Fake (?) Sunon DP200A/Sunon DP201A fans

Last weekend I had to replace a 230 V fan (120 mm), a Sunon DP200A, that ‘smelled’ strange and also made strange noises. Better safe than sorry…

Well: I ordered a slightly less powerful Sunon DP201A (at Reichelt Elektronik) to replace the possibly dangerous fan. Although they look similar their connectors are completely different. So I’m now wondering if the first one (the DP200A) wasn’t an original fan at all…?sunon-dp200a-dp201a-front

Sharp PC-1500/1600 ROM Dump Method 2: Desoldering the ROM Chips

To make it clear from the beginning: this is a (possibly) destructive method of reading ROM chips. The process of extracting and possibly a resoldering of the memory chip might fail. In my case I’ve tested it on two Sharp CE-150 PCBs I’ve declared to be spare parts. It is only a proof of concept as there are simpler non-destructive ways of ROM extraction on a Sharp PC. I was just curious and so I’m describing my experiences.

Well… At first I did not want to desolder the ROMs: I started with the intention to use a set of probes attached to the individual pins of the chip to read the content of the Sharp PC / CE ROM chips. This did not work due to the narrow leg distance of the QFP chips (0.8 mm).

Probe Connection Problem

Desoldering QFP chips can be done rather quickly with a hot air gun. At least that’s the most comfortable way I know of. I usually add some flux and in some cases larger quantities of leaded solder. The latter decreases the melting point and speeds up the process. I don’t care about solder joints as the chips and the pads can easily be cleaned after the removal. Excessive amounts of solder can be removed with flux and a clean soldering iron tip.
Continue reading “Sharp PC-1500/1600 ROM Dump Method 2: Desoldering the ROM Chips”

Sharp PC Audio Output (CMT-OUT) Simulation in LTspice

This was a little test out of curiosity… I’m currently playing around with an amplifier circuit for the Sharp CE-150 audio output (CMT-OUT) and wanted to see if the signal I’m getting is already distorted when leaving my Sharp PC, or if my circuit and/or sound card is causing the distortions.

The CE-150 uses Frequency Shift Keying (FSK) to transfer binary data via audio signal (e.g. to a tape recorder). It sends four pulses of 1.27 kHz for a binary “0” and eight pulses of 2.54 kHz for a “1”.

Sharp CMT-OUT LTspice Schematic

To test the circuit I’ve taken the original design and simulated the circuit in LTspice (running under Linux with Wine). This tool allows the simulation of various analog (and digital) circuits – perfect for my test.

Sharp CMT-OUT LTspice Plot

Sharp CMT-OUT Audacity Plot

The result was – to be honest – pretty surprising for me. The upper screenshot shows the LTspice simulation of the output signal, the lower screenshot was taken from a WAV file in Audacity. I was not only able to simulate the circuit but also to use the resulting signals as a good approximation for my amplifier circuit (not shown). 🙂 One minor fix (also not shown) left was to adapt the transition time between a “0” and a “1” to better fit to the original curve.

Sharp PC-1500/1600 ROM Dump Method 1: Audio Transfer via CE-150 Extension

In this post I’m describing a method which is widely used to Dump RAM and ROM images on Sharp PC-1500 and PC-1600 systems. This method is non-destructive and can be used on most Sharp PC ROMs and extension cards. It only requires a Sharp CE-150 extension, an audio cable, and a computer with a microphone input (i.e. sound card).

Besides a plotter, the CE-150 Color Graphic Printer also provides two audio interfaces (line-in and microphone output). These were (and still are) used to transfer code or data between Sharp PCs and tape recorders. Today, such recorders are mostly outdated but the method works nonetheless with sound cards. Software tools are freely available (e.g. pocket-tools) that allow the transformation of recorded audio files into binary dumps and even further into BASIC code.

Continue reading “Sharp PC-1500/1600 ROM Dump Method 1: Audio Transfer via CE-150 Extension”

Dumpster Dive: Sony Digital Mavica MVC-FD73 (Floppy Digital Camera)

Another day, another dumpster dive, another hit… a digital camera that uses 3.5″ floppy drives as storage device. A Sony Digital Mavica MVC-FD73.

My first surprise was that I was still able to charge the cameras battery. The second surprise was that it was still working flawless. And when doing some background research there was a third surprise that Sony still provides a manual (PDF). I did not expect any of these points.

Specifications
MVC-FD73
Max. resolution 640 x 480 (0.4 megapixels)
Sensor type CCD (ISO 100)
Optical zoom 10x (focal length ~ 40-400 mm)
Screen size 2.5"
Screen dots 84,000
Min shutter speed 1/60 sec
Max shutter speed 1/4000 sec
Weight (inc. batteries) ca. 500 g
Dimensions (ca.) 138 x 103 x 62 mm
Continue reading “Dumpster Dive: Sony Digital Mavica MVC-FD73 (Floppy Digital Camera)”

Dumpster Dive / Teardown: Moser Galvanosan Feinstromgerät / Galvanic Stimulator

From time to time I have (and take) the chance to dumpster dive for electronic parts. Recently, on one of these occasions, an old piece of hardware felt into my hands: a “Moser Galvanosan” galvanic stimulator.

To be honest, I’ve had no idea what it was and at first I only thought it would be a nice case for another project I was working on. After some research (out of curiosity) I thought the device is interesting enough to take some photos of its interior and write about it.

Disclaimer: I’m totally not into alternative medicine or stimulation current therapy. I’m just taking an interesting looking piece of hardware apart, that’s all!

