The microcontroller described in the article, on the PCB taken out of the kettle

Dumping Encrypted-At-Rest Firmware Of Xiaomi Smart Kettle

May 4, 2022 by Arya Voronova 52 Comments

[aleaksah] got himself a Mi Smart Kettle Pro, a kettle with Bluetooth connectivity, and a smartphone app to go with it. Despite all the smarts, it couldn’t be turned on remotely. Energized with his vision of an ideal smart home where he can turn the kettle on in the morning right as he wakes up, he set out to right this injustice. (Russian, translated) First, he tore the kettle down, intending to dump the firmware, modify it, and flash it back. Sounds simple enough — where’s the catch?

This kettle is built around the QN9022 controller, from the fairly open QN902X family of chips. QN9022 requires an external SPI flash chip for code, as opposed to its siblings QN9020 and QN9021 which have internal flash akin to ESP8285. You’d think dumping the firmware would just be a matter of reading that flash, but the firmware is encrypted at rest, with a key unique to each MCU and stored internally. As microcontroller reads the flash chip contents, they’re decrypted transparently before being executed. So, some other way had to be found, involving the MCU itself as the only entity with access to the decryption key.

Continue reading “Dumping Encrypted-At-Rest Firmware Of Xiaomi Smart Kettle” →

Screenshot of a logic analyzer software, showing the SDA channel being split into three separate traces

I2C Tap Helps Assign Blame For SDA Conflicts

May 2, 2022 by Arya Voronova 8 Comments

If you’ve ever debugged a misbehaving I2C circuit, you probably know how frustrating it can be. Thankfully [Jim] over at Hackaday.io, has a proto-boardable circuit that can help!

Inter-integrated circuit bus (aka I2C) uses open collector outputs on a two wire interface. Open collector means a device connected to the I2C bus can only pull the bus down to ground. Chips never drive a logic “HIGH” on the wires. When nothing is driving the lines low, a weak resistor pulls the lines up to VCC. This is a good thing, because I2C is also a multidrop bus — meaning many devices can be connected to the bus at the time. Without open collector outputs, one chip could drive a high, while another drives a low – which would create a short circuit, possibly damaging both devices.

Even with all this protection, there can be problems. The SCL and SDA lines in the I2C communication protocol are bidirectional, which means either a controller or a peripheral can pull it low. Sometimes, when tracing I2C communications you’ll need to figure out which part is holding the line low. With many devices sharing the same bus, that can become nigh-impossible. Some folks have tricks with resistors and analog sampling, but the tried and true method of de-soldering and physically lifting chip pins off the bus often comes into play.

[Jim’s] circuit splits SDA signal into controller-side and peripheral-side, helping you make it clear who is to blame for hiccups and stray noise. To do that, he’s using 6N137 optoisolators and LMV393 comparators. [Jim] shared a NapkinCAD schematic with us, meant to be replicate-able in times of dire need. With this design, you can split your I2C bus into four separate channels – controller-side SDA, peripheral-side SDA, combined SDA and SCL. 4 Channels might be a lot for a scope, but this is no problem for today’s cheap logic analyzers.

Continue reading “I2C Tap Helps Assign Blame For SDA Conflicts” →

Track Those Leftovers With This Little Timer

May 1, 2022 by Jenny List 28 Comments

We’ve all at some point in our lives opened the fridge door and immediately wished we hadn’t. A miasma of stench envelops us as we discover that last Saturday’s leftovers have been forgotten, and have gone off. If only we had some way to keep track of such things, to avoid such a stench-laden moment. Step forward [ThinkLearnDo], with a little timer designed for exactly that purpose.

The operation is simple enough, press the button and place the unit on top of the container with the leftovers in it. If you haven’t eaten the leftovers within a week, the LED will start blinking. The blink is a subtle reminder to deal with the old food before it becomes a problem.

Onboard is a Holtek HT68F001 microcontroller with a coin cell for power, not much else is needed. The Holtek is an unusual choice, one of several brands of super-inexpensive Chinese microcontrollers we see less commonly than ATmegas and STM32s. This is exactly the place where such a minimal computer fits perfectly: a way to add a little bit of smarts to a very cheap item with minimal strain on the BoM.

If these chips interest you, a while back we covered a run-down of the different families including the Holtek and the famous 3-cent Padauk chips.

All-In-One Automated Plant Care

May 1, 2022 by Bryan Cockfield 18 Comments

Caring for a few plants, or even an entire farm, can be quite a rewarding experience. Watching something grow under and then (optionally) produce food is a great hobby or career, but it can end up being complicated. Thanks to modern technology we can get a considerable amount of help growing plants, even if it’s just one plant in a single pot.

Plant Bot from [YJ] takes what would normally be a wide array of sensors and controllers and combines them all into a single device. To start, there is a moisture sensor integrated into the housing so that when the entire device is placed in soil it’s instantly ready to gather moisture data. Plant Bot also has the capability to control LED lighting if the plant is indoors. It can control the water supply to the plant, and it can also communicate information over WiFi or Bluetooth.

