Sunday, November 8, 2015

Beginner 3D printing - CTC dual

I've bought a CTC dual from a couple of weeks ago, for significantly less than 400E, shipped from Germany. Here are my experiences with it, as a complete beginner.
This will be a text-only post, if there is enough interest I will post some pictures and pictorial guides later.
It's a FlashForge clone which is in itself a Replicator Dual (2X?) clone.
It has a heated bed, dual extruder, wood panels and acceptable build quality and components.

TL;DR version:
- print simple objects no bigger than 5(W)x5(D)x2(H)cm if you want no issues
- install a glass plate on top of the bed
- use masking tape on the bed
- experiment with temperatures for each new filament
- install sailfish
- pre-order 40mm cooling fans
- install active cooling
- cut polycarbonate covers to size to keep heat inside

In the box

The printer came pre-assembled, saving about one week of fiddling. It also came (mostly) calibrated, I just did a basic plate leveling, which might have not been necessary. The build timer showed 16h and there was some residual filament oozing, which means that they probably printed some parts for the printer during testing. I think that's awesome.

The ebay ad said it would ship with 1kg of filament, I haven't measured that but it seemed more like 500g. Yes, I've measured all the parts and scraps. They shipped black PLA by default (you can ask for a ABS and/or a different color). For initial testing the 0.5kg lasted me less than a week.

There were a few bits and ends (screws, SDCARD, allen keys) that were mostly not needed in the beginning.

I just unpackaged everything, assembled the head (2 mins), power cord, powered up, mounted the filament 'toilet tube' support and leveled the bed.
I laid yellow painter's tape from the start, the 3cm wide one, on top of their 5cm wide blue tape. It took 8 strips., but that's what I had laying around.

The included manual is pretty hard on the English with a strong hint of automated translation. They 'hint' to bed leveling as an important part but fortunately the printer menu (2x16 LCD) explains everything.

First prints

I inserted the included 2GB SDCARD into the slot hidden in the right side, took a random file and hit print. I have no idea what it was supposed to be, some kind of bull I suppose, printed halfway until the tension of the filament caused the extruder to grind idle.
The filament does not have any guide tube nor any guides so the extruder has a hard time unravelling the spool.
I initially printed this double-guide:
Well, it doesn't fit, and it made things worse.
I then printed 6 of these clips: but ended up using only 2 of them - because they also cause binding.

The seller replied that guide tubes were removed from later versions as they cause binding and I should use the printer as-is.
So the warning is to make sure your extruder can pull the filament freely, otherwise your 4h build might fail after 3h.


All the subsequent prints from above were exported from MakerBot Desktop ( with no adjustments, sent to the SD-card, inserted into the printer. The default settings for MakerBot were for ABS (bed 90-110C, nozzle 230C) but the PLA objects still printed fine.
The STL files were downloaded from, drag-and-dropped into MakerBot and either hit export or print (when connected via USB).
The USB connection worked out of the box with MakerBot, no additional settings were needed. Unfortunately you cannot preheat the unit or level the bed or do any other adjustments from within MakerBot Desktop.

ReplicatorG did not work at all, complaining because of a missing Python installation. I have tried one hour to get it working.

The printer firmware identifies itself as 'The Creator - ver 1.0' and the vendor says it cannot be updated. However, MakerBot displays that it can upgrade it. Better safe than sorry. I will look later into upgrading to SailFish.

So far MakerBot Desktop fills the need to 90% - though I would like to customize things based on layer number or time (like bed and nozzle temperature) without editing the G-Code.


This is a moving target for which I do not have a definitive answer.
Basically you have to adjust everything each time you change the filament vendor.
I started with a bed temperature of 90C, went down to 50C, now up to 67C (glass bed on top).
Nozzle temperature for PLA went down from 230C to 195C, but 200-205C seems right with the current filament provider (Firstcom, 1.75mm, black).

ABS - not yet possible. I've tried for 3h to set up the thing but it still fails.

Designing parts

Unless you spend your life designing things in CAD, will provide answers to most of your needs. To get to the next level there are customizable parts (like metric screws, parametric phone cases, name plates).
You can then use some OpenSCAD software to design your parts. Even is pretty ok, though I could not get it to work with thingiverse models or any scad files.
For the final level, the latest kid on the block is It's a full-featured parametric design software that runs inside the browser and on any mobile (web) platform. It's a steep learning curve but well worth it.
In the past I've played a bit with AutoCAD, Sketch-Up, Illustrator (not really 3D), Autodesk 123D and they all have significant flaws compared to OnShape.
Hopefully OnShape continues to remain free for small use or I would have to adjust my opinion. I will do a full review later as it challenges a lot of the current technologies and mindsets.

Printing quality and mods

The first few prints came out acceptable, if they were the standard box-shaped ones with plenty of support from the previous layers. However, curved items showed a jagged edge(1), big objects printed with solid blobs(2) and high objects either came detached or a blobby mess(3).
Issue (1) was caused by the default extruding speed being set to high 150-90mm/s instead of the recommended 120-60mm/s.
Issue (2) was caused by improper nozzle/filament size calibration. Still working on that, but I had to reduce the filament size from 1.77mm to 1.68mm (real size is ~1.75mm).
Issue (3) was caused but not cooling the parts as they build up. Putting a big fan on the piece after the 5th layer solved most of this. Also caused by warped bed.

