Scrolling LED Badge Hack

[ozarkshermit]

Here is my code and additional information on how I hacked one of the "Scrolling LED Badges" that are everywhere on eBay. Also attached is a Utube link for a video.
Most of the details are included in the program listing, which also has a lot of comments. The only limitation I have (so far) is that I can't figure out how they are deriving the checksum.
If I could do that, it would no longer be necessary to generate the Badge program first using the supplied software and a serial port monitor to view it. That requirement is not too much trouble, however, but lacks the ability for easily using variables to change the display (such as changing temperature, etc). The way I do that on a limited basis is shown on the "Hello World [x]" routine. There I had to program the Badge using the supplied software and the serial port monitor to find the checksums. I have developed a table of their bizzare Hex codes for capital and small letters, as well as numbers 0 to 9.

Here is a link to the Utube video



I have attached a screen shot of a message showing the hex code for a short message, next to a view of the Badge programming screen.

'*************************************************  ***************
'*  Name    : BADGE TEST.BAS                                    *
'*  Author  : KEN STUEMPGES                                     *
'*            HACKING A SMALL "SCROLLING LED BADGE""            *
'*  Date    : 21 DEC 2012                                       *
'*  Version : 1.0                                               *
'*  Notes   : BAUD RATE  IS 38400                               *
'*         8 BITS, 1 STOP BIT, NO PARITY, INVERTED  LSB FIRST   *
'*           TIMING BETWEEN BYTES SENT IS CRITICAL.             *
'*                                                              *
'*  THE CONNECTION BETWEEN THE PIC AND DISPLAY IS ONLY THREE    *
'*  WIRES, ONE FROM THE PIC Tx PORT, TO THE Tx LINE ON THE      *
'* USB, (WHITE WIRE).  +5 VOLTS TO RED, AND GND TO BLACK        *
'*                                                              *
'*   TO DETERMINE THE PROTOCOL FOR INDIVIDUAL MESSAGES,         *
'*   THE MESSAGES MUST BE GENERATED USING THE BADGE SOFTWARE    * 
'*   IN CONJUNCTION WITH A SERIAL PORT MONITOR TO DISPLAY IT    *
'* THE 6TH BYTE OF THE PROTOCOL MAKES ABSOLUTELY NO SENSE       *
'* I AM CONVINCED IT IS A CHECKSUM, BUT HAVE NOT FOUND HOW      *
'*                IT IS CALCULATED.                             *
'*                                                              *
'* AFTER THE MESSAGE IS GENERATED, I ONLY "COPY AND PASTE" THE  *
'*       FIRST 48 BYTES (THREE LINES OF 16 BYTES EACH)          *
'*              THE REST REMAINS THE SAME                       *
'*      AND IS USED IN THE "FILL_DISPLAY" LOOKUP TABLE.         *
'* THE REASON I USED 48 BYTES WAS TO ALLOW FOR LONGER MESSAGES  *
'* WITHOUT HAVING TO CHANGE THE SIZE OF THE "FILL_DISPLAY"      *        
'* (ALL 348 BYTES DO NOT HAVE TO BE CHANGED FOR EACH MESSAGE)   *
'* MESSAGES CAN BE SELECTED BY AN INPUT, INTERRUPT, TIMER, ETC  *

