The reason I haven’t written any more about my fun with the Dockstar was that due to an unfortunate set of circumstances I was left with a bricked dockstar. (read: I did something stupid.)  After performing a lot of research and thanks to a bunch of people over at the PlugApps.com Forum site who helped me, I was able to get it running.  Read more for a complete list of what you will need including how to build an adapter and where to get the needed JTAG kit.

Before we begin

This document demonstrates how to recover your Dockstar and upload a custom bootloader to it using a JTAG cable.  JTAG is used for low-level in-circuit debugging of embedded applications and is very hardware specific. If you are familiar with working with Linksys routers and uploading custom firmware to them, you have heard of the term bricking and you have more than likely heard of something called JTAG that is used to recover it.

Because of the nature of JTAG and the fact that manufacturers don’t typically like us having access to the JTAG port, these ports are often hidden in many different locations, usually unmarked or unpopulated headers, or other odd locations and is the way that the manufacturer loads the firmware for the very first time on to a new device.

By using JTAG, we can place the hardware into a “debug” mode where we can manipulate the microprocessor’s core functionality.  We can also send instructions to it, monitor responses from it, or even pause the chip, leaving it in a state of suspended animation until we issue the command to start it up again or reset the device.

In this particular howto, we will cover how to use the debug mode of the Marvell chip in the Dockstar to upload a new boot loader in order to rewrite the bootloader to the onboard Flash which will result in a working, new Dockstar.  Please note that if you have NOT bricked your dockstar, there is no need to perform the steps in this howto.  This is only for bricked dockstars that have been verified with a serial adapter to be dead. (A dead dockstar will produce NO serial output and the front panel LED will not light up when power is applied.)

Legal Disclaimer

By performing the steps outlined in this document, you agree not to hold firestorm_v1, YourWarrantyIsVoid.com or any other linked sites, forums, companies, liable if you really screw something up.  You can also not hold any of these entities responsible for data loss, physical damage, emotional trauma, spousal abuse or any other act of whatever god(s) that you may have happen to you.  In short, Read twice, type once, hit enter and don’t screw up.  If you’re at this point, then you’ve already come to terms that your dockstar may be unrecoverable already so deal with it.

Parts List

In order to perform this recovery, you will need the following items:

1. The dead seagate dockstar and power supply.
2. A handful of 2.0mm female connectors or one 2.0mm female connector with at least 10 pins (5 pins in 2 rows)
3. A 10 pin header that matches your PCB 2.5mm spacing  (again, 5 pin, 2 row)
4. A bit of holed PCB board 2.5mm pin spacing. (Radio Shack is good for this kind of stuff)
5. A CA-42 cable with the appropriate pins as outlined in my previous Dockstar post.
6. A handful of extra breadboard jumpers.
7. Superglue
8. A Windows PC (2k or XP, untested on vista/7 although plugapps forums says it should work.) with a Parallel Port
9. Whatever provisions needed for the CA-42 cable to work properly.  (I have to use a linux box to SSH to, you can do the same or if your Windows computer works with the CA42 cable, you can use that as well.  You don’t need two PCs for this operation.)
10. A TAIO Buffered/Unbuffered “Universal” Parallel Port JTAG module kit (Here’s the eBay seller where I got mine, ~$21.00 out the door) and a Parallel cable extension (Male to Female) so that you can reach it without having to get behind your PC. For my setup, I used an old iomega Parallel/SCSI Zip drive cable. I also recommend the ebay link as this is the seller that I purchased mine from and it comes with a lot of extra jumpers that are very useful for this project.
11. A USB A to USB mini B cable (for powering up the JTAG adapter).
12. Glue gun with extra gluesticks
13. Heatshrink tubing and lighter/heat source
14. In lieu of building/reinforcing your JTAG cable, you can use a laptop hard drive adapter (3.5 IDE to 2.5IDE) if you’re in a pinch and just need to get it running.

In addition to the above items, you will need the following software applications:

1. Kragorn’s copy of dockstar.cfg – Mirrored Here
2. A copy of OpenOCD – Mirrored Here
3. A copy of the Jeff Doozan’s custom USB-boot capable u-boot (Recommended!) (Mirrored Here) or a copy of another factory or custom uBoot.  If you want to compile your own, there’s a great write-up here: http://jeff.doozan.com/debian/uboot/
4. A copy of PuTTY for Serial/Telnet communication.  You can download it here.

Getting Started

This howto will be divided up into several sections:

Section I:Building an adapter cable – This section will cover how to build the required cable from spare 2MM connectors or if you already have the proper cable, this will describe how to reinforce it for repeated use using heatshrink tubing. I call it a smokestack cable because it resembles a small smokestack sticking out of the Dockstar’s mainboard.

Section II: Wiring it all up – This will cover the Dockstar’s pinout, the TAIO parallel port pinout, the serial port pinout and how to wire it up together.

Section III: Performing the JTAG recovery – This is where the actual recovery process takes place now that we have everything wired up.

Section IV: Notes and credits – As much as I’d like to say this was all my doing, truth is it’s not.  I couldn’t have done it without some great people from the PlugApps forums.

Each section will have lots of pictures that you can use as a guide to make sure you’re making the right connections.

BIG FAT OBNOXIOUS WARNING!!!

Although there are as many JTAG adapters on the market as there fish in the sea, I can not cover each and every device’s unique configuration options. Generally the JTAG port is a universal standard but many vendors implement their own standard, have other standards that they choose to leave out and their pin configurations may not match what is given here.  This article is based on my experience performing the JTAG restoration of a dockstar I broke using the equipment and the software outlined above.  If you are new to JTAG, I recommend using the versions and adapter board listed as other devices/software may not work in the same way.  When in doubt, go with what you know!

Section I: Building out the JTAG adapter cable.

The dockstar’s JTAG port uses a 2.0 mm spacing and while it’s good for tight spaces, isn’t exactly ideal when dealing with breadboard jumpers as most breadboards have a 2.5mm spacing and the jumpers have connectors to match.  In this instance I felt that since I was going to be working on actually developing code for the Dockstar, the inevitable would happen and I would end up bricking it through a random error (namely user failure) and would need a quick and reliable connector that I could use to quickly connect and disconnect the JTAG port as needed during restore and development.

I checked out EPO and managed to find several 2.0mm spaced connectors however these were in groups of three and while they would work, would require significant effort to harden the connectors to something that could stand the test of repeated connections and disconnections. So let’s get started.

Checking the connectors to make sure they would work

This is a shot of the connectors standing out of the Dockstar.  Since I had four connectors with 3 pins each, this means that I had two pins that hung over the connector block on the Dockstar.  Since these two wires were not needed, I cut them and removed the metal connector from inside the plastic, leaving 10 wires for 10 pins of the dockstar’s JTAG port.  We’ll deal with the two vacant holes later.

Little known fact: The pin spacing on the Dockstar’s JTAG port is identical to that of a laptop hard drive (which is why this part of the process is optional.)  In a pinch, you can use a laptop IDE adapter similar to this one (in fact I own several exactly like this).  If you decide to use a laptop IDE adapter, use the part of the adapter opposite the power connector.

Since the goal is to harden the four little connectors to one single connector, I used a dead laptop hard drive and superglued the four connectors together. USE THE SUPERGLUE SPARINGLY!! You do not want to superglue your connectors to a hard drive so only put a tiny amount. It also helps to put a dab of glue on one connector, then put the connectors together as you’re pushing them onto the laptop HD pins.  Make sure they are completely seated so they will be even as possible.  If you see the pins of the laptop HD, you’re not down far enough.

Glued 2.0MM connectors curing on a laptop HD.

Once you get all four connectors onto the laptop HD and properly aligned, let it cure for at least an hour.  This will ensure that the superglue bonds correctly and the connector doesn’t fall apart later.

Glued connectors after the superglue set.