I cut a piece of glass 230x150x2mm and overlaid it on top of the original plate (with the blue tape still on). The pieces now print much more reliably - previously I had to choose a favorable position on the plate - but they seem not to stick as well. So now I have to push the filament gently into the extruder for the first 2 layers.
I tried hair spray and 80-grit sandpaper to get the glass to adhere but had to go back to the masking tape solution.

The mod above also allowed the left extruder head to be moved to its level position - from the factory it was about 2mm higher. I assume that was set because the uneven bed would cause the left head to hit the parts that were already printed by the right head - which happened to me as well.

For cooling I printed a part similar to this which requires the extruder fan to be rotated for sucking instead of blowing. I am not yet convinced of its efficacy, it caused the nozzle to clog at least two times.

Printing with rafts is a huge pain - the rafts cannot be easily removed.


The bed was warped from day 1 with a 0.5mm variance. This is a lot when the layer height is by default 0.1 or 0.2mm.

Blower fan on the driver board (RAMPS) started making loud noises after 1 day. I took the sticker off and put a few drops of fine mechanical oil, but it will need replacement. I think they did the same at the factory as the sticker was not holding on very well.

Right extruder fan started making noises after an additional 25h of printing. It starts up with a low whine (radial vibration?) like cheap computer power supplies, then it goes full speed after 30s-1m.

Right extruder started making noises under medium load after 20h of my printing. If I feed the filament manually the noise goes away. If it has to draw the filament from the spool it makes creaking noises like and old windmill.

Z-Axis positioning makes a vibrating noise from the start, not sure if this is intended or not.

It somehow seems that the right extruder does not have the same volume as from the factory, missing the first few millimeters at the start of the print - after ~20h of my printing.

The X axis rods (parallel to the front) might have a slight warpage to them, 0.1-0.2mm, causing the right nozzle to be higher at some point than the left one, when moving along the left-right horizontal. This can be 'fixed' by rotating the rods along their axis but it will either increase the drag or cause offset in another dimension.

Build quality

Everything is build with laser-cut plywood, 3 panels, totaling to 5.6mm wall thickness.
The nuts are not captive which means you have to be really careful when unscrewing things and work like a surgeon when putting things back together - alight the nut with the screw and the slot using tweezers.
The SD card slot has double the width - which means you can insert the card into the space between the card slot and the slotted hole in the box. If you manage to drop the card inside the unit, you have to take the bottom panel off to fish it out.
Several zip ties came loose (low quality ties).
The 'low noise' fans are really not. You cannot have a speakerphone conference in the same room with the running printer.

Other than the above I cannot really fault it, for the price.

Power consumption

Given the increasing electricity prices, these figures might prove useful.
- idle: 37-39W
- heating: 60-200W. Probable average about 75W, the heated bed takes the most power
- during operation 60-80W, probable average 70W
Obviously printing ABS is going to take a lot more power than PLA. It also takes a significant amount of time to get the parts up to temperature. Expect 3-5 minutes to start a PLA print from cold and 10 minutes for ABS.


Out-of-the-box it performs like a second-generation 3D printer - it give out decent results with little effort. If you want high quality or demanding parts you have to invest a lot of frustrating time.
Expect hours of watching the printer do its thing, manually unspooling filament and feeding it and 'adjusting' parts while printing with a thin scalpel.

Saturday, October 24, 2015

Inside stuff - Joytech ERoll

This is a teardown and 'repair' of a common type of e-smoke cigarette.

If you are reading this in the future (say, ten years from now, 2025) smoking is a type of pleasure that's dying in this year - 2015. It's an expensive drug (5-20%of monthly income) that takes a bit worse than soap and makes everything stink. It's still legal while other drugs (THC-based)  are still illegal.
It forms a strange addiction to this bad smell and lack of brain oxygenation that augments alcohol consumption. Well, lack of oxygen will strengthen any other drug or high, but can be had even cheaper while trying to stay underwater in a sink.

If you are underage and you are reading this then probably the parental filter set on the router has failed. Smoking is bad, m'kay?

If you are reading this in the future, some people here are trying to get rid of this so-called nasty habit and enrich their gadget profile. This means that the thing they are trying to replace WITH has a microcontroller, rechargeable battery and USB connection.

Enter the Joytech E-Roll - mostly sold at convenience stores and gas stations, it provides an easy entry into the world of e-smoke - the latest fab term is called 'vaping'.

Smoking introduction

As a qualified tester and having sampled the right audience (the friend who gave me this) I can offer a short opinion on this. One of the usual long-style cigarettes provides around 20 inhalations (draws). A shorter one does 10 to 15. This, on a full charge, would provide around 15 lightweight draws.

Now, to get into the mind of a typical smoker, there are two kinds of behaviors: straight to lungs or mouth to lungs. A mouth-to-lung inhaler will 'charge' the cigarette first with two-three draws, inhaling afterwards. A straight-to-lung (my term) one will draw directly in the lungs. The first user might get throat cancer while the second one is more like to get lung cancer. Choose your destiny.

There's a third type of smokers, so-called social smokers. These don't enjoy smoking but make it as an act of bravery/show-off  They will typically inhale into the mouth and 10-30% gets into the lungs while the rest of the smoke exits via nostrils and other orifices.