'* I USED A 18F2520 FOR THIS PROJECT, FOR A COUPLE OF REASONS:  *
'*                                                              *
'* FIRST, AN 18F SERIES PIC IS REQUIRED FOR THE LARGE LOOKUP    *
'* TABLES. SECOND, THERE IS 32K BYTES OF PROGRAM MEMORY         *
'* AVAILABLE, SO A LARGE NUMBER OF MESSAGES CAN BE STORED       * 
'*
'* THE FIRST FOUR SUBROUTINES "HELLO WORLD", "MERRY", "HAPPY",  *
'* AND "HACKED" ARE JUST THE "MESSAGE PART" OF THE PACKET .     *
'* THE LARGEST LOOKUP TABLE / SUBROUTINE , "FILL_DISPLAY"       *
'* CONTAINS THE REST 
'
'* I HAVE BEEN ABLE TO TABULATE THE HEX VALUES FOR BOTH CAPITAL *
'*          AND SMALL LETTERS, ALONG WITH NUMBERS 0 TO 9        *
'*  BUT DETERMINING THE CHECKSUM REMAINS A MYSTERY TO ME        *
'*                                                              *
'*             EVENTUALLY, I MIGHT USE A SMALLER PIC,           *
'*        ALONG WITH A SERIAL EEPROM TO STORE THE MESSAGES      *      
'*************************************************  ***************
 
 
define OSC 20    ' NEED 20 MHZ FOR 38400 BAUDRATE 
TRISC =  %00001111 ' USED FOR PUSH BUTTON INPUT

PB_1    VAR PORTC.0
PB_2    VAR PORTC.1
PB_3    VAR PORTC.2
PB_4    VAR PORTC.3

 TX     var  PORTC.6

 Pntr var   word   ' Pointer NEXT BYTE OF MESSAGE LOOKUP TABLE
 Temp   var byte   ' CHARACTER TO WRITE TO THE DISPLAY
 CHK    VAR BYTE    ' VARIABLE FOR CHECKSUM  FOR HELLO WORLD
 NUM    VAR BYTE    ' VARIABLE FOR HELLO WORLD [1], [2], OR [3]
 i      var byte    ' VARIABLE FOR "HELLO WORLD" COUNT

 i = 0 
 TX = 0
 PAUSE 100    ' GUARANTEES A START FROM THE FIRST MESSAGE SUBROUTINE

 GOTO START
'
'::::::::::::::::::::|||||||||||||||||||::::::::::  ::::::::::::
' HELLO WORLD ALSO USES VARIABLES FOR THE CHECKSUM AND COUNT, FOR 1,2,OR 3
' IT WILL DISPLAY [1], [2], OR [3] AFTER HELLO WORLD
' THE COUNT IS INCREMENTED FROM 0 TO 2, EACH TIME PB_1 IS PRESSED
 ' THIS DEMONSTRATED A LIMITED ABILITY FOR VARIABLES IN THE DISPLAY
 ' to avoid confusion, when power-down, advance to hello world [1] 
 ' than select one of the other three messages - preferably "HACKED "
 '::::::::::::::::::::\\\\\\\\\\\\\\:::::::::::::::  :
 '
 '**************************************
HELLO_WORLD::    

    for pntr = 0 to 47
    gosub getit
    serout2 tx,16390,[temp]
    pauseus 190
    next
    gosub   fill_display
    return

getit:          'GET THE NEXT BYTE TO SEND

 '        "Hello  World [1], [2], OR [3] "

lookup2 pntr,[$82,$B2,$A2,$A0,$F0,CHK,$B0,$2C,$F3,$6A,$6A,$59,$A  2,$A2,$D2,_ 
$59,$85,$6A,$E2,$A2,$A2,$1E,NUM,$78,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_ 
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0],temp

  return

'**************************************** 
MERRY:  ' FIRST TWO LINES FOR "MERRY"

    for pntr = 0 to 47
    gosub get1
    serout2 tx,16390,[temp]
    pauseus 190
    next
    gosub   fill_display
    return

get1:          'GET THE NEXT BYTE TO SEND


LOOKUP PNTR,[$82,$B2,$A2,$A0,$F0,$6A,$5F,$79,$F1,$87,$87,$3C,$A  2,$97,$2C,$87,_
$3D,$96,$E1,$79,$B5,$96,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0],temp

 return 

'*************************************************  ********
'
HAPPY:            ' "HAPPY NEW YEAR "

    for pntr = 0 to 47
    gosub getit2
    serout2 tx,16390,[temp]
    pauseus 190
    next
    gosub   fill_display
    return

getit2:          'GET THE NEXT BYTE TO SEND 

LOOKUP PNTR,[$82,$B2,$A2,$A0,$F0,$15,$4E,$2C,$B5,$A5,$A5,$3C,$A  2,$4A,$F1,$D2,_   
$A2,$3C,$F1,$B5,$87,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_
$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0],temp

