Ducted Fan Drone Flies

July 4, 2015 by Anool Mahidharia 19 Comments

A while back, we wrote about the ducted fan, single rotor, VTOL drone that [Armin Strobel] was working on. It wasn’t quite finished then, and hadn’t got off the ground yet. He’s posted an update, and from the looks of it, he’s made tons of progress, including a first flight with successful take-off and landing.

The successful flight was no coincidence. Tuning any kind of ‘copter is a tricky business. Handling them manually during testing could be outright dangerous. So he built two different test-beds from pieces of wood, some 3D printed parts and bearings. One lets him mount the drone and tune its pitch (and roll), while the other lets him tune the yaw parameters. And just like they do in wind tunnel testing, he fixed short pieces of yarn at various points on the air frame to check for turbulence. Doing this also gave him some insight into how he could improve the 3D printed air-frame in the next iteration. He repeated the tests on the two test beds, going back and forth to make sure the tuning parameters were not interfering with each other. He also modified the landing gear to improve stability during take-off and landing and to prevent tipping. [Armin] is using the PixHawk PX4 for flight control and a BeagleBone Black for higher level functions and control.

Once the first flight showed that the drone could do stable flight, he attached a Go-Pro and recorded some nice video on subsequent flights. The next steps are to fine tune the flight control parameters to ensure stable hovering with position hold and way point following. He may also 3D print an improved air-frame. For details about the build, check out our earlier blog post on the Ducted Fan Drone. Check out the two videos below – one showing the first flight of the Drone, and the other one about the test beds being used for tuning.

Continue reading “Ducted Fan Drone Flies” →

Rotary Indexer Gives Mill A 4th Axis (sort Of)

July 4, 2015 by Anool Mahidharia 23 Comments

Rotary indexer’s are standard issue in most machine shops. These allow you to hold or chuck a work piece, and then a graduated handle lets you to rotate the workpiece. Useful when you want to drill or tap axial or radial features. A rack and pinion drive ensures that the workpiece does not move under machining load. Quite often, these indexers also have a manual lock to take care of gear backlash and play. Automating them is not too difficult either. You could use just a stepper motor (open loop) or servo+encoder (closed loop) to drive the turntable.

[smashedagainst] needed to drill six radial holes on a part. And he had to do it on 500 pieces for a total of 3000 holes. That was just for the first initial run, with more drilling likely in the future. The part in question was small and light weight. So instead of using a heavy duty, industrial grade unit, he built an all-electric rotary indexing jig using a stepper motor and an Arduino, giving him a sort of rotary 4th axis. His idea was to directly use the stepper motor to rotate the workpiece without any gearing, but he needed to build his own rig to do so.

Continue reading “Rotary Indexer Gives Mill A 4th Axis (sort Of)” →

Retro-fit Old Radio With Arduino And FM Module

July 2, 2015 by Anool Mahidharia 30 Comments

“You can’t put new wine in old bottles” – so the saying goes. But you would if you’re a hacker stuck with a radio built in 2005, which looked like it was put together using technology from 1975. [Marcus Jenkins] did just that, pulling out the innards from his old radio and converting it to an Arduino FM radio.

His cheap, mains powered radio was pretty bad at tuning. It had trouble locating stations, and tended to drift. One look at the insides, and it was obvious that it was not well engineered at all, so any attempts at fixing it would be pointless. Instead, he drew up a simple schematic that used an Arduino Nano, an FM radio module based on the TEA5767, and an audio amplifier based on the LM386.

A single button on the Arduino helps cycle through a range of preset frequencies stored in memory. The Arduino connects to the FM radio module over I2C. The existing antenna was connected to the TEA5767 module. The radio module outputs stereo audio, but [Marcus] was content with using just a mono channel, as it would be used in his workshop. The audio amplifier is pretty straightforward, based on a typical application found in the data sheet. He put it all together on proto-board, although soldering the FM radio module was a bit tricky. The Arduino code is quite simple, and available for download (zip file).