E-cig short review

With the questions above answered, we have two questions: how good is this thing and what's inside it?
Well, as with all entry-level e-cigs there is a lack of control with both regard to airflow and temperature. Airflow is restricted by a tiny hole (see pictures below) to a slim-type cigarette. The fact that this hole is situated where people normally keep their index finger does not help. So it cannot really break the addiction to those straight-to-lung inhalers.

The temperature is 'controlled' by the inhaled airflow - a longer draw will make the heating element hotter if the airflow is higher. However, there is a limit to this. Quick, successive draws will turn on a protection on the unit - either the 10s continuous draw one or the the battery's undervoltage limit. The internal battery is rated at 90mAh

As a conclusion, it's suited for social smokers - people that want to look cool - or slim-type smokers - those who get satisfied with a bodiless menthol flavor.

Inside stuff

The kit contains two metal 'cigarettes' and a charging station. My station charged only while plugged in, although it felt heavy as like having a built-in battery,

The cigarette charges through it's end, with the center ring being the positive connection and the outer ring and body the negative one:

This means that you can charge one with 3xAAA rechargeables, in case of a zombie invasion,, if you can control the current that is. Since the battery is rated at 90mAh you can use a supply limited at 90mA and 4.2V. Or just another charged LiPo battery and a 47 ohm resistor.

Wednesday, October 21, 2015

txtr Beagle PC software and TL-WR841 VPN server firmware

This is a quick update to some projects that I've been working on.

My txtr Beagle PC software fork has received an updated version.
Changes and tutorial here:

In Germany youtube gets to screw us twice - most music videos cannot be viewed and ads are shown on 90% of the videos. The iOS and Android youtube players cannot skip those ads. Here's my solution to that - buy a TL-WR841N router and give it as a present to some close friend in another country. It's a decent router and my custom firmware adds VPN server support so you can get rid of those pesky ads and private 'law' agencies monitoring*:

Afterwards just set up a normal VPN connection - works with Windows, iOS and Android, out of the box. For Android I recommend VpnROOT instead of the stock feature.

*Those so-called agencies are private companies monitoring your traffic for 'illegal' content. They have automated software which intercept your downloads and match them against some generic database (e.g. movies, music, ...).
Then they get your IP from your Internet Provider via a legalese letter and craft another letter for you, on behalf of the company representing the matched content (e.g. Sony Music). They request ~100$ for DMCA damages and ~700$ in lawyer fees. Or you can settle the case for ~400$.
I've never been burned but it mostly targets non-technical people.

Thursday, October 15, 2015

MacBook Air water damage repair - part 1

I was asked to try to repair an Apple MacBook Air A1466 (mid 2012) that has received a cup of tea.

When I first heard of the water damage I requested the user to stop using the laptop immediately and take the battery out. However, the laptop was still put in use for a few weeks after which it failed. Had the advice been heeded the extent of the damage would probably not have been so high.

The symptoms were: some keys not working, including the power key, screen kept blanking out or flashing colors, laptop shut down by itself.

Getting inside is pretty easy, if you have the right tools. You need several strange screwdrivers that can be purchased from iFixit:

Most of the damage seems to be located in the upper left corner:

Screen (LVDS) cable has a few corroded pins, the power regulator next to the right seems to have been cooking some tea:

The screen connector on the mainboard looks heavily corroded:

Obviously the water detection sticker has been triggered to a red color instead of its innocuous white color:

Wednesday, October 14, 2015

Getting (near) infinite lives in Candy Crush Soda on Kindle HDX

I'm running a social experiment to see how many views would get a post targeted to a different audience.

This hack is focused on Amazon's Kindle line since it does not allow changing the date via the settings, but it's applicable to all Android devices.

I would suggest having a cheap tablet just for the game, since the clock will be way off. Also, connecting to WiFi will, in some cases, update the clock.

The preparations will take around 15 minutes, only once, afterwards it should take around 20 seconds to get your life back. Actually, if you are playing this game, you are never getting your life back.

Edit - quicker way: change the date 1 day after, go back to the game, see 5 lives restored, change back 1 day, go back to the game.

What you need:

Kindle Fire or Kindle Fire HDX rooted
Terminal Emulator - install the store version if possible or sideload the apk
Hacker's Keyboard - not needed but highly recommended.


Disable WiFi to block automatic clock updates.
Activate Hacker's Keyboard (if installed) by going into the application and following the instructions.


After your lives are exhausted, start Terminal Emulator and type the text in bold below

u0_a22@android:/ $su
Click grant root if requested.
root@android:/ #date
The reply should be something like:
root@android:/ #dateWed Jul 8 14:00:00 CEST 2015root@android:/ #
 Take note of the date and type the text in bold below:
root@android:/ #date -s 20150708.16000Wed Jul 8 16:00:00 CEST 2015root@android:/ #
As you can see, the date -s command sets the date to a string in the form of yyyyMMdd.hhmm - where yyyy is the year, MM is the month number, dd is the day of the month, hh is the hour and mm are the minutes.
By running the command above we essentially added two hours to the current time.

Do not close the terminal, just go back to playing the game by tapping the home icon.


After your lives are exhausted, go to the home screen and drag from the top to open the notification drawer. Select 'Terminal Emulator / Terminal session is running' from the list.

If you have Hacker's Keyboard installed just press arrow up on the keyboard to get the last command.
Hit the left/right arrow keys to move to the hour section and replace 16 with 18, press enter:
root@android:/ #date -s 20150708.18000Wed Jul 8 18:00:00 CEST 2015root@android:/ #
Each 2 extra hours add 3 lives, this is the most efficient way to not lose any lives.
Do this every time you are out of lives, should take around 20 seconds or less.


