Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Last revision Both sides next revision | ||
xro:rollohack_gw60 [2015-10-09 15:09] xro [Investigating the GW60] |
xro:rollohack_gw60 [2015-10-16 12:48] xro |
||
---|---|---|---|
Line 33: | Line 33: | ||
^PIN# ^ Voltage ^ Notes ^ | ^PIN# ^ Voltage ^ Notes ^ | ||
| 1 | GND | directly connected to GND plane on PCB and to GND of DC power supply | | | 1 | GND | directly connected to GND plane on PCB and to GND of DC power supply | | ||
- | | 2 | GND | Data-Pin, can be pulled to 5V with a 100 Ohm resistor | | + | | 2 | GND, DataPin | can be pulled to 5V with a 100 Ohm resistor | |
- | | 3 | 5V | Data-Pin, can be pulled to GND with a 100 Ohm resistor | | + | | 3 | 5V, DataPin | can be pulled to GND with a 100 Ohm resistor | |
| 4 | 5V | 5V Power for the ZB40, directly connected to voltage regulator on board| | | 4 | 5V | 5V Power for the ZB40, directly connected to voltage regulator on board| | ||
| 5 | - | not connected to anything ??| | | 5 | - | not connected to anything ??| | ||
Line 46: | Line 46: | ||
After several attempts to just toggle pins resulted in nothing, we suspected some serial interface. Opening up the GW60 again, | After several attempts to just toggle pins resulted in nothing, we suspected some serial interface. Opening up the GW60 again, | ||
- | I traced the lines to two 1KOhm resistors and then to the TX/RX input pins of a PIC16F90 microcontroller. | + | I traced the lines to two 1KOhm resistors and then to the TX/RX input pins of a [[http://ww1.microchip.com/downloads/en/DeviceDoc/40001262F.pdf |PIC16F90]] microcontroller. |
^PIN# ^ Use ^ Notes ^ | ^PIN# ^ Use ^ Notes ^ | ||
| 1 | GND | directly connected to GND plane| | | 1 | GND | directly connected to GND plane| | ||
- | | 2 | RX | connected to PIC16F90 Pin 12 (RX) via 1kOhm resistor | | + | | 2 | RX | connected to [[http://ww1.microchip.com/downloads/en/DeviceDoc/40001262F.pdf |PIC16F90]] Pin 12 (RX) via 1kOhm resistor | |
- | | 3 | TX | connected to PIC16F90 Pin 10 (TX) via 1kOhm resistor | | + | | 3 | TX | connected to [[http://ww1.microchip.com/downloads/en/DeviceDoc/40001262F.pdf |PIC16F90]] Pin 10 (TX) via 1kOhm resistor | |
| 4 | 5V | 5V Power from voltage regulator on PCB | | | 4 | 5V | 5V Power from voltage regulator on PCB | | ||
Line 64: | Line 64: | ||
The ZB40 can select one of three or all three rollos and send commands UP, DOWN, STOP. Simplest minimum implementation would require at least 4 bits. So I could hope that one-byte bruteforcing might still yield results. Two byte bruteforcing while also guessing the bps would be impossible in the 60s pairing mode window of the GW60. Unfortunately: NO LUCK. | The ZB40 can select one of three or all three rollos and send commands UP, DOWN, STOP. Simplest minimum implementation would require at least 4 bits. So I could hope that one-byte bruteforcing might still yield results. Two byte bruteforcing while also guessing the bps would be impossible in the 60s pairing mode window of the GW60. Unfortunately: NO LUCK. | ||
- | Status: grudgingly ordered a overpriced ZB40 with even more prohibitive 9,90 shipping costs from Germany. | + | Yes, at this point I could just a well have soldered something on the PCB and simulated button presses. But I was curious now, so I grudgingly ordered a overpriced ZB40 with even more prohibitive 9,90 shipping costs from Germany. |
=== Listening In === | === Listening In === | ||
+ | <WRAP right>{{:xro:superrollo_zb40.jpg?direct&400 |}}</WRAP> | ||
Next step: Listening in on the ZB40 talking to the GW60 using my OpenBench Logic Analyzer. | Next step: Listening in on the ZB40 talking to the GW60 using my OpenBench Logic Analyzer. | ||
+ | |||
+ | {{:xro:rollo_gw60_zb40_signal.tar.xz|OpenBench LogicSniffer recorded signals, Sigrok format}} | ||
+ | |||
+ | Testing the included RF Remote as well as other 433MHz remotes, it would seem the ZB40 receiver just down-modulates the signal into the baseband and pipes the raw signal to the gw60. The actual signal sent by the remote look quite strange though. It's pulse-width modulation for sure. | ||
+ | Seems to me that the receive (not the remote) could easy be replaced by the contents of this [[http://www.pollin.de/shop/dt/MzIyODcyOTk-/Computer_und_Zubehoer/Hardware/Maeuse_Unterlagen_Joystick/PC_Funkfernbedienung_mit_USB_Empfaenger_X10.html|Remote's USB-Stick]] |
realraum Graz, Brockmanngasse 15, 8010 Graz, realraum - Verein für Technik in Kultur und Gesellschaft