Friday, 24 February 2017

Hacking the BSIDE ADM20 Multimeter - Software

BSIDE ADM20 hack 1: Software

How I got into this

When I worked on a review of a battery charger, I came accross some potential issues that I had to investigate things more thoroughly. I needed a multimeter to record the charge curves.
So my contact at Gearbest sent me this BSide ADM20 Multimeter. This has a built-in USB interface to display and record mesaurements on the PC.
Values imported into LibreOffice Calc
It turned out I quite like the meter. See my review video here. (Hardware-hack will follow) The software however was rather basic and wouldn't allow to set a sample rate or measurement duration.

The meter is available under several names:

I already had a look inside the meter and see pretty cool options to turn this into an IoT device. But let's not jump to conclusions. Some more work needs to go into that and I have only focussed on the software side here.


Fortunately it is pretty obvious how the meter communicates with (or rather "to") the PC:
A new COM port appears, presented through the well known CH340 USB-to-SERIAL bridge driver.
And you thought COM-Ports were a thing of the past
If you then fire up the software (DMM Data logger) that came with the meter, you're good to go.

Original Software

Nooo! Boooooooring!!!!

A look at the protocol

Pretty obvious that I should see something when I start a a terminal program like TeraTerm od Putty.
In part 2 of this post, you'll see that this is strictly a one-way communication. So we can't talk back to the meter.

  • The port speed is 2400 baud.
  • There is no CR or LF at the end of each data set (see below)
  • The usual 8n1 seems to apply
  • Continuous stream of data: no xon/xoff
  • No return channel

With the width set properly, TeraTerm's hex mode shows a pattern:
The 5Fs are the Zeroes, the DF has the decimal point

Whatever I do, the transmission always starts with a series of HEX values: AA5552240110
followed by four bytes that change when stuff moves on the display. I could map the values to the following displayed digits: (excerpt from my visual basic prog)

        If SerVal = 95 Then measured = 0
        If SerVal = 6 Then measured = 1
        If SerVal = 107 Then measured = 2
        If SerVal = 47 Then measured = 3
        If SerVal = 54 Then measured = 4
        If SerVal = 61 Then measured = 5
        If SerVal = 125 Then measured = 6
        If SerVal = 7 Then measured = 7
        If SerVal = 127 Then measured = 8
        If SerVal = 63 Then measured = 9

It turns out that the most significant bit is the decimal point, the other bits map to the seven segments. It also sends the measured unit and the polarity further back in the data stream. Up to now I choose to ignore all of that.

The four bytes with the four digits are in reverse order, of course, for more programming fun.

So my VisualBasic program listens for the "AA555224110" sequence and then decodes the four following bytes.

I suspect that the data stream is derived from the communication with the display driver, as many bits in the data stream can directly be mapped to segments on the display.

More on those details in the second part where I will look at the hardware of both the meter and it's communication.

First try in VisualBasic

No decimal point yet.
That was once a 9v battery

If you want to have a go at the experimental code, here is where I left off for the moment:

 Imports System.Threading.Tasks  
 Imports System.Timers  
 Imports System.IO  
 Imports System.IO.Ports  
 Imports System.Threading  
 Public Class Form1  
   Dim datensatz As String  
   Dim rohwert As Integer  
   Dim werte(22) As Integer  
   Dim decodewerte(4) As Integer  
   Dim recorddata As Boolean = False  
   Dim i As Integer = 0  
   Delegate Sub DataDelegate(ByVal sdata As Integer)  
   REM Define the method (Function) that will be called by the Invoke method   
   Private Sub PrintData(ByVal sdata As Integer)  
     Dim startsequence As String = "AA555224110"  
     Dim tmpchar As String  
     Dim str As Integer  
     Dim measured As Integer  
     Dim x As Integer  
     If recorddata Then  
       werte(i) = sdata  
       Console.Write("I= ")  
       If i = 4 Then  
         recorddata = False  
         i = 0  
         tmpchar = Hex(werte(1))  
         REM Console.WriteLine(werte(1))  
         x = DecodeValue(werte(1))  
         decodewerte(1) = x  
         Label2.Text = x  
         tmpchar = Hex(werte(2))  
         REM Console.WriteLine(werte(2))  
         x = DecodeValue(werte(2))  
         decodewerte(2) = x  
         Label3.Text = x  
         tmpchar = Hex(werte(3))  
         REM Console.WriteLine(werte(3))  
         x = DecodeValue(werte(3))  
         decodewerte(3) = x  
         Label4.Text = x  
         tmpchar = Hex(werte(4))  
         REM Console.WriteLine(werte(4))  
         x = DecodeValue(werte(4))  
         decodewerte(4) = x  
         Label5.Text = x  
         TextBox1.Text = CStr(decodewerte(4)) & CStr(decodewerte(3)) & CStr(decodewerte(2)) & CStr(decodewerte(1))  
       End If  
       i = i + 1  
     End If  
     tmpchar = Hex(sdata)  
     Label1.Text = tmpchar  
     datensatz = datensatz + tmpchar  
     If (datensatz.Contains(startsequence)) Then  
       REM Console.WriteLine("Got Header")  
       datensatz = ""  
       recorddata = True  
     End If  
   End Sub  
   Public Sub New()  
     ' This call is required by the designer.  
     ' Add any initialization after the InitializeComponent() call.  
   End Sub  
   Dim WithEvents sp As New SerialPort  
   Private Sub GetSerialPortNames()  
     sp.BaudRate = 2400  
     sp.PortName = "COM3"  
     sp.DataBits = 8  
     sp.Parity = Parity.None  
     sp.StopBits = StopBits.One  
     sp.Handshake = Handshake.None  
     REM sp.Encoding = System.Text.Encoding.Default  
     sp.Encoding = System.Text.Encoding.Default  
   End Sub  
   Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load  
   End Sub  
   Private Sub SerialPort_DataReceived(ByVal sender As Object, ByVal e As System.IO.Ports.SerialDataReceivedEventArgs) Handles sp.DataReceived  
     Dim str As Integer  
     REM Dim str2 As Char  
     str = sp.ReadChar()  
     REM Console.WriteLine(str)  
     REM str2 = Convert.ToChar(str)  
     Dim adre As New DataDelegate(AddressOf PrintData)  
     Me.Invoke(adre, str)  
   End Sub  
   Function DecodeValue(ByVal SerVal As Integer)  
     Dim decimalpoint As Boolean = 0  
     Dim measured As Integer  
     If SerVal > 128 Then  
       SerVal = SerVal - 128  
       decimalpoint = True  
     End If  
     measured = 99  
     If SerVal = 95 Then measured = 0  
     If SerVal = 6 Then measured = 1  
     If SerVal = 107 Then measured = 2  
     If SerVal = 47 Then measured = 3  
     If SerVal = 54 Then measured = 4  
     If SerVal = 61 Then measured = 5  
     If SerVal = 125 Then measured = 6  
     If SerVal = 7 Then measured = 7  
     If SerVal = 127 Then measured = 8  
     If SerVal = 63 Then measured = 9  
     If SerVal = 8097 Then measured = 7  
     If SerVal = 8096 Then measured = 1  
     If SerVal = 0 Then measured = 0  
     Console.Write("Decoder got a: ")  
     Console.Write(" decoded as: ")  
     Return measured  
   End Function  
 End Class  

If you have done work on hard- or software-hacking those meters please let me know.

Saturday, 18 February 2017

Can't make voice call with Siri - Solution

Since the upgrade to iOS 10, I could not get Siri to dial any numbers from my address book.
I changed quite a few of Siri's settings back and forth, but was unable to fix the problem. Resets and restarts would not help either.

What finally helped was a rather unexpected:

  • I switched off the "Dial Assist" function in the "Phone" settings and Siri was able to make calls again.
  • I then switched "Dial assist" back on and Siri could still dial without any issues.

Problem solved.
I can just assume, that some not otherwise accessible parmeter has been set to a valid value when switching Dial Assist off and on.

Sprachwahl mit Siri funktioniert nicht: Lösung

Siri hat ein Problem:

Seit dem Update auf iOS 10 konnte ich per Siri - Sprachwahl nicht mehr wählen. Neustart oder die Änderung von Siri - Einstellungen blieben wirkungslos.

Keine Sache der Einstellung

Die Lösung für dieses Problem liegt nicht in den Siri-Einstellungen, sondern ist unter "Telefon" zu finden:

  • Nachdem ich die Funktion "Wählhilfe" abeschaltet hatte, ging die Sprachwahl.
  • Wählhilfe wie der aktiviert: Siri kann noch wählen.

Ich kann nur spekulieren, daß ein nicht anderweitig zugänglicher Parameter durch das Aus- und einschalten der Wählhilfe korrekt gesetzt wurde.

Friday, 3 February 2017

Using the Nitecore SC2 superb charger

Superb charger

on Nitecore's web pages for the "SC2 superb charger", there is no shortage of superlatives. Charging with "Infinite Intelligence" certainly is the boldest claim.

See for yourself >>> HERE <<< in my review video on YouTube.

Infinite intelligence

So I tried to find out more about the limits of this "active charging with infinite intelligence" thing. Gearbest sent me a unit for review and I put it through a few tests to see how it performs.

First impression

The charger feels quite tough & beefy to the to touch. The kind of plastic that doesn't feel plasticy, but rather reminds of high quality power tools. A good start.

Second impression

But why-oh-why are the settings for the current and max. charge voltage printed on what looks like a sheet of protective film that easily comes off the display.
I'm sure if I don't constantly use that charger, I'll have forgotten what which LED means what after a few days. Nitecore has to do something about that in the next iteration of the SC2.

Automatic battery capacity detection

Now this should be what is at the heart of this ominous infinite intelligence. The traditional way to determine the battery's capacity is to discharge them and measure the capacity that they charge to, possibly adding another discharge/charge cycle. Nitecore's web pages claim that it automatically detects the battery's capacity and sets the charge current accordingly.
So come on SC2, impress me!

Test setup

First, I have to know about my cell's actual capacity. To find that out, I use an improved version of my previously published Arduino battery tester.

Makeshift battery tester

I use four cells for testing:
  1. AWT 18650 35A 3000 mAh IMR cell 
  2. Ultrafire 18650 3000mAh (Really is only 300mAh)
  3. KeepPower 14500 800mAh 
  4. Ultrafire 14500 1200mAh (Really a little over 200 mAh)
With automatic battery capacity detection, The good quality cells AWT and KeepPower cells should charge at a higher rate than the Ultrafires (who in all tests had only a fraction of their nominal capacity, regardless of the charger.)

Size matters

As cells with the same size charge at the same current, I wondered what happened if I make the 14500 appear bigger. So I inserted a spacer with the 14500 cell.
14500 to 18650 converter :-)

Nut&bolt spacer inserted
It charged at 2A. Way above the recommended 0,4-0,8A (Unconfirmed, from reseller pages)

The assumption that bigger cells hold more capacity might on the whole be correct. But we all know that there are good and bad cells and that makes way more of a difference than the size.

The limits of infinite intelligence

There is more that will confuse the charger:
  1. LiFePO4 cells: The charger can't distinguish LiFePO4 cells from Li-Ion cells and would overcharge them. So the maximum charge voltage has to be set manually
  2. 3,8V Li-Ion cells. I've never had or seen any of these, But as they are indistinguishable from a 3.7V cell, The charge voltage needs to be set manually.

Example Charge

While I had initially observed some brief overvoltage conditions, All the voltage (and charge curves I took) did not exhibit that phenomenon.
0,5A charge curve
I did many of the long-term measurements with PC on the USB-Port of the bside ADM20 Multimeter that I quite like. I also got from Gearbest to get a better grip on some problems I suspected with the SC2 charger.
bside ADM20 at work with a current shunt resistor
The multimeter turned out to be quite hackable. But that will be a whole new blog entry & video.

Final word

  • Great charger if you're in a hurry. Very fast and reasonably safe.
  • Supports all currently available battery chemistry types.
  • Sometimes has trouble disabling the protection circuit in KeepPower batteries.
  • Needs help choosing the right battery chemistry.