Currently there is a bug in the game - if more than 24 (or 48?) hours have passed you get the full 5 lives, as usual. If you don't start a new game and change the date back any number of days you still have all the 5 lives. So you can go forward 2 days and back 2 days each time.

You don't need to necessarily calculate the days when the hour gets past 24, the date command will do that for you:
root@android:/ #date -s 20150708.36000Wed Jul 9 12:00:00 CEST 2015root@android:/ #

This means that you can keep adding 2 until you get to 98. I haven't tried to see what happens afterwards.

Friday, October 9, 2015

Adding an isolated data output to Mastech MS8229

As seen from the previous related post, adding data output to MS8229 does not take very long and it might prove useful at times.

However, some people might undertake that modification - which for safety reasons I don't recommend - so here you get to see a proper isolated connection.

First, the hand-drawn schematic:

Some optocouplers and resistors were scrounged from crappy USB chargers. You need 2x optocouplers and 2x or 3x resistors. The left dotted side signifies the UART converter while the right side the multimeter.

The circuit above has the added benefit that it draws no power if the data output is not connected to a computer -> if no USB is plugged into the converter the first optocoupler does not turn on, yielding no power to the second one.
It also does the necessary inversion of the signal by weakly pulling RX to GND at all times (through the 3.3k resistor) while turning on the second optocoupler will pull the signal to VCC (3.3V).

The resistors are randomly chosen but there is a nice hack that can be done to get rid of the 1k resistor. If you take a look at a typical optocoupler datasheet you will see that it acts as a voltage-controlled resistor, designated by the posh-sounding "CTR":

In effect, with the circuit above, I get 2mA going through the multimeter side. The current should be 3mA (3V supply divided by the 1k resistor) so my current NCTR is 2/3=66%. This is controlled by the 330 ohm resistor connected to pin 1 - which gives me 10mA forward diode current. The graph above confirms that the NCTR should be 60-70%.

By raising the 330 ohm resistor above 3.3k we should get an NCTR of less than 25%, which would enable us to get rid of the 1k resistor connected to pin 4. We've seen in the previous post that the multimeter is able to source 40mA so we should target an NCTR of <0.1.

Perhaps a 5k resistor connected to pin one should do it, I haven't tried this yet. But it also means that the current going through the LED of the second coupler will be lower, causing the current seen at the other end to be lower which might not overcome the 3.3k resistor pulling to ground. Which means the 3.3k would likely be raised to >20k.

Update: tested and implemented the idea above, see the last part of this post.

Adding a non-isolated data output to Mastech MS8229

I bought a Mastech MS8229 multimeter for a decent price because it offered a few compelling extra features which would be nice to have - sound meter and luxmeter. I also knew from this post that data logging was possible to 'bolt on' afterwards.

Short review

TL;DR: I would likely not recommend this meter for the money it currently retails for (45E).

It has a really slow autoranging, especially on the Ohms scale, taking 2-3s to read a resistor.
The input protection is almost inexistent, which is not a huge issue if you don't intend to use it at high voltages.
It has a multi-purpose mode of resistance, diode, continuity and capacitance - which defaults to resistance. I am using continuity mode 90% than any other mode so I would have liked that to be the default or to have it's separate switch position.
The rotary switch cannot be moved without holding the device with the other hand and it frequently goes between positions. While in that erroneous mode you have no indication that the device is misbehaving.
No auto-hold or smart hold feature. I really don't understand why this kind of hold feature exists on all these meters, it has been completely useless for the past >15 years.

Crappy probes - not the worst but just slightly above - which makes the continuity buzzer work with a one second delay. My 'fix' for this issue is to use a 200 sandpaper on the tips each 6 months or so. By doing this the tips are also sharpened, making them more useful. If you cringe at this then you have to know it takes 20s to do, the probes are likely worth 4$ a pair and you would have to do it 100 times before the tips are completely eaten away.  I think that's the best solution to the problem and I haven't seen any tip on doing this elsewhere.

The mod

First, if you don't know why you need the isolated data output - don't try this, really. It can fry your computer/tablet, yourself, your significant other, etc.

I intend using this for 3-5V work while connected to a [Windows] tablet that's running off it's own battery so if that matches your use case read on. For the isolated version check this site: or this:

Sunday, September 20, 2015

Ikea SKARSTA sit/standing desk hack

Since I am lately doing contract work mostly from home I need to set up the environment just right. Sitting for 8-10 hours straight at a desk is unhealthy and a lot of my colleagues have motorized desks that go for 1700E (~2000USD) a pop.
I just bought an Ikea SKARSTA desk that’s raised and lowered via a manually actuated crank, old-school style. The price for the base was 170E (x1.13 for USD) plus another 30E for the base plate. The motorized version (BEKANT) retails for 500E which means by doing a conversion we can save around >300E - 340$ at the time of writing, likely to be more by the time you read this article.


Wednesday, June 17, 2015

Decoding wireless weather sensor data

Being on the hunt for the cheapest wireless temperature and humidity sensors led me to FreeTec NC-7345-675 - sold by at the fair price of 10E, though I might have paid even less for them.
The requirements were: multi-channel, have at least 0.5C accuracy and provide humidity readout. Rolling your own can easily cost more than that.
The sensors pair with this weather station.