Now that the superglue has set, check that it still fits in the Dockstar. On the connectors used here, my wires were quite long. To alleviate yet another mass of cable snakes on my desk, I cut them down to about three inches, which should be big enough to handle, but small enough to not get in the way. You can cut your wires to any length desired.

In order to solder to the 10 pin header and ensure that the wires would not seperate from use, I chose to use a small piece of PCB as shown below.

Header and Breadboard

Keep in mind that if you cut your own, you’re soldering 10 wires into a 10 pin header, so you will need a 20 hole piece of PCB (5 holes by 4 holes).  The idea here is that the wires will come in on the component side of the PCB and wrap around it then go further down to the 2.0mm connector we just glued together.   Go ahead and solder the header into the center two rows of the PCB as shown below(Leave one row of 5 on each side of the header).

Header and PCB soldered together

Strip off a 1/8 inch off of each wire on one side of the glued connector and solder to the PCB. Keep your pinout the same and do not cross the wires.   Below, you can see that the first half of the PCB and the wires has been soldered.

Header with one side soldered.

Now comes the fun part.  Trying to solder the other side of the PCB without burning yourself or the other wires and without creating unnecessary solder bridges to other pins.  Below is a shot of my connector, partially soldered.

Second set of wires to solder

Protip: If you don’t already have a pair, I highly recommend you get a pair of Helping Hands for soldering like this. Available at Radio Shack and many other electronics outlets.  Below is a picture of the completely soldered PCB.

Completed PCB soldering

Now that the PCB is soldered, go ahead and check your wiring!  Don’t do any pin swaps, make sure that pin 1 on the 2.0mm connector is pin 1 on the header, pin2 on the 2.0mm connector is pin 2 on the header and so on. Also make sure that you didn’t bridge between pins on the PCB. Before you slip on the shrinkwrap, we’re going to reinforce the body of the adapter.  Get your hot glue gun ready and shoot a large bead of glue down the length of the wire. Once that is done, shoot some more hotglue around the connector to reinforce the wires coming out of the connector. Below is a picture of the hotglue process.

Wires hotglued together and header is wrapped in hotglue.

The hotglue on the wire-side of the plug will make sure that the wires don’t wiggle around inside the heatshrink tube and fail later on.  After you’ve properly applied the hot glue, put the tip of the hotglue gun over the two holes that we vacated earlier.  Keep consistent pressure on the hotglue gun and press the trigger.  This will inject hot glue into the holes left behind when the excess pins were extracted and ensure that the connector is “keyed” and will prevent a one-off connection (and prevent further headache).  This is what the hotglue injected connector looks like.

Key-glued header.

Take one moment and check your cable one last time.  Make sure that the pins are wired one to one.  Once you’re ready, get the heatshrink tube and cut it to a little bit less than the length of your adapter.  Below, you can see the heatshrink and adapter lengths I used. (This image was taken before the hot glue was applied.)

Header adapter and shrinkwrap.

Slip over the heatshrink wrap over the connector (it may not fit over the PCB) and leave just a little bit so that it overlaps the 2MM connector end.  Apply even heat to the 2MM connector end first so that it will shrink and hold the heatshrink wrap in place as you apply even heat to the rest of the connector. When completed, you should have a connector resembling the below image.

Heatshrink wrapped adapter.

Now take the hotglue gun and fill in the gap between the heatshrink wrap and the bottom of the PCB. If your gluegun has a fine tip, also shoot some hot glue into the open end of the shrinkwrap.  This will further harden the connector and ensure that it doesn’t flex and damage the connections.  You may have something looking like the below image.

Header Top with glue bead.

For a final touch, wrap and distribute hot glue around the wiring from a little bit over the heatshrink wrap all the way to the black part of the header wiring.  It’s ok to use a large amount of glue as this will make sure that the connector is properly protected.  As a last step, connect it to the Dockstar and make sure it fits.  Once finished, you should have something resembling the below image.

Completed Smokestack adapter on Dockstar.

Now, you have a completed Smokestack adapter.  You can use this for any device that has 2.0MM connector pitch and for any purpose.  Since the header on top is a 1 to 1 representation of the connector on bottom, you can use this anywhere where you need to use breadboard connectors for a temporary connection to these headers.

Section 2: Wiring it all up.

With a completed smokestack adapter, now you can wire it all up together  but before we begin, it is highly recommended to solder in a ground pin.  This ground pin will be used to ensure that the ground used by the JTAG adapter’s reference ground will be the same as the ground used by the Dockstar.  While it may not be required, it is recommended as a difference in ground may end up corrupting data being sent and received as part of the update.  To do that, we can use any of the ground planes, shields or open spots on the PCB.  I preferred to use one of the three USB shields as the shield’s purpose is the same as the GND connection that we are trying to establish.  For this, we’ll use a jumper pin with no plastic on it.  Start off by applying a small bead of solder to the USB shield as shown below.

Dockstar USB shield pin prepped for header pin.

Apply the heat from the soldering iron to the bead again and drop in the jumper pin.  Remove heat and do not touch the jumper pin until the connector has cooled.  Do not apply heat for a long period of time otherwise you may damage the USB port itself.  Below is the completed ground pin installation:

Dockstar Ground pin installed.

Now, we have a properly installed Ground pin that is easy to connect and remove and we also have our smokestack JTAG adapter.  At this point, we can start wiring up the JTAG connector up and prepare for recovery of our dead dockstar.  If you went with my suggestion and ordered the TIAO Parallel JTAG adapter, you should have received the following items.  JTAG board (blue with DB25 connector), Short jumpers (left of  JTAG board) and Long Jumpers (above board) as shown in the picture below.

TIAO Parallel JTAG kit.

The below image is the entire wiring diagram for the Dockstar JTAG adapter.  As long as you keep pin 1 on the dockstar as pin 1 on the smokestack adapter, you should have no problems with the connection.  As mrbill and Klingon and several others pointed out in the PlugApps forums, the nSRST line (orange) and the DINT(purple) leads are both not connected.  Pin 1 on the Dockstar/Smokestack are also left unconnected as we will use the Dockstar’s power supply to power the board while it is connected to the JTAG adapter.  Additionally, it is crucial to plug the USB cable into the JTAG adapter and into a PC to power the onboard buffer chip.  Without the USB cable connected, the adapter will not function.  There is also an LED on the JTAG adapter that will light when the device has sufficient power. Click on the below image to get a much larger image.

Dockstar/TAIO JTAG connection table.

The Dockstar layout diagram on the right hand side of the image is bundled together to provide a reference.  Pin 1 of the JTAG port is on the LED side of the jumper and is towards the center of the board and is designated by a black dot in the image and a white triangle on the dockstar board itself as shown below.  The picture of the Dockstar is rotated 90 degrees clockwise to the layout diagram in the image above.

Dockstar JTAG port showing pin 1

You can use the following images as a reference that your dockstar is connected properly.  The below image is a picture of my CA-42 adapter’s serial header as discussed in the serial port post. Also, since the serial port post discussed soldering to the header, if you haven’t done so already, remove the existing serial port wires so that your smokestack adapter will fit.  In the image below, the three jumpers coming off of the pins are colored as they would be if you had just cut and stripped back the CA-42′s cable. Remember that your CA-42 cable may be different!

Serial Port jumpers from CA42 USB cable.

The below image shows the top of the smokestack adapter and the respective colors.  You can see that the black wire for GND is attached to the USB shield pin we installed earlier. Remember, pin 1 and pin 7 on the smokestack are left not connected!

Top of smokestack adapter with jumpers.

The below image shows the JTAG adapter, properly wired and ready to go.  You can see the device is powered by the USB connector and that the orange and purple wires have been spared off.   Although the flash from my camera drowned out the red power LED, you will need to make sure that your LED is lit.  Please note, the JTAG adapter does require power however it will not show up as anything in Windows as we are using the USB port strictly for the power lines for the JTAG buffer.

