Browsed by
Author: Shadyman

How to convert .RMT to .BIN for OpenRG Bootloader (RGLoader)

How to convert .RMT to .BIN for OpenRG Bootloader (RGLoader)

I recently encountered a situation while loading firmware into an Actiontec MI424-WR router, when I found myself without a bootable firmware, and the OpenRG bootloader would vehemently refuse to load .rmt files.

The MI424-WR has two sections in its Flash for firmware. The stock firmware available from Actiontec is, of course, a RMT. (I did in fact have the .bin dump of the entire flash chip, but I wasn’t about to attempt to make the bootloader overwrite itself.)

After comparing hex dumps, I came to the conclusion that .rmt files are .bin files with a 148-byte header. All you have to do to create a .bin that is ready to be downloaded by the router is to use the following command:

dd if=firmware.rmt of=firmware.bin bs=1 skip=147

Such that the resulting “firmware.bin” file begins with 0xE2 0x8F 0xA0 like other .img files built for this router. I’m not sure if the “magic” will be the same for other machines, but that’s what it seems to be for the MI424-WR running on the stock bootloader (OpenRG).

I hope this saves someone some hassle. As usual, no guarantees of accuracy or completeness πŸ˜‰

iRobot Roomba Hacking [Work in Progress]

iRobot Roomba Hacking [Work in Progress]

Another of my thift store finds (and likely the oddest) is an iRobot Roomba 530 for $60, along with its dock, power cord, and two virtual walls. I plugged the charger into the base, sat the Roomba on it, and it started its “deep charge” cycle.

After charging it for 24 hours, I started it up. It backs up, turns, and backs up again, continuing in this pattern for a few rotations before stopping with an Error 9, which the User Manual states is a dirty front bumper.

TODO: Gut an old mouse or other device for its mouse-wheel IR sensor to replace the broken one.

WIP: DIR-615 rev C1 Hacking

WIP: DIR-615 rev C1 Hacking

In my most recent thrift store trips, I found (among other things) a large quantity of D-Link DIR-615 Rev C1.

Some relevant linkage:

Things on my TODO List:

  • Add a USB port and/or hub, and supporting components
  • Add a third antenna (requires a lot of supporting components)
  • Install Kismet and gpsd for a mobile wardriving box?
  • Add I2C Bus over GPIO
  • Add SD Card Support over GPIO?
Fun with (Laser) Printers using PJL

Fun with (Laser) Printers using PJL

Conversing with your Laser Printer:(See disclaimer below)

To extract information from your printer in PJL telnet to its IP address, port 9100 (or by serial, see below), and send it these commands:

<Control+[>%[email protected] <Enter>

Then copy and paste the following commands:


Or even try some newer, more detailed but undocumented ones:


Save your responses, and then type (note: NO <Enter> afterwards):

Then you can disconnect and/or close your Telnet program

Alternately, here is a small BASH script to return all of the information in a dated text file. To use, simply give the script the IP address of the printer as an argument.

#v1.0 – M Lange, 4-Jan-2014
echo -e “Scan of $1 9100 run on `date`:\n——————————-\n” > PJLScan-`date -I`.$1.txt

{ echo -e “\033%[email protected]”;
echo @PJL INFO ID;
echo -e “\033%-12345X”;
sleep 5; } | telnet $1 9100 | sed -e ‘s/\r$//’ >> PJLScan-`date -I`.$1.txt

If you could post your results in the comments, or Pastebin them and post the link, I’d be happy to share them. (Feel free to remove serial numbers if you wish; simply replace them with ‘x’s or ‘-‘s.) I’m trying to get a feel for what the most common options and languages are, as an upcoming open-source project has me parsing raw data and sending it to network printers.

The usual disclaimers apply: I’m not responsible for damages caused to your stuff or expenses incurred (i.e ink/toner/paper). Luckily, the worst case scenario is either A) Print out a page with those commands on it, or B) Hog the printer’s I/O until it times out (or you turn it off and then back on). For this reason, I recommend only trying this on a printer to which you *own* and to which you have physical access.