The goal is to store all the data on an SBC and provide a nice HTML frontend with long-term statistics and heating automation.

EDIT: blogger removed without warning all the newlines from my code, I had to redo some of those


The first step is to open up the sensors and see what we are dealing with.

With the main board detached from the zebra display connector, we can see the coil antenna at the top and the wires for the humidity sensor running at the bottom right.
Judging by the traces going from the SW-CH part directly into the chip it seems there is no way to force additional channels.

On the other side, the top part is the 433Mhz transmitter. Behind this small board there's also a crystal oscillator. Beneath it, to the left, is the temperature sensor, and, to the right, the watch crystal.
The sliding switch at the bottom right allows selecting between the three possible channels.
I have no idea what the part at the bottom right does - it looks like a switch but it's actually a trimmer resistor with the top cut off. It might adjust how often the sensor sends data or the power.

Encoding scheme

I've connected the DATA pin from the TX1 board directly to the oscilloscope so I can get clean readings, without any radio receiver noise.
It seems that with each update the sensor sends 9 packets with a length of 36 bits each.
In the screenshot below I've marked the 0s and 1s to aid in decoding.

Measuring the signal yields that the encoding scheme is: 480us time unit = T. Each 0 bit is represented by T+2T. Each bit 1 is T+4T. The spacing between packets is ~8T (3900us):

Software tools

Next, I took the rc-switch library for Arduino and made some heavy modifications to it: instead of keeping all the timings in an array I moved them into a circular buffer.
The library had to be updated to support peekInt:
int ByteBuffer::peekInt(unsigned int index){
 int ret;
 byte *pointer = (byte *)&ret;
 pointer[1] = peek(index);
 pointer[0] = peek(index+1);
 return ret;
This allowed me to continuously capture packets while the decoder was still running, and process them in any order without having to worry about array indexes.

Then a new decoding protocol was implemented with the main purpose of writing out timings on the serial console:

The first line is the serial output, the second one is where I marked the potential bits and the third line is the data.
This can be done even with the current rc-switch library, just add the following code after all the receiveProtocolX functions have returned false:
for (int i = 0; i<changeCount ; i++) {
  Serial.print(" ");
However this is running inside the interrupt 'thread' so it cannot be left there. It's time to write a custom decoder that will discard a few of the first few bits and decode the 0s and 1s.
bool RCSwitch::receiveProtocol5(unsigned int changeCount){
    unsigned long code = 0;
    unsigned long delay = 480;
    unsigned long delayTolerance = delay * RCSwitch::nReceiveTolerance * 0.01; 
    unsigned int size = buffer.getSize();

    if (buffer.getSize()<(26*2)){      // clearing the buffer will be taken care of
      return false;
    Serial.print("entering with changecount:");
    Serial.println(changeCount);    // remove some bits

    Serial.print(" ");
    Serial.print(" ");
    Serial.print(" ");
    Serial.print(" ");
    Serial.print(" ");
    Serial.println(" ");

    unsigned int firstSignal;
    unsigned int secondSignal;

      firstSignal = buffer.getInt();
      secondSignal = buffer.getInt();
      if (THRESHOLD(firstSignal, delay, delayTolerance) && THRESHOLD(secondSignal, delay*2, delayTolerance)) {
        code = code << 1;
      } else if (THRESHOLD(firstSignal, delay, delayTolerance) && THRESHOLD(secondSignal, delay*4, delayTolerance)) {
        code = code << 1;
      } else {        // Failed
        code = 1;
    code = code >> 1;

    if (changeCount > 52) {    // ignore < X bit values => noise
      RCSwitch::nReceivedValue = code;
      RCSwitch::nReceivedBitlength = (changeCount - changeCount % 2) / 2 - 12;
      RCSwitch::nReceivedDelay = delay;
      RCSwitch::nReceivedProtocol = 5;
    if (code == 0){
        RCSwitch::nReceivedValue = NULL;
        return false;
    }else if (code != 0){
      return true;
The output from a code similar to the one above, amended manually with the values that were being displayed by the sensor and the chosen channel:
29.6 38% ch3
Received 1960 / 480bit Protocol: 480
entering with changecount:73
484 972 01110001010000100101000111100100110
Received 168988454 / 24bit Protocol: 5
entering with changecount:69
1016 1288 110001010000100101000111100100110
Received 168988454 / 22bit Protocol: 5
entering with changecount:69
936 1368 110001010000100101000111100100110
Received 168988454 / 22bit Protocol: 5
entering with changecount:69
880 1420 110001010000100101000111100100110
Received 168988454 / 22bit Protocol: 5
29.6 37% ch3
Received 492 / 1952bit Protocol: 988
Received 996 / 468bit Protocol: 488
entering with changecount:73
480 988 01110001010000100101000111100100101
Received 168988453 / 24bit Protocol: 5
entering with changecount:69
1016 1288 110001010000100101000111100100101
Received 168988453 / 22bit Protocol: 5
Received 980 / 484bit Protocol: 484
entering with changecount:73
476 992 01110001010000100101000111100100101
Received 168988453 / 24bit Protocol: 5
29.7 42% ch3
Received 1968 / 468bit Protocol: 488
entering with changecount:73
480 988 01110001010000100101001111100101010
Received 168992554 / 24bit Protocol: 5
27.4 49% ch2
Received 1000 / 480bit Protocol: 480
Received 980 / 480bit Protocol: 476
Received 984 / 480bit Protocol: 480
entering with changecount:73
472 984 10100001001000100010010111100110001
Received 152121137 / 24bit Protocol: 5
27.9 45% ch1
Received 1948 / 484bit Protocol: 488
Received 980 / 484bit Protocol: 484
entering with changecount:73
496 976 10010111000000100010111111100101101
Received 940670765 / 24bit Protocol: 5

Rinse and repeat for about 30 times and we start seeing the big picture. There are a lot of losses, buffer overflows and multi-threading issues (e.g. protocol 480 with 480 bits) but I can see that the significant values repeat themselves during a packet burst.


