DEV Community: Raleigh Littles

Analyzing Super Nintendo World's Power-Up band

Raleigh Littles — Sat, 01 Apr 2023 04:50:47 +0000

Background context

Nintendo sells "Power-Up Band™" wristbands for use at their Super Mario World locations. These wristbands are used for keeping track of score information on different rides and games at their parks.

https://www.universalstudioshollywood.com/web/en/us/things-to-do/entertainment/key-challenges

About device

On the back, apart from the Nintendo logo is the text:

56674-P-300006-1022

QR code

The back of the wristband also has a QR code, used to pair the device to an account using the Nintendo app on a smartphone.

My band's QR code data is:

011101000000000000000590880000000000FF03

NFC data

The band uses NFC to communicate with rides at the park. Using a simple NFC reader and pcscd, we can read the data from it:

Fri Mar 31 20:16:52 2023
 Reader 0: ACS ACR122U 00 00
  Event number: 1
  Card state: Card inserted, 
  ATR: 3B 8F 80 01 80 4F 0C A0 00 00 03 06 03 00 03 00 00 00 00 68

ATR: 3B 8F 80 01 80 4F 0C A0 00 00 03 06 03 00 03 00 00 00 00 68
+ TS = 3B --> Direct Convention
+ T0 = 8F, Y(1): 1000, K: 15 (historical bytes)
  TD(1) = 80 --> Y(i+1) = 1000, Protocol T = 0 
-----
  TD(2) = 01 --> Y(i+1) = 0000, Protocol T = 1 
-----
+ Historical bytes: 80 4F 0C A0 00 00 03 06 03 00 03 00 00 00 00
  Category indicator byte: 80 (compact TLV data object)
    Tag: 4, len: F (initial access data)
      Initial access data: 0C A0 00 00 03 06 03 00 03 00 00 00 00
+ TCK = 68 (correct checksum)

Possibly identified card (using /home/raleigh/.cache/smartcard_list.txt):
3B 8F 80 01 80 4F 0C A0 00 00 03 06 03 00 03 00 00 00 00 68
3B 8F 80 01 80 4F 0C A0 00 00 03 06 .. 00 03 00 00 00 00 ..
    MIFARE Ultralight (as per PCSC std part3)
3B 8F 80 01 80 4F 0C A0 00 00 03 06 03 00 03 00 00 00 00 68
3B 8F 80 01 80 4F 0C A0 00 00 03 06 03 .. .. 00 00 00 00 ..
    RFID - ISO 14443 Type A Part 3 (as per PCSC std part3)
3B 8F 80 01 80 4F 0C A0 00 00 03 06 03 00 03 00 00 00 00 68
    RFID - ISO 14443 Type A - NXP Mifare Ultralight or UltralightC
    Tempmate S1 Data Logger (Other)
    https://www.tempmate.com/
    prepaid bus card (Transport)
    https://www.t-l.ch/abos-billets/billets/carte-prepayee

This output tells us that the wristband uses a MIFARE Ultralight NFC chip internally.

To read the data off the NFC chip, we'll use:nfc-mfultralighthttps://manpages.ubuntu.com/manpages/xenial/man1/nfc-mfultralight.1.html

NFC device: ACS / ACR122U PICC Interface opened
1 ISO14443A passive target(s) found:
    046b2eb2e81090
Using MIFARE Ultralight card with UID: 046b2eb2e81090
WARNING: Tag is EV1 or NTAG - PASSWORD may be required
NTAG Type: NTAG216 (888 user bytes)
Reading 231 pages |.......................................................................................................................................................................................................................................|
Done, 231 of 231 pages read (0 pages failed).
Writing data to file: mario.mfd ... Done.

Here's the raw output of my dumped file (mario.mfd):

046b2eb2e810900044000fe0f110ffeea50000009f9b3f450e8f58601127
c2a86618b59003bbf2fdec0e18525e6c85a5a7b3938a9ca7458bb0a3e7b2
5eb04cfe22c2fd282e588e0037476e6543cc263541bd6fbe00000003039b
ff02aabbccdd454741df649658422f4e4d304b3c3cc656eab11fe104c0ac
9d59ce7d426cb9e09345bdbe48ebe2702134d9d14f0c2a1c7242456822ce
6794c933af0064cfd8435b9c3e3361699f2cef194cea7b3207b2d00e8e56
0cdc2ed77eedd1b1ca6f7f443b3ea5fef403a12dc2686a385da30391e7fb
d8c8cee3491501130ea68fe71e99c6ef76025bdb28ccbd59e34596ca5315
2d91b2b6d9a357a3cfd186f1fe2c7663fc0b61834797bc4383627e7489ce
95596f326166afea5713923f4d6c7e6c6ec3e0de9412b657f6256b348e45
b74b1d7d8c6f4cbab0eabcaa4333fe5601864b7b25e7d8a4dd8423d13329
89579559ab7a692c24b2f49f3371a1c6ed5a60c5cb33c8f782d825f1a606
e598beb5e21f6881a1e63e025f9fd2f459934d442932ff12c988afdbb2a6
26164db2c2f1e0bbc68cc7aa75b512cd63202996b4c93239aaef62c24c91
092eb722ba55ceea486392b6c10c6723379c1654f7169d577cff3a8ac069
528579f38f17dfefee9bfda7b7afe575778d85c29eafc03ce53cf123372e
7fd5202a1a9acfa3177086555c2084206dfea3b437d559f1a73d18ddd648
287a33451541d6c9641e01000f00000000045f0000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000303131313031303030303030303030303030303030353930
383830303030303030303030464630330000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000
0000000001011f0000000004070000000000000000000000