TIAO JTAG wired up and ready.

An aerial view of the whole mess.     Yes, I know my desk is still messy.

C:\Program Files\OpenOCD\0.4.0

Wow, what a rats nest.

Now that all of the required connections have been made, it’s time to get busy with the software. Plug in the power cable to your dockstar and proceed to the next section.

Step III: Software

If you haven’t already, go back up to the Parts list and download Kragorn’s dockstar.cfg, OpenOCD and the uBoot image.

Install the OpenOCD software and accept the defaults.  Once completed, unzip the dockstar.zip and copy dockstar.cfg to C:\Program Files\OpenOCD\0.4.0\board and then copy your uboot image to C:\Program Files\OpenOCD\0.4.0  It would be recommended to rename it to just “uboot.bin” so that way you won’t have to retype that complicated line later on.

Now that we have all the proper software in place let’s discuss what all is going to happen.  When you start OpenOCD in a DOS window, it will in turn start a telnet server on localhost, port 4444.  You will use PuTTY to connect to the telnet server process and issue commands to OpenOCD.   In conjunction with that, you will need a second PuTTY session established to COM1 (if your windows machine has the CA-42 cable plugged into it) or to SSH to the machine you have the cable connected to. The reason is that once you enter specific commands on the telnet window, you need visibility to the other window (serial or SSH) to see if your dockstar is booting. Timing is critical! From here on out, commands and things to look for in output are in bold with other important text in bold, italics and underline.

In my configuration, my windows computer is what will run OpenOCD and the telnet session, and a nearby Linux box will have the SSH session with an application called minicom.

Start off by opening a DOS window (Start -> Run -> “cmd” )

Type the following command in exactly as shown: 

openocd -f board/dockstar.cfg

You should get output similar to the below image.  If you get what I have, then you can proceed to the next step.  If you get any errors, check your wiring. Make sure only those pins shown in the above images are what you have hooked up. Also, you may get a  Windows Firewall exception error.  If you do, just hit “Allow” otherwise you won’t be able to talk to OpenOCD.

OpenOCD successful startup

If OpenOCD is running without errors, minimize the DOS box and start PuTTY. Use the below configuration to establish a connection to the telnet process that OpenOCD started.

PuTTY Telnet settings

When you connect, you should get a window that says “Open On-Chip Debugger” with a caret “>” prompt.  Before we continue, if you haven’t already pulled up your serial session to the dockstar, you will need to do that now.  The issue is that from here on out, we will either be communicating with OpenOCD via Telnet, or communicating with the Dockstar via serial.

Now that you’ve established your connection to OpenOCD, perform the next two steps.

• Type the command “init” into the telnet session and hit enter.
• Type the command “sheevaplug_init” into the telnet session and hit enter.

Now, here is the hard part. The routine sheevaplug_init from above will attempt to halt the processor.  The Marvell chip has two types of halt, one of which labelled “ARM” and one labelled “Thumb”.  If your output resembles the below output (processor halted in Thumb state), you will need to perform the next steps otherwise skip down to the next section. When in doubt,  continue with the instructions below.

Thumb State Halt is no good!

If you got “Target halted in Thumb State”: There is some additional trickery that must be performed.   The issue is that the processor must be halted in ARM state as this allows OpenOCD to communicate with the processor properly.

• Hit Ctrl-C in your OpenOCD session. Your PuTTY session will break and generate an error. Dismiss the error and restart OpenOCD.
• Hold down the reset button and keep it held down with one hand and with the other, type “sheevaplug_init” and hit enter.  Ignore the error messages.
• Type in the command “halt” . DO NOT HIT ENTER YET!
• Release the RESET switch and simultaneously hit Enter.
• You should see that the processor was halted in ARM state.
• Type in “sheevaplug_init” and hit enter. No output should be generated from this command.

Check your telnet session output with my output in the screenshot below.  Make sure your output matches the screenshot before proceeding.

Properly halted dockstar

Now for the ultimate test.  We need to probe the NAND flash to make sure that the processor can communicate with it. Type in “nand probe 0” (zero) and hit enter.  If everything is correct, you should get text returned similar to “NAND flash device ‘NAND 256MiB 3,3V 8-bit’ found“.  If you get any other message ESPECIALLY anything about Unknown Manufacturer, restart OpenOCD and try again.  Here is my output so far:

Nand Probe Successful!

Now that the processor has been correctly identified by OpenOCD and the processor has properly identified the flash memory, we can now load the image into the Dockstar’s RAM and tell the processor to execute it. Type in load_image uboot.bin 0×800000 (zero, letter x, 8 and five zeros). If you renamed your uboot file something other than “uboot.bin” then substitute as needed.  This will take a couple of minutes as the image is transferred. Here is the output of what I have after the image loaded into RAM:

Load_Image successful!

When you get the caret prompt back “>”, type in the command “resume 0×800200” and check your serial connection for activity.  At this point, you can minimize the telnet session.  Now we will be dealing expressly with the serial connection.  Depending on your connection method, you may have a different window, but the text is the same.  As soon as you hit enter on the resume command, you should notice that the LED on your once dead dockstar is now blinking. Immediately switch over to the serial connection and hit a key to disrupt the boot process. If you did it right, you should see that the command prompt now shows Marvell>> as shown in the screenshot below:

Interrupted boot sequence

DO NOT DISCONNECT POWER FROM THE DOCKSTAR YET! WE ARE NOT DONE. The Dockstar has successfully loaded and ran the uboot commands in RAM however if we hit the reset switch or powercycle the dockstar, the device will return to it’s zombie state, and we will have to do it all over again. The only thing left to do is to prepare and write the image to flash.

If you were like me and you accidentally typed in ‘nand erase” and bricked your dockstar, you will need to re-erase the flash to reload it.  If you bricked your dockstar by another method, skip this step and go on to the next paragraph. To do this, type in “nand erase“.  This will erase the entire flash chip.  Now to write the working uboot to flash, use the command “nand write.e 0×800000 0×0 0×80000“  (zero x eight then 5 zeroes, zero x zero, then zero x eight then four zeros). You should get a message that the nand write was successful similar to the below screenshot.

Successful flash write.

If you did not brick your dockstar by an errant nand erase command, you will want to use “nand erase 0 0×0 0xa0000” (zero, zero x zero, zero x a then four zeros).  The reason for this difference is that if you didn’t erase your flash, this command will preserve the u-boot environment variables, otherwise you would have to recreate them later on.

Now, it’s time for the moment of truth.  Don’t start disconnecting wires just yet, simply tap the reset switch to load the uboot from the flash and test your recovery.   You will notice two key things:  Your uboot will be stuck in a permanent loop (assuming you didn’t interrupt autoboot) and the LED on the dockstar will alternate between flashing green and flashing orange as uboot cycles through.  This is because the dockstar can’t find a valid kernel or filesystem to boot from.  If you used the same version of the uBoot I listed above then you will notice that this uboot will attempt to boot off of USB key drives unlike the original factory image which opens up a LOT of opportunity.

To clean up, simply exit the various windows you have open, and exit OpenOCD by hitting Ctrl-C.  Remove power from the Dockstar, then remove the smokestack adapter and the ground wire on the USB shield.  If you want to make sure (because you’re as paranoid as I am, reapply power after all the jumpers have been removed and make sure that the Dockstar’s LED continues to blink orange then blinks green and repeats.  This means that your dockstar is confirmed as running off it’s own flash.

Now get to hacking!

Section IV: Notes and Credits

This article was assembled using information and help from various sources.  I want to thank everyone listed below for your assistance in helping me with getting the Dockstar JTAG figured out.  It was definitely not easy for someone new to JTAG however it was an enjoyable learning experience once I got the bugs worked out,  even if I did scratch my head a lot.