 RETURN

'********************************************
HACKED:            ' "HACKED "

    for pntr = 0 to 47
    gosub getit3
    serout2 tx,16390,[temp]
    pauseus 190
    next
    gosub   fill_display
    return
    
getit3:          'GET THE NEXT BYTE TO SEND
 
LOOKUP PNTR,[$82,$B2,$A2,$A0,$F0,$27,$80,$2C,$B5,$97,$1F,$F1,$E  0,$A2,$B3,$A2,_
$A2,$A2,$A2,$F0,$96,$3D,$4A,$D3,$A2,$A5,$3D,$97,$A  2,$86,$B5,$96,_
$3D,$97,$A2,$A5,$87,$5B,$A2,$A2,$A2,$A0,$A0,$A0,$A  0,$A0,$A0,$A0],TEMP

 RETURN
'*********************************************
 
 FILL_DISPLAY:   ' THESE ARE THE REMAINING BYTES FOR THE DISPLAY PACKET

    for pntr = 0 to 299
    gosub getX
    serout2 tx,16390,[temp]
    pauseus 190
    next
    return

getX:          'GET THE NEXT BYTE TO SEND

lookup pntr,[$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_
 $A0,$A0,$A0,$A0,$50,$82,$B2,$A2,$A4,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_
 $A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_
 $A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_
 $A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_
 $A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$50,$82,$B2,$A  2,$A8,$A0,$A0,_
 $A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_
 $A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_
 $A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_ 
 $A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$50,$82,_
 $B2,$A2,$AC,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_ 
 $A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_
 $A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_
 $A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A0,$A  0,$A0,$A0,$A0,_
 $A0,$A0,$A0,$50,$82,$B2,$5C,$A0,$A0,$E4,$B1,$B1,$A  0,$A0,$B1,$A0,_
 $A0,$B1,$A0,$A0,$B1,$A0,$A0,$B1,$A0,$A0,$B1,$A0,$A  0,$B1,$A0,$A0,_
 $B1,$A0,$A0,$B1,$A0,$A0,$B1,$A0,$A0,$B1,$A0,$A0,$B  1,$A0,$A0,$B1,_
 $A0,$A0,$B1,$A0,$A0,$B1,$A0,$A0,$B1,$A0,$A0,$B1,$A  0,$A0,$B1,$A0,_
 $A0,$B1,$A0,$A0,$AB,$46,$86,$49,$50,$82,$90,$A0],Temp
 
   return
  	
 '*************************************************  *************** 

START:
'
'     THE CHECKSUMS FOR THE THREE VERSIONS OF "HELLO wORLD [x] 
'     WERE DETERMINED USING THE BADGE SOFTWARE.  THE HEX VALUES FOR 
'     1 , 2 , AND 3 WERE ALSO DETERMINED THAT WAY
'
       if PB_1 = 0 THEN
       i = i + 1
       if i = 1 then 
       chk = $C1 : num = $B2   ' CHECKSUM AND NUMBER ( 1,2,OR 3)    
       ENDIF
       if i = 2 then 
       chk = $D0 : NUM = $81
       ENDIF
       if i = 3 then 
       CHK = $2F : NUM = $90    
       ENDIF       
 GOSUB   HELLO_WORLD ' AS SELECTED BY THE VALUE IF i (1,2,or 30
        if i = 3 then i = 0
        ENDIF

    IF PB_2 = 0 THEN
        GOSUB   MERRY
        endif

    IF PB_3 = 0 THEN
        GOSUB HAPPY
        endif

    IF PB_4 = 0 THEN
        GOSUB   HACKED       
        ENDIF
       
    GOTO    START
    
 end