Browsed by
Category: Electronics Projects

My Electronics Projects

Driving a WS2811 RGB LED Strip with an Arduino

Driving a WS2811 RGB LED Strip with an Arduino

I recently purchased a WS2811 RGB LED strip for PC case modding purposes. I will be making an ATMega-based controller for it, so I decided to use an Arduino for testing and prototyping.

I found two libraries capable of driving this strip:

Plus many great links regarding the WS2811 at the Noisebridge Wiki.

I recommend trying out funkboxing’s FastSPI2 effects as great examples of using the FastSPI2 library. You will need to use the line LEDS.addLeds<WS2812, 13, GRB>(leds, NUM_LEDS); to properly initialize the code.

Writing a BeagleBone Cape’s EEPROM from UBoot

Writing a BeagleBone Cape’s EEPROM from UBoot

eeprom -d /dev/i2c-3 -a 0x54 -f foo

vi foo
<Escape> and :%!xxd
Edit the hex portion to your heart’s content
<Escape> and :%!xxd -r
Save and quit vi

To convert your eeprom.bin for upload via BusPirate

cat eeprom.bin | hexdump -v -e ‘8/1 “0x%02X “‘ -e ‘”\n”‘> eeprom.ascii

Upload using the method shown here.

Thanks to “Kev’s Site” for the tip on using VI as a hex editor

Pager-Controlled Thermostat Teardown (Work in Progress)

Pager-Controlled Thermostat Teardown (Work in Progress)

After installing a new furnace and thermostat, I was left with an old thermostat that was controllable by the power company to allow them to shut off the A/C remotely during high-load time, and allows users access to set their thermostat online

The Cannon Technologies Inc “ExpressStat” board (Rev M) has:

  • a Renesas H8/3937 non-roaming FLEX decoder, with on-chip 60-kbyte ROM and 2-kbyte RAM,
  • a Ramtron FM24CL64 “F-RAM array” (similar to an EEPROM),
  • an Infrared TX/RX pair,
  • a Texas Instruments TIR1000
  • a pager sub-board, including pager motor and beeper/buzzer, antenna and receiver circuitry
  • an 8-pin header to the thermostat’s mainboard


EExtractor: An (EE)PROM-Extracting Arduino Shield (Beta)

EExtractor: An (EE)PROM-Extracting Arduino Shield (Beta)

Purpose: EExtractor is an Arduino-compatible Shield that allows a user to dump (or download) the contents of a ROM chip (ROM, PROM, EPROM, EEPROM, etc). 

Hardware Method: The EExtractor uses two SOIC MCP23S17 ICs to control the 31 (32 minus ground) pins of the ZIF Socket. This (ideally) allows the user to address any size or pinout of PROM IC up to, and including, 32 pins. Headers are broken out to allow for direct powering of PROM pins from the Arduino’s +5V port (if needed).

Software Method: The Arduino (or compatible) software will correctly configure pins (inputs/outputs, Hi-Z, pull-ups, etc) to allow for proper reading of the IC’s data. The software will then proceed sequentially through each byte of the PROM, outputting it along with a verification or checksum.

(The code is still under construction at this time.)

Availability: PCBs will be available once testing is complete.

EExtractor was made using the Open-Source gEDA suite of tools, including gschem, pcb, etc, and, as always, a little symbol and footprint help from

All materials, schematics (.sch), PCB Layout (.pcb), and related derivatives such as PCB renderings, schematic renderings, .ps, .pdf, .gbr and .cnc files, or other Gerber-format files and PCB boards produced with them, collectively known as v1.0 Beta 1, are released under the CC BY-SA 2.5 Canada license.

*EExtractor is not sponsored or otherwise supported by Arduino. The Arduino name used only to signify compatibility.

Fun with (Laser) Printers using PJL

Fun with (Laser) Printers using PJL

Conversing with your Laser Printer:(See disclaimer below)

To extract information from your printer in PJL telnet to its IP address, port 9100 (or by serial, see below), and send it these commands:

<Control+[>%[email protected] <Enter>

Then copy and paste the following commands:


Or even try some newer, more detailed but undocumented ones:


Save your responses, and then type (note: NO <Enter> afterwards):

Then you can disconnect and/or close your Telnet program

Alternately, here is a small BASH script to return all of the information in a dated text file. To use, simply give the script the IP address of the printer as an argument.