From the PlugApps forums, I’d like to thank Admin, Kragorn, bzboi, klingon, ygator, mrbill, and jtagfun.

A special thanks to bzboi for the initial howto that most of the OpenOCD instructions were used from and to Admin for the starting post with the Dockstar’s JTAG diagram.

I’d also like to thank mrbill for getting me involved with these things. It’s all his fault that I even have a dockstar to break.

Thanks goes to Kragorn for finding out the proper settings in his dockstar.cfg so that all of us could unbrick after the inevitable “Oops…” moment.

Last, but not least, thanks goes out to Jeff Doozan for his work with uBoot and compiling in needed features into the bootloader so that we can use USB sticks as boot devices.

Where do we go from here?

The answer is “Where do you want to go?”  In my relatively short time with the Dockstar, I was working on getting OpenWRT compiled and installed on it.  OpenWRT is the same OS that they use for the Linksys and other branded routers and is pretty much it’s own distribution.  There are also processes on how to install Debian onto the dockstar, using a laptop drive and USB sled to run the OS.  There is a lot of people doing research and finding out other warranty voiding things to do with their dockstars so take a look around.

As far as me personally?  I have three of them and while one of them is going to be a small NAS fileserver, one of the more esoteric things I was planning on doing with mine is making it into a roving USB camera with wifi.  The idea is that the Dockstar’s mainboard would be the brains of the rover and could send commands to a Parallax BOE-BOT via a usb to serial converter.  Since the entire thing would be wireless off of a USB dongle, I could use the IP based connection to deliver video and commands via a custom written application.

I sincerely hope that you are able to recover your dockstar using the above process.  It’s no fun when you accidentally destroy something you have put so much work into however now you should be able to work on the Dockstar without fear that you’re going to damage it and prevent it from booting.  Also, if you decide to try custom boot loaders, you can do so worry free.

Happy Hacking!

FIRESTORM_v1

As long as there has been electronics, there has been the problem of how to keep them cool.  Unfortunately, the problem gets more complex the smaller that computers get and what works for one PC might not work for others.  This is clearly the obstacle to overcome when trying to cool down a settop box.  Read more to find out how I was able to pull it off very well for a little over $10 in parts and still maintain all my hair.

It’s pretty synonymous that computers == heat and with any mainstream processor, you have a pretty significantly sized heatsink and fan to keep the processor cool.  While processor fans and heatsinks are pretty easy to come by for standard desktop computers and servers, embedded devices are pretty much left to their own devices (no pun intended).  I was faced with the very same problem when I decided to start using two embedded computers to replace a NAT router and mini home server.   These machines are sold as a “set-top-box” and were initially intended for some kind of Video On Demand service that used broadband service to deliver content.  The computer hardware was figured out and working however left to the “stock” heatsink and heatspreader (there was no fan when I started) the box was very hot to the touch.  I decided to initially tack a case fan to the heatsink to help with the cooling, but that only served to band-aid the problem.

The settop box. Those holes on top are supposed to keep this cool?

A view of the internals left very little room to work with.  There was no way I was going to be able to use a standard computer case fan without some massive case modding. Since I wasn’t really looking for a reason to spend the entire day with the dremel cutting sheet steel, I decided to take a look at what I had to work with.

Settop internals. It's quite cramped in there.

Since this thing was designed to be a set top box, there were all kinds of connections on the back, including a big SCART connector.  According to wikipedia, SCART is primarily a European standard and is very commonplace for connecting AV equipment to TVs and etc.  Since this settop was sold in the US, the SCART connector was unpopulated and instead left a knockout.  This gave me a sizeable aperture for the hot exhaust, now to find some way to get the air moving.

Exhaust Port Location

In the above shot, the SCART port is the large dull steel colored rectangular hole in the silver backing.  The hole is high enough that it does not interfere with the SDRAM sticks and far enough away from the power supply not to be a shock hazard.  Now knowing what I had and how big of a fan I needed, I went to Microcenter and took a look around. They had a lot of normal desktop fans and a few oddball fans and the one that would work best ended up being an old-style squirrelcage fan.  A squirrelcage fan is like the standard case fan that you’re used to however instead of normal blades, the squirrel cage fan uses an impeller that sucks in air from the front and exhausts it out of the side of the fan. The fan exhaust is perpendicular to the intake unlike a standard fan.  The advantage is that a squirrel cage fan offers the airflow of a standard fan in a smaller form factor due to the perpendicular exhaust.  The general idea is that the squirrel cage fan will suck in the warm air from inside the case and exhaust out of the now ex-SCART port.

Squirrel cage blower

This is the squirrelcage fan that I selected. Although I couldn’t find a link on Microcenter’s website, here is a link of a comparable fan. It is a12V fan that is designed to screw into a removed expansion slot blank on a computer case.  The fan connects via a 12VDC Molex connector and is designed to connect between the power cable and a hard drive or CDROM.  Since there are no Molex connectors, I had to also get a three pin cable to connect to the motherboard. Thankfully Microcenter had a clearance on Intel OEM Processor fans and were selling just the connector for 25 cents.

Intel cable and Power header

The Intel cable snaps perfectly into a convenient header that I found on the motherboard.  This will be perfect as if I ever need to replace the squirrelcage fan, I can do so without having to cut up wires and desolder splices.

Now that I had the idea of generally where everything was to go, I had to make some modifications to the steel bracket on the blower. The blower was originally designed to fit in an empty expansion slot and the tab used for securing the blower to the chassis needed to be flattened.

Squirrelcage bracket

The bracket in question is so eloquently highlighted by none other than Duke Nukem.  In order to modify the bracket without destroying the fan in the process, I decided to remove the bracket.  In the above picture, you can see a notch that holds the fan in the bracket.  There are four notches in total, two on each side. I used a couple of flat bladed screwdrivers and gently pried the bracket off.

Bracket removed from fan

After a little bit of  the creative application of force, I finally had the bracket flat enough so that it would not interfere with mounting. (Translation:  I beat the crap out of it with a hammer.)

Flattened Bracket modification

Now that the bracket is flattened enough, it’s time to see about how to go about lining it up with the SCART exhaust port.

SCART holes line up with the grill.

I lucked out on this one.  The two holes that were intended for the SCART interface hardware line up perfectly with two lines on the grill.  This made mounting the bracket as easy as a couple of small nuts and bolts.  Once mounted, it was time to start working on the power cable.  I decided to use the yellow and black wires for the fan’s power because black is considered “ground” and yellow is considered the “+12V” lead in computer power supplies.

Three wire connector

I cut off the green lead, and cut the cable about two inches long.  I then wired the wires from the fan to the Intel cable.  The red wire on the blower goes to the Yellow wire on the Intel cable and the two blacks go together. Not shown in this image is the small length of shrinkwrap used to secure and isolate the connection.

Solder Preperation

After soldering the first wire, I sealed it with the heatshrink and then soldered the other wire.

Soldered and Shrinked

Another piece of heatshrink later and I have a ready to install cable.

Completed cable

With the cable now complete, all that remained was to plug the power cable into the power header and snap the blower back into the bracket.

Blower Mounted

Here is a shot of the back of the case with the now operational blower.

SCART Exhaust port.

And finally, here’s a side-by-side (or top and bottom) with an unmodified settop box.

Modded and Unmodded settops

Final Results

I’ve been running the settop now for the past couple of days and I can say that the blower is 100% effective.  The case is cool to the touch and my fears of cooking the processor have been abated.  The machine will do very nicely as a pfSense firewall as soon as I get around to finishing it up but for now, this is one less thing stopping me from using it.

If you ever find yourself in a similar situation where you have to get airflow but don’t have much space, I highly recommend these squirrelcage blowers.  They’re cheap, they’re effective and well worth the time to install.  Although I had to go a bit out of my way to install the blower, not having to worry about cooking the machine is well worth the effort.

