PDA

View Full Version : Scrolling LED Badge Hack



ozarkshermit
- 23rd December 2012, 13:10
Here is my code and additional information on how I hacked one of the "Scrolling LED Badges" that are everywhere on eBay. Also attached is a Utube link for a video.
Most of the details are included in the program listing, which also has a lot of comments. The only limitation I have (so far) is that I can't figure out how they are deriving the checksum.
If I could do that, it would no longer be necessary to generate the Badge program first using the supplied software and a serial port monitor to view it. That requirement is not too much trouble, however, but lacks the ability for easily using variables to change the display (such as changing temperature, etc). The way I do that on a limited basis is shown on the "Hello World [x]" routine. There I had to program the Badge using the supplied software and the serial port monitor to find the checksums. I have developed a table of their bizzare Hex codes for capital and small letters, as well as numbers 0 to 9.

Here is a link to the Utube video


http://www.youtube.com/watch?v=mbjorRZ1Hoc

I have attached a screen shot of a message showing the hex code for a short message, next to a view of the Badge programming screen.




'************************************************* ***************
'* Name : BADGE TEST.BAS *
'* Author : KEN STUEMPGES *
'* HACKING A SMALL "SCROLLING LED BADGE"" *
'* Date : 21 DEC 2012 *
'* Version : 1.0 *
'* Notes : BAUD RATE IS 38400 *
'* 8 BITS, 1 STOP BIT, NO PARITY, INVERTED LSB FIRST *
'* TIMING BETWEEN BYTES SENT IS CRITICAL. *
'* *
'* THE CONNECTION BETWEEN THE PIC AND DISPLAY IS ONLY THREE *
'* WIRES, ONE FROM THE PIC Tx PORT, TO THE Tx LINE ON THE *
'* USB, (WHITE WIRE). +5 VOLTS TO RED, AND GND TO BLACK *
'* *
'* TO DETERMINE THE PROTOCOL FOR INDIVIDUAL MESSAGES, *
'* THE MESSAGES MUST BE GENERATED USING THE BADGE SOFTWARE *
'* IN CONJUNCTION WITH A SERIAL PORT MONITOR TO DISPLAY IT *
'* THE 6TH BYTE OF THE PROTOCOL MAKES ABSOLUTELY NO SENSE *
'* I AM CONVINCED IT IS A CHECKSUM, BUT HAVE NOT FOUND HOW *
'* IT IS CALCULATED. *
'* *
'* AFTER THE MESSAGE IS GENERATED, I ONLY "COPY AND PASTE" THE *
'* FIRST 48 BYTES (THREE LINES OF 16 BYTES EACH) *
'* THE REST REMAINS THE SAME *
'* AND IS USED IN THE "FILL_DISPLAY" LOOKUP TABLE. *
'* THE REASON I USED 48 BYTES WAS TO ALLOW FOR LONGER MESSAGES *
'* WITHOUT HAVING TO CHANGE THE SIZE OF THE "FILL_DISPLAY" *
'* (ALL 348 BYTES DO NOT HAVE TO BE CHANGED FOR EACH MESSAGE) *
'* MESSAGES CAN BE SELECTED BY AN INPUT, INTERRUPT, TIMER, ETC *

'* I USED A 18F2520 FOR THIS PROJECT, FOR A COUPLE OF REASONS: *
'* *
'* FIRST, AN 18F SERIES PIC IS REQUIRED FOR THE LARGE LOOKUP *
'* TABLES. SECOND, THERE IS 32K BYTES OF PROGRAM MEMORY *
'* AVAILABLE, SO A LARGE NUMBER OF MESSAGES CAN BE STORED *
'*
'* THE FIRST FOUR SUBROUTINES "HELLO WORLD", "MERRY", "HAPPY", *
'* AND "HACKED" ARE JUST THE "MESSAGE PART" OF THE PACKET . *
'* THE LARGEST LOOKUP TABLE / SUBROUTINE , "FILL_DISPLAY" *
'* CONTAINS THE REST
'
'* I HAVE BEEN ABLE TO TABULATE THE HEX VALUES FOR BOTH CAPITAL *
'* AND SMALL LETTERS, ALONG WITH NUMBERS 0 TO 9 *
'* BUT DETERMINING THE CHECKSUM REMAINS A MYSTERY TO ME *
'* *
'* EVENTUALLY, I MIGHT USE A SMALLER PIC, *
'* ALONG WITH A SERIAL EEPROM TO STORE THE MESSAGES *
'************************************************* ***************


define OSC 20 ' NEED 20 MHZ FOR 38400 BAUDRATE
TRISC = %00001111 ' USED FOR PUSH BUTTON INPUT

PB_1 VAR PORTC.0
PB_2 VAR PORTC.1
PB_3 VAR PORTC.2
PB_4 VAR PORTC.3

TX var PORTC.6

Pntr var word ' Pointer NEXT BYTE OF MESSAGE LOOKUP TABLE
Temp var byte ' CHARACTER TO WRITE TO THE DISPLAY
CHK VAR BYTE ' VARIABLE FOR CHECKSUM FOR HELLO WORLD
NUM VAR BYTE ' VARIABLE FOR HELLO WORLD [1], [2], OR [3]
i var byte ' VARIABLE FOR "HELLO WORLD" COUNT