Continue reading “Dumpster Dive / Teardown: Moser Galvanosan Feinstromgerät / Galvanic Stimulator”

Reviving (jump-starting) a dead R.O.GNT Speaker Lithion-Ion Battery

I recently had to revive a (as it at first seemed) dead Li-Ion battery. It was the battery of a newly bought R.O.GNT external speaker which refused to work or even charge. The device was DOA (dead on arrival) but it was so cheap that sending it back would have cost more than I’ve paid for it.

The speaker has an internal Lithium-Ion battery to allow mobile usage. My guess was that this battery slowly discharged while waiting for a buyer and at some point the undervoltage protection kicked in. Normally this protection should prevent a defective cell from being charged. In my case I hoped the cell would still be okay and survive a jump-start. It was successfully done before in other cases. Continue reading “Reviving (jump-starting) a dead R.O.GNT Speaker Lithion-Ion Battery”

Ripped off JTAG header pads on my dev FritzBox [FAIL]

Ugh… this is so disappointing. I tried to solder a ribbon cable to the JTAG header of my “development” FritzBox 7270. Right during the process I accidentally bumped against the bare PCB. It fell off the table and the already soldered cables ripped off some of the pads. Here’s a photo after removing the remaining cables:

FritzBox Ripped-off JTAG pads

I’m unsure how to continue. I followed the traces but so far did not find adequate vias or pads to solder to. At the moment I’m trying to not brick the FritzBox and therefore do not need a JTAG connection… again…

Reverse Engineering a Sharp CE-160 Cartridge

I wanted to make a small tutorial on how to reverse engineer old PCBs, in this case how to trace the vias of a Sharp CE-160 cartridge.Disassembly of a Sharp CE-160 cartridge

Disassembled Sharp CE-160 cartridgeAfter disassembling I’ve made photos of both sides of the cartridge:

Sharp CE-160 - Top layerSharp CE-160 - Bottom layer

The following step was inspired by an EEVBlog tutorial on reverse engineering a Rigol DS1054Z. The two photos were then aligned (photoshopped) to fit onto each other when printed. One of the two layers needed to be mirrored, and it took a bit to align all vias. Luckily the two photos was taken with a tripod from the same angle. The result was printed onto plastic photocopy foil.

Sharp CE-160 - Top and bottom layer overlay Sharp CE-160 - Printed top and bottom layer overlayThis allows tracing the routes from both sides, including the vias.

In some cases traces were hidden under chips or other parts. I used my multimeter (set to measuring resistance) and needle pin tips to trace them:

Tracing Sharp CE-160 tracks with needle-tip probes

Kabel Deutschland TR-069 Auto-Configuration on a FritzBox 7390

The cable provider Vodafone (Kabel Deutschland) does not officially support VoIP connections from other routers than the ones they have issued: in my case a FRITZ!Box 7270. They do not provide the VoIP credentials; their boxes are auto-configurated via TR-069 protocol. Having a FRITZ!Box 7390 led me to investigate how to enable this full auto-configuration in other boxes than the 7270.

This is a follow-up to my previous post on how to clone CWMP settings between FritzBox 7270s.

I started with a freshly recovered FritzBox 7390, i.e. all previous configuration settings were erased. Also I did not connect any devices to the FritzBox. The Power/DSL LED is blinking.

The following changes were made via the UART interface on the PCB. I have not tested them via the FritzBox Telnet connection. It might be possible to write and  trigger them as a shell script (as the network connection is shut down in the process), I have not tested that either.

FritzBox 7390 UART Connection

Start with a shell on the FritzBox and shut down the network and DSL daemons:

cd /etc/init.d/

./rc.net stop
    [...takes some time...]

./rc.dsl.sh stop
    [...takes some time...]

Then reconfigure the environment settings. I’ve used the urlader / boot loader (EVA) to set the tr069-credentials (as described here). I’m not sure if they can be also defined later, but if so, it should look something like this:

echo "tr069_passphrase XXXXXXXXXXXX" >> /proc/sys/urlader/environment
echo "tr069_serial 00040E-XXXXXXXXXXXX" >> /proc/sys/urlader/environment

You might also want to check the MAC addresses: maca, macb, macwlan, macwlan2, macdsl, usb_board_mac, usb_rndis_mac
If the default addresses are set the FritzFox might completely fail to establish an internet connection. You then should set them to (pseudo)random values.

The following settings have to be adapted temporarily to simulate a FritzBox 7270. These environment variables will be reset on the next reboot (unlike the changes in the urlader, btw.). The remote TR069 server is checking the product name and the software version (besides the previously defined tr069-credentials).

export CONFIG_PRODUKT_NAME="FRITZ!Box Fon WLAN 7270 v2"

export CONFIG_PRODUKT="Fritz_Box_7270_16"

export CONFIG_VERSION="06.05"

export CONFIG_SUBVERSION=""

export CONFIG_VERSION_MAJOR="54"

export EXTERNAL_BOX_PARAMS="hardware=${HWRevision}&oem=${OEM}&language=${Language}&country=&version=${CONFIG_VERSION_MAJOR}.${CONFIG_VERSION}&subversion=${CONFIG_SUBVERSION##*-}"

After that restart the network settings:

./rc.net start
    [...wait 10-20 seconds...]

Connect the FritzBox to the cable modem (via LAN1). After a while the FritzBox should fetch the CWMP/TR069 settings, including the telephone settings. This can be checked by entering:

 cat /var/flash/tr069.cfg
     [...should list tr069 settings...]
cat /var/flash/voip.cfg
    [...should list telephone settings...]

P.S. I recommend to disable the TR-069 auto-configuration settings if not needed. They theoretically poke a quite huge hole into the security of your router.