I hope you enjoyed this article, it was definitely an interesting approach to cooling in a small form factor.  Do you have any insight or other experience with odd cooling in a similar situation?  Please leave a comment, I’m always interested in other people’s stories.

Ok, so not long after I published the article on  the hardware teardown of the Seagate Dockstar, I couldn’t help myself  so I started working on things to do with this device.  I did a lot of research in regards to the capabilities of the Dockstar, including being able to push a customized Linux OS on the device.  Once I saw the article at Hackaday that covers exactly how to replace the OS, I knew I had to do it for myself.  There are two ways to perform this upgrade however in order to capture syslog output and to be able to get to the bootloader, a serial port is required.  Just about all of the sites will describe the pins needed to make the connection, however none of them detail how to do it very clearly and none of them address the issue of aesthetics.  Read on for my method of adding a serial port to the Dockstar without affecting the look of the device.

Before We Begin….

The Seagate Dockstar has a serial port available via three of the pins on the header at the front of the PCB.  The issue is that they’re not very easy to get to without having to disassemble the device each and every time you need to do a recovery on it.  This is hardly an ideal solution, and who knows what I’ll be doing with the device in the future.  If I decide to embed the  device and something goes wrong, I’ll have to have access to the serial port in order to debug it.

But, simply having access to the serial port is not enough.  The Dockstar’s aesthetic elegance is in the fact that it’s so simple.  No  massive amount of connectors aside from Power and Ethernet, and with little room to begin with, I don’t want to have a cable hanging out of the box just to have access to the serial port.  After much deliberation, I decided that a pin-row setup would be ideal instead of some other outward-facing connector.  The advantages to a pin-row set up is that there are only as many holes as are needed to establish connection and the connector size is significantly smaller than would be a standard DB-9 connector.  An additional advantage to the pin-row setup is that the connection would be temporary and can be easily removed. The resulting connection port would still be cleanly presented and would not stick out like a sore thumb.

Parts List:

In order to pull this off, you will need the following items:

- a CA-42 USB cable. – This is most commonly sold as a Nokia cable through Amazon and can usually be had for a few bucks. This is required as the dockstar’s serial port voltages are at a 3.3V TTL.  interfacing it to a standard +12V/-12V serial port will damage your Dockstar. The CA-42 cable has a PL-2303 USB to 3.3v TTL serial adapter in it which provides the required 3.3v TTL and gives an easy to use connector for plugging it into your host PC.

- a 4-pin header with long pins. – The pins have to be long enough that they will go through the Dockstar case and into the matched connector securely.

- a matched connector for the 4 pin header. – This will be mounted inside the Dockstar.

- Heat shrink tubing of various sizes. (Use the images as a guide)

- A couple of spares of the 4 pin header and the connector.  (We’ll use one spare for making the holes in the case, but it’s always good to have extras just in case.

Tools List:

- Soldering Iron

- Lighter (for heatshrink)

- small diameter drillbits

- Spudger (or Radio Shack soldering toolkit)

- A Linux machine with an available USB port. Note: It may be possible to use a windows computer for testing however my USB adapter only works in Linux.

Now that you have all the components, it’s important to stop here for a sec and cover the legal mess. It is critically important that you know what you’re doing.  You can not blame me or hold this site responsible (or the maintainers of this site) if you do something and blow up your Dockstar.  Be careful, do your research, check twice, solder once.

Please note that if you have never worked with shrinkwrap, the important thing is to watch the fire and keep it moving.  If you leave the lighter in the same place for too long, the shrinkwrap will stop shrinking and will catch fire.  When in doubt, apply the hat quickly and watch the shrinkwrap closely.   If it does something wrong, move the lighter away and start blowing on it to cool it down.

Part 1:  The Cable

It’s easier to do the modification on the cable first rather than do the Dockstar portion due to the fact that part of performing the Dockstar side of things will require testing to make sure it’s all working properly. So, let’s get started.

CA-42 cable, header and connector

This is the cable that we will be hacking together. The pin-row connector shown above is a 4 pin wirewrap terminal and a push-on style PCB mount connector.

cable header and connector

In the above photo,you can see the long header pins and the matching connector and how they fit together.  Before we get started with modifying the cable, we first need to figure out how it’s wired up.  Because there is a very good chance that you have a generic cable, and generic cables are wired differently, we will start off with spudging the USB connector apart.

Spudger to cable case

Follow the plastic seam of the USB connector with the sharp blade of the spudger.  Gently work the two halves of the plastic apart until you are able to seperate them.  You should see a connector that looks like the one below.

Opened cable

A closer of the PCB will reveal that the  wires (white, blue and green) are labeled for our easy hacking convenience . The three wires in my cable are Blue(GND), Green (RxD), and White (TxD). Now that we know which wire does what, reassemble the USB cable as we will not need to do any work on this end of the cable.  Starting with the 4 pin connector, pick one of the two internal pins and remove it.

Removed pin from connection block

The reason for removing the offset pin is for two reasons.  1) There are only three wires required for connection and 2) The missing pin will allow us to key the connector so that it can’t be reversed.  Going back to the USB cable, cut off the fat Nokia phone end and strip the cable back about an inch.  To help with soldering, insert the long end of the header pins into a block of breadboard.  This will help hold the connection stable while you solder the cable.   You will also need to cut the small diameter shrinkwrap in three sizes as shown below.

Cable preparation

The reason for the three lengths of heatshrink tubing is that we will build up the edge of the cable to a large size so that we can use the larger heatshrink tube  (in the back of the picture) to bind the header pins into the wrap and the wrap to the end of the cable to strengthen the cable.  If you have never worked with heatshrink tubing, it’s very easy to work with.  Start with the longest piece of tubing, and slide it over the cable. Make sure that the cut end matches the end of the insulation and heat with the lighter.  KEEP THE FLAME MOVING ACROSS THE HEATSHRINK!! Once the heatshrink has stopped shrinking, allow it to cool and repeat for each piece.

Shrinkrwrapped cable

This is the end result of the shrinkwrapping.  Now that the end is built up, slide a piece of the large shrink over the end of the cable but do not apply heat just yet. Strip back the individual wires so that you can attach them to the header pins.

Cable prepped for soldering

Now that we’re ready to solder the connector, it’s important to decide how to create the pinout.  In my setup, I elected to have the GND connection by itself, then the TX and RX pins.  For each wire, wrap the wire around the soldering post on the header pins and solder.  Be sure to use only enough solder as is required for the connection and do not  bridge the pins.

Soldered cable to header pins

Now with the cable soldered and the connections solid, it’s time to apply the heat to the large heatshrink.  Very carefully pull the end of the heatshrink over the black plastic header and gently apply heat.  Adjust if needed and let the tubing shrink without it pulling itself off of the header plastic.

Heatshrink applied to header

When you have it this far, go ahead and apply heat to the rest of the heatshrink tubing, making sure not to singe it.  When you are done, you should have a cable looking like the one below.

Completed cable with socket

This was the easy part, Now it’s time for the dockstar.

Part 2: The Dockstar

We’ve got the cable, but without something to connect it to, it’s pretty useless (unless you want to use it on a breadboard).  Let’s take a look at what’s going on.

Dockstar connection planning

Since I’ve already determined that I want the connector for the serial to come out of the back of the device and I’ve already found a suitably small connector, it’s time to find a location where I can attach it without getting too involved or without interfering with the existing ports on the back of the dockstar.  I’ve elected to put the serial port just above the center USB connector.  In the photo above, you can see how much space we’re dealing with in comparison with the USB ports and the header socket.

Dockstar shielding

Some of the RF shielding will need to be removed, but thankfully the metal is pretty flimsy and easily cut.   Be sure that when you remove the little fins pictured that you do not distort the top of the metal shielding.  We need a surface as smooth as possible for the superglue to properly bind with the connector for the serial port.