PJL Commands:

Tip: To run a PJL command,
you need to be in PJL mode. If you’re not in PJL mode (ie you typed something that doesn’t begin with an @, you get bumped into raw text mode), you need to send a <Control+[>%[email protected] <Enter>, then you can type your PJL command, beginning with “@”. To end your PJL session, send <Control+[>%-12345X (with no <Enter> after it)

“@PJL” can be used as a command on its own, or rather, a lack of command (or NOOP). It is used after the Escape Code (…%-12345X) to tell the printer you will be typing some PJL. This is necessary because printers sample the code after the Escape Code (…%-12345X) to try to determine what type of data they are receiving (PJL, PCL, PCLXL, PostScript, etc., depending on the model)

HP LaserJet 4M Plus

HP Color LaserJet CP1518ni:

HP Color Laserjet MFP M275nw:

HP LaserJet 1012:

  • Plugs in by USB only
  • Can interact with it at /dev/usblp0 at 115200,8,n,1 using gtkTerm as root: sudo gtkterm –port /dev/usblp0 –speed 115200 –echo and set “CR LF auto” under the configuration menu
  • Interesting: @PJL SET TESTPAGE=DATASTORE is an interesting (4-page) test page, essentially a printout of the value and meaning of all variables
  • Personalities: PCL, PCLXL
  • Info: HP LaserJet 1012 Info Dump.doc

HP LaserJet 9050:

HP Color LaserJet 9500:

HP Officejet Pro X476dw MFP:

Brother HL-3040cn:

Brother MFC-7440n:

See also:

Please note:

  • I would imagine a number of inkjets use PJL, though honestly I have no inkjet printers on-hand to test on. I posit that a number of inkjets will work, including ones with built-in Ethernet. It may be possible to execute commands over USB as with the LaserJet 1012 (See above for serial terminal settings). If anyone has inkjet dumps, they’re just as welcome as Laser ones.
USB Host on HP Touchpad: Progress…

USB Host on HP Touchpad: Progress…

To access USB Host mode on the Touchpad (to plug in a Keyboard/USB Drive/etc), you need:

  1. A microUSB to USB Female cable (USB-OTG cable), available on ebay for ~$3, shipped [search ‘USB-OTG cable’]
  2. A powered USB Hub (a USB Hub with a spot to plug in an external power supply), available on ebay for under $10, shipped, with power supply  [Search ‘powered usb hub’]

All you need to do is plug the USB Hub into the OTG adapter, and the OTG Adapter into the Touchpad. Power it with a wall adapter, and you’ll have USB devices showing up in dmesg in no time!

For example:

[16075.755719] usb 1-1.1: new high speed USB device using msm_hsusb_host and address 3
[16075.775744] get_port_status port=1,portstatus=1503, portchange=10
[16075.868006] usb 1-1.1: New USB device found, idVendor=13fe, idProduct=3323
[16075.868111] usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[16075.883769] usb 1-1.1: Product: STORE N GO
[16075.883821] usb 1-1.1: Manufacturer: Verbatim
[16075.894000] usb 1-1.1: SerialNumber: 070007A315074099E8C5
[16075.922270] scsi1 : usb-storage 1-1.1:1.0
[16075.944010] get_port_status port=1,portstatus=1503, portchange=0
[16076.953338] scsi 1:0:0:0: Direct-Access     Verbatim STORE N GO       5.00 PQ: 0 ANSI: 0 CCS
[16076.993863] sd 1:0:0:0: Attached scsi generic sg0 type 0
[16077.204050] sd 1:0:0:0: [sda] 7802880 512-byte logical blocks: (3.99 GB/3.72 GiB)
[16077.204665] sd 1:0:0:0: [sda] Write Protect is off
[16077.216317] sd 1:0:0:0: [sda] Mode Sense: 23 00 00 00
[16077.216329] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.219671] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.227274]  sda: sda1
[16077.237134] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.237234] sd 1:0:0:0: [sda] Attached SCSI removable disk

To be fair, there is most likely a way to enable the Touchpad to power USB OTG devices itself, which would remove the need for the powered hub.

See also: and, which suggest using a USB Y-cable to inject power, and from which I blatantly stole the idea of using a powered USB hub πŸ˜‰

So far I have tried a USB thumbdrive and a wireless mouse dongle; the thumbdrive was detected flawlessly, while the mouse’s dongle was not.

gRover Robotics Platform

gRover Robotics Platform

This is gRover, the Grove-Platform Rover; it is a general, all-purpose rover for house exploration.


This page is a bit of a mess, I’ll admit. The PDF file attached is much neater and contains much more information about the project than this page’s text does. For more pictures, see the gRover Flickr Photoset. This rover build uses parts graciously provided by Seeed Studio.


I purchased an RC car from the thrift store for $2. It had no remote control to go along with it, but it did have a 4.8V Ni-Cad battery pack, a chassis, a steering motor, and a drive motor. While the 4.8V Ni-Cad battery does not have enough voltage to power the I2C Motor Driver (it may be useful in another project), the motors and chassis provide a great base for a robot.


