Hack Correlation

Living close to a densely populated area means that it's hard to do consistent testing without spending a lot of fuel, which is also expensive. Nevertheless, I took the pen&paper approach and started working my way from the basics. I studied all the Bosch sensors from this page , used a bit of common sense and figured out that my sensor is a Bosch 0281002691, or similar, with a 180 MPa (26000 psi) nominal rating. This might be wrong but It's a good place to start. I've already used Torque and my multimeter to get some data and it seems to fit with the sensor I've chosen. It might be wrong, but so far it clicks into place. Using the data I've gathered I've created a simple JS page that shows some logs and tries to simulate what my module (and sensor) does: https://jsbin.com/goyavabuju/edit?html,output (Note that this is the HTML/JS result after I did the interpolation.) So the basic function is: the ECU commands the pump, this delivers a pressure...

I bought one of these cheap 'wireless drives' from Amazon:  https://www.amazon.de/I-ONIK-70752-i-onik-WIFI-Cloud/dp/B00I16C1K2/ Currently (early 2017) selling for 15E, I think I paid 12E including shipping. This post will focus on basic features and some early data. Later posts will go into some reverse-engineering, featuring a great YouTuber, LiveOverFlow . If you like reverse-engineering you will surely enjoy his tutorials. By the time you read this he will have probably published his first video showing you how to get into the device. He also discovered that a very similar device is being sold under the Strontium Mobile Wifi Cloud (Sri-CUBa-3KW) moniker in US and India. However that one is advertised as having a 3000mAh battery while this one only has a 1900mAh one. Edit The excelent video from  LiveOverFlow  is up:  https://www.youtube.com/watch?v=FxE2ITDWsNE

If you are following the project you might've seen that the new source code for the firmware and (Android) client application are up: Arduino firmware:  https://github.com/ligius-/DieselTuningBox Mobile UI:  https://github.com/ligius-/DieselBoosterClient With that out of the way, I've had about a month of testing with the new prototype and several months already with the old one. The definitive result is that there are significant fuel savings. Outside city limits I now get better than 6L/100km, at highway speeds (130 km/h) better than 6.5/%. I believe the highway consumption can be further improved but I haven't used the car so much lately to be able to fine-tune the settings. Previously I would get 7.6L/100km at best on country/county roads and 7.4/% on highways. So that would be a 12% mileage increase on highways and 21% on slower roads. Inside the city is where the story changes since that's where I did most of my driving and had time to tune the pa...

As I wrote in the previous article , the barebones design has been through some basic testing - 500km mixed environment driving - and has been mostly successful so far. I had a suspicion that the output impedance of the circuit must somehow match a known impedance, but was not sure which. The clue was that the RaceChip unit raised city consumption by 5-15% even though it had no effect during the bench testing. Here's a datasheet for a similar Bosch pressure sensor: http://rb-aa.bosch.com/boaasocs/index.jsp;jsessionid=A20738712FCFB9E51CA919DD7D2F9E91.sundoro2?ccat_id=275&prod_id=516 For testing they are using a pull-up resistor, so on the input side of the ADC the same circuit must be simulated in order to drive the sensor. I used a 10k resistor, but perhaps even the internal pull-up could work. At the DAC/PWM output I found out that a 1.5k resistor was too large and could not sink the ECU input line low enough. With a 10ohm resistor it seemed to work fine, perhaps 47oh...

See my first article for a short review and teardown: http://hackcorrelation.blogspot.de/2016/02/inside-stuff-racechip-car-tuning-thingie.html First off let me start by saying I consider this fair use, as the instructions and website do not explain what the settings do, how the unit actually functions and what effects it can have. The description below refers to a single-channel Diesel engine (single common rail). Settings First off, most of the users will just want the simple explanations, here's a graph that should be in the manual: The chart above shows 4 possible settings and their effects. The first rotary encoder controls how much 'extra power' is requested. See 9E vs. BE vs. 4E The second rotary encoder controls the RPM high range (endpoint). See BE vs B7. The encoders go from 8 (minimum) through 9, A, B, C, ..., F, 0, 1 ... 7 (maximum).

Since I am lately doing contract work mostly from home I need to set up the environment just right. Sitting for 8-10 hours straight at a desk is unhealthy and a lot of my colleagues have motorized desks that go for 1700E (~2000USD) a pop. I just bought an Ikea SKARSTA desk that’s raised and lowered via a manually actuated crank, old-school style. The price for the base was 170E (x1.13 for USD) plus another 30E for the base plate. The motorized version (BEKANT) retails for 500E which means by doing a conversion we can save around >300E - 340$ at the time of writing, likely to be more by the time you read this article.

Being on the hunt for the cheapest wireless temperature and humidity sensors led me to FreeTec  NC-7345-675 - sold by pearl.de at the fair price of 10E, though I might have paid even less for them. The requirements were: multi-channel, have at least 0.5C accuracy and provide humidity readout. Rolling your own can easily cost more than that. The sensors pair with this weather station . The goal is to store all the data on an SBC and provide a nice HTML frontend with long-term statistics and heating automation. EDIT: blogger removed without warning all the newlines from my code, I had to redo some of those Hardware The first step is to open up the sensors and see what we are dealing with. With the main board detached from the zebra display connector, we can see the coil antenna at the top and the wires for the humidity sensor running at the bottom right. Judging by the traces going from the SW-CH part directly into the chip it seems there is no way to force addition...

I have a lot of posts in my backlog that have pictures but no text added to them. Since a lot of them are more than one year old I figured I should take the effort to add the text lest I forget what happened. There is a common problem with the DSO5062B oscilloscopes in that they get a white screen once in a while and require a power cycle to recover, temporarily. The scope seems to be functioning in the mean time but nothing is displayed. The same device is being sold under many different name and brandings: Tekway DST1062B, Voltcraft DSO5062B, Zhongce, Protek, PCE (like mine) but it's exactly the same thing save for the splash screen and printed logo. There's an extensive thread about hacking and modding them on the EEVBlog forum. Here's how the white screen syndrome looks like, see below for the fix:

This project is taking longer than anticipated even though it was supposed to be something simple. I will publish a schematic of the complete circuit in the near future (this year) but in the meantime there is still the slow process of troubleshooting. Safety considerations: the complete circuit is not isolated from mains so testing is pretty critical. I have been feeding 3.6V to test the low-voltage part but in the end it will have to be hooked up to 220V the boiler / water heater can only take a limited amount of pressure. If the thermistor is not properly calibrated in software there is the risk of a scalding hot water explosion With that being said there is some small but steady progress being done. The MSP430 has a some strange power requirements that are not properly documented. The VCC supply  needs to rise with >1V/ms otherwise it gets into an undefined state. That undefined state might also mean that some GPIOs are high, causing catastrophical failure. C...

My TV has a quite complex set of features, none of which work particularly well. Except perhaps using it as a PC display. Input latency is quite bad, ranging from over 200ms in normal mode to 100ms in "gaming" mode. The latency can easily be tested by going to this link and making a picture of both displays (native and external) at the same time, preferably with a flash, in order to shorten exposure time. There's a half-assed [HBBTV] implementation that crashes once in a while, a horrible YouTube app that takes 1-2 seconds to react to keypresses, a barely-workable DLNA implementation and barely-acceptable USB media integration. Oh, it also does triple-tuner TV, but I don't watch TV. Sometimes I'm just wishing they would have stuck with a Linux, WinCE or Android implementation with freeware apps instead of reinventing the square wheel each time. What's worse, each of these apps (TV, DLNA, HBBTV, YouTube, USB media) seems to be written by a diff...

In the first part I identified the problem leading to the unit overheat: a design decision consisting of dropping more than 10 Watts on a couple of 3W resistors. I've thought of several ways to address the issue: change the 5V rail to a switching design put bigger resistors and mount the 7805 on a heatsink have a switching or linear preregulator that drops 12V to a more manageable 7-9 Volts I have a few switching supplies bought from ebay at around 2-4$ each based on the LM2596 reference design. However they might be noisy and I'm not sure how well they handle high loads. Should be good enough for charging the USB and anyway the 1.8V and 3.3V lines go through linear regulators first, cleaning them of noise. The bigger resistor solution would also work but I did not have any 10W resistors at hand and I'm not sure they would fit in the small space between the CD tray and the case. Since I have a few LM7808 and LM7809 from scrap I decided to go with the third solut...

I've bought a somewhat cheap car MP3 player a few years ago on the reason that it had Bluetooth support and nice amber lights to complement the design of my E39. I understand some people will come here looking for a wiring diagram so I should start with that first: Model: Watson CRC8060MU I've always had the issue of not being able to charge anything from the USB port or the unit resetting with some strange USB sticks. Also, the unit lost its settings when cranking the engine with a low battery while it was playing music. After the jump I start taking it apart to see how it works and what can be done to address the issues.

I've been avoiding to do a write-up on this section for several reasons. First, I'm using the IDA disassembler which is pretty expensive and thus quite extensively pirated. Unfortunately there are no freely available tools that I know of that can perform this task. Second, I really suck at assembler and C so might not be the best person to do these analysis. I've used the freely available Thumb decompiler plugin which is able to translate assembly into readable code but only in about 30% of the cases. There's no substitute for knowledge, it seems. Part 1:  http://hackcorrelation.blogspot.de/2013/07/txtr-beagle-teardown-part-1.html Part 2:  http://hackcorrelation.blogspot.de/2013/07/txtr-beagle-part-two-software.html Part 3:  http://hackcorrelation.blogspot.de/2013/07/txtr-beagle-part-3-storage-and-transfer.html Part 4:  http://hackcorellation.blogspot.de/2013/07/txtr-beagle-card-parser.html Part 5:  http://hackcorrelation.blogspot.de/2013/07/txtr-b...

I started playing around with the SD card contents to see how I can parse it and verify the functionality. The result is a small Java program that is able to read the contents page by page and display it on a little panel. You can type the page number and press <Enter>, you can use arrow keys or mouse wheel to scroll.

This experiment was done about a year ago so I don't have all the details at hand. I wanted to see if a car USB charger can be modified to run on 1-3V. The car charger is based MC34063 chip which can function in both buck and boost configurations.

I'm wrapping this up for now as one of the COG (chip-on-glass) devices has apparently fried and the reader has sold out. UPDATE : Andreas Schier has written an open-source java toolchain for Beagle:  https://github.com/schierla/jbeagle UPDATE : Florian Echtler has built two Python scripts, one emulating the server and another one for the client. The server allows you to send images to your reader:  http://floe.butterbrot.org/matrix/hacking/txtr/ Part 1:  http://hackcorrelation.blogspot.com/2013/07/txtr-beagle-teardown-part-1.html Part 2:  http://hackcorrelation.blogspot.de/2013/07/txtr-beagle-part-two-software.html Part 3:  http://hackcorrelation.blogspot.de/2013/07/txtr-beagle-part-3-storage-and-transfer.html Part 4:  http://hackcorellation.blogspot.de/2013/07/txtr-beagle-card-parser.html Part 5:  http://hackcorrelation.blogspot.de/2013/07/txtr-beagle-native-code-analysis.html I've scratched some of the white glue-like ...

Bluetooth Thanks to Moritz I was able to connect to txtr via the Bluetooth SPP profile. To do this you need to disable the txtr app that is installed on your phone and install any app that does Bluetooth serial debugging. I used "Bluetooth SPP", available freely on the Play Store. UPDATE : Andreas Schier has written an open-source java toolchain for Beagle:  https://github.com/schierla/jbeagle My own version:  https://github.com/ligius-/jbeagle UPDATE : Florian Echtler has built two Python scripts, one emulating the server and another one for the client. The server allows you to send images to your reader: http://floe.butterbrot.org/matrix/hacking/txtr/ Part 1:  http://hackcorrelation.blogspot.de/2013/07/txtr-beagle-teardown-part-1.html Part 2:  http://hackcorrelation.blogspot.de/2013/07/txtr-beagle-part-two-software.html Part 3:  http://hackcorrelation.blogspot.de/2013/07/txtr-beagle-part-3-storage-and-transfer.html Part 4:  http://hack...

In a previous posting I described how I got this iPod Classic 6G working again by just using an older 1.8" drive. I did not provide any pictures, so here are two of them with the "roadkill".

First: this is borderline immoral so don't ask for any source code or help. My friend got me into a repetitive Android game that I will not name here. Basically it's a different kind of Farmville (I assume) that requires you to mindlessly click 'animals' to 'farm' money from them. On top of that you have to also activate two type of farms in order to feed the animals and evolve them. Feeding is not a requirement, so it will only be done in the second iteration of this automation. As a rule of thumb any task that takes you at least 5 minutes every day for a year should be automated if it could be done in less than 20 hours.