Ricoh SP C250DN (Toner page couter reset) follow up

As described in an earlier Post, I hacked the Ricoh toner cartridge page counter in order to be able to refill them. Today I finally got around to draw a small box-shaped enclosure with four small pogo pins as the connecting element between the MCU and the cartridge. Because the flashing process does require external power, I added a standard USB-cable to connect to any 5V supply available. This really is handy, because the printer's USB port does also work just fine. As far as the circuit goes nothing really has changed. I added a 3mm yellow led to light up while flashing of the cartridge is in progress. In addition it does flash continuously on and off, if writing or reading back has failed. The Software is slowed down a lot to ensure good physical connection and a stable state inside of the cartridge's IC. Using the device works as follows:

1. - Attach the device to a power supply
2. - Align the device with the cartridge 
3. - Wait for the yellow led to light up
4. - Wait until the led goes off
5. - done! If the led does flash instead of continuously off, start from step one again.

The finished "product"

The advantage of using pogo pins -> perfect contact for each pin!

New power supply!

Say hello to my new precision laboratory power supply! I lusted after a good precision and adjustable power supply for years. Finally a week ago I decided to look after one that does fit my requirements. I was searching for at least two adjustable outputs, constant current and voltage mode, a sequencing funktion and a nice user interface. Of cause you'll find a lot of power supplys with these specs as they are really common, but on the user interface side most of them suck. The probably worst UI I've ever used was a Siglent unit and according to a few YouTube videos nothing has changed in the newer models, they still suck. For power supplys with that price to performance ratio a shame... Next brand on my list was GWInstek. Unfortunately these units are waaay out of my budget, so I continued with Korad units. Because I used these power supplys before I already knew their value.
Most of the smaller units only have one output and only 'for the price adequate' precision. But I still left them in mind in case I don't find something more suitable. Then I considered buing a used Rigol as they are a dream to use an really well build. You may have seen my hacked Rigol Oscilloscope on some of my other Blogs and I'm really in love with the usabillity and specs. Buying a new unit wasn't worth thinking about... About 900€ are really high for a hobby use powersupply. But after searching on eBay I found a auction for a DP831A. I placed it on my viewing list and stopped searching for that night. The next day the auction was going to end. I placed my bid and suprisingly got the unit for a reasonable price.

Just a few days later the unit arrived in good shape. I hope the supply will be worth the money I spend for my usecases.

DIY FrSky Transmitter Part 1 (Taranis Allmode Project)

After two nights of messy code work I finally got my Testboard transmitting BIND packets. In other words I'm able to bind to a receiver and establish a connection. I did a few stupid mistakes, for example I swapped milliseconds and microseconds... But even here, in my non regular Workspace, without my Oscilloscope etc. I got it to work in almost no time at all. So far everything seems to be a little bit too easy. Even my code compiled on first attempt... SCARY!
I hope that I'll get it to transmit data packets until this weekend, so that I can try the functionality and stability of the connection on the airfield.
Short post this time, but I just wanted to keep you up to date.
In addition I attached a small Video to show you what I achieved so far. After I pressed the button on the Testboard you can see the receiver flashing and the transmitter lighing up as well.

Sorry for the poor video quality but it was already past midnight as I shot it.

Taranis Allmode considerations

A friend of mine pointed me into a totally different topic a couple days ago. He said he has heard about a firmware for the popular FrSky-Taranis, which I own too by the way, with which you can use Futaba and some other protocol receivers in addition to the standard FrSky ones.
Because this really sounds interesting and also really plausible, I did a quick Google search on that topic. Unfortunately I found nothing but a YouTube-Video which is clearly a Fake. The person in the Video has done just a small change to the OpenTx-Firmware and ran it on the Simulator. So nothing special there, just a different GUI. I also found some plug-in Modules which contain multiple HF-Modules to be able to talk to other protocol receivers. But this was not what I was aiming for.
I want to be able to use the stock Hardware and a modded firmware to talk to other protocol receivers.
After that I took apart my own Transmitter in order to see whether thats a plausible thing to do or not. In fact FrSky is using just a plugin module (XJT - Module, well known) as their main transmitter unit. But thats nothing special, they're clearly cutting the cost down by doing so. All the approvals and the design afford costs an awful amount of money and this way they can do changes or even a whole new transmitter without getting everything done again. As expected they used a small STM32 controller on the XJT module just to deal with all the protocol and telemetry stuff.
In addition to that they're holding that way their protocol secret and untouched by the OpenTx firmware. This last point is unfortunately the end for any further thoughts about just changing main processor firmware to be able to use other protocols because you'll need direct access to the RF IC. (This clearly proves my opinion to the video that I mentioned earlier)