Unneeded shielding removed

Here is the picture of the unneeded shielding removed.  Please only remove the shielding that you need.  Next, you will need to prep another three pin header just like you did for the cable.  Rather than trusting faulty measurements and guessing, we’re going to use the header’s pins themselves to point out where we need to place our holes.

Burned through holes

Using a pair of needlenose pliers and your soldering iron, heat the pins evenly and apply moderate pressure.  The pins may wiggle slightly but don’t let them move too far off otherwise your holes won’t be lined up. When all three pins have punched through, remove the pins with the needlenose pliers.  Use the small diameter drill bit to widen the holes and to furr out any residual plastic scraps.  Your finished holes should look something like below.

Completed holes

Just to make absolutely sure, go ahead and test with the connector and the cable to make sure everything fits properly.

Hole Alignment Test

If you’ve made it this far, you’re doing good.  Now it’s time to prep the connector for supergluing into the Dockstar’s case.  Since it’s a four pin connector and we’re only using three pins, make sure that the connector is properly oriented so that it fits properly and so that the serial cable can move freely in and out of the connector.  Back the cable off a bit so you can see which pin is missing and cut off the connector’s matching pin to eliminate a possible mis-wiring later on. Go ahead and attach and solder a wire to each of the three remaining pins.

Socket connection with wires

In order to glue the connector socket in, take the excess wire and coil it up for now. Apply a thin coat of superglue inside the Dockstar and when aligned, push the three pin header you used for burning the connector in through your drilled holes and into the connector.  This will hold the socket steady while the superglue cures.  Give it about 15 minutes to cure properly, then gently remove the pins from the socket.  At this point, you should have a fully mounted socket like in the picture below.

Glued in header socket

Now that the socket is taken care of, we need to attach it to the serial port on the Dockstar’s board.  Before we do anything permanent, we will test the serial port and then once we are satisfied that it’s all working, we’ll solder them in and close it up.   Start off with wrapping the ground wire to the lower right hand pin on the connection block.  This is the common GND connection and must be established first. If you are using my wiring plan, the GND wire is the single pin by itself on the three pin header we made earlier.

wirewrapped GND wire

The two pins to the left of the GND pin are the RX and TX pins respectively.  Attach the centermost pin to RX and the remaining pin to TX on the superglued connector.

Connected wires

Remember, we have NOT soldered the three wires yet.  Also, make sure that none of the wires are touching prior to connection.  In order to test the serial port and make sure we have it hooked up right, connect the three pin header on the serial cable to your socket on the back of the Dockstar and connect the USB connector to your computer. Do not apply power to the Dockstar yet.  Open up minicom and set the serial device to /dev/ttyUSB0, 115200, no parity, 8 bits, 1 stop bit.  When properly configured, apply power to the Dockstar and watch your console window.  If you got it right, you should get similar output like below.   If not, pull the power plug on the Dockstar and disconenct the serial cable out of the back of the dockstar.  Swap the left two pins (RX and TX) and try again.  You should get output like below.

Serial terminal output

Now that you’ve tested the wiring, disconnect the power and the serial cable from the Dockstar.  Solder the wires in place and reassemble the Dockstar. Be careful closing the cover as you want to make sure that the wires coming off the superglued socket do not touch the metal shielding. (Editor’s Note: I really need a hot glue gun)

Closeup of Dockstar prior to reassembly

Close it all up and test it one more time.  If everything works as should, you’re good to go.  Now you can access the serial port without having to take your Dockstar apart over and over again.

Completed mod with serial cable attached

Here is a picture of the completed serial cable mod. The serial cable is plugged in right above the keydrive in this photo.

View of Serial Port

Same view as above, but with the serial cable removed.  Nothing but three holes.

Dockstar box

This is the box that the Dockstar came in.  Having not bought a non-OEM seagate drive in ages, I was pleasantly surprised that they used normal cardboard instead of some plastic case for this device.  Seagate is really pushing their “Go Green” incentive by changing the entire box (even the box inside) with easy to recycle cardboard instead of that translucent plastic “tray” that normally accompanies electronics.  While not necessarily an indication of product performance, it does show that they care about the environment.

Dockstar contents

Inside the box, aside from the little “Getting Started Manual” is the following items:  A Universal power brick pre-fitted with the US style prongs, a shielded ethernet cable and of course, the dockstar itself.

universal plug sticker

Here’s a closeup of the universal plug and all it’s various warnings and certifications.  I have seen a shift towards these universal plugs and away from the more proprietary plugs that manufacturers would normally use as a cost saving process. Since there is no one world-wide standard on power for every country that Seagate does business with, why spend that money building 20+ different power adapters when all you need is one with different prongs to fit whatever country’s plugs you’re going to be selling to.

Universal Plug details

And, just because I’m a sucker for details (and I keep losing the power bricks), here’s the voltage and amperage rating of the power brick.  Output is 12vDC 2Amps with a positive tip.

Dockstar front

Finally, we get to the dockstar to find what secrets it holds.  The front panel has one LED for device status and the USB mini-B port for the Freeagent drive to sit in.  Unlike most older-style USB devices, the Seagate Freeagent is powered entirely through the USB port, eliminating the need for two cables to power one device.  Overall it’s a simple presentation of what looks to be a fairly complex device.

Dockstar Back

The back of the dockstar has two USB ports, the Gigabit Ethernet port and the power port on it.  I would like for there to have been a link and an activity LED for the Ethernet port, but unfortunately this was not implemented.  I guess I’m a sucker for LEDs.

Right side of dockstar

The right side of the dockstar features another USB port and the reset switch for the device.  The left side of the dockstar (not pictured) only has cooling vents on the side.

Dockstar Bottom

This is the bottom of the dockstar which has a large sticker that shows the serial numbers and MAC address of the device.  Of note, there was one number on this sticker which is formatted like some kind of product activation key and is formatted as follows:  six alphanumeric characters,  hyphen, six alphanumeric characters, hyphen, two alphanumeric characters, hyphen, six alphanumeric characters, hyphen, six alphanumeric characters.   At first glance, I thought these were hexadecimal numbers however the letters used were not between A-F and so it’s currently unclear what this number is for.  There is no mention of what this number is for in the documentation.

Gaining access to the insides

Typically on a device like this and most small consumer devices, there are four screws on the bottom (usually under the black slip-resistant dots) however the Dockstar doesn’t have any.  In order to gain access, I used a metal spudger to work the bottom away from the top half of the body.  There are two notches on each side of the square base, so you may need to use something flat like a spudger, small flathead screwdriver or a expansion slot blank to pry it open.

Cracked the case

Once you cracked the case open (hopefully without breaking it), you should see the small cable that connects the top USB port to the dockstar’s mainboard.  Carefully disconnect this cable and the two halves should now be seperated.

Mainboard top view

This is the dockstar in all it’s nude glory. The front of the device is to the right in this photograph. The small black square is Nanya 1Gb (comes out to ~128 megabytes)  DDR-2 RAM in a BGA package. Datasheet available here and the large square is the device’s main processor.  From research I have performed, this appears to be a Marvell 1.2GHZ processor (just like the sheevaplug devices that Marvell is also selling. I tried to pull some more datasheets from plugcomputer.org, but their datasheet listing is quite lacking.  For now, just know that it’s an arm compliant processor and when I post an update article, I will have more juicy details on the capabilities of the processor.  Also of note, just below and to the right of the processor is a small ten pin header.  Presumably this can be used for a serial port however I do not have the cable for that.  Once I get it in and test it, I will update this article with a pinout diagram for you. Since this device is so low-level I would not recommend trying to connect a regular serial port to it directly as it more than likely requires a level shifter like a MAX232 to bring the -12/+12VDC down into something that won’t blast the components.

