Photo of the spectrophotometer in question, with a screenshot of the decoding software on the right

Exporting Data From Old Gear Through LCD Sniffing

May 5, 2022 by Arya Voronova 27 Comments

[Jure Spiler] was at a flea market and got himself a spectrophotometer — a device that measures absorbance and transmittance of light at different wavelengths. This particular model seems to be about 25 years old, and it’s controlled by a built-in keyboard and uses a graphical LCD to display collected data. That might have been acceptable when it was made, but it wasn’t enough for [Jure]. Since he wanted to plot the spectrophotometry data and be able to save it into a CSV file, hacking ensued.

He decided to tap into the the display communication lines. This 128×64 graphical display, PC-1206B, uses a 8-bit interface, so with a 16-channel logic analyzer, he could see the data being sent to the display. He even wrote decoder software – taking CSV files from the logic analyzer and using primitive optical recognition on the decoded pixels to determine the digits being shown, and drawing a nice wavelength to absorbance graph. From there, he set out to make a standalone device sniffing the data bus and creating a stream of data he could send to a computer for storage and processing.

[Jure] stumbled into a roadblock, however, when he tried to use an Arduino for this task. Even using a sped-up GPIO library (as opposed to notoriously inefficient digitalRead), he couldn’t get a readout frequency higher than 80 KHz – with the required IO readout rate deemed as 1 MHz, something else would be called for. We do wonder if something like RP2040 with its PIO machinery would be better for making such captures.

At that point, however, he found out that there’s undocumented serial output on one of the pins of the spectrophotometer’s expansion port, and is currently investigating that, having shelved the LCD sniffing direction. Nevertheless, this serves as yet another example for us, for those times when an LCD connection is all that we can make use of.

We’ve seen hackers sniff LCD interfaces to get data from reflow ovens, take screenshots from Game Boys and even equip them with HDMI and VGA ports afterwards. With a skill like this, you can even give a new life to a vintage calculator with a decayed display! Got an LCD-equipped device but unsure about which specific controller it uses? We’ve talked about that!

Continue reading “Exporting Data From Old Gear Through LCD Sniffing” →

Screenshot of Pulseview showing capture and decode of some digital channels

Need A Logic Analyzer? Use Your Pico!

March 2, 2022 by Arya Voronova 23 Comments

There’s a slew of hardware hacker problems that a logic analyzer is in a perfect position to solve. Whether you’re trying to understand why an SPI LCD screen doesn’t initialize, what’s up with your I2C bus, or determine the speed of an UART connection, you’ll really want to have a logic analyzer on hand. People have been using a Pi Pico as a logic analyzer in a pinch, and now [pico-coder] has shared a sigrok driver that adds proper support for a Pico to beloved tools like Pulseview.

The specs offered are impressive. Compared to the $10 “Saleae” clone analyzers we are so used to, this thing boasts 21 digital channels with up to 120 MHz capture speed, 3 ADC channels at up to 500 KHz, and hardware-based triggers. The GitHub repository linked above stores the driver files out-of-tree, but provides build instructions together with an easily flash-able uf2 firmware. It’s likely that you’ll soon see this driver in a stock Pulseview installation, however, given the submitter-friendly attitude we’ve witnessed on the sigrok mailing list. However, if you need a logic analyzer ASAP, you should follow the caringly offered quickstart guide.

We’ve covered Pulseview being used in combination with cheap accessible analyzers before — a must-watch if you need to get yourself up to speed on the value they provide to a hobbyist. If an oscilloscope is what you need and a smartphone is what you have, perhaps you’ll enjoy the Scoppy firmware for the Pico.

We thank [mip] for sharing this with us!

Logic Meter Aims To Make Hobby Electronics Troubleshooting Easier

January 28, 2021 by Dan Maloney 28 Comments

The basic test instrument suite — a bench power supply, a good multimeter and perhaps an oscilloscope — is extremely flexible, but not exactly “plug and play” when it comes to diagnosing problems with some common hardware setups. A problem with a servo driver, for example, might be easy enough to sort of with a scope, but setting everything up to see what’s going on with the PWM signal takes some time.