But as always I just can't stop thinking about possible ways to hack something! So I took a closer look to the board and investigated some parts of it. And yes there are at least two ways to maybe get it done. Because the builtin XJT module uses just a standard CC2500 (like my MC3D as well) and a power Amp to boost it up, all protocols that are transmittable with that hardware are theoretically possible to use. So the first option that came into my mind is to cut either in soft or in hardware the connection between the existing CC2500 and the Coprocessor. This way I could inject my own protocol and transmit it via the existing hardware. The other idea I had was to replace the existing XJT by a self-made one. That way I could flash protocols to the module until the Flash of the processor is full. Of cause reverse engineering the entire XJT module would also be a possible option to go for but as far as I can see they have used a 4 layer PCB which makes reverse engineering a lot less comfortable. As you may have seen in a earlier Blog I own a CC2500 module with an onboard LNA and PA so in fact just the same hardware as in the transmitter used.
I thought to myself that if I'm able to talk via that module to at least Futaba and FrSky receivers, I'll go for one of the above mentioned options and hack the transmitter.

On the same day I started to build-up a prototype board with just a small cortex M3 and the Transceiver module. So all the messy software stuff can now be done without going out of order with my "daily" Transmitter. I hope you liked that this time really theoretical article and stay tuned for more!

MC3D - First Take-off

I finally had some spare time to complete the MC3D project. After a lot of issues I had with the Firmware like Failsave and Pinconfig everything seems to work just fine now. All missing 3D printed parts and motors got attached. 

First start! 

I carefully armed the board and pushed the throttle stick gently upwards. I'm flying mode 1 by the way. The rotors started spinning and with just a little more throttle he took off the ground. The stabilisation system did his job really well and apart from the really way too high control rates I had nothing to complain. PID wise I'm using Luxfloat and standard betaflight parameters.
After this first successfull flight I attached the cheap Banggood FPV camera to the frame with some Hotsnod and connected all the neccessary wireing. I used this camera before and it's one of the best FPV cameras I've seen so far. And also with just about 9$ you get a wide angle camera that actually performs like a really large and also often expensive one.
I then set up my FPV-Goggles. After checking everything I took off again. This time with the Goggles in front of my eyes. And as I expected I got lines crossing my field of view as soon as I the Motor PWM kicks in. They are actualy so strong visible that I can't event take off. So a filter for the camera and Video transmitter is neccessary to solve this. 

To become some idea about the actual size of the problem, I attached my Scope and took a closer look to the unregulated Powerrail. 

As clearly visible the 32kHz PWM takes the biggest part of the entire noise.

Of cause I did a first job by adding some capacitance across each motor while designing the circuit, but as clearly visible some noise found it's way out. 

Because I don't know how the more sensitive parts on the PCB react to that, I plan to filter right at the motors to reduce the overall noise level. Hopefully the FPV issue can be solved as well by doing so. That's it unfortunately for today about the MC3D. All I can say so far is that I'm really proud of this little guy. I hope you liked the small update on that project. More stuff coming up soon!

Smartwatch part 1

I recently received the STM32F469 Discovery Board! It features a MiPi DSI Display with capacitive touch an SRAM for buffering Frames, a micro sd card slot, audio and so on... Because it's the same processor that I want to use in my new design and because there is really good support with exampels, I plan to complete almost all Software work on this platform before starting to buildup my own hardware. Just to make sure I dont't miss something important.

