Saturday, October 24, 2015

Inside stuff - Joytech ERoll

This is a teardown and 'repair' of a common type of e-smoke cigarette.

If you are reading this in the future (say, ten years from now, 2025) smoking is a type of pleasure that's dying in this year - 2015. It's an expensive drug (5-20%of monthly income) that takes a bit worse than soap and makes everything stink. It's still legal while other drugs (THC-based)  are still illegal.
It forms a strange addiction to this bad smell and lack of brain oxygenation that augments alcohol consumption. Well, lack of oxygen will strengthen any other drug or high, but can be had even cheaper while trying to stay underwater in a sink.

If you are underage and you are reading this then probably the parental filter set on the router has failed. Smoking is bad, m'kay?

If you are reading this in the future, some people here are trying to get rid of this so-called nasty habit and enrich their gadget profile. This means that the thing they are trying to replace WITH has a microcontroller, rechargeable battery and USB connection.

Enter the Joytech E-Roll - mostly sold at convenience stores and gas stations, it provides an easy entry into the world of e-smoke - the latest fab term is called 'vaping'.

Smoking introduction

As a qualified tester and having sampled the right audience (the friend who gave me this) I can offer a short opinion on this. One of the usual long-style cigarettes provides around 20 inhalations (draws). A shorter one does 10 to 15. This, on a full charge, would provide around 15 lightweight draws.

Now, to get into the mind of a typical smoker, there are two kinds of behaviors: straight to lungs or mouth to lungs. A mouth-to-lung inhaler will 'charge' the cigarette first with two-three draws, inhaling afterwards. A straight-to-lung (my term) one will draw directly in the lungs. The first user might get throat cancer while the second one is more like to get lung cancer. Choose your destiny.

There's a third type of smokers, so-called social smokers. These don't enjoy smoking but make it as an act of bravery/show-off  They will typically inhale into the mouth and 10-30% gets into the lungs while the rest of the smoke exits via nostrils and other orifices.

E-cig short review

With the questions above answered, we have two questions: how good is this thing and what's inside it?
Well, as with all entry-level e-cigs there is a lack of control with both regard to airflow and temperature. Airflow is restricted by a tiny hole (see pictures below) to a slim-type cigarette. The fact that this hole is situated where people normally keep their index finger does not help. So it cannot really break the addiction to those straight-to-lung inhalers.

The temperature is 'controlled' by the inhaled airflow - a longer draw will make the heating element hotter if the airflow is higher. However, there is a limit to this. Quick, successive draws will turn on a protection on the unit - either the 10s continuous draw one or the the battery's undervoltage limit. The internal battery is rated at 90mAh

As a conclusion, it's suited for social smokers - people that want to look cool - or slim-type smokers - those who get satisfied with a bodiless menthol flavor.

Inside stuff

The kit contains two metal 'cigarettes' and a charging station. My station charged only while plugged in, although it felt heavy as like having a built-in battery,

The cigarette charges through it's end, with the center ring being the positive connection and the outer ring and body the negative one:

This means that you can charge one with 3xAAA rechargeables, in case of a zombie invasion,, if you can control the current that is. Since the battery is rated at 90mAh you can use a supply limited at 90mA and 4.2V. Or just another charged LiPo battery and a 47 ohm resistor.

Wednesday, October 21, 2015

txtr Beagle PC software and TL-WR841 VPN server firmware

This is a quick update to some projects that I've been working on.

My txtr Beagle PC software fork has received an updated version.
Changes and tutorial here:

In Germany youtube gets to screw us twice - most music videos cannot be viewed and ads are shown on 90% of the videos. The iOS and Android youtube players cannot skip those ads. Here's my solution to that - buy a TL-WR841N router and give it as a present to some close friend in another country. It's a decent router and my custom firmware adds VPN server support so you can get rid of those pesky ads and private 'law' agencies monitoring*:

Afterwards just set up a normal VPN connection - works with Windows, iOS and Android, out of the box. For Android I recommend VpnROOT instead of the stock feature.