i = 0
TX = 0
PAUSE 100 ' GUARANTEES A START FROM THE FIRST MESSAGE SUBROUTINE

GOTO START
'
'::::::::::::::::::::|||||||||||||||||||:::::::::: ::::::::::::
' HELLO WORLD ALSO USES VARIABLES FOR THE CHECKSUM AND COUNT, FOR 1,2,OR 3
' IT WILL DISPLAY [1], [2], OR [3] AFTER HELLO WORLD
' THE COUNT IS INCREMENTED FROM 0 TO 2, EACH TIME PB_1 IS PRESSED
' THIS DEMONSTRATED A LIMITED ABILITY FOR VARIABLES IN THE DISPLAY
' to avoid confusion, when power-down, advance to hello world [1]
' than select one of the other three messages - preferably "HACKED "
'::::::::::::::::::::\\\\\\\\\\\\\\::::::::::::::: :
'
'**************************************
HELLO_WORLD::

for pntr = 0 to 47
gosub getit
serout2 tx,16390,[temp]
pauseus 190
next
gosub fill_display
return

getit: 'GET THE NEXT BYTE TO SEND

' "Hello World [1], [2], OR [3] "

lookup2 pntr,[$82,$B2,$A2,$A0,$F0,CHK,$B0,$2C,$F3,$6A,$6A,$59,$A 2,$A2,$D2,_
$59,$85,$6A,$E2,$A2,$A2,$1E,NUM,$78,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0],temp

return

'****************************************
MERRY: ' FIRST TWO LINES FOR "MERRY"

for pntr = 0 to 47
gosub get1
serout2 tx,16390,[temp]
pauseus 190
next
gosub fill_display
return

get1: 'GET THE NEXT BYTE TO SEND


LOOKUP PNTR,[$82,$B2,$A2,$A0,$F0,$6A,$5F,$79,$F1,$87,$87,$3C,$A 2,$97,$2C,$87,_
$3D,$96,$E1,$79,$B5,$96,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0],temp

return

'************************************************* ********
'
HAPPY: ' "HAPPY NEW YEAR "

for pntr = 0 to 47
gosub getit2
serout2 tx,16390,[temp]
pauseus 190
next
gosub fill_display
return

getit2: 'GET THE NEXT BYTE TO SEND

LOOKUP PNTR,[$82,$B2,$A2,$A0,$F0,$15,$4E,$2C,$B5,$A5,$A5,$3C,$A 2,$4A,$F1,$D2,_
$A2,$3C,$F1,$B5,$87,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0],temp

RETURN

'********************************************
HACKED: ' "HACKED "

for pntr = 0 to 47
gosub getit3
serout2 tx,16390,[temp]
pauseus 190
next
gosub fill_display
return

getit3: 'GET THE NEXT BYTE TO SEND

LOOKUP PNTR,[$82,$B2,$A2,$A0,$F0,$27,$80,$2C,$B5,$97,$1F,$F1,$E 0,$A2,$B3,$A2,_
$A2,$A2,$A2,$F0,$96,$3D,$4A,$D3,$A2,$A5,$3D,$97,$A 2,$86,$B5,$96,_
$3D,$97,$A2,$A5,$87,$5B,$A2,$A2,$A2,$A0,$A0,$A0,$A 0,$A0,$A0,$A0],TEMP

RETURN
'*********************************************

FILL_DISPLAY: ' THESE ARE THE REMAINING BYTES FOR THE DISPLAY PACKET

for pntr = 0 to 299
gosub getX
serout2 tx,16390,[temp]
pauseus 190
next
return

getX: 'GET THE NEXT BYTE TO SEND

lookup pntr,[$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$50,$82,$B2,$A2,$A4,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$50,$82,$B2,$A 2,$A8,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$50,$82,_
$B2,$A2,$AC,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A 0,$A0,$A0,$A0,_
$A0,$A0,$A0,$50,$82,$B2,$5C,$A0,$A0,$E4,$B1,$B1,$A 0,$A0,$B1,$A0,_
$A0,$B1,$A0,$A0,$B1,$A0,$A0,$B1,$A0,$A0,$B1,$A0,$A 0,$B1,$A0,$A0,_
$B1,$A0,$A0,$B1,$A0,$A0,$B1,$A0,$A0,$B1,$A0,$A0,$B 1,$A0,$A0,$B1,_
$A0,$A0,$B1,$A0,$A0,$B1,$A0,$A0,$B1,$A0,$A0,$B1,$A 0,$A0,$B1,$A0,_
$A0,$B1,$A0,$A0,$AB,$46,$86,$49,$50,$82,$90,$A0],Temp

return

'************************************************* ***************

START:
'
' THE CHECKSUMS FOR THE THREE VERSIONS OF "HELLO wORLD [x]
' WERE DETERMINED USING THE BADGE SOFTWARE. THE HEX VALUES FOR
' 1 , 2 , AND 3 WERE ALSO DETERMINED THAT WAY
'
if PB_1 = 0 THEN
i = i + 1
if i = 1 then
chk = $C1 : num = $B2 ' CHECKSUM AND NUMBER ( 1,2,OR 3)
ENDIF
if i = 2 then
chk = $D0 : NUM = $81
ENDIF
if i = 3 then
CHK = $2F : NUM = $90
ENDIF
GOSUB HELLO_WORLD ' AS SELECTED BY THE VALUE IF i (1,2,or 30
if i = 3 then i = 0
ENDIF

IF PB_2 = 0 THEN
GOSUB MERRY
endif

IF PB_3 = 0 THEN
GOSUB HAPPY
endif

IF PB_4 = 0 THEN
GOSUB HACKED
ENDIF

GOTO START

end