I've already successfully deployed TochGFX by Draupner Graphics, which blew my socks off! They seem to take their motto 'outstanding graphics and smooth animations with minimal resource and power consumption' really seriosly! You should check it out if you plan a project with a  GUI.

Lenovo G70-70 updates

Finally I can say for sure, that you can expand your storage capacity by adding an odd board to your G70-70! I searched quite a while for a good price to performance SSD and finally bought a really fast (500+mb/s) one made by Transcend. It was due to Amazons prime day also really cheap.

All that's left to say is that there is unfortunately a small issue with the covering of the odd slot. The original odd dummy has a unconventional round edge which is near to impossible to find on the web and I'm still searching for the best solution. 

Beelink XII repair

Untortunatly due to the exam phase at my University I really have no time to work on my projects. But this weekend I decided to try to repair a broken TV box. The box is an Allwinner H3 based single chip device (Beelink XII), running Android 4.4.2.. 

One day the box wasn't powering up at all and because it was in a working condition on last shutdown I thought about a software issue. I started with trying to flash the latest stock firmware but no success. In addition I got no response by the Software on connect of the device. So the device was unreachable bricked. 

After some reasearch I found the linux-sunxi website which offers really good reference information about almost all Allwinner SOCs. And as always If you're trying to fix or reverse engineer something, spending some time on a good research for informations is always well spend time. 

With the new knowledge about these devices I now soldered some wires to the serial interface pads on the boxes mainboard. And after powering up the device I got some output about the boot process.

So far so good So at least the processor wasn't dead. Also boot0 and uBoot seemed to be in a working condition. This also means that the nand flash was at least not entirely broken. Good news for the further process. 

I now tried to build a bootable SDCard for further digging into the boot issue from the nand. But after serveral hours of image building compiling and copying files I stopped the repair session for that night (It was already 4 o'clock in the morning). 

Later that day I thought about searching for possible issues of the box in the serial output. And there was indeed a really strange line which I missed out before (last line in first screenshot). Dram value=1. I tought either that is just an index or it's the actual size of the RAM. If it's the actual value of the RAM there was something entirely wrong happening. 

And because the box was already broken I fired up my reflow soldering station and started to preheat the Pcb. After that I reflowed the RAM modules and let everything cool down to room temperature.

Now the final test, will it work at all after that?

YES it does! Now the output of the console showed up the correct 1Gib capacity and also the blue light came back on and the device was booting properly. 

So just that tiny little line in the serial output pointed me into the right direction and saved another device from being tossed out into the garbage. I hope I can motivate you to repair some gear yourself and trust me the feeling when you got it back up is just outstanding. In addition you always lern a lot about the devices and how they work. 

PS: After several checks I can say that also the overall speed has also increased by at least 15%. Therefore a production fault can be a possible reason why the box stopped working.

Smartwatch project

In the last 3 Years I have built a few different smartwatches for myself. 

Im not a typical smartwatch user but really interestet into the technology involved to build them.
Most of the watches that I've build had a small 8-bit Atmel, a HC06 for the Bluetooth communication and a oled dotmatrix display. As smartwatches became more popular google released a watch version of their android called android wear and I thought about building a new watch. But this time a really powerfull one with a ARM processor running android wear or a custom os.

And because this wasn't crazy enough I decided to use a round display with capacitive touch. After some research I found a round 1.5" lcd with free viewing angle. The interface on this lcd is called MIPI-DSI. This interface type is used in almost all newer smartphones and wearable devices, because it uses only a differential serial signal to transmit the LVDS signals to the display. Also this display features a serial capacitive touch interface. I ordered the display and a few days later it arrived in my mailbox. Now it was time to search for a matching processor. I found some ready-made platforms by a Chinese manufacturer and considered using them. At the time I found their website (about 1 1/2 Years ago) they haven't offered a complete solution as there doing at the moment I'm writing this blog. But the M200 SOC had almost everything I need. A Mipi interface, serial touch, small form factor, low power consumption and it is capable running android.

Unfortunately the project suspended until now, because I was too busy and a project like that really needs a lot of time... The only thing that is stopping me at the moment from buying one of their development platforms is the bad documentation. I really don't want to spend a lot of money for a board that I'm not capable using. Another point is that I would need to build a adapter pcb for at least the display and touch interface. Also software wise I don't really know if I'm capable enough writing my own lcd driver for this SOC... Because of these arguments I searched further for some alternatives . Fortunately ST Microelectronics released a few new Cortex M4 processors (STM32F469 for example) including a MIPI interface. They also feature a graphics accelerator Chrom ART to enable smartphone like graphics. I love the way ST does their documentation so using their processor should be doable. Unfortunately using this processor would cause me to write my own watch os, because android would not run on this processor (as far as I know). At the moment I don't know which way to go. Let me know your opinion to this in the comment section! 

DIY Long Range Receiver

While searching for parts to build the MC3D project I found a CC2500 module with an on board PA and LNA. The specs are really impressive. Up to 1800m range and 22dbm transmit power. So I orderd the part four weeks ago and today it arrived in the mail. Hopefully I'll be able to complete the MC3D project soon and start working on this one!

Followup for this one: http://stefansbb.blogspot.de/2017/07/div8rtv-compact-cheap-but-powerful.html?m=1

Expanding a D4R - II to 8 channels

Today I quickly build myself a small "magic box" that is able to output 8 pwm channels (standard servo signals) from a D4R II FrSky receivers output. You may ask why to do something like that when there are a lot of cheap 8 channel receivers out there. Well it happened (as always) to me that I run out of receivers while preparing my model airplanes for a larger RC flight event. Unfortunately I thought too late about that this time... The only receiver I had at hand was a broken D4R II and the macgyver inside me decided to try fixing and expanding it. First things first I started troubleshooting the receiver. I measured a dead short at the voltage input. That clearly indicated a dead LDO (Low-dropout regulator). After checking the output voltage, pinout and footprint at the datasheet, I searched for a matching one in my part stock. Unfortunately I only had one in SOT-223-3 package. So I hacked that one onto the receivers PCB and sure enough, the receiver started working again! With that done the fun part of hacking took action. Because I had no time to buildup my own hardware, I took an old 2.4Ghz (also broken) receiver apart. Removed carefully the receiving module. And reverse engineered the important sections like SPI interface, channel output pins, status leds and serial data lines. Because the D4R II is able to output ppm signals on channel 1 pin for 8 channels by shorting channel 3&4 pins. I checked the output with my scope and took rough measurements and calculations. I just had to build a PPM to pwm converter. The Atmega8 on the old receiver is more than capable doing that, so I started writing some software to analyze the PPM signal and split it. You can checkout that messy piece of code here (written in AVR GCC). It uses the 16bit timer1 to capture the incoming PPM data and split it into data and sync. One of the 8bit timers was then used to output the servo commands. That's it! Here the final result I came up with.

MC3D status update

During the last weeks I was really busy so I wasn't able to work on my projects.
Yesterday I printed all the 3D parts required to finish the build. The only thing left to do before final assembly is to edit the cleanflight software, so it matches my needs. Hopefully I will finish that today. Stay tuned!

Lenovo G70-70 second hdd

After disassembling my current laptop (a Lenovo G70-70) for cleaning, I considered to increase the storage capacity to at least the double. One possible way would be to replace the current HDD with a larger one. But I thought about using the space left inside and physically adding a second HDD. Because my model has a plastic cover instead of the optical drive a HDD caddy would be a great option. So with that in mind I removed the cover and locking screw to take a closer look inside. One important thing on adding a caddy to your laptop is to make sure there are the matching connectors fitted. Unfortunately in my case Lenovo hasn't fitted these. I took a quick look to the block diagram and found a second sata connector (SATA ODD) drawn. So I've done some research on the web and found the maintenance manual by Lenovo. On page 84 arrow 5 you can see the missing part on my version. It seems to be just a adapter board with a flat flex jumping over to the mainboard. So at least a flat flex connector should be visible on the mainboard. And after taking a really close look inside the slot I was able to see a connector. I also counted the number of pins (10) to compare to possible adapters later on. So all I need to add another HDD would be the missing odd board. After searching for hours for a suitable reseller I almost gave up. Most of the resellers (I found about 5) had really high price points for something that simple. Then I stumbled over an odd board for a Lenovo G50 on aliexpress. After checking the pincount, mounting holes and overall design I ordered the part. Last week (20 days later) the part arrived in the mail. It was nicely packed in some bubble wrap and in good shape. So later today I disassembled my laptop in order to add the PCB. I really was confused by the amount of parts that I needed to remove just to reach the mainboard section. I removed keyboard, cooling fan and the entire keyboard bezel to get access. But the steps are pretty easy to do if you follow the maintenance manual I linked in above. So I test fitted the odd adapter PCB and thankfully it did fit perfectly! BUT the flatflex cable was way too short...  Thinking about possible issues why, I should have looked the G50 up. The G50 is way smaller (15,6" instead of 17.3") than my model. Thankfully the cable has standard 1mm pitch so I can easily replace that. Yesterday I soldered a new flatflex cable out of an old cd-rom drive onto the odd board. After disassambling the laptop again I screwed the board into it's place and reassambled everything back together. Now I have to order a matching hdd caddy before I can say anything about the functionality, but the part does fit perfectly inside. To be continued...

MC3D Project

Back in december of 2015 my brother and I decided to build another fpv multicopter. We came up with the following properties/goals to aim for:

• tiny, we want it to be as small as possible
• fpv equipped
• onboard receiver for FrSky or Spektrum but still be able to use different rx as well
• clean-/betaflight compatible
• 1s single cell LiPo-Battery
• 8.5mm brushed motors
• simple mosfet driver as esc
• 3d printed arms and landing gear
• PCB-base plate
• name MC3D (MultiCopter3D)

That's it for the technical aspects! As far as the design goes, we wanted something similar to the nqx980. So my brother who is into 3d-modeling started to draw a simple shape of the base plate.

Sorry for the poor image quality! At this point we haven't thought about publishing the project and only rough documented the process.

With that done I've converted the shape into a PCB outline and started drawing the schematic.

Because we're aiming for a compatible board to CC3D and others running cleanflight I choose the same stm32f1 mcu and mpu6000 accelerometer as used on a cc3d & atom. For the esc's the choice was pretty straight foreward. Small SOT32 package mosfet very simple driving circuit and some noise filtering with caps. Next was the receiver. I thought a lot about reverse engineering the protcol used by FrSky/Spektrum but never realy took it into action. So after a quick google search, to get at least some idea of the enemy, I found a post at the rcgroups forum by midelic, where he published a diy FrSky receiver. So all the fun part of reverse engineering was already done! Awesome work guys! Using something "of the shelf", I simply added his schematic into my project and linked all the necessary pins. That's it for the receiver!
So the schematic was done after just a few evenings of work and I now could focus on the layout part.

To keep the cost low, I wanted to make the board with 2 layers only instead of four. This has unfortunately some disadvantages. One of them is a increased noise floor, which really has to be considered, because we're using noise sensitive components like the mpu6000. Usually a board like this has four or more layers. Two of them with a "flood fill" to keep the inductance as low as possible. Furthermore the routing is way simpler. But as I said, we'll stay on a 2 layer pcb.
In order to get rid of at least some problems, I floodfilled both layers and attached them to ground. And to prevent slight potential differences between the layers and also for a better noisefloor I stiched the board on the surronding chip areas with vias. You might ask what has happend to the positive connection which also does provide power to all 4 main corners of the pcb for the escs? Well I really thought a lot about this one track and finally come up with just one 200-300 mil track snaking its way right at the boards edge.

At the same time my brother drew the rest of the parts. Here is what he came up with.

To get an idea of the dimensions we testprinted one arm of the frame on our diy TinyBoy.

Surprisingly the arm had a really good strength to weight ratio. Huge success!

The next weeks I spend on optimising the pcb layout and finally in mid january of 2016 I placed my order at a pcb manufacurer in china to produce our pcbs. After waiting the usual 3-4 weeks the parcel arrived in good shape in my mailbox. 

The quality was awesome! Even the large silkscreen on the bottom, covering some vias was pretty good considering the price to performance ratio.