Time display the leading bits as well and reformat the output:
       110100001 0010 1000 11110010 0100 29.6 36%
        10100001 0010 1000 11110010 0101 29.6 37%
       110100001 0010 1000 11110010 0110 29.6 38%
        10100001 0010 1000 11110010 0110
       110100001 0010 1000 11110010 0111 29.6 39%
        10100001 0010 1001 11110010 0111 29.7 38%
        10100001 0010 1001 11110010 0111 29.7 39%
        10100001 0010 1001 11110010 1010 29.7 42%
     10110100001 0010 0100 11110010 0100 29.2 36%
      1010100001 0000 1111 11110001 1101 27.1 29%
          100001 0000 1111 11110001 1101
      1110100001 0000 1111 11110011 0001 27.1 49%
       110010001 0001 1001 11110011 0000 28.1 48%
               1 0001 1001 11110011 0000
0100100110010001 0001 1001 11110011 0000
        10010001 0001 0010 11110011 0001 27.4 49%
      1110000001 0001 0111 11110010 1101 27.9 41%
0100101110000001 0001 0111 11110010 1101
     10110000001 0001 0110 11110010 1110 27.8 46%
After more formatting:
CH3:110 10 0001 0010 1000 1111 0010 0100 29.6 36%
        3  -----296------      ----36--- 
     10 10 0001 0010 1001 1111 0010 1010 29.7 42%
           -----297------      ----42---
CH2:110 01 0001 0001 1001 1111 0011 0000 28.1 48%
CH1:110 00 0001 0001 0111 1111 0010 1101 27.9 41%
This shows that the structure is:
  • 10 bits header (and checksum?)
  • 2 bits: channel
  • 12 bits: temperature multiplied by 10
  • 4 bits: 1111 - padding(?)
  • 8 bits: humidity
I haven't studied the header checksumming formula but it's not needed for my purposes.
After removing the serial debugging lines from the decoder and plugging some quick&dirty code in the main loop...
if ( mySwitch.getReceivedProtocol() == 5){
  unsigned long value = mySwitch.getReceivedValue();
  unsigned int humidity = ((unsigned long)value & 0xFF);
  unsigned int temp = (((unsigned long)value >> 12) & 0xFFF);
  unsigned int channel = (((unsigned long)value >> 24) & 3) + 1;
  Serial.print( "Temp:");
  Serial.print( temp/10 );
  Serial.print( "." );
  Serial.print( temp%10 );
  Serial.print( "* Humidity:");
  Serial.print( humidity );
  Serial.print( "% Channel:");
  Serial.println( channel );
...the output is:

I spent a few hours into this, mostly understanding the rc-switch library and flashing the fake Arduino Nano with a fake PL2303HX serial converter. I've never seen so many blue screens in one day - until now.
As a bonus I've also decoded some RF-controlled outlets bought from Lidl 10 years ago. They were using the Quigg protocol*. Both these decoders will be opensourced once the code is cleaned up a bit.

If I were to do it again I would use the Stellaris Launchpad - it has step-by-step debugging and hands-free flashing.

*Actually, I was able to decode the RF outlets with the rc-switch library and the Stellaris, around one year ago, but somehow I could not do that with the Arduino Nano at the present time.

Wednesday, June 10, 2015

Essential Windows software for power users

Do you feel efficient enough when using Windows?
Here are some pieces of software that I use and have saved me years.

Total Commander

I've been using this for more than 10 years, think of it as Midnight Commander (mc) on steroids, for Windows. Screenshots of main features here:
It's practically the first thing I install when I need to work on a machine.


  • copy stuff around from one drive/ftp/share to another, queuing (F2) operations along the way
  • view any files (F3) in ascii/unicode/hex, edit them (F4)
  • search in current folder (Alt+F7), much faster than using an IDE for source files
  • archive old files (Alt+F5, Alt+o) and unpack multiple archives (insert, Alt+F9), in background
  • compare directories (Shift+F2), including by content (Alt+c, y) like different GIT repositories
  • diff selected files, including binary/hex (Alt+f, y)
  • virtual folder support for FTP/Samba/nfs shares, adb, ext2fs, deleted files ...
  • virtual folder support for most archive types - I use mostly use zip with maximum compression
  • see how much each folder takes up (Alt+Shift+Enter)
  • open a quick DOS prompt at the current location (Alt+c, d) with the same elevation
There's an active community for add-ons and it's mature enough to be almost bug-free.
License: Winzip-like (forever shareware), 40 CHF (plus VAT!) otherwise.


Including the plugin pack this is my go-to image viewer and basic editor. It integrates nicely with the above (F3 on an image / video file to view it).