#v1.0 – M Lange, 4-Jan-2014
echo -e “Scan of $1 9100 run on `date`:\n——————————-\n” > PJLScan-`date -I`.$1.txt

{ echo -e “\033%[email protected]”;
echo @PJL INFO ID;
echo -e “\033%-12345X”;
sleep 5; } | telnet $1 9100 | sed -e ‘s/\r$//’ >> PJLScan-`date -I`.$1.txt

If you could post your results in the comments, or Pastebin them and post the link, I’d be happy to share them. (Feel free to remove serial numbers if you wish; simply replace them with ‘x’s or ‘-‘s.) I’m trying to get a feel for what the most common options and languages are, as an upcoming open-source project has me parsing raw data and sending it to network printers.

The usual disclaimers apply: I’m not responsible for damages caused to your stuff or expenses incurred (i.e ink/toner/paper). Luckily, the worst case scenario is either A) Print out a page with those commands on it, or B) Hog the printer’s I/O until it times out (or you turn it off and then back on). For this reason, I recommend only trying this on a printer to which you *own* and to which you have physical access.

PJL Commands:

Tip: To run a PJL command,
you need to be in PJL mode. If you’re not in PJL mode (ie you typed something that doesn’t begin with an @, you get bumped into raw text mode), you need to send a <Control+[>%[email protected] <Enter>, then you can type your PJL command, beginning with “@”. To end your PJL session, send <Control+[>%-12345X (with no <Enter> after it)

“@PJL” can be used as a command on its own, or rather, a lack of command (or NOOP). It is used after the Escape Code (…%-12345X) to tell the printer you will be typing some PJL. This is necessary because printers sample the code after the Escape Code (…%-12345X) to try to determine what type of data they are receiving (PJL, PCL, PCLXL, PostScript, etc., depending on the model)

HP LaserJet 4M Plus

HP Color LaserJet CP1518ni:

HP Color Laserjet MFP M275nw:

HP LaserJet 1012:

  • Plugs in by USB only
  • Can interact with it at /dev/usblp0 at 115200,8,n,1 using gtkTerm as root: sudo gtkterm –port /dev/usblp0 –speed 115200 –echo and set “CR LF auto” under the configuration menu
  • Interesting: @PJL SET TESTPAGE=DATASTORE is an interesting (4-page) test page, essentially a printout of the value and meaning of all variables
  • Personalities: PCL, PCLXL
  • Info: HP LaserJet 1012 Info Dump.doc

HP LaserJet 9050:

HP Color LaserJet 9500:

HP Officejet Pro X476dw MFP:

Brother HL-3040cn:

Brother MFC-7440n:

See also:

Please note:

  • I would imagine a number of inkjets use PJL, though honestly I have no inkjet printers on-hand to test on. I posit that a number of inkjets will work, including ones with built-in Ethernet. It may be possible to execute commands over USB as with the LaserJet 1012 (See above for serial terminal settings). If anyone has inkjet dumps, they’re just as welcome as Laser ones.
Kenwood KDC-MP528 Internals

Kenwood KDC-MP528 Internals

The Kenwood KDC-MP528 has the following goodies inside:

  • STMicro TDA7415 (TQFP64) – Car Radio Multimedia Signal Processor
  • STMicro TDA7540 (TQFP80) – AM/FM Car Radio Tuner IC with Stereo Decoder and Intelligent Selectivity System
  • Renesas M30624MWP-A43GP (TQFP100) – Single-Chip 16-Bit CMOS Microcomputer [Resources]
  • TI “HC02A 54K FYEE” (14-pin)
  • “4565 514 JRC” (8-pin)
  • “1930 4ZX4” (10-pin SOIC)
  • “L04 W209 5J” (8-pin)
Acer Aspire 3000 Battery Internals

Acer Aspire 3000 Battery Internals

This is a 4-cell battery; before opening it up, I was under the impression that it was a 3-cell.

The charge controller circuit board has “LIP8198” and “1-867-277-11” markings in the silkscreen, along with a strip of Kapton tape over the top of the PCB.

The PCB has +/- going to the 4 cells in series, as well as leads between each cell (probably for measuring voltage at each intermediate point), and two temp sensors: one on the battery closest to the circuit board (the one that the board’s “-” connects to) and one on the next one after that (the middle-most one).