*Those so-called agencies are private companies monitoring your traffic for 'illegal' content. They have automated software which intercept your downloads and match them against some generic database (e.g. movies, music, ...).
Then they get your IP from your Internet Provider via a legalese letter and craft another letter for you, on behalf of the company representing the matched content (e.g. Sony Music). They request ~100$ for DMCA damages and ~700$ in lawyer fees. Or you can settle the case for ~400$.
I've never been burned but it mostly targets non-technical people.

Thursday, October 15, 2015

MacBook Air water damage repair - part 1

I was asked to try to repair an Apple MacBook Air A1466 (mid 2012) that has received a cup of tea.

When I first heard of the water damage I requested the user to stop using the laptop immediately and take the battery out. However, the laptop was still put in use for a few weeks after which it failed. Had the advice been heeded the extent of the damage would probably not have been so high.

The symptoms were: some keys not working, including the power key, screen kept blanking out or flashing colors, laptop shut down by itself.

Getting inside is pretty easy, if you have the right tools. You need several strange screwdrivers that can be purchased from iFixit:

Most of the damage seems to be located in the upper left corner:

Screen (LVDS) cable has a few corroded pins, the power regulator next to the right seems to have been cooking some tea:

The screen connector on the mainboard looks heavily corroded:

Obviously the water detection sticker has been triggered to a red color instead of its innocuous white color:

Wednesday, October 14, 2015

Getting (near) infinite lives in Candy Crush Soda on Kindle HDX

I'm running a social experiment to see how many views would get a post targeted to a different audience.

This hack is focused on Amazon's Kindle line since it does not allow changing the date via the settings, but it's applicable to all Android devices.

I would suggest having a cheap tablet just for the game, since the clock will be way off. Also, connecting to WiFi will, in some cases, update the clock.

The preparations will take around 15 minutes, only once, afterwards it should take around 20 seconds to get your life back. Actually, if you are playing this game, you are never getting your life back.

Edit - quicker way: change the date 1 day after, go back to the game, see 5 lives restored, change back 1 day, go back to the game.

What you need:

Kindle Fire or Kindle Fire HDX rooted
Terminal Emulator - install the store version if possible or sideload the apk
Hacker's Keyboard - not needed but highly recommended.


Disable WiFi to block automatic clock updates.
Activate Hacker's Keyboard (if installed) by going into the application and following the instructions.


After your lives are exhausted, start Terminal Emulator and type the text in bold below

u0_a22@android:/ $su
Click grant root if requested.
root@android:/ #date
The reply should be something like:
root@android:/ #dateWed Jul 8 14:00:00 CEST 2015root@android:/ #
 Take note of the date and type the text in bold below:
root@android:/ #date -s 20150708.16000Wed Jul 8 16:00:00 CEST 2015root@android:/ #
As you can see, the date -s command sets the date to a string in the form of yyyyMMdd.hhmm - where yyyy is the year, MM is the month number, dd is the day of the month, hh is the hour and mm are the minutes.
By running the command above we essentially added two hours to the current time.

Do not close the terminal, just go back to playing the game by tapping the home icon.


After your lives are exhausted, go to the home screen and drag from the top to open the notification drawer. Select 'Terminal Emulator / Terminal session is running' from the list.

If you have Hacker's Keyboard installed just press arrow up on the keyboard to get the last command.
Hit the left/right arrow keys to move to the hour section and replace 16 with 18, press enter:
root@android:/ #date -s 20150708.18000Wed Jul 8 18:00:00 CEST 2015root@android:/ #
Each 2 extra hours add 3 lives, this is the most efficient way to not lose any lives.
Do this every time you are out of lives, should take around 20 seconds or less.


Currently there is a bug in the game - if more than 24 (or 48?) hours have passed you get the full 5 lives, as usual. If you don't start a new game and change the date back any number of days you still have all the 5 lives. So you can go forward 2 days and back 2 days each time.

