Reverse Engineered Grill Controller Gets Open Firmware

If you are a regular reader, then the odds are you have taken apart an electronic gadget, either for a fix, or simply because your curiosity got the better of you. Once inside, it’s all but impossible to help yourself from doing at least a little reverse engineering. That’s what happened when [PRBS23] took a look inside a MasterBuilt Gravity 800 Grill for a simple wire fix. But one thing led to the next, and now open source firmware for the grill is freely available!

Control board schematic.
Control board schematic.

The first order of business in creating the firmware is reverse engineering the original controller. Opening it up immediately reveals an ESP-32 and a well-labeled programming port. The rest of the control board is equally simple, including connectors for four thermistor temperature sensors, lid open/close switch, fan driver, 16 segment LCD, piezo buzzer, and some physical inputs.

The thermistor along with the physical inputs are connected to a 16 pin chip, interfacing with the MCU over a 9600 baud UART connection. [PRBS23] cannot determine an ADC chip meeting these specifications, so the most likely answer is a cheap MCU programmed to act as a simple analog fronted.

The neatly labeled programming header is used to quite easily dump the firmware with the espflash utility. Analyzing this dump reveals a rather strange ADC correction function used by the original firmware. The necessity and overall utility of this function remains unclear, does corrects a maximum of around 40 degrees Fahrenheit.

Most of the other features ended up being at least somewhat easier. The CS1621 segmented display driver is reasonably well documented with datasheets making its implementation far easier. Likewise, the other odds and ends were implemented in a far more normal manner compared to the thermistors.

All this reverse engineering work got tied together into a neat little firmware package. It comes with over the air updates PID controlled temperature, and a real-time web interface. This also isn’t the first time we have seen an IoT device liberated from proprietary firmware, and this remains one of our favorite uses of reverse engineering!

 

Toy Computer Restored

In the 1960s, the home computer was barely a twinkle in anyone’s eye. This was the decade in which computers were used by a handful of companies and organizations and took up entire rooms. It was the decade that saw the birth of the first integrated-circuit computer, the Apollo Guidance Computer, and, rather strangely, one of the first home computers of sorts: the Digi-Comp 1.

In 1963, E.S.R. introduced this little programmable educational toy computer. It relies on simple mechanical logic gates, programmed by positioning tubes on sliders. Their original intention was to create actual computers, but one thing led to the next, and E.S.R. became the premier educational computer toy company of the 1960s. The Digi-comp is a rather simple device. A program is entered by soda-straw-like tubes placed on sliding rails. These tubes interact with spring-loaded levers which move in accordance with the “clock” switch. The result is a simple binary computer you can program.

Continue reading “Toy Computer Restored”

Researchers Hack An Airline Analog

Modern airliners are rather complicated feats of engineering. Innumerable safety-critical components are connected with tens of miles of wiring, complex digital buses, and dozens (perhaps hundreds) of computers. But, as hackers, we know that any computer can be hacked and, of course, aircraft avionics are no different. 

Modern aircraft typically use the ARINC 429 protocol. This differs from many protocols we see where multiple transmitters are allowed. ARINC 429 has a single transmission source. This makes a transmission-override attack hypothetically difficult, as an attacker was thought to need to physically replace a legitimate transmitter (like a flight management computer), a rather daunting task. However, the ARINC 429 transmitters sit behind a pair of 37.5 ohm resistors, so by transmitting on the same line, an attack device can simply override the legitimate transmitter’s power.

Continue reading “Researchers Hack An Airline Analog”

Peeling Fruit With The Power Of Steam

Steam power is a staple of the steampunk aesthetic, thermodynamics, and a checkpoint for the budding mechanical engineer studying heat cycles. But because food is largely made of water, steam is also common in the culinary arts. So it’s no surprise that when thermodynamics is applied to cooking, exciting things can happen. 

This particular example of steam-powered culinary happenings is inspired by industrial potato-peeling machines. By adding high-pressure, high-temperature steam to a pressure vessel with potatoes inside, heat can transfer more easily to the inside of the potatoes. Because the pressure is so high, however, the water in the skin won’t boil. This is fundamentally the same concept as a pressure cooker. However, what’s different is that instead of a pressure cooker’s slow release, these industrial peeling machines rely on explosive decompression, flash boiling the water underneath the potato’s skin. This rapidly expanding steam rips away the skin in a nice clean sheet.

But, to [Stuff Made Here’s] disappointment, there were no videos of the process on the internet. But, fortunately for us, being an engineer of complicated machines means that there is one now that you can watch below.

Continue reading “Peeling Fruit With The Power Of Steam”

Submersible Drone Analyzes Ice

Doing anything on a frozen lake can carries some amount of risk. Nevertheless, every year events ranging from car racing to ice skating are held on them. As such, proper safety precautions are needed, the most important of which is ensuring the ice is thick enough to withstand the weight of whatever may be on it. This is done by cutting holes into the ice and measuring its depth in several locations. But this is a dangerous and imperfect process only giving a rough picture of actual thickness. So to solves these problems, a team of students at ETH Zurich made an ice measuring submersible drone. 

The concept of ice measurement employed is, on paper, reasonably simple. When a sonar pulse is sent out, some of the energy will return off the bottom of the ice sheet, but some of it will pass through creating a second return. By measuring the difference in these two returns, the thickness can be calculate with a high degree of precision. Attach the sonar to a submersible and give it a positioning system and you can simply get a thickness map, right? Well, employing theory in practice is a far more complicated prospect as the students soon found out.
Continue reading “Submersible Drone Analyzes Ice”

Building A Bicycle Dropper Seat Post

A recent addition to mountain bikes is the dropper seat post. This invention is in the vein of office swivel chairs, allowing the seat height to be adjusted with a simple handlebar mounted lever. They are rather fascinating inventions ranging in complexity from simple mechanical systems, to electronic monstrosities actuated by Bluetooth. Inspired by the panoply of possibilities, [kane components] set forth to create such a home-built dropper post. 

Inspired by woodworking bar clamps, [kane’s] design utilizing angled plates binding against a rail inside the dropper post. Two pairs of plates sitting at opposite angles resist opposite forces from either the rider sitting on the post, or the return spring. A simple cable actuated cam moves the plates to a nonbinding position when the lever is actuated, and springs return the plates to a binding rest-state. The return is handled by an air spring pressurized against a piston at the bottom of the shaft.

Continue reading “Building A Bicycle Dropper Seat Post”

Transponder Mania

In order to not hit something, you generally need to know where that thing is. On land, the meager human eyesight tends to be sufficient. On the water, however, the prospects are more dangerous and complicated. So, technology is required to ensure safe ocean voyages in the form of the AIS transponder system. The off the shelf solutions tend to work quite well, but [peterantypas] was displeased with the commercial offerings, and built what appears to be the first open source AIS transponder called MAIANA.

Automatic Identification System (AIS) is a GPS tracking system designed for maritime applications. Broadly speaking, it broadcasts GPS and other data at intervals over VHF radio. AIS is what allows the precise tracking of vessels by authorities, and online hobbyists. AIS is also often received by other vessels to augment radar improving boat to boat collision safety.

Most commercial AIS transponders used by sailors are rather bulky, expensive, come with a large power budget. The MAIANA project avoids these pitfalls by being entirely self-contained. The RF portion is largely made up of a STM32L4 micro controller, a SI Labs Si4460 ISM RF chip, and a Quectel L76L-M33 with a Johansson ceramic chip antenna for GPS. With such simple hardware, the PCB is easily small enough to fit inside the antenna assembly.

This design eliminates the need for long runs of multiple shielded RF cables to a bulky transponder unit inside. Instead, a simple Ethernet cable is used to transfer data to and from the mast. Inside the boat, a USB decoder is used to pass the AIS data on to a PC. This whole setup is remarkably simple and reliable, with hundreds of units having been produced since the project’s start.

While this is the first full blown AIS transponder we have covered, we have seen other projects utilizing the protocol. We have also seen quite a number of projects with the aircraft equivalent, ADS-B.

Thanks [Bernerd] for the tip!