Mainboard bottom

This is the bottom of the dockstar’s mainboard.  Unfortunately, the board is now oriented that the front of the dockstar is now at the bottom of the picture. (Bad cameraman, no cookie.)  There’s not really much to note here as the board layout is jam packed with passive components.  The large black square on the lower right is the NAND storage for the device and while I couldn’t pull up the datasheet for it, the guys over at PlugPBX already had a forum post that showed the Dockstar’s hardware specs for us.  According to their chart, the dockstar’s storage is 256MB. which should be more than adequate for general Linux fun.  The small chip just under the black tape in the upper right hand corner of the board is presumably the ethernet NIC however googling the chip numbers came up with nothing.

Just looking at the hardware overall, it would appear that the Seagate Dockstar is a very capable device that just needs to be altered to run whatever we choose to run with it.  While the software on the device (stock) comes with a filesharing service called Pogoplug, I do not intend on using that software and will be looking to get this device as far away from stock as possible.  Here is a list of some things I’ve been thinking of doing with it so far:

• Home NAS (without Internet file sharing)
• multihomed router (I have a stack of pegasus USB modules)
• semiportable network notification device (USB to parallel port, HD44780 LCD display)
• realtime data acquisition device (USB logger and serial ports?)
• Apple MT-DAAPd server for streaming music to iTunes installations on your local network

Some sites I’ve seen while doing research have mentioned things from a in-home webserver with databases, to even a PBX server (take a look at www.plugpbx.org)

The big question is:  What would you do with it? Feel free to leave a comment as to what you’d do with this device, suggestions, information, etc.

FIRESTORM_v1

BIG FAT OBNOXIOUS WARNING!:

Because of the Dockstar’s affinity to want to “phone home” thanks to the Pogoplug software,  I would not recommend plugging this into your live network just yet.  In all of the research I have done for this device, just about every site I have seen has posted some kind of warning about this.  The dockstar was originally designed to run with pogoplug which is an internet filesharing service that allows you to access your files from anywhere with Internet connectivity.  I don’t exactly trust an outside third party to have access to my files on a device that is only going to be used on a local network so I have not connected mine up to even test it.  If you are going to do any work with this device, I recommend that you use a dedicated mini-hub or switch and that it not be allowed to connect to the Internet until you have a complete understanding of what all it wants to do.

Image courtesy of Parallax.com

Hello Everyone!   If you’ve been in a Radio Shack sometime in the last year or so, you’ll know that Radio Shack and Parallax have teamed up to bring some variety to the parts drawers.  This once $50 serial RFID reader kit is now $10 at Radio shack although it only comes with two tags.  Read more for additional details about the Serial RFID reader now on sale!

The Parallax Serial RFID reader is 5 volt TTL compatible signalling and requires two I/O pins.  One is output for the “enable” pin which when brought low, turns on the RFID reader.  The tag data comes in on another pin to be read by your 5V TTL compatible microcontroller.   If you are using the 5V Basic Stamp or the 3.3V (5V tolerant) Propeller, then this is just a snap-in add on, no additional hardware is required.  Other controllers may require additional voltage converters to drop the TTL signal down to a voltage compatible for your controller.

Also take note that this is a 125kHz tag reader, so reading your company’s HID RFID tag will more than likely not work unless you have a 125kHz tag.

You can find the full datasheet, sample code and schematics from Parallax’s product web page here.

If two tags just aren’t going to cut it, you can take a look at all of Parallax’s tags here.

I know it’s been a while so here’s another post.  In this post, I’ll go over the hardware in this gun style barcode scanner that holds a real helium-neon laser tube with power supply! Although this post only covers the basic modding, there’s nothing to stop you from gutting the gun and using the HeNe tube for your own nefarious plan.

Before we get started, I can not stress the importance of safety especially with working with lasers and high voltage.  The laser energy generated in this gun is powerful and can result in eye damage, even if only temporary.  Unlike laser diodes that use an LED type technology to generate a laser beam, the HeNe tube is a lot more powerful and also generates UV radiation as well as laser light making it doubly dangerous.   Please be cautious when working with this device, and pay special attention to the aperture where the laser light is emitted.  YOURWARRANTYISVOID.COM CANNOT BE HELD LIABLE FOR THE USE OR MISUSE OF THIS INFORMATION. IT IS PROVIDED ONLY AS AN EDUCATIONAL REFERENCE AND SHOULD BE TREATED AS SUCH.

Now that the legal mess is out of the way….

After the last post with a barcode scanner was posted, I got to thinking about two laser “gun” style barcode scanners I have in storage.  I acquired them at a flea market about two years ago for $20 each but didn’t have enough information or internet access to be able to use them.  Well times have changed and so has the tools and information available to me so now I was able to complete what I had set out to do.

In this post, I will cover how to convert the Telxon LS-201 laser barcode scanner into a functional laser pistol using all of the included hardware.  We will cover the hardware that’s in the scanner, as well as the connections needed to fire the high voltage power supply for the HeNe laser tube.  Since the hardware is already pretty functional, most of our work will center around the control board and not the receiver board, but more on that later.

Getting Started

You will need the following tools:

• Philips screwdriver
• Razor cutter
• Soldering Iron
• 12VDC power supply (at least 750mA)

Teardown

We’ll start off with some pictures.

Aperture and receiver

This picture shows the aperture (top) and the receiver (front two windows).  When the laser is engaged, the laser is emitted from the aperture and is bounced off of a reflecting mirror (not shown) that produces a line which is then “read” by the receiver.  The laser dot’s position is controlled by the reflecting mirror using the receiver controller board and is then interpreted by the onboard logic to produce the codes to send.

Telxon LS-201

This side shows the holes that have the screws we will need to remove.

Opened up

After opening up the laser, you can make out the major components.  Reflector mirror and optics (upper right hand corner); Laser tube case (large black horizontal cylinder); laser HV power supply (copper box in handle); receiver board (top PCB); trigger board (lower PCB).

Receiver board

This is the receiver board (upper PCB0 and contains the “crab eyes” receivers that are used to see the laser as it scans the barcode. We won’t be using it so it will be removed.

trigger board

This is the trigger board.  All of our wiring will be done from this board.

optics

Here is the barcode scanner’s optics package.   The laser comes up through a lens in the back of the view, is bounced off of a stationary mirror in the red clip and then bounced off of the reflective mirror on the left hand side of the package.  You can see the servo’s cable that is used by the decoder board to generate the horizontal line. At this part of the build, wedge a piece of folded paper under the mirror to prevent it from moving.

top of optics package

This picture shows the lens and the mirror mentioned on the last picture. You can see the recess for the laser tube body and another mirror.  The indentations on the top and bottom of this view are used with large rubberized cushions to protect the laser assembly from drops, shock, etc.

laser tube

Here is the laser tube mounted in the bottom half of the protective mounts.  The emitter aperture for the laser tube is on the left, with a lens and a pair of mirrors.

laser tube detail

Here is a closeup of the detail on the laser tube.

laser tube detail 2

Another view of the laser tube with part number and the power rating.  This tube is a little bit more than 1 milliwatt.

Energized laser tube

In this view, the laser tube is energized and lasing.  The tube emits a pink/orange glow while energized.  The connection block on the lower left is ground which goes to the far side of the laser tube (right hand side in these photos).  The positive side of the laser tube is also the laser’s aperture.

reflector leakage

Helium Neon laser tubes consist of a fully reflective mirror and a partially reflective mirror.  The fully reflective mirror bounces the laser light back into the laser, while the partially reflective mirror is the laser aperture.  In this view, we can see that there is a bit of laser leakage from the fully reflective mirror which more than likely explains the low watt rating on the laser.

laser beam

This is the beam that is produced out of the laser’s aperture.

power supply wiring

The laser’s power supply has four wires coming out of it.  A white wire with yellow stripe (designated white/yellow), a white wire with black stripe (white/black), red and black. The large red wire is the High Voltage line for the laser tube while the thin black wire accompanying it is the ground wire.  In all testing from now on, the large red wire and thin black wire are not considered in any wiring diagrams as they are dedicated only to the laser power supply.