You don't need to necessarily calculate the days when the hour gets past 24, the date command will do that for you:
root@android:/ #date -s 20150708.36000Wed Jul 9 12:00:00 CEST 2015root@android:/ #

This means that you can keep adding 2 until you get to 98. I haven't tried to see what happens afterwards.

Friday, October 9, 2015

Adding an isolated data output to Mastech MS8229

As seen from the previous related post, adding data output to MS8229 does not take very long and it might prove useful at times.

However, some people might undertake that modification - which for safety reasons I don't recommend - so here you get to see a proper isolated connection.

First, the hand-drawn schematic:

Some optocouplers and resistors were scrounged from crappy USB chargers. You need 2x optocouplers and 2x or 3x resistors. The left dotted side signifies the UART converter while the right side the multimeter.

The circuit above has the added benefit that it draws no power if the data output is not connected to a computer -> if no USB is plugged into the converter the first optocoupler does not turn on, yielding no power to the second one.
It also does the necessary inversion of the signal by weakly pulling RX to GND at all times (through the 3.3k resistor) while turning on the second optocoupler will pull the signal to VCC (3.3V).

The resistors are randomly chosen but there is a nice hack that can be done to get rid of the 1k resistor. If you take a look at a typical optocoupler datasheet you will see that it acts as a voltage-controlled resistor, designated by the posh-sounding "CTR":

In effect, with the circuit above, I get 2mA going through the multimeter side. The current should be 3mA (3V supply divided by the 1k resistor) so my current NCTR is 2/3=66%. This is controlled by the 330 ohm resistor connected to pin 1 - which gives me 10mA forward diode current. The graph above confirms that the NCTR should be 60-70%.

By raising the 330 ohm resistor above 3.3k we should get an NCTR of less than 25%, which would enable us to get rid of the 1k resistor connected to pin 4. We've seen in the previous post that the multimeter is able to source 40mA so we should target an NCTR of <0.1.

Perhaps a 5k resistor connected to pin one should do it, I haven't tried this yet. But it also means that the current going through the LED of the second coupler will be lower, causing the current seen at the other end to be lower which might not overcome the 3.3k resistor pulling to ground. Which means the 3.3k would likely be raised to >20k.

Update: tested and implemented the idea above, see the last part of this post.

Adding a non-isolated data output to Mastech MS8229

I bought a Mastech MS8229 multimeter for a decent price because it offered a few compelling extra features which would be nice to have - sound meter and luxmeter. I also knew from this post that data logging was possible to 'bolt on' afterwards.

Short review

TL;DR: I would likely not recommend this meter for the money it currently retails for (45E).

It has a really slow autoranging, especially on the Ohms scale, taking 2-3s to read a resistor.
The input protection is almost inexistent, which is not a huge issue if you don't intend to use it at high voltages.
It has a multi-purpose mode of resistance, diode, continuity and capacitance - which defaults to resistance. I am using continuity mode 90% than any other mode so I would have liked that to be the default or to have it's separate switch position.
The rotary switch cannot be moved without holding the device with the other hand and it frequently goes between positions. While in that erroneous mode you have no indication that the device is misbehaving.
No auto-hold or smart hold feature. I really don't understand why this kind of hold feature exists on all these meters, it has been completely useless for the past >15 years.

Crappy probes - not the worst but just slightly above - which makes the continuity buzzer work with a one second delay. My 'fix' for this issue is to use a 200 sandpaper on the tips each 6 months or so. By doing this the tips are also sharpened, making them more useful. If you cringe at this then you have to know it takes 20s to do, the probes are likely worth 4$ a pair and you would have to do it 100 times before the tips are completely eaten away.  I think that's the best solution to the problem and I haven't seen any tip on doing this elsewhere.

The mod

First, if you don't know why you need the isolated data output - don't try this, really. It can fry your computer/tablet, yourself, your significant other, etc.

I intend using this for 3-5V work while connected to a [Windows] tablet that's running off it's own battery so if that matches your use case read on. For the isolated version check this site: or this: