YKM's corner on the web

  • Hacks
    • PCB Business/Name Card
    • Changing Casio watch to positive display
    • Printing app for NUS SoC
    • (Partial) Reverse Engineering the NDP 2016 LED Wristband
  • Retrocomputing Projects
    • A Science Project: “Make the 486 Great Again!” – Modern Linux in an ancient PC
    • A Science Project: Bringing the Covox Speech Thing to 2017
    • A Science Project: Windows for Workgroups 3.11 on vintage and modern hardware in 2016
    • Installing Windows XP on a modern unsupported (Haswell) system in 2016
  • Aviation
    • Considerations on picking a Flight school for PPL – A Singaporean perspective
    • Flight trip to Malacca and back to Singapore
    • Notes on flying in Seletar Airport and Singapore Training Areas
    • I became a Private Pilot and this is my story: Part (1/2) in Singapore
    • I became a Private Pilot and this is my story: Part (2/2) in San Diego
    • Aviation FAQ from my friends
    • First Flight Experience in a light plane (Socata TB10)
    • Reflections after 2 weeks of PPL Training in the US
  • Notable Pieces
    • Review and partial teardown of Fairphone 3
    • Why I use the IBM Model M keyboard that is older than me?
    • My First Conference Emcee Experience
    • X commandments before finding a tech-cofounder/engineer
    • Local exchange to NTU
    • Thoughts on LKY’s passing
    • Graduation, Uni story arcs and thanks
  • Book Reviews
    • Book Review: Neither Civil Nor Servant (The Philip Yeo Story)
    • Chaotic Thoughts from the Old Millennium by Sim Wong Hoo
    • Fringe: September’s Notebook
    • Kampong Boy by M Ravi
    • Democratically Speaking by Dr Chee Soon Juan
    • Beyond Suspicion? by Francis Seow
    • To Catch a Tartar: A Dissident in Lee Kuan Yew’s Prison by Francis Seow
  • About
    • About Me
    • CV of Failures
    • My Rig
    • Favourite quotes
    • Github account

(Partial) Reverse Engineering the NDP 2016 LED Wristband

August 11, 2016 7 responses Yeo Kheng Meng hardware hacks wearable

(Checkout the 2019 version here!)

The Singapore National Day Parade (NDP 2016) happened on 9 August 2016 to celebrate its 51st birthday. For those who had the opportunity to attend the actual parade or its previews/rehearsals, they will also get to receive a funpack where one of the items will be a wearable LED band made by a company called Pixmob.

ndp2016-re-wristband

This band receives infrared(IR) signals from the organisers and then displays the LED colour of their choosing. There is also an onboard accelerometer. After the event when the IR signals disappear, the (single-axis I believe) accelerometer will cause the Red LED to light up when a shock is detected.

Here are the slides and the talk video on this subject I gave at Hackware v2.1.

I had the opportunity to attend the Preview 2 (or rehearsal) of this event on 30 July 2016. Here are 2 videos of the wristband in action during the NDP Preview 2.

Each segment is given a particular colour theme and the band blinks in tandem with what the organisers want.

You can see how the colour changes during the show.

So obviously I was curious about how this wristband works. A look at Pixmob website shows they have 2 products to cater to different audience capacities

  1. Professional (1500 to 150000 attendees) that runs on infrared
  2. Spark (Up to 1500 attendees) that runs on Bluetooth Low Energy

Since the National Stadium where NDP2016 was held has a capacity of 55000, it has to the former. I believe how the system is set up is that there are numerous Infrared emitters placed around possibly on the ceiling of the stadium to reach all the audience.

That is however not enough, I want to know MORE! So I proceeded to the teardown.

Teardown

I cracked open the case to reveal the following:

ndp2016-re-front

Front view of the board. I have identified the major components in the list below

  • IR1: Infrared Receiver
  • LED1: RGB LED
  • IC1: Atmel AT24C02S 2KB, 2-Wire Serial EEPROM (SOT23-5 package)
  • IC2: Abov 81F4204R 8-bit microcontroller (MCU) with 4KB ROM and 192B RAM (TSSOP16 package)

I have no idea why there needs to be Atmel EEPROM chip, what does Pixmob need to store inside there?

ndp2016-re-back

Back view of the board. The device is powered by a 3V CR2032 battery. The tube on the left is what I believe to be a single-axis accelerometer.

Hardware Reverse Engineering

If you are interested in the raw schematics/code used in this post, you can see my Github link.

I was not satisfied with knowing what components goes inside the band, I’ll like to know how are they connected together. So using a multimeter, I set down to work.

ndp2016-re-blue-led ndp2016-re-red-led ndp2016-re-green-led

Using the Diode mode of the multimeter, we can see the different colours on the LED exhibit different voltage drops.

ndp2016-re-schematic

After some painstaking work mapping out all the connections, I drew out both the necessary Kicad libraries and schematic as you can see above. I even included the test points. Note that I cannot guarantee the schematic is correct.

Programming pads

The test points TP_SCK and TP_SO are no doubt used to program the board for the first time after the PCB is fabricated and assembled. I anticipate that ROM dumping could be possible but I don’t have the time and tools to make it happen.

Connection between host chip and EEPROM

What surprised me was the connection between the Abov MCU and the EEPROM chip. The AT24C02S uses the I²C bus to connect with a host MCU. However, the Abov MCU does not have hardware I²C support according to its datasheet. If I’m right, this means the Pixmob engineers had to bit-bang the GPIO pins to simulate a I²C bus to communicate with EEPROM, not trivial to do!

EEPROM write-protection is not enabled

According to AT24C02S’s datasheet, shorting the WP pin to ground disables the write-protection. This implies the MCU host can write new data to the EEPROM chip. Hmmm… Wonder what is this for?

R2 and R6?

I have no idea what is the purpose of R2 and R6? Measure battery voltage?

Unsuccessful attempt to brute-force the IR combinations

As many would have thought, it would be great if we can reuse this band by mimicking the IR signals sent by the NDP organisers. Googling shows that someone has made his previous Pixmob model light up using just a typical TV remote. I tried all the remotes I have in my possession, none worked. This means there are only 2 ways left to derive the IR code combinations

  1. Dump the code of the MCU and decipher the machine code
  2. Brute-force the IR combinations and hope for a response.

Since I lack the time and equipment to do option 1, I wanted to try out option 2. This could possibly work assuming that Pixmob has not programmed in a Kill code that will disable further IR functionality should the organisers send out this code at the end of the event.

My IR brute-forcer

This is a Fritzing schematic showing my design of a IR brute-forcer:

ndp2016-re-brute-force-microview-connections

The brains of this project is a Microview, an Arduino-compatible component that has a standard ATmega328p chip and an OLED screen. The Microview drives an IR LED with the numerous IR combinations. Should a particular combination work, the wristband will light up and the differing light intensity can be captured by the photocell.

ndp2016-re-brute-force-finding

This is the setup, the IR LED and the photocell are both aimed at the wristband.

ndp2016-re-brute-force-fake-find

This photo shows a false positive. Should the wristband light up, the OLED screen will display “Found”. The corresponding IR combination will be then sent via the Serial port to the computer.

Brute-force conclusion

This didn’t work out in the end as I realised there are literally trillions of IR combinations made up of IR-ON, IR-OFF, multiple delay timings and the Arduino can only output about a few hundred or thousand combinations a second. Even worse, even if one can find a faster way to brute force quickly, if a Kill code has been sent, then there is no way this could work.

Concluding remarks

Coming back to the title, this is not a complete reverse-engineering project as I did not dump the code and analyse it which is above my current skill level anyway. Nevertheless, I have learned lots in the process and I hope this will prove informative to those interested in the inner workings of this wristband.

Comments

comments

  • « Repair Kopitiam specialty electrical tools
  • A Science Project: Windows for Workgroups 3.11 on vintage and modern hardware in 2016 »

Recent Posts

  • Review and partial teardown of Fairphone 3 December 7, 2019
  • Trivia Questions asked during GeekcampSG 2019 October 20, 2019
  • Considerations on picking a Flight school for PPL – A Singaporean perspective September 28, 2019
  • Stock take for my last birthday in my 20s September 5, 2019
  • Teardown of NDP2019 LED wristband August 3, 2019
  • Flight trip to Malacca and back to Singapore July 21, 2019
  • Notes on flying in Seletar Airport and Singapore Training Areas June 9, 2019
  • Conference Emcee Experience: GopherconSG 2019 May 5, 2019
  • Aviation FAQ from my friends March 20, 2019
  • I became a Private Pilot and this is my story: Part (1/2) in Singapore February 15, 2019

Recent Comments

  • WEBSITE OPT FOR: MAKE ME Your FRESHMAN-A FREE OF CHARGE TOOL FOR ORGANIZING Homework Market COLLEGE APPLICATIONS on CV of Failures
  • I became a Private Pilot and this is my story: Part (1/2) in Singapore | YKM's corner on the web on Considerations on picking a Flight school for PPL – A Singaporean perspective
  • Aviation FAQ from my friends | YKM's corner on the web on Considerations on picking a Flight school for PPL – A Singaporean perspective
  • Singaporean perspective on picking a Flight school for PPL | YKM's corner on the web on I became a Private Pilot and this is my story: Part (2/2) in San Diego
  • Singaporean perspective on picking a Flight school for PPL | YKM's corner on the web on I became a Private Pilot and this is my story: Part (1/2) in Singapore
  • Stock take for my last birthday in my 20s | YKM's corner on the web on Flight trip to Malacca and back to Singapore
  • Stock take for my last birthday in my 20s | YKM's corner on the web on I became a Private Pilot and this is my story: Part (1/2) in Singapore
  • Stock take for my last birthday of my 20s | YKM's corner on the web on I became a Private Pilot and this is my story: Part (1/2) in Singapore

Archives

Categories

Meta

  • Log in
  • Entries RSS
  • Comments RSS
  • WordPress.org
Proudly powered by WordPress