Next step was to assemble the first prototype! Because we want to spend as little as possible we recycled almost every part of an old cc3d atom and placed them on our new board. The hardest part was to get the old leadfree solder of the pads, without damaging them. But with the iron set to a low temperature and just a minimal amount of pressure this was quickly done.

Workbench

Comparing the MPU6000 to a MicroSd

A closer look to the just soldered MPU6000

Almost finished prototype

Now the moment of truth! Lets plug it into the USB and try to flash...
And success! On first try the board connected without any problem to the Cleanflight config. After calibrating the accelerometer I had a really big smile on my face! Everything worked like a dream.

First connect ever to our first prototype

To be continued....

Hacking Ricoh SP C250DN toner cartridges

Although the printer prices have fallen hard in recent years, the average cost per page has not really changed. The most expensive parts on these modern printers are the replacement cartridges. Just a few month ago our color laser printer indicated low toner on 3 of 4 cartridges. I've heard a lot about resetting chips and so I could not resist to try it. Because these cartridges have to be as cheap as possible to manufacture they have to use "of the shelf" parts. So after disassembling one of these PCBs' from one of the cartridges I researched the part number (yes the marking wasn't removed :) ) and after checking power pins I was almost entirely sure that they use a BR24Lxxx-W IIC EEProm. Because these ICs are eeproms I should be able to rewrite them indicating full. Furthermore they use the standard I2C interface so it should be pretty easy to write some software on a 8bit µC to reset the cartridges. 

With that in mind I simply wrote a small piece of software to scan all standard addresses and wait for a reply by the chip. Unfortunately I got no response at all. A quick check was made to verify the cartridge was still working... Thankfully it was. So maybe I was simply to fast for the IC while sweeping across the addresses. So I slowed it down really hard but still got nothing. Changing the pullup also hasn't affected the result in any way. So I thought maybe these ICs don't use the standard address space. And I was right after increasing the search radius I finally got a response on 0xA7. Nice! Next thing was reading back the eeprom. I really wasn't sure my code was working properly because the result was just a huge mess. But after reading a fresh cartridge back I got a different but consistent result. So last thing to do was writing to it. This was not as easy as spoken but after slowing down the writing speed I finally was able to write and read back successfully. With that done I copied the data from a fresh full cartridge to a "empty" one inserted it into the printer and a huge smile took hold. It WORKS! 

Last thing I plan for the future is to make it standalone and portable. Also finishing it up with a nice 3d printed case would really be cool. 

While searching for the datasheet to link it into this blog, I found this page where someone else already covered reverse engineering these cartridges. So please refer to his blog he really has described it well better than I ever could. He has got the same speed and address issues as I got so I assume my setup wasn't the limiting factor. Sometimes I really should research a lot more on the web before trying to reverse engineer something but I can't help myself... It's just way to much fun!

The following Link guides you to all the files I still have from the Project. This also contains a zip file with code that has been given to me from someone who has written the code in Arduino. You use this all at your own risk!

 LINK

If you have any further questins don't hesitate to ask.

Chip dimensions

Arduino clone as a cheap development platform

Serial output from the µC

Charge your Lenovo laptop with a benchtop power supply

It happed to my that I forgot my usual charger at my parents home about 2 hours away. The only problem I had was I really needed my Laptop to be able to work. So I looked into my rectangular charging port and saw a pin in the middle and on the sides some connections as well. I thought "well that's easy lets just check the polarity on the web".... FAIL! This connector really is strange... The center connection is a indicator-pin which has to be linked in series to a 290Ohm resistor to ground. The outer shell of the connector is the ground connection, which was relatively easy to connect to via some pirate hook cables. But now comes the difficult part... the connector has a connection on its inside apart from the huge pin in the middle... That's the positive connection. After nearly half an hour I managed to get a connection via some pirate hooks. A quick measurement was taken to ensure there was no short circuit. And finally I attached the power supply. A lot of work for something that simple...But at least it has worked for me!

Hallo Welt!

This is my new blog! I have created it to be able to share my projects to everyone out there who loves electronics and RC modeling.