To me, this build was more about making a framework that other users could utilize to easily use the Grove platform to make a rover. I created gRover with the following (easily-modifiable and easily-expandable) features:

  • Autonomous Mode: Drive the rover around autonomously using the on-board sensors for guidance
  • Remote Control: Drive the rover around with commands sent over the serial port (currently non-functional, as it interrupts I2C. A Bluetooth Twig using NewSoftSerial should work well.)
  • Cat Spooker: Lie in wait until a cat approaches, then make some noise and start Autonomous mode (This can be replaced with something more interesting. I’m open to suggestions)
  • Cat Taunter: Make a noise every 15 seconds while there isn’t a cat in the area. (Ditto)
  • Motor Test: Run a test of the motors connected to the I2C Motor Driver Twig
  • Sensor View: Get a live view of sensor data on the OLED Display



Part Name



R/C Truck


Arduino (or Arduino Clone)


Battery Box (Output: 8-15V)


Stem – Grove Base Shield



Twig – OLED Display 128×64



Twig – I2C Hub



Twig – I2C Motor Driver



Twig – I2C Touch Sensor



Twig – Sound Recorder



Twig – Buzzer



Twig – PIR Motion Sensor



Twig – 80cm Infrared Proximity Sensor



Twig – 3-Axis Accelerometer



Twig – Chainable RGB LED



Twig – Sound Sensor



Twig – Vibrator



Grove – Universal 4-Pin Cable (5 ea)


Part Usage: The Twigs perform the following tasks:

  • The 3-axis Accelerometer Twig helps track the rover’s movements, and can be used to tell if it is standing still (despite motors turning) (not currently implemeted into Auto Mode)
  • The OLED Display 128×64 Twig and I2C Touch Sensor Twig are used as a User Interface, mounted on the top of the robot (or under a clear polyurethane shell for weatherproofing). The Vibrator Twig is used as tactile feedback for the I2C Touch Sensor Twig’s buttons, (also known as β€œfeelers”) which aren’t physical buttons but actually touch sensors.
  • The Buzzer Twig is used as audible feedback in addition to the Vibrator Twig’s tactile feedback, and can be used for sound effects if the Sound Recorder Twig isn’t used.
  • The PIR Motion Sensor Twig is set to a fairly short range, and is used to either detect obstacles, or (in some cases) wait for obstacles (like cats!) to approach it.
  • The 80cm IR Proximity Sensor Twig is used to detect obstacles ahead of the rover.
  • The Sound Recorder Twig has various sounds recorded, such as a monster-truck engine and a car horn.
  • The Chainable RGB LED Twigs act as pseudo-Police flashing lights (with two RGB LEDs, flashing in a red/blue pattern)
  • The Sound Sensor Twig is used to control the robot by clapping. (Not currently implemented into Auto Mode)
  • The I2C Motor Driver Twig is used to control the drive and steering motors in the RC car.


For more information, please see the attached PDF file. The code (which is ~1850 lines long, including lots of comments) is attached as a ZIP file.

The code is CC BY-SA licensed to the extent possible, given that the code has minor sections taken from example code from the Seeed Studio wiki (links are available in the PDF and in the code headers), and for the Touch Sensor Twig, from Rory Nugent (cited in the code).  If I have missed a citation, please let me know.

The documentation PDF is CC BY-SA.

HP Touchpad Hardware [Preliminary]

HP Touchpad Hardware [Preliminary]

Although this is an article on hardware, I’m going to be using software to probe it. This is from a 32GB HP Touchpad, though the 16GB should be the same, barring the difference in storage.


Processor       : ARMv7 Processor rev 2 (v7l)
processor       : 0
BogoMIPS        : 13.52

Features        : swp half thumb fastmult vfp edsp neon vfpv3
CPU implementer : 0x51
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0x02d
CPU revision    : 2

Hardware        : TENDERLOIN
Revision        : 0000
Serial          : 0000000000000000

The touchpad runs on a Qualcomm Snapdragon dual-core CPU, so I would take this output with a grain of salt: It’s only showing one core, and my touchpad is in powersave mode, so the bogomips, as usual, is way off.

Now for the more interesting stuff, like i2c devices.

cat /sys/bus/i2c/devices/*/name: (with annotations)

mt9m113– Aptina Webcam SoC

  • /sys/devices/i2c-1/1-0078

a6_0 – Battery monitor – Battery?