There’s got to be a better way to diagnose hobby electronics woes, and if [Bob Alexander] has his way, his “Logic Meter”, or something very close to it, will be the next must-have bench tool. The Logic Meter combines some of the functionality of an oscilloscope and a logic analyzer into a handy instrument that’s as easy to use as a multimeter. The Logic Meter’s probes connect to logic-level signals in a circuit and can be set up to capture or send serial data, either directly to or from a UART or via an SPI bus connection. There are also functions for testing servos and similar devices with a configurable PWM output. [Bob] rounds out the functionality with a GPS simulator and a simple logic analyzer, plus some utility functions.

The beauty part of the Logic Meter is that [Bob] has left where it goes next largely up to the community. He’s got a GitHub repo with details on the PIC32-based hardware, and the video below makes it clear that this is just a jumping-off point to further work that he hopes results in a commercial version of the Logic Meter. That’s a refreshing attitude, and we hope it pays off; from the look of a few of [Bob]’s retrocomputing makeovers, something like the Logic Meter could come in pretty handy.

Continue reading “Logic Meter Aims To Make Hobby Electronics Troubleshooting Easier” →

Teaching A Pocket Logic Analyzer (Many) New Tricks

October 1, 2020 by Tom Nardi 8 Comments

A few years ago, low-cost pocket digital oscilloscopes aimed at the hacker and maker crowd started hitting the market and gained quite a following. While few would consider them to be a replacement for a proper bench scope, they’re cheap and convenient enough that it’s hard to complain. Manufacturers are apparently looking to expand on the concept, as we’re now seeing similarly priced and sized logic analyzers pop up from the usual sources.

[Gabriel Valky] got his hands on a sub-$100 USD model known as the LA104, and decided that the stock software didn’t quite deliver. So he started a project to create a new open source firmware for the affordable gadget that greatly expands its core functionalities. The code has even been ported to a few of those digital oscilloscopes, as it turns out (perhaps unsurprisingly) that they aren’t too far removed internally.

Controlling addressable LEDs with the LA104.

In the video after the break, [Gabriel] shows off some impressive radio tricks by adding a small CC1101 transceiver to the mix. This allows his modified LA104 to scan for and decode popular RF protocols in the 300 – 900 MHz range. His software even allows for the received packets to be modified and re-transmitted, which he demonstrates by pushing a fake temperature signal into a wireless weather station.

But that’s just the beginning. A perusal of the GitHub page for his replacement firmware shows just how many features have already been packed into this project. For example it can be used to control WS2812 LED strips, generate arbitrary PWM signals, log data from temperature sensors, interface with MIDI devices, and scan for I2C devices. Many of these functions can be controlled on the computer by utilizing a modern browser and WebUSB.

The replacement firmware that [Gabriel] has come up with for the LA104 is really an incredible accomplishment, and elevates an already intriguing piece of kit. Being able to pack all of these functions into something small and cheap enough you can toss into a bag is a very compelling prospect for hackers on the go.

Continue reading “Teaching A Pocket Logic Analyzer (Many) New Tricks” →

Bus Sniffing Leads To New Display For Vintage Casio

March 8, 2020 by Tom Nardi 11 Comments

Despite his best efforts to repair the LCD on his Casio FX-702P, it soon became clear to [Andrew Menadue] that it was a dead-end. Rather than toss this relatively valuable device in the trash, he wondered if would be possible to replace the LCD with a more modern display. Knowing that reverse engineering the LCD panel itself would be quite a challenge, he decided instead to focus his efforts on decoding the communications between the calculator’s processor and display controller.

With his logic analyzer connected to the Casio’s four bit bus [Andrew] was able to capture a sequence of bytes during startup that looked promising, although it didn’t quite make sense at first. He had to reverse the order of each nibble, pair them back up into bytes, and then consult the FX-702P’s character map as the device doesn’t use ASCII. This allowed him to decode the message “READY”, and proved the concept was viable.

Of course a calculator with a logic analyzer permanently attached to it isn’t exactly ideal, so he started work on something a bit more compact. Armed with plenty of display controller data dumps, [Andrew] wrote some code for a STM32 “Blue Pill” ARM Cortex M3 microcontroller that would sniff and decode the data in near real-time. In the video after the break you can see there’s a slight delay between when he pushes a button and when the corresponding character comes up on the LCD below, but it’s certainly usable.