He retained the original tuning knob, which is no longer functional. The AM-FM selector knob was fitted with a micro-switch connected to the Arduino for selecting the preset stations. Almost everything inside was held together with what [Marcus] calls “hot-snot” glue. The whole exercise cost him a few Euros, and parts scavenged from his parts bin. A good radio could probably be had for a few Euros from a yard sale and much less effort, but that wouldn’t be as cool as this.

Go deeper and explore how FM signals are modulated and demodulated for playback.

Pneumatic Multiplexer

June 23, 2015 by Anool Mahidharia 17 Comments

This is a pretty cool project [Sebastian Morales] is working on – a 3D printed Pneumatic Multiplexer. Large interactive installations, kinetic art and many other applications require large numbers of actuators to be controlled. For these type of projects to work, a large number of actuators equals higher resolution and that allows the viewer to be captivated by the piece.

The larger the system becomes, the more complex it becomes to control all of those actuators. [Sebestian] wanted to move a large number of components with a relatively low number of inputs. He thought of creating a mechanical equivalent of the familiar electronic X-Y matrix that can control large quantities of outputs using only a few inputs – in a more descriptive form, Outputs=(Inputs/2)^2.

He looked at chemical reactions that change liquids in to gases, but that seemed pretty complicated. Refrigerants used in air conditioning looked promising, but their handling and safety aspects looked challenging.

Eventually, he decided to look at using “air logic“. Air logic uses pneumatic devices to create relays, limit switches, AND gates, NAND gates, OR gates, amplifiers, equivalent to electrical circuits. Electrical energy is replaced with compressed air. His plan was to build a multiplexer whose elements would open only if the combination of pressure between both lines was the right one. As in electronics, NAND logic is easy to implement. A moving element creates a seal and only allows air out if the bottom line was low and the top line was high.

He had access to a high resolution, resin based 3D printer which allowed him to create fully air-tight systems. He started with prototyping a small 4×4 matrix to test out his design, and had to work through 6 to 7 iterations before he could get it to work. The next step was to create a larger matrix of 100 elements controlled by 20 inputs (10×10 matrix). He created Omnifarious – a kinetic sculpture demonstrating the concept of shapeshifting objects. The Omnifarious is a hexecontahedron which would be able to transform its surface to render different geometries via 59 balloons on its surface. Below, you can check the videos of his progress building the various prototypes and another video showing the Omnifarious sculpture.

Continue reading “Pneumatic Multiplexer” →

USB2Serial Adapter As An I/O Device

June 21, 2015 by Anool Mahidharia 19 Comments

There was a time when computers had parallel ports. For the hacker types, this meant an eight bit data port, and nine additional pins which could be interfaced with the real world via the 25 pin connector. This is no longer the case, although USB does help with suitable hardware. [Jabi] was working on a project that required controlling one relay to switch a strip of LED’s. His solution was to use a USB to Serial Adapter as an I/O device (Spanish, translated here).

He wrote a short C program, SioFus (Simple Input Output from USB2SERIAL), that converts a simple USB to Serial Port Adapter into an I/O device with 4 inputs and 2 outputs. It’s simple and gets the job done. The code uses ioctl and allows DCD, DSR, CTS and RI to act as inputs while DTR and RTS act as outputs. These pins then likely control transistors that switch the relays. The SioFus code is available on github and there are a couple of to-do’s on [Jabi]’s list if you would like to chip in.

The video after the break supposedly shows the hack in action. Seems like some kind of photo booth which then spits out a QR code, possibly a URL to the picture (post in the comments if you figure out what it does).

If you are looking for a more dedicated hardware, check out the Tiny Bit Dingus – a microcontroller stuffed into a USB plug with a few controllable pins.

Continue reading “USB2Serial Adapter As An I/O Device” →

IR Remote For Smartphone Via Bluetooth Adapter

June 19, 2015 by Anool Mahidharia 8 Comments

Quite often, the raison d’être for building a project is to learn and hone one’s skills. In which case it doesn’t matter if the end use seems a bit frivolous. [indiantinker] built BlueIR, a device to control Bluetooth A2DP devices using an archaic IR Remote using a BT-Aux Adapter.