  • /sys/devices/i2c-3/3-0031
  • This one seems to have information on voltage, charge percentage, etc.
  • Seems to be the battery monitor
  • Here are the values/categories for the Veer (for comparison and info)
  • A6 Version: HW: 255, FW (M.m.B): 2.13.25, ManID: 28769, ProdTyp: 1281

a6_1 – Battery monitor – Charger?

  • /sys/devices/i2c-3/3-0032
  • This one has info in acc_data_*, but not voltage
  • Seems to be the battery charging circuit
  • A6 Version: HW: 255, FW (M.m.B): 2.7.23, ManID: 28769, ProdTyp: 1793

LM8502– National Semiconductor “Smart Lighting” IC

  • /sys/devices/i2c-3/3-0033
  • Fun: The LM8502 driver brings out the vibrator, LEDs (home button LEDs?), flash (for camera? I dont’ think the TP has one),

wm8958– Wolfson Microelectronics Audio Hub w/ 3 Digital Audio interfaces & DSP

  • /sys/devices/i2c-4/4-001a
  • Fun: Driver brings out some GPIO pins

maXTouch– Atmel’s family of “Unlimited-Touch” Touchscreen controllers

pm8058-core – Qualcomm Power Management IC

  • /sys/devices/i2c-6/6-0055
  • The datasheet for this one is kept under wraps?
  • From what the driver brings out, we can see that it controls power to the charger, GPIO, MPP (Multi-Purpose Pins), PWM, Power button, RTC, TM (IC Temperature Monitor), UPL(?), and the vibrator

pm8901-core – Qualcomm Power Management IC (No datasheet?)

  • /sys/devices/i2c-7/7-0055
  • The datasheet for this one is kept under wraps?
  • The driver brings out MPP (Multi-Purpose Pins), regulators, and a Temperature Monitor.
  • (Maybe this one is used for large loads, whereas the pm8058 is for smaller loads?)

QUP I2C adapter – (Six) – Qualcomm Universal Peripheral [cite]

  • /sys/devices/i2c-0 all the way through i2c-5

MSM SSBI adapter – (Three) – Qualcomm MSM-series “Single-Wire Serial Bus Interface” [cite]

  • /sys/devices/i2c-6 through i2c-8

cat /etc/fstab:

  • # <filesystem>  <mount point>   <type>  <options>       <dump>  <pass>
  • rootfs  /       ext3    ro,suid,dev,exec,auto,nouser,async,noatime      1       1
  • /dev/mapper/store-var   /var    ext3    noatime,data=writeback  0       0
  • /dev/mapper/store-cryptodb      /var/db ext3    noauto,noatime,data=ordered     0       0
  • /dev/mapper/store-cryptofilecache       /var/file-cache ext3    noauto,noatime,user_xattr       0       0
  • /dev/mapper/store-log   /var/log        ext3    noatime 0       0
  • /dev/mapper/store-update        /var/lib/update ext3    noauto,noatime  0       0
  • proc    /proc   proc    defaults        0       0
  • devpts  /dev/pts        devpts  mode=0620,gid=5 0       0
  • tmpfs   /tmp    tmpfs   size=40M,mode=1777      0       0
  • tmpfs   /var/run        tmpfs   size=16M,mode=1777      0       0
  • tmpfs   /var/tmp        tmpfs   size=32M,mode=1777      0       0
  • tmpfs   /media/ram      tmpfs   defaults        0       0
  • /dev/mapper/store-media /media/internal vfat    utf8,shortname=mixed,umask=0000 0       0

/dev/input/event0 is the home button and volume button device
/dev/input/event1 is the power button device
/dev/bt_uart is the Bluetooth serial stream

/proc/tty/drivers: (showing some promising signs of USB-Host ability)

/dev/tty             /dev/tty        5       0 system:/dev/tty
/dev/console         /dev/console    5       1 system:console
/dev/ptmx            /dev/ptmx       5       2 system
/dev/vc/0            /dev/vc/0       4       0 system:vtmaster
usbserial            /dev/ttyUSB   188 0-253 serial
acm                  /dev/ttyACM   166 0-31 serial
msm_serial_hsl       /dev/ttyS     243 0-3 serial
pty_slave            /dev/pts      136 0-1048575 pty:slave
pty_master           /dev/ptm      128 0-1048575 pty:master
pty_slave            /dev/ttyp       3 0-255 pty:slave
pty_master           /dev/pty        2 0-255 pty:master
smd_tty_driver       /dev/smd      253 0-36 serial
unknown              /dev/tty        4 1-63 console

More to come.