Let the Modding Begin

Before we begin hacking and slashing, let’s cover what needs to be done (in no particular order):

• We need to figure out how to apply power to the laser’s power supply.
• We need to figure out how to get the trigger to apply power to the power supply
• We need to modify the cable so that we can give the gun the proper voltage.
• We need to remove the now unneeded receiver board.
• We need to find a way to make an indicator LED so we know the laser is producing laser light.

Reviewing the Power Supply’s wiring:

Before we begin, let’s examine the power supply.  It had no identifying marks on it or manufacturer data on it so I really had to guess and get lucky.  Thankfully I was able to decipher it’s wiring method using the existing wiring on the trigger board and through some clever detective work.

As mentioned before, the power supply has five leads coming out of it.  After performing some testing and research, I was able to decode what the leads do and how to hook them up so that the tube is energized. Please remember that the thick red wire and the thin black wire that go to the HeNe Laser are not considered in this table.

RED wire:  This is the main power lead for the power supply.  This must be +12vDC.

BLACK wire: This is the ground lead for the power supply.

WHITE WIRE / YELLOW STRIPE: This is the “trigger” lead.  If it receives voltage between 5vDC and 12vDC, the laser tube will energize.

WHITE WIRE / BLACK STRIPE: This is an output lead and will be used for our LED indicator.

Test rig

Here is a pic of the test rig I used to figure out the wiring.  The rest of the components on that breadboard are not associated with this project.

Now that we have the the easy part figured out, it’s time to rework the trigger board. One thing of special note is that the trigger “button” is easily pried off.  I’m assuming that this was done on purpose as it would wear out quite quickly and an easy replacement method was needed.  Start off by cutting the ribbon cable from the trigger board and use a flat bladed mini screwdriver to gently pry off the trigger button

trigger board detail

Please note that we intend to reuse most of the components on the trigger board so be careful with your soldering iron.  With the trigger board separated from the  receiver board, start off by desoldering all the wires and resistors.

clean trigger board

While you remove all the parts from the trigger board, also make sure that the holes left behind are clear.  I used a pneumatic solder sucker to remove excess solder and debris.  This is the model I have, purchased from Radio Shack Rather than reinventing the wheel, we will be modifying the existing header and connecting only the pins we need to get power to the HVAC power supply for the laser and to light our LED. Due to the way that the trigger board is wired, we will be swapping the black header block from the laser power supply with that from the coil-cord cable. In the below picture, I have already removed the connector block from the end of the coil cord that goes into the gun and cut all but the black and white wires.

coil cord cable prepped

This image shows the cable with the black connector reinstalled. Remember, this is the laser’s black header connection. (Don’t worry, I’ll go over pinouts later)

power cable header connection

We then do the same thing with the laser’s HVAC power supply.

both headers ready

We then reattach the header pins to the trigger board and power it up. At this point, pushing the trigger button should fire the laser.   Next, we make the connection for our LED. In the below picture, the brown wire goes to the power supply ground, (black wire from the coil-cord) and the red wire (and the resistor) go to position 5 (from the right hand side of the trigger board).

Attaching the LED

Below is the diagram I used for wiring up both connector blocks:

connector block diagram

Now that all that is said and done, reassemble the laser, trigger board, HVAC power supply into the laser body and let’s test it again.  Depending on how accurate you were early on with the paper wedge and the servo mirror, it may take a couple of times to get the dot to point down the gun body.  Here is a pic with all the hardware installed and ready for the mating connector.  In this shot, you can see the LED that was wired in is working and that the laser tube is energized through a port in the housing an inch from my thumb:

Reinstalled hardware

So with all the parts back in the gun case, let’s test it. Below is my test shot.

Test Firing

So, where do we go from here?

Now that you know how to mod your laser scanner, the choice on what to do with it is completely up to your imagination.  Some ideas that come to mind:

• build a “target” to shoot at that toggles power to an appliance or light.
• build several targets to make a shooting gallery in your own home.
• Really cool presentation laser.  (Pens? Bah, I have a gun!)

This information is also useful in case you actually find need of a helium neon laser in any of your hacks and considering that this project had a $0 parts cost aside from the purchase of the scanner to begin with, makes a great price point for starting into experimentation with lasers.   Do the sensible thing if you do want to start experimenting with lasers. Please invest in quality eye protection and always practice safety first!

I hope you’ve had fun reading this article and I look forward to your comments. If you build something cool with your laser, please let me know about it!

FIRESTORM_v1

You can download the update from Sprint at http://shop.sprint.com/en/software_downloads/pda_smartphone/samsung_moment.shtml

Please note: According to the instructions available at the link above, you will need to use a Windows PC to apply the update to your phone.  I will be posting a mirror shortly and it will show up in the “Download Files” page at the top of this page.

The Challenge:

The trick was to figure out how to get certain “four letter words” past the chat app’s filter and into the main chat window without the word being munged by the system.  Most chat applications filter out obscene words through a string matching system and replaces it with something that is much less offensive, usually a series of asterisks.  The only thing I could use was straight ASCII characters, and I couldn’t use any “img src” HTML tags to do the dirty work (literally).

The Analysis:

All HTML code that is rendered is associated with something called a character set (or code page from the old MS-DOS days).  These character sets associate any character with a certain number (often called it’s ASCII value).  Although some characters are standard on all character sets, (like “a” = 97),  some control characters and characters above 256(decimal) change significantly.  In order to properly convey these control characters via the web, urlencoding was created and implemented as part of the HTML spec.  What this means is that every character in a character set can be represented in HTML through the use of the percent sign (%) modifier. The syntax for this was %(ASCII value in hexadecimal). The general idea was that if you typed in a russian name using symbols not found in the Latin alphabet, these symbols could be properly represented on the server side.

With that in mind, I examined the UTF-8 character set.  In this example, I’ll use the word “taco” to represent the offending word.

How it’s done:

The process for this is as follows:

1. Find the ASCII value for each character in the word
2. Find the hexadecimal value for the ASCII value
3. Add “%” in front of that number
4. Insert a “null” character somewhere.

For reference, you can use this chart which gives you the ASCII and the ASCII in hex values already

From the chart, we see the following information:

t = 116 (decimal) or 74(hex)

a=97(decimal) or 61(hex)

c= 99(decimal) or 63(hex)

o = 111(decimal) or 6f(hex)

Using this information, we can then create our string, inserting the % where needed.  %74 %61 %63 %6f

Only one item remains.  In order to spoof some of the more intelligent content filters, you need to put a null character in there somewhere. This throws off the content filter and makes it think that there are different characters represented.  For this, I used character 0B which does not have latin equivalent and is a control code that does not render in HTML.  I used 0B because 08 rendered as a tab in testing.

Knowing this, I inserted the null character between the urlencoded “a” and the urlencoded “c”: %74 %61 %0B %63 %6F

Testing it out:

All that is needed to test it is to copy and paste the above string into any chat application and hit send. You will need to remove the spaces from between the characters otherwise your application will treat them as renderable characters as well.  If it works, you’ll see the word “taco” in your window.  Now you know how to get past content filters.  If you are in the business of building content filters, now you have a new strategy for blocking people abusing them.

Don’t be a prick!

I posted this information with the hopes that people may find it useful, not so that script kiddies can run around and make asses of themselves.  Be smart about how you use this information and last but not least, DON’T BE A PRICK!

I have recently gotten my hands on a new Samsung Moment on the Sprint network. Within the next few days, I will post all the gory details from this Android n00b and will be offering a comparison against the other smartphone I have, the Palm Pre.