Sounds convoluted? Let’s try again. He uses an old IR remote to send data to a MSP430-series microcontroller, which is connected over serial to a USB Bluetooth Receiver Adapter, which in turn is connected to a set of wired speakers. The Bluetooth adapter is paired with his phone. The IR remote allows him to control the audio player commands on his phone from a far greater distance compared to the bluetooth adapter.

He begins by breaking open the BT adapter to find that the markings on the chip have been erased. What he did find instead, were two pads promisingly marked as TX and RX, but he still did not know the baud rate or the command set. Digging around the Internet, he figured out that the chip used was the OVC3860 Bluetooth 2.0 + EDR Stereo Audio Processor and found its list of AT Commands. After some tests using a serial console he figured out that it worked at 115600 baud. Soon enough, he had it hooked up to the MSP430 Launchpad and was able to communicate. Next up, he built a small PCB, using the toner transfer method. The board consists of the MSP430G2553 micro controller, IR receiver, LED, some decoupling capacitors and a few pull up resistors. He leached power from the 3.3V regulator on the host BT adapter. The assembled PCB is piggy backed on top of the BT adapter for the time being, and a 3d printed housing is on his to-do list. His code is available at the BlueIR Github repo and the video below shows it in action.

Continue reading “IR Remote For Smartphone Via Bluetooth Adapter” →

Hacking The IM-ME To Open Garages

June 8, 2015 by Anool Mahidharia 32 Comments

If you have a wireless controlled garage door, a child’s toy can wirelessly open it in a few seconds. [Samy Kamkar] is a security researcher who likes to”think bad, do good”. He’s built OpenSesame, a device that can wirelessly open virtually any fixed-code garage door in seconds, exploiting a new attack he’s discovered in wireless fixed-pin devices, using the Mattel IM-ME toy.

The exploit works only on a gate or garage which uses “fixed codes”. To prevent this type of attack, all you need to do is to upgrade to a system which uses rolling codes, hopping codes, Security+ or Intellicode. These are not foolproof from attack, but do prevent the OpenSesame attack along with other traditional brute forcing attacks. It seems there are at least a couple of vendors who still have such vulnerable products, as well as several more whose older versions are affected too.

Before you read further, a caveat – the code released by [Samy] is intentionally bricked to prevent it from being abused. It might work, but just not quite. If you are an expert in RF and microcontrollers, you could fix it, but then you wouldn’t need his help in the first place, would you?

The IM-ME is a defunct toy and Mattel no longer produces it, but it can be snagged from Amazon or eBay if you’re lucky. The Radica Girltech IM-ME texting toy has been extensively hacked and documented. Not surprising, since it sports a TI CC1110 sub-GHz RF chip, an LCD display, keyboard, backlight, and more. A good start point is the GoodFET open-source JTAG adapter, followed by the work of [Travis Godspeed] , [Dave] and [Michael Ossmann].

One issue with fixed code systems is their limited key space. For example, a remote with 12 binary dip switches supports 12 bits of possible combinations. Since its binary and 12 bits long, that’s 2^12, which is 4096 possible combinations. With a bit of math, [Samy] shows that it takes 29 minutes to open an (8-12)-bit garage, assuming you know the frequency and baud rate, both of which are pretty common. If you have to attempt a few different frequencies and baud rates, then the time it takes is a multiple of 29 minutes. If you don’t transmit the codes multiple times, and remove the pauses in between codes, the whole exercise can be completed in 3 minutes.

The weak link in the hardware is how the shift registers which decode the received codes work. Each bit is loaded in the register sequentially, gradually moving as additional bits come in and push the previous ones. This, and using an algorithm [Samy] wrote based on the De Bruijn sequence, the whole brute force attack can be completed in just over 8 seconds. OpenSesame implements this algorithm to produce every possible overlapping sequence of 8-12 bits in the least amount of time.

You can take a look at understanding how the code works by checking it out on Github. [Samy] loves doing such investigative work – check out his combo lock code breaker we featured recently, the scary, keyboard sniffing wall wart and the SkyJack – a drone to hack all drones.

Continue reading “Hacking The IM-ME To Open Garages” →