How to make a 5-Bay NAS Box for under $400

How to make a 5-Bay NAS Box for under $400

What you will need:


  • Case: If space and/or looks are an issue, get a Lian Li PC-Q08, otherwise just get any generic case that will accept a Mini-ITX board and 5 (or 6, like the PC-Q08) hard drives. I chose the PC-Q08 because it was the only reasonably small, well-ventilated case for Mini-ITX and six 3.5″ drives. (It can also hold a 2.5″ hard drive in a space underneath the 5.25″ bay, as I’ll discuss later)
  • Power Supply: I went with the SeaSonic 350W SS-350ET as it was one of the lowest-powered models available (except for the 300W version, which seems to be hard to find), and was from a reputable power supply manufacturer. It supports ATX2.31 and has received the 80 Plus Bronze rating for efficiency. Although it is still overkill for what will be going into this machine, it will allow for adding a graphics card for HTPC use if you decide to go that route either now or in the future.
  • Motherboard/CPU: ASUS E35M1-I — If you are going to use your NAS as an HTPC as well, get the Deluxe version. If you’re going all-out for storage capacity, get the regular, non-deluxe one (The regular has 6 SATA ports, Deluxe only has 5)
  • RAM: This is a bit of a tricky one, as the motherboard tops out at PC3-8500 (DDR3-1066), single channel. That speed of memory is pretty scarce compared to its faster sibling, PC3-10666, and if nothing else, the PC3-10666 will give you more stability. I’d recommend the Mushkin 996992 Silverline PC3-10666 8GB (2x4GB Kit) as it fills the motherboard up to its maximum for memory without breaking the bank.

    I couldn’t get my hands on the Mushkin 996992 memory, and the Mushkin 997667
    Blackline PC3-12800 8GB (2x4GB Kit)
    was actually cheaper than buying two no-name, bottom-of-the-barrel 4GB sticks of PC3-10666 memory.

    My reasoning for maxing out the memory is that we can use this later on to set up RAM drives (tmpfs) to speed up generic tasks and keep our drives spun down longer to save power. If this isn’t your cup of tea, feel free to grab whatever memory best suits your needs.

  • Hard Disk (OS): For power savings, I opted to use a 2.5″ drive for my system disk as it takes substantially less power to operate. I considered a Seagate Momentus XT for the added benefit of having a small amount of SSD storage, but the benchmarks for a server-type machine don’t support spending the extra money. I settled on a WD Scorpio Black 500GB drive (WD5000BEKT)

    As an added bonus, the Lian Li case that I discussed earlier has a special hiding spot for a 2.5″ drive so that it won’t take up any of the 3.5″ bays (leaving a whopping 6 3.5″ bays for possible RAID storage! Unfortunately, the motherboard only has 6 SATA ports, though if you really wanted to have a 6-bay RAID, you could always add a SATA board in the PCIe slot.)

  • Hard Disks (RAID): For this build, I will be making a RAID out of Western Digital Green 2TB SATA-II drives (WD20EARS).

    As of this writing, 2TB drives have the lowest Cost/GB of any 3.5″ drive. 3TB drives, while available, are disproportionately expensive as they are still solely in the realm of the early adopter.

    A RAID 5 setup requires (as a bare minimum) 3 drives. You can always add more in later; the RAID array will just expand to accommodate the extra space.

    Unfortunately, whereas most Western Digital drives used to have a feature known as TLER (Time-Limited Error Recovery) [Wikipedia] hidden in the firmware, this feature now seems to be only available on Enterprise-level drives. This isn’t a problem for Linux software RAID (mdadm) as it just waits for the drive to complete its recovery, but may be a problem if you plan on using a RAID controller card.

Kenwood KDC-MP528 Internals

Kenwood KDC-MP528 Internals

The Kenwood KDC-MP528 has the following goodies inside:

  • STMicro TDA7415 (TQFP64) – Car Radio Multimedia Signal Processor
  • STMicro TDA7540 (TQFP80) – AM/FM Car Radio Tuner IC with Stereo Decoder and Intelligent Selectivity System
  • Renesas M30624MWP-A43GP (TQFP100) – Single-Chip 16-Bit CMOS Microcomputer [Resources]
  • TI “HC02A 54K FYEE” (14-pin)
  • “4565 514 JRC” (8-pin)
  • “1930 4ZX4” (10-pin SOIC)
  • “L04 W209 5J” (8-pin)