The top side has the following ICs:

  • 3182 5J94 (Looks like a tiny EEPROM/Flash)
  • Two unlabelled 8-pin square ICs marked “04” and “07” on the silkscreen
  • 12AH4 SC SF

The bottom has the following:

  • TI bq80201DBT – “Battery ‘Gas Gauge'” for storing the cycle count?
  • TI bq29312PW – “Two, Three and Four Cell Lithium or Lithium-Polymer Battery Protection AFE”
  • A number of various bare-copper test points 🙂

With a bit of digging, it seems that the bq80201 is used for many different battery makes such as Sanyo, Dell, etc.

Relevant URLs:
Battery EEPROM Works (Software; not affiliated with this site, I have no guarantees of how well it works)
Battery EEPROM Works Forum topic re: B80201 support (Forum Thread)
Would still be nice to actually find a listing of the I2C codes that it uses.

D-Link DWL-120 Hacking/Probing

D-Link DWL-120 Hacking/Probing

I found 3 or 4 of these at a garage sale a few years ago for a few bucks, and I am (surprisingly) just cracking them open now.

On the front, it is marked as D-Link DWL-120 11Mbps Wireless USB Adapter, on the back is FCC ID# MXF-WL280, H/W: B2, F/W: 2.25

On the bottom of the PCB, we have the following chips:

  • Atmel AT76C503AWireless LAN MAC Unit with ARM7TDMI RISC Processor
  • Atmel AT25040N4K (512 x 8) SPI Serial EEPROM
  • tmTECH T14L1024N128 x 9 High-Speed CMOS Static RAM
  • Intersil HFA3861BINDirect Sequence Spread Spectrum Baseband Processor

On the top of the PCB (under the RF shield), we have the following chips:

  • Intersil HFA3683AIN2.4GHz RF/IF Converter and Synthesizer
  • Intersil HFA3783INI/Q Modulator/Demodulator and Synthesizer
  • Intersil HFA3983IV2.4GHz Power Amplifier and Detector

I plugged it into my i386-based laptop (My x64 desktop doesn’t have drivers) and got this dmesg:

[   80.592101] usb 1-2: new full speed USB device using uhci_hcd and address 2
[   80.763204] usb 1-2: configuration #1 chosen from 1 choice
[   81.504200] cfg80211: Using static regulatory domain info
[   81.504209] cfg80211: Regulatory domain: US
[   81.504215] 	(start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[   81.504224] 	(2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 2700 mBm)
[   81.504233] 	(5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[   81.504241] 	(5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[   81.504248] 	(5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[   81.504256] 	(5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[   81.504264] 	(5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 3000 mBm)
[   81.504290] cfg80211: Calling CRDA for country: US
[   81.654555] cfg80211: Regulatory domain changed to country: US
[   81.654567] 	(start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[   81.654577] 	(2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2700 mBm)
[   81.654585] 	(5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 1700 mBm)
[   81.654593] 	(5250000 KHz - 5330000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   81.654601] 	(5490000 KHz - 5710000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   81.654609] 	(5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 3000 mBm)
[   81.912231] Atmel at76x USB Wireless LAN Driver 0.17 loading
[   81.912307] usb 1-2: firmware: requesting atmel_at76c503-i3861.bin
[   81.965349] usb 1-2: using firmware atmel_at76c503-i3861.bin (version 0.90.0-44)
[   81.967174] at76c50x-usb 1-2:1.0: downloading internal firmware
[   84.329808] usb 1-2: reset full speed USB device using uhci_hcd and address 2
[   84.477154] usb 1-2: device firmware changed
[   84.477265] usbcore: registered new interface driver at76c50x-usb
[   84.492786] usb 1-2: USB disconnect, address 2
[   84.604098] usb 1-2: new full speed USB device using uhci_hcd and address 3
[   84.781393] usb 1-2: configuration #1 chosen from 1 choice
[   84.789161] at76c50x-usb 1-2:1.0: downloading external firmware
[   85.032206] phy0: Selected rate control algorithm 'minstrel'
[   85.034924] phy0: USB 1-2:1.0, MAC 00:05:5d:f1:9d:39, firmware 0.90.0-44
[   85.034935] phy0: regulatory domain 0x00: <unknown>
[   85.383777] udev: renamed network interface wlan0 to wlan1
[   89.584738] ADDRCONF(NETDEV_UP): wlan1: link is not ready