Ghidra Used To Patch Fahrenheit Into An Air Quality Meter

February 15, 2021 by Maya Posch 73 Comments

Even though most of the world population couldn’t tell you what room or body temperature is in Fahrenheit, there are some places on this globe where this unit is still in common use. For people in those areas, it’s therefore a real hassle when, say, a cheap Chinese air quality measurement systems only reports in degrees Celsius. Fortunately, [BSilverEagle] managed to patch such a unit to make it display temperature in Fahrenheit.

The reverse engineering begins by finding a way to dump the firmware. It’s nice to hear that [BSilverEagle] used some the skills demonstrated in [Eric Shlaepfer’s] PCB reverse engineering workshop from Hackaday Remoticon last November to trace out the debug header and the SWD pins of STM32F103C8 MCU. After that, OpenOCD could be used to dump the firmware image, with no read protection encountered. The firmware was then reverse-engineered using Ghidra, so that [BSilverEagle] could figure out where the temperature was being calculated and where the glyph for the Celsius symbol was stored. From there this it was a straight-forward rewrite of those two parts of the original firmware to calculate the temperature value in Fahrenheit, change the glyph and reflash the MCU.

So why buy this thing in the first place if it didn’t spit out units useful for your current locale? Cost. Buying this consumer(ish) device was about the same cost as buying the individual parts, designing and manufacturing the PCB, and writing the firmware for it. The only downside for their use case was the lack of Fahrenheit. Not a problem for those who demand full control of the hardware they own.

Need a boot camp for using Ghidra? Matthew Alt put together a spectacular video series on Reverse Engineering with Ghidra.

Convert Temperatures The Analog Way

August 10, 2017 by Dan Maloney 28 Comments

Everyone knows how to convert from Celsius to Fahrenheit, right? On a digital thermometer you just flick the little switch, on a weather app you change the settings, or if worse comes to worse, you let Google do the math for you. But what if you want to solve the problem the old-fashioned way? Then you pull out a few op amps and do your conversions analog style.

We’ve seen before how simple op amp circuits can do basic math, and the equation that [Kerry Wong] wants to solve is even simpler. Recalling the old T_f= 9/5·T_c + 32 formula (and putting aside the relative merits of metric versus traditional units; we’ve had enough of that argument already), [Kerry] walks us through a simple dual op amp circuit to convert the 1 mV/°C output of a thermocouple module to 1 mV/°F. The scaling is taken care of by a non-inverting amplifier with resistors chosen to provide a gain of 1.8, while the offset is handled by a differential amplifier that adds 32 mV to the scaled input. Strategically placed trimmers allow [Kerry] to tweak the circuit to give just the right conversion.

For jobs like this, it’s tempting to just use an analog input on an Arduino and take care of conversions in code. But it’s nice to know how to do it old school, too, and hats off to [Kerry] for showing us the details.

Continue reading “Convert Temperatures The Analog Way” →

Logging Engine Temperature For RC Models

June 22, 2015 by Rick Osgood 20 Comments

[Rui] enjoys his remote-controlled helicopter hobby and he was looking for a way to better track the temperature of the helicopter’s engine. According to [Rui], engine temperature can affect the performance of the craft, as well as the longevity and durability of the engine. He ended up building his own temperature logger from scratch.

The data logger runs from a PIC 16F88 microcontroller mounted to a circuit board. The PIC reads temperature data from a LM35 temperature sensor. This device can detect temperatures up to 140 degrees Celsius. The temperature sensor is mounted to the engine using Arctic Alumina Silver paste. The paste acts as a glue, holding the sensor in place. The circuit also contains a Microchip 24LC512 EEPROM separated into four blocks. This allows [Rui] to easily make four separate data recordings. His data logger can record up to 15 minutes of data per memory block at two samples per second.

Three buttons on the circuit allow for control over the memory. One button selects which of the four memory banks are being accessed. A second button changes modes between reading, writing, and erasing. The third button actually starts or stops the reading or writing action. The board contains an RS232 port to read the data onto a computer. The circuit is powered via two AA batteries. Combined, these batteries don’t put out the full 5V required for the circuit. [Rui] included a DC-DC converter in order to boost the voltage up high enough.