Unfortunately, the hardware he’s created for this hack is just slightly too large to fit inside the calculator proper. The new LCD is also nowhere near the size and shape that would be required to replace the original one. But none of that really matters. While [Andrew] says he could certainly make the electronics smaller, the goal was never to restore the calculator to like-new condition. Sometimes it’s more about the journey than the destination.

Continue reading “Bus Sniffing Leads To New Display For Vintage Casio” →

Unlocking SIM Cards With A Logic Analyzer

January 2, 2020 by Tom Nardi 20 Comments

[Jason Gin] wanted to reuse the SIM card that came with a ZTE WF721 wireless terminal he got from AT&T, but as he expected, it was locked to the device. Unfortunately, the terminal has no function to change the PIN and none of the defaults he tried seemed to work. The only thing left to do was crack it open and sniff the PIN with a logic analyzer.

This project is a fantastic example of the kind of reverse engineering you can pull off with even a cheap logic analyzer and a keen eye, but also perfectly illustrates the fact that having physical access to a device largely negates any security measures the manufacturer tries to implement. [Jason] already knew what the SIM unlock command would look like; he just needed to capture the exchange between the WF721 and SIM card, find the correct byte sequence, and look at the bytes directly after it.

Finding the test pads on the rear of the SIM slot, he wired his DSLogic Plus logic analyzer up to the VCC, CLK, RST, and I/O pins, then found a convenient place to attach his ground wire. After a bit of fiddling, he determined the SIM card was being run at 4 MHz, so he needed to configure a baud rate of 250 kbit/s to read the UART messages passing between the devices.

Once he found the bytes that signified successful unlocking, he was able to work his way backwards and determine the unlock command and its PIN code. It turns out the PIN was even being sent over the wire in plain text, though with the way security is often handled these days, we can’t say it surprises us. All [Jason] had to do then was put the SIM in his phone and punch in the sniffed PIN when prompted.

Could [Jason] have just run out to the store and picked up a prepaid SIM instead of cracking open this wireless terminal and sniffing its communications with a logic analyzer? Of course. But where’s the fun in that?

The Bluetooth LCD Sniffer You Didn’t Know You Needed

July 29, 2019 by Tom Nardi 16 Comments

At one time or another, we’ve all suffered through working with a piece of equipment that didn’t feature a way to export its data to another device. Whether it was just too old to offer such niceties, or the manufacturer locked the capability behind some upgrade, the pain of staring at digits ticking over on a glowing LCD display and wishing there was a practical way to scrape what our eyes were seeing is well known to hackers.

That was precisely the inspiration for DoMSnif, the dot matrix LCD sniffer that [Blecky] has been working on. Originally the project started as a way to record the temperature of his BRTRO-420 reflow oven, but realizing that such a device could have widespread appeal to other hardware hackers, he’s rightfully decided to enter it into the 2019 Hackaday Prize. If perfected, it could be an excellent way to bolt data capture capabilities to your older devices.

The first phase of this project was figuring out how to capture and parse the signals going into the device’s KS0108 LCD. Getting the data was certainly easy enough, he just had to hook a logic analyzer up between the display and the main board of the device. Of course, figuring out what it all means is a different story.

After running the oven for a bit with the analyzer recording, [Blecky] had more than enough data to get started on decoding it. Luckily, the layout of this fairly common 128×64 pixel display is well documented and easy enough to understand. With a little work, he was able to create a tool that would import the captured data and display it on a virtual LCD.

Unfortunately, the Bluetooth part is where things get tricky. Ultimately, [Blecky] wants to ditch the logic analyzer and use a Adafruit Feather nRF52 Bluefruit to capture the signals going to the LCD and pipe them to a waiting device over Bluetooth. But his testing has found that the nRF52’s radio is simply too slow. The display is receiving data every 14us, but it takes the radio at least 50us to send a packet.

[Blecky] is looking at ways around this problem, and we’re confident he’ll crack it. The solution could be in buffering and compressing the data before sending it out, though you’d lose the ability to monitor the display in real-time. Even if he has to abandon the Bluetooth aspect entirely and make the device wired, we still think there would be a market for an easy to use hardware and software solution for scraping LCD data.