  • open up a picture, press T to go to the thumbnails view and batch-organize files
  • select an area, press Ctrl+Y to crop to that area, press Ctrl+R to resize [the long side] to a size of your choice (I choose mostly 2048 px for the blog), Ctrl+S to save, space/PgDn to go to the next picture, DEL to remove the file
  • Shift+G to do basic gamma/contrast enhancement
  • L,R to rotate 90 deg, Ctrl+U to rotate arbitrarily (misaligned pictures)
  • B to run a batch conversion: change file names, resolution, format, EXIF
There's a lot of stuff that can be done, including support for old-style Photoshop plugins.


This one almost does not need an introduction. If it does, I suggest you take a look at 'A case of the unexplained' video presentations and blog posts.
I use Process Monitor a lot, especially to figure out why installers fail and what secret files some programs might access. For example a firmware update utility might write the raw firmware file to some other folder than Temp. Other programs check for a registry key + a hidden file to see when the trial expires.

PowerShell, WinDBG, BootICE, Unlocker and other utilities also fall under the same category, but they are too generic/specific/slow to use in comparison.


I discovered this quite recently but it has become almost indispensable. It is like putty on steroids.
It allows managing several terminal sessions (ssh, telnet, ftp, serial!) at once, does X forwarding and saves the passwords as well. So you can have sessions for your router, Raspberry PIs, esp8266 and Arduino, all under one tabbed interface.

Also has SCP support out-of-the-box so you can browse the folders, view the files and edit them. I'm so happy whenever I don't have to use the vi retardness, especially on Solaris.

Best thing: it ports an almost complete Cygwin environment to Windows so you can run your awk/grep/cat/wc inside your DOS prompt. Close the window and it goes away.

License: free edition a bit lightweight (though sufficient), 49 EUR (+VAT) otherwise.


I use this to connect from my tablet or phone to the computer(s) running in the other room. Why get up from the bed if you forgot to shutdown the computer? Or if you want to stream some PC-only web stuff to Chromecast/EZCast in the other room, without dragging your laptop.


Another late-comer for me, I used to use RealEdit before.
I like the fact that it opens the same set of files so you can have a TODO list inside your Dropbox folder synced across computers. Unless it's a corporate workstation, that is.
But the editor in itself is really nice: lightweight, able to work with huge files, macros, syntax highlighting for a lot of languages, 
I will try to set it up for use with Arduino and light PHP work, it should support deployment scripts and autocompletion.

Classic Shell

I used to use it when Windows 8 first came out but decided to give the new Windows 10 launcher a chance. After 6 months of usage I can confidently say that Classic Shell is better. Text search works across the desktop icons as well, you can get rid of the heavy Metro sidebar and you can even disable Cortana. It's also noticeably faster in everything it does.

Honorable mentions

No offense to the Firebug team but Chrome dev tools really kick ass - live Javascript editing with two-way syncing with the workspace folder, live CSS editing, breakpoints that work 99% of the time.
Remove those 'click to like' overlays, debug why clicks are not working (hint: AdBlock).
I wish there would be one tool that does everything archive-related. TotalCmd really makes these almost obsolete. Still, there are times when they are needed.
For when someone loses files on their portable harddrive or formats the sd card from vacation.
A portable Apache / mongoDB / mySQL / PHP installation. The 'zero-installation' does not work on corporate workstations but you can make a batch file that maps a drive to a folder.
The swiss-knife of serial port debugging
You might be in for a big surprise after you calibrate your displays.
Deluge - non-classic mode
Use a Raspberry PI (or Banana PI or NAS) as your main torrent client, but manage it from any machine. The interface is similar to uTorrent, a bit buggy but very functional.
Make multi-boot USB sticks: Linux, Windows XP and Hiren - all on one stick
Plug any device into your Ethernet port and sniff the traffic.
The first one enables different settings (for example speed) on different pointing devices while the second one allows you to map your mouse buttons to do something else.
AutoHotKeyRecently started using this but there is a huge community of scripts. I like the fact that some Windows hotkeys can be disabled selectively.
Much better than SysInternals' Desktops.

Classic Start Menu, Snipping Tool, Task Manager, Resource Monitor (all three included in Windows), MPC-HC and VLC

Monday, June 8, 2015

Various laptop operations

I had these pictures lying around, they might be of help to someone. So, in no particular order:

  • MSI GT60 2PC mini-review, inside photo and getting the Windows 8 key from BIOS
  • Intel Centrino Advanced-N 6230 SMA socket repair
  • Random Toshiba laptop reflow attempt

Saturday, June 6, 2015

Keyboard membrane repair

This is a short article on a lighter note.
I got a broken keyboard (from boxes with DOA stuff) with a few keys that were not working.

I've opened the keyboard up and marked the keys that were not working, you can see a slight red marker trace in the picture below:

The key circuitry is a sandwich of three flexible plastic layers: top and bottom with conductive traces and a middle one for isolation. Only the bottom one was broken.

Using a continuity meter the breakage was traced to an area near the connector.
As a heads-up, the measured resistance for this type of traces is 5-10 ohms/cm, so for a strip/trace longer than 20 cm the meter might not beep anymore.

I had some silver paste sitting around unused, so I covered the broken traces with that.
 Some shaking required....

...after shaking all the silver flakes/powder should be evenly distributed. I don't think they mention this anywhere.

I believe a bottle of that stuff is around 15E for 5ml, but should last a really long time.

There's no way to properly construct traces, I've tried using toothpicks and other small-pointed objects:

I've left it to dry for 5 minutes then proceeded to remove the large unneeded areas with a cotton ball tip and traced the outline with a needle-like tip:

After 30 mins of drying and some more cleaning the keyboard was ready for use.

Reballing adventures - part 2

Thinking that I've had the process in hand, I've tried reballing a PS3 video chip. I'm not sure it was the video chip at fault since the person who gave it to me had attempted a reflow on it, transforming the YLOD (yellow light of death) into a GLOD (green one).

Setup was pretty similar to the one in the previous post; started with a light warming (100-120C) of the complete board to provide uniform thermal expansion and remove moisture:

However the chip proved to be a beast and my hot air gun was raising the temperature too slowly to be safe.

 I began looking for items that are a similar size and shape in order to make a template for the gun. This screwdriver accessory proved to be the best match.

The layout was started by wrapping some gardening wire around the magnetizer and holding it in place with some masking tape.

Not removing the tape proved to be a mistake when temperatures of 400C were involved.
The wired frame was then wrapped in food-grade aluminium foil...
...and after preheating the board I started following the lead-free solder temperature profile.
The attachment had to be moved really close to the board in order to get the temperatures to rise up fast enough: around 3 minutes are required.
Any longer than that and the chip can become toast, as well as the parts around it.

I tried to get the chip to be at 240C but it would not move. I've then removed the heat spreader (top aluminium part) exposing the bare chip and tried to remove that.

I was working in 3-5 minutes increments then slowly removing heat as to not stress the parts, then started a new cycle with 10C more.
After around 5 cycles of the above I raised the hot air temperature from 350C to 420C and see where that might go.

Still no luck, tried various tools to pry the chip off while still hot, thinking it might be attached with some strong glue.
Found out the hard way that the required temperature for removal was much higher, measured around 265C until solder balls started popping off and 280C until the chip could be removed.
Oh, I had to use a paint stripper for this, the hot air gun just could not provide sufficient thermal flow.

The result is ghastly:

The chip was permanently bent by the tools used to try to pry it, pads were ripped from the chip and pads and tracks were ripped from the motherboard.

I did not even attempt a reball at this point, there's no coming back to life for this unit.

Lessons learned:

  • have the proper attachment for the heat gun
  • ensure the gun can reach temperature in a safe time - or replace it if not
  • do not try to pry the chip - minor nudging should be enough to see if it's removable
  • most glues soften by the time the solder is molten
  • improper heating patterns (insufficient preheating) leads to delamination
  • same as above with regard to moisture content
  • eyeballing the temperature works much better in my case than using tools
  • prepare the full workflow in advance and work fast
I can see why reballing is such a lucrative (or rather expensive) service: the guys (and girls?) doing this have to break tens of units in order to teach themselves the proper process.

However, not everything is lost: I'm pretty confident now that I can prototype with BGAs with a 20% success rate. i.e.: 'Bad experience, F--, would attempt again'.

Reballing adventures - part 1

Some time ago I wrote about a reflow I did on a broken laptop:

The unit worked fine for ~6 months, after which it failed again with the same symptom: no video.
It sat unused for one year but then I received a PS3 with the YLOD symptom. This prompted me to order a BGA reballing set from eBay and attempt to fix them both.

The PS3 reball will be in a part 2 of this series.
This is not a guide, just a journal describing the mistakes I've made during the process.

The video chip is the plagued NF-G6150 , also used in the HP DV6000. The laptop still has decent performance when paired with an SSD, for today's standards.

The area around the chip was masked with Kapton tape:

Then 'shielded' with food-grade aluminium:

I had a goose-neck-style phone cradle sitting around which provided a stable hands-free holder for the hot-air gun.

The chip was painted with a black marker (for reducing thermal reflection) and the measurement from an IR thermometer was compared to a K-type probe.

The hot air gun was left at 100C for around 15 minutes in order to heat the board uniformly to avoid a sudden thermal expansion on the working area.

After which the temperature was raised to ~350C on the gun (~250C on the chip), air speed was set to 3-4 (out of 7). This enabled a clean removal of the chip, but you can already see the non-uniformity on the surface pointing to a delamination.

The chip and motherboard were cleaned from solder - there are hundreds of how-to videos on YouTube.
The basic process: flux is added then the soldering iron is run with some fresh solder on the pads. After most of the solder has been removed, some more flux is added and the remaining solder is removed with a [copper] wire braid. The flux residue is cleaned with alcohol.

Did I mention how much I hate the Blogger editing interface? There's no way to align multiple pictures into the same area.

The chip is then covered in flux and the reballing pattern is placed over it.

A nice trick for getting the balls in (hehe) is to pour from the ball container into a larger container, over the pattern. Instead of the ~200 balls you will be using ~3k, but they can safely be reused afterwards. Learned this trick on YouTube from some random Indian guy:

The pattern and chip are then heated in order to reflow the balls and attach them to the chip

First attempt: 20% of the balls got detached from the chip and stuck on the template. Do not reuse these ones!

Second attempt: only two balls detached. They were manually placed on the pads and reflowed again, without the template in place.

The result looks promising:

Time to reflow the chip back into place. The black stuff is permanent marker that I've used to increase emissivity(?) or reduce heat reflection.

Result: no video.

I've tried two or three times to reflow the chip, I think I might've also reballed it again but there was no improvement. This one goes back to the scrap pile.