinese air quality measurement systems only reports in degrees Celsius. Fortunately, [BSilverEagle] managed to patch such a unit to make it display temperature in Fahrenheit.

The reverse engineering begins by finding a way to dump the firmware. It’s nice to hear that [BSilverEagle] used some the skills demonstrated in [Eric Shlaepfer’s] PCB reverse engineering workshop from Hackaday Remoticon last November to trace out the debug header and the SWD pins of STM32F103C8 MCU. After that, OpenOCD could be used to dump the firmware image, with no read protection encountered. The firmware was then reverse-engineered using Ghidra, so that [BSilverEagle] could figure out where the temperature was being calculated and where the glyph for the Celsius symbol was stored. From there this it was a straight-forward rewrite of those two parts of the original firmware to calculate the temperature value in Fahrenheit, change the glyph and reflash the MCU.

So why buy this thing in the first place if it didn’t spit out units useful for your current locale? Cost. Buying this consumer(ish) device was about the same cost as buying the individual parts, designing and manufacturing the PCB, and writing the firmware for it. The only downside for their use case was the lack of Fahrenheit. Not a problem for those who demand full control of the hardware they own.

Need a boot camp for using Ghidra? Matthew Alt put together a spectacular video series on Reverse Engineering with Ghidra.

73 thoughts on “Ghidra Used To Patch Fahrenheit Into An Air Quality Meter

    1. Constitution, rebel, superior, fuk yu, … commie, pink, we don’t need , … BLA, BLA , BLA , deep state, divisible by three, BLA, BLA , BLA, I like my drills sorted by LETTERS, … BLA, BLA BLA, Twelve, BLA , BLA BLA, …. divisibe, foot relatable, …

      GOD, I hate this sht. Just get on board already, you morons ( I’m A US citizen). Fck Me (us)/ (them), whatever.

  1. The history is written before our eyes… ‘In the first half of the twenty-first century the remaining countries using the Fahrenheit scale have switched to Celsius due to wide use of Chinese electronic modules’.

    1. That’s a blatant misrepresentation. I’ll go ahead and call it a lie! (Don’t take this personally, please, Jabberwock :) )

      All English-speaking countries switched to Celsius in the 1960s to 1970s, with one notable exception.

      Thus, this shift started way before the availability of “Chinese electronic modules”. Honestly, I don’t care which units of measurement any populace prefers, but please, dear US readers:

      Don’t assume the rest of the world switched to SI-derived units for any commercial/social/… reasons that don’t apply to the US. It was a concrete, clear, unambiguous effort of national and international organizations to harmonize on a system that is founded in science and interoperability.

      The US just decided it would be worth having engineers convert between units useful for calculation and units useful for ordering, and communicating with the public. That’s a conscious decision not to push for standardization that even the UK did, where the US/imperial customary units originated, and I’m sure there’s more costly examples of what that costs the US than dashboard meters and the occasionally lost Mars Climate Orbiter.

  2. A real hassle to convert c to f?
    You Google a conversion table, print it out and stick it next to the device. Solved… And by constantly looking at the table, you get a feeling for the numbers and learn to understand the values of both units.

          1. I feel like these days hack is synonymous with solution. It used to be that it was an unconventional solution. I really don’t think a look up table qualifies as a hack. What’s so hard about (9/5)x+32… Maybe the hack should should involve a 3d printed mechanical calculator that inputs Celsius and outputs Fahrenheit. [or would that essentially be a look up table on gears…]

          2. @Prower50mil
            ok I’ll give you a few more improvised solutions which should be hacks according to your definition:
            – buying a completely different device that does spit out the required temp in C.
            – typing in the F amount in google and it will tell you in Celcius
            – doing arithmetic in your head

          3. About 30 to 40 years ago, about anyone who saw the War Games movie would associate both a “hack” and “hacking” with criminal activity, rather than tinkering with electronics. Even hobbyist magazines of the kind of Popular Electronics did distance themselves from the bad bad “hacker” community. I guess “we” can be glad that the term now has a better reputation again. No matter whether people think of tinkering or finding a solution. :)

          4. @Joshua: actually no, hacker culture originated at MIT and was used before it appeared in popular culture where it was misrepresented.
            Hacks were always meant to mean hardware tinkerers that used it to make systems bend to their wills using creative solutions.

            Some would use it to circumvent paying for phones. But the term of hacking as something negative is a mainstream/normy thinking, eventhough the misunderstanding is decades old, the origin is way older.

            Look up Marvin Minsky, he is a hacker.

          5. No matter what the history/source/complexity/ … It’s about “holy sht. That’s cool”. Generally about doing a lot with a little, or clever, original, “out-of-the-box”, eye opening, ….

            This is one of my favorites.

    1. Re: ” it’s therefore a real hassle when, say, a cheap Chinese air quality measurement systems only reports in degrees Celsius. ”

      BOO HOO. The rest of the world has to deal with purchasing both Metric and Imperial sets of tools, only because of the 5% who refuse to light up a couple neurons.

