Reverse Engineering

I enjoy taking things apart since my early childhood. I’m glad I kept my curiosity…

KVM over IP Switch: Cross-vendor Firmware Upgrade via hidden Option adds VNC Server

/ Kai / 4 Comments

At work we have a KVM over IP switch from Inter-Tech, a KVM IP-KVM101. It is really a small and versatile device that, in combination with 16-port KVM switches, allows us to control a complete rack with test hardware.

The KVM switch provides a web interface with a Java Web Start application for remote access. But the latest browser security updates disabled and removed the Java Web Start support . This move was announced quite some time ago (Oracle White Paper). Still, the vendor of the KVM switch, Inter-Tech, was not able to provide a valuable solution to cope with this problem.

After a bit of Googling I found an Amazon review about this particular KVM switch where the reviewer stated to have installed the firmware from another brand, the LINDY KVM over IP Switch. The LINDY switch looks identical (besides a different sticker) and – even better – their latest firmware provides a VNC server. This would allow us a browser and even operating system independent access to the KVM.
Continue reading →

Fake (?) Sunon DP200A/Sunon DP201A fans

/ Kai / Leave a comment

Last weekend I had to replace a 230 V fan (120 mm), a Sunon DP200A, that ‘smelled’ strange and also made strange noises. Better safe than sorry…

Well: I ordered a slightly less powerful Sunon DP201A (at Reichelt Elektronik) to replace the possibly dangerous fan. Although they look similar their connectors are completely different. So I’m now wondering if the first one (the DP200A) wasn’t an original fan at all…?sunon-dp200a-dp201a-front

Sharp PC-1500/1600 ROM Dump Method 2: Desoldering the ROM Chips

/ Kai / 4 Comments

To make it clear from the beginning: this is a (possibly) destructive method of reading ROM chips. The process of extracting and possibly a resoldering of the memory chip might fail. In my case I’ve tested it on two Sharp CE-150 PCBs I’ve declared to be spare parts. It is only a proof of concept as there are simpler non-destructive ways of ROM extraction on a Sharp PC. I was just curious and so I’m describing my experiences.

Well… At first I did not want to desolder the ROMs: I started with the intention to use a set of probes attached to the individual pins of the chip to read the content of the Sharp PC / CE ROM chips. This did not work due to the narrow leg distance of the QFP chips (0.8 mm).

Probe Connection Problem

Desoldering QFP chips can be done rather quickly with a hot air gun. At least that’s the most comfortable way I know of. I usually add some flux and in some cases larger quantities of leaded solder. The latter decreases the melting point and speeds up the process. I don’t care about solder joints as the chips and the pads can easily be cleaned after the removal. Excessive amounts of solder can be removed with flux and a clean soldering iron tip.
Continue reading →

Sharp PC Audio Output (CMT-OUT) Simulation in LTspice

/ Kai / Leave a comment

This was a little test out of curiosity… I’m currently playing around with an amplifier circuit for the Sharp CE-150 audio output (CMT-OUT) and wanted to see if the signal I’m getting is already distorted when leaving my Sharp PC, or if my circuit and/or sound card is causing the distortions.

The CE-150 uses Frequency Shift Keying (FSK) to transfer binary data via audio signal (e.g. to a tape recorder). It sends four pulses of 1.27 kHz for a binary “0” and eight pulses of 2.54 kHz for a “1”.

Sharp CMT-OUT LTspice Schematic

To test the circuit I’ve taken the original design and simulated the circuit in LTspice (running under Linux with Wine). This tool allows the simulation of various analog (and digital) circuits – perfect for my test.

Sharp CMT-OUT LTspice Plot

Sharp CMT-OUT Audacity Plot

The result was – to be honest – pretty surprising for me. The upper screenshot shows the LTspice simulation of the output signal, the lower screenshot was taken from a WAV file in Audacity. I was not only able to simulate the circuit but also to use the resulting signals as a good approximation for my amplifier circuit (not shown). 🙂 One minor fix (also not shown) left was to adapt the transition time between a “0” and a “1” to better fit to the original curve.

Sharp PC-1500/1600 ROM Dump Method 1: Audio Transfer via CE-150 Extension

/ Kai / 6 Comments

In this post I’m describing a method which is widely used to Dump RAM and ROM images on Sharp PC-1500 and PC-1600 systems. This method is non-destructive and can be used on most Sharp PC ROMs and extension cards. It only requires a Sharp CE-150 extension, an audio cable, and a computer with a microphone input (i.e. sound card).

Besides a plotter, the CE-150 Color Graphic Printer also provides two audio interfaces (line-in and microphone output). These were (and still are) used to transfer code or data between Sharp PCs and tape recorders. Today, such recorders are mostly outdated but the method works nonetheless with sound cards. Software tools are freely available (e.g. pocket-tools) that allow the transformation of recorded audio files into binary dumps and even further into BASIC code.

Continue reading →