And the formatted version via hexdump:

00000000  04 6b 2e b2 e8 10 90 00  44 00 0f e0 f1 10 ff ee  |.k......D.......|
00000010  a5 00 00 00 9f 9b 3f 45  0e 8f 58 60 11 27 c2 a8  |......?E..X`.'..|
00000020  66 18 b5 90 03 bb f2 fd  ec 0e 18 52 5e 6c 85 a5  |f..........R^l..|
00000030  a7 b3 93 8a 9c a7 45 8b  b0 a3 e7 b2 5e b0 4c fe  |......E.....^.L.|
00000040  22 c2 fd 28 2e 58 8e 00  37 47 6e 65 43 cc 26 35  |"..(.X..7GneC.&5|
00000050  41 bd 6f be 00 00 00 03  03 9b ff 02 aa bb cc dd  |A.o.............|
00000060  45 47 41 df 64 96 58 42  2f 4e 4d 30 4b 3c 3c c6  |EGA.d.XB/NM0K<<.|
00000070  56 ea b1 1f e1 04 c0 ac  9d 59 ce 7d 42 6c b9 e0  |V........Y.}Bl..|
00000080  93 45 bd be 48 eb e2 70  21 34 d9 d1 4f 0c 2a 1c  |.E..H..p!4..O.*.|
00000090  72 42 45 68 22 ce 67 94  c9 33 af 00 64 cf d8 43  |rBEh".g..3..d..C|
000000a0  5b 9c 3e 33 61 69 9f 2c  ef 19 4c ea 7b 32 07 b2  |[.>3ai.,..L.{2..|
000000b0  d0 0e 8e 56 0c dc 2e d7  7e ed d1 b1 ca 6f 7f 44  |...V....~....o.D|
000000c0  3b 3e a5 fe f4 03 a1 2d  c2 68 6a 38 5d a3 03 91  |;>.....-.hj8]...|
000000d0  e7 fb d8 c8 ce e3 49 15  01 13 0e a6 8f e7 1e 99  |......I.........|
000000e0  c6 ef 76 02 5b db 28 cc  bd 59 e3 45 96 ca 53 15  |..v.[.(..Y.E..S.|
000000f0  2d 91 b2 b6 d9 a3 57 a3  cf d1 86 f1 fe 2c 76 63  |-.....W......,vc|
00000100  fc 0b 61 83 47 97 bc 43  83 62 7e 74 89 ce 95 59  |..a.G..C.b~t...Y|
00000110  6f 32 61 66 af ea 57 13  92 3f 4d 6c 7e 6c 6e c3  |o2af..W..?Ml~ln.|
00000120  e0 de 94 12 b6 57 f6 25  6b 34 8e 45 b7 4b 1d 7d  |.....W.%k4.E.K.}|
00000130  8c 6f 4c ba b0 ea bc aa  43 33 fe 56 01 86 4b 7b  |.oL.....C3.V..K{|
00000140  25 e7 d8 a4 dd 84 23 d1  33 29 89 57 95 59 ab 7a  |%.....#.3).W.Y.z|
00000150  69 2c 24 b2 f4 9f 33 71  a1 c6 ed 5a 60 c5 cb 33  |i,$...3q...Z`..3|
00000160  c8 f7 82 d8 25 f1 a6 06  e5 98 be b5 e2 1f 68 81  |....%.........h.|
00000170  a1 e6 3e 02 5f 9f d2 f4  59 93 4d 44 29 32 ff 12  |..>._...Y.MD)2..|
00000180  c9 88 af db b2 a6 26 16  4d b2 c2 f1 e0 bb c6 8c  |......&.M.......|
00000190  c7 aa 75 b5 12 cd 63 20  29 96 b4 c9 32 39 aa ef  |..u...c )...29..|
000001a0  62 c2 4c 91 09 2e b7 22  ba 55 ce ea 48 63 92 b6  |b.L....".U..Hc..|
000001b0  c1 0c 67 23 37 9c 16 54  f7 16 9d 57 7c ff 3a 8a  |..g#7..T...W|.:.|
000001c0  c0 69 52 85 79 f3 8f 17  df ef ee 9b fd a7 b7 af  |.iR.y...........|
000001d0  e5 75 77 8d 85 c2 9e af  c0 3c e5 3c f1 23 37 2e  |.uw......<.<.#7.|
000001e0  7f d5 20 2a 1a 9a cf a3  17 70 86 55 5c 20 84 20  |.. *.....p.U\ . |
000001f0  6d fe a3 b4 37 d5 59 f1  a7 3d 18 dd d6 48 28 7a  |m...7.Y..=...H(z|
00000200  33 45