The entire build is based around an ESP32 which is integrated into the PCB along with all of the other sensors and components needed to monitor a single plant. Plant Bot is an excellent all-in-one solution for caring for a plant automatically. If you need to take care of more than one at a time take a look at this fully automated hydroponic mini-farm.

Automatic Turntable Makes Photogrammetry A Cinch

April 28, 2022 by Lewin Day 9 Comments

Photogrammetry is a great way to produce accurate 3D models of real objects. A turntable is often a common tool used in this work as it helps image an object from all angles. [Peter Lin] wanted a way to run the photogrammetry process with minimal human intervention, and set about building an automated turntable setup.

The build relies on a smartphone to take images of the physical object. The phone is triggered to take photos by an ESP8266, which fires the shutter via the phone’s audio socket. The microcontroller then turns the turntable on for a short period of time after each shot, rotating it by a set angle.

The build still requires objects to be repositioned in various orientations on the turntable now and then, in order to capture the top and bottom areas that would otherwise be obscured. However, the grunt work of taking the photos and rotating the objects is now entirely automated.

It’s a useful build for anyone that finds themselves regularly imaging objects to create 3D models. The results of [Peter]’s rig look great, and as a bonus come with life-like textures ready to go. We’ve seen some other great photogrammetry builds before, too. Video after the break.

Continue reading “Automatic Turntable Makes Photogrammetry A Cinch” →

A Rotary Encoder: How Hard Can It Be?

April 20, 2022 by Al Williams 70 Comments

As you may have noticed, I’ve been working with an STM32 ARM CPU using Mbed. There was a time when Mbed was pretty simple, but a lot has changed since it has morphed into Mbed OS. Unfortunately, that means that a lot of libraries and examples you can find don’t work with the newer system.

I needed a rotary encoder — I pulled a cheap one out of one of those “49 boards for Arduino” kits you see around. Not the finest encoder in the land, I’m sure, but it should do the job. Unfortunately, Mbed OS doesn’t have a driver for an encoder and the first few third-party libraries I found either worked via polling or wouldn’t compile with the latest Mbed. Of course, reading an encoder isn’t a mysterious process. How hard can it be to write the code yourself? How hard, indeed. I thought I’d share my code and the process of how I got there.

There are many ways you can read a rotary encoder. Some are probably better than my method. Also, these cheap mechanical encoders are terrible. If you were trying to do precision work, you should probably be looking at a different technology like an optical encoder. I mention this because it is nearly impossible to read one of these flawlessly.

So my goal was simple: I wanted something interrupt driven. Most of what I found required you to periodically call some function or set up a timer interrupt. Then they built a state machine to track the encoder. That’s fine, but it means you eat up a lot of processor just to check in on the encoder even if it isn’t moving. The STM32 CPU can easily interrupt with a pin changes, so that’s what I wanted.

The Catch

The problem is, of course, that mechanical switches bounce. So you have to filter that bounce either in hardware or software. I really didn’t want to put in any extra hardware more than a capacitor, so the software would have to handle it.

I also didn’t want to use any more interrupts than absolutely necessary. The Mbed system makes it easy to handle interrupts, but there is a bit of latency. Actually, after it was all over, I measured the latency and it isn’t that bad — I’ll talk about that a little later. Regardless, I had decided to try to use only a pair of interrupts.

Continue reading “A Rotary Encoder: How Hard Can It Be?” →

OLED Display Kicks Knob Up Several Accurate Notches

April 19, 2022 by Tom Nardi 9 Comments

As far as input devices go, the potentiometer is pretty straightforward: turn it left, turn it right, and you’ve pretty much seen all there is to see. For many applications that’s all you need, but we can certainly improve on the experience with modern technology. Enter this promising project from [upir] that pairs a common potentiometer with a cheap OLED display to make for a considerably more engaging user experience.

To save time, the code is fine tuned in a simulator.

The basic idea is to mount the display over the potentiometer knob so you can show useful information such a label that shows what it does, and a readout of the currently detected value. But you’ll likely want to show where the knob is currently set within the range of possible values as well, and that’s where things get interesting.

In the video after the break, [upir] spends a considerable amount of time explaining the math behind details like the scrolling tick marks. The nearly 45 minute long video wraps up with some optimization, as getting the display to move along with the knob in real-time on an Arduino UNO took a bit of extra effort. The final result looks great, and promises to be a relatively cheap way to add an elegant and functional bit of flair to an otherwise basic knob.

With the code and this extensive demonstration of how it all works, adding a similar capability to your next knob-equipped gadget shouldn’t be too much of a challenge. Perhaps it could even be combined with the OLED VU meters we’ve covered previously. Be sure to let us know if you end up using this technique, as we’d love to see it in action.

Continue reading “OLED Display Kicks Knob Up Several Accurate Notches” →