  3. “From there this it was a straight-forward rewrite of those two parts of the original firmware to calculate the temperature value in Fahrenheit, change the glyph and reflash the MCU.”

    Maybe it was straight forward for the author but I would hardly know how to start!
    So a great article find, and a great writeup on the link the article links to with exactly how the rewrite of firmware was performed.

    1. If it was up to the HaD comment section, nobody would do anything! Proof of concepts like this are pretty awesome in my book – even if you’d never need to duplicate the hack in question, just learning that something is possible is an invaluable tool in the kit.

    1. I would be thrilled to see the world go all metric, all US, all Imperial (slightly different than US), or with any other system that ever has been, will be or could be invented just so long as the whole world uses the SAME system. Decimals would be nice but I can deal with fractions too.

      What I really want is to be able to print a model I downloaded off the internet and buy perfectly fitting fasteners to finish the job at the local hardware store without paying an arm and a leg for the specialty sized parts that don’t follow the local system.

      But then again, when I order metric fasteners online I always order larger quantities than I need. Maybe someday I’ll have enough of a collection that I can build a few things without the months long wait for the envelope from China.

  4. Surely it can’t be too hard to educate US citizens to grasp 0ºC = Freezing, 100ºC=Boiling? And then the other more minor cases: 20ºC = ambient; 30ºC-40ºC = a hot day; 37ºC = body temp? It’s more intuitive than ºF.

    1. Sure, that doesn’t sound hard.

      But once one is “educated” then what? The local weather forecast comes in degrees Fahrenheit. Most people we might communicate with about our own local weather are only familiar with Fahrenheit. We can become familiar with Celsius but with zero opportunity to use it how practical is that and how long will we even remember? Imagine living in a fully metric country and knowing temperature in F°. What would you do with it?

      When I was a kid I remember most thermometers having both measurements on one. I tried to always look at both sides because I knew the people around me spoke in F° but “some day” we would all be switching to C° and I would need to know. Some day never came.

      Recently, I wanted to buy an analog thermometer. I hoped to get one that showed both but I could hardly find any! The internet sold almost exclusively metric-only thermometers and the local stores sold fahrenheit-only ones. And the few I did find that showed both were big, decorative and expensive when I was looking for cheap and functional so Fahrenheit-only it is.

      Of course nothing stops one from changing their own digital thermostat’s display to Celsius. If they live alone. And they don’t mind everyone that visits and notices it thinking they are some sort of showoff. It’s a bit like setting all your clocks to display 24-hour format. It honestly makes a lot more sense but everyone is going to think you are weird for doing it.

      I’m finding that I am becoming more familiar with Celsius through 3D printing. But if the outside air ever reaches those temperatures well, which units we use won’t be much of a concern will they? I do know that when my printer is at room temperature it reads about 18 or 19° so there’s that.

      1. Re: “but everyone is going to think you are weird for doing it.”

        Good for you for learning. Now, Be a Man.

        I’m dreaming of that day in the near future, when I hear U.S. Bob talking to himself:

        “Why the heck do I have these dam_ Imperial tools and fasteners? Everything I have uses Metric. Bet it’s those Chinese or the Deep State trying to sell us more of this Imperial sht… Oh, …wait …”

        The US will conform (kicking and whining). As one can see with the Air Quality Meter, the rest of the world is moving on …

        1. When you’re hacking, or working on a budget, the reality is that imperial tooling is affordable, and metric isn’t.

          There’s just decades and decades of the stuff around, and cheap. Metric stuff is new and expensive. It’s not a philosophical issue, or kicking, or whining, “being a man” (really?) or anything else like that. It’s “here’s what you can afford”. Anybody making anything with proper industrial budgets in the US has already gone Metric ages ago and isn’t even having this conversation.

          1. Failure in logic. You do know that fasteners and tooling for both systems mostly come from China. There is no inherent difference driving up the cost. The reason Metric may be more expensive, is that you’ve decided to consider it “special”.

            Re: “Anybody making anything with proper industrial budgets in the US has already gone Metric ages ago and isn’t even having this conversation.”
            My point exactly. Only the dim and lazy are holding us back.

          2. Ugh. Meant to hit “Reply” not “report”.

            When you go to an industrial auction, which there are many of, you can get imperial machines, and boxes of imperial tooling for pennies on the dollar. Even new stuff from china can’t compete with that on price.

            Stop trying to pass moral judgement on people (“dim and lazy”) for being completely rational in a way that happens to be great for them just because it doesn’t get you what you want. If your budget is hundreds of dollars, not thousands or tens of thousands, you buy an imperial mill / lathe and a crate of tooling. Or you get all religious about your units and have no tools.

            Since you seem to have a particularly insular perspective, you should know… you can get war era/post-war era imperial manual machines all day in the low hundreds of dollars here if you can haul them home. We’re not going to send them out for scrap because you’re too lazy to multiply.

          3. Re: “ivan256 … industrial auction, … budget is hundreds of dollars, …

            This isn’t about us as hobbyist being able to afford tooling. I’m fairly well off, and as a former machinist, have tooling you’ve never seen.

            It’s about the world in the future not needing two similar systems. What if you could just get tools at an auction, without worrying about what system it follows?

            Not “dim/lazy”? What is our excuse as a nation?

            If you’re told two pint make a quart, no problem, right? I tell you two pounds are a kilogram (~), circuit breakers trip.

            While we’re at it, you know lathes are mostly measurement system agnostic. I’ve run mills, lathes, and grinders for years. Most were 20 to 50 years old. All Imperial. Most of what was made: Metric. If you need a “Metric” lathe to make Metric parts, that’s you’re shortcoming.

            Insular? I grew up in Europe and US. Metric Rules.

            Are you being insular, by defending lack of progress as a nation, on how it pertains to you? How would you feel if you had to put in extra effort, or spend extra money, or have projects fail, because of that 1 out of 20 stick-in-the-mud? Do you understand, that the world is doing exactly that (for now)? What if you had to type 1 out of twenty words in Swahili to post a comment.

            Yeah, that is dumb.

      1. Most of us are humans on Earth. Zero/100 degrees Celsius is much more relatable than 273/373 or 32/212 degrees. Next you’ll claim we should be using the plank length for distance.

        1. It is kind of bitchy though. Sure, “the length of the path travelled by light in vacuum during a time interval of 1/299 792 458 of a second” sounds kind of sexy, way better than metre/meter, but it’s not very relatable. But neither is meter alone. The only decent thing (compared to yards or feet) is that it’s metric.

        1. With a good pair of well fitting shoes on my foot is almost exactly 1-foot from heal to toe. I’ve taken advantage of this many times to make quick, rough measurements. It’s quite convenient!

          Maybe I should go to the UK and claim to be the reincarnation of the king. Think the royal family will have me?

          I guess everyone else’s experience will vary. But I doubt anyone has a foot that so easily measures in metric. Maybe a 1-decimeter hoof? Any sartyrs out there?

          I suppose I could say my foot is about 3 decimeters. I don’t know, that’s not very accurate, almost 1/2 a centimeter off. Nor does everything divide into 3 as easily as 1.

    2. When it comes to ambient temperature, it’s actually much easier to teach somebody familiar with Celcius how Fahrenheit works than the other way around.

      0-100 Fahrenheit can be loosely generalized as a percentage of how hot you are. Below zero, you’re likely to freeze to death. Likewise 100 is about the max you can handle for any period of time.

      Conversely, humans have very little concept of temperatures that are too hot but less than boiling, so it’s difficult to grasp a description of a scale that includes a range between “that will burn me” to 100ºC. Try to describe to somebody the distinction between 65C and 80C…. They’re abstract concepts at best. 20 degrees, 30 degrees, those only seem intuitive to you because you’ve grown up familiar with them.

      Now… if we’re talking about science, or engineering, or… anything but ambient air temperature…. use metric.

  5. Ghidra is such a powerful tool. So much easier than radare2 too, sorry to say. I suspect I wasn’t part of the desired target audience for it though, one of those “user friendly, just very picky about its friends”

    I’ve actually used Ghidra to modify firmware that I could have asked for a source change, but for testing purposes it was just easier and faster to modify the code directly with the aid of the disassembly and decompilation. So, that should give you an idea of how powerful and usable it is. Definitely worth learning. If you’re using arm microcontrollers, make sure to use the svd loader plug-in before you hit Analyze!

    1. And now that I’ve read the article: it’s definitely a good write-up on how to get this conceptually-simple but quite useful hack done, so congrats and kudos to the author. Go find an SWD header on something in your space and reverse some firmware today! Even if you don’t modify and reflash it, the feeling of discovery and learning from figuring out functions, renaming them, and getting an idea of the organization of the code is a real high. On second thought, maybe it is better to start with a specific goal in mind, so you don’t get carried away reversing the entire codebase – I’ve definitely fallen into that trap myself. Think it might even be more dangerous with Ghidra since you can define data structures, then it can be a completion-ist thing to try to define all the members, etc…

  6. Good one.

    I got myself struggling with two cars: a Ford Fusion that insisted in provide information about fuel consumption in “gallons per hundred miles”; then a Hyundai that was slightly better, showing “litres per hundred kilometers”, with the useless option to change it to gallons per hundred miles.

    …both were irritating, as we are used to “kilometers per liter” in the country I live.

  7. As much as I am for helping people to come out the dark ages and embrass SI units (Celsius in this case) by stopping the use of legacy/nonsense units like Farenheit, I’m all for this hack since its execution is top notch and it allows us to learn plenty with it.

  8. Another problem with these units is the AQI is computed using the Chinese formula, resulting in much lower numbers than if it was computed using US or EU formulas, for instance. That AQI shows up in the AQI box and the bottom bar of the display.

  9. Using Ghidra to reverse engineer some firmware, modify and flash onto the system chip is definitely on my to do list.

    Great product also and thinking might be an excellent tutorial project to follow along with as a first, along with having a standard system to work from for later similar project exercises.

Leave a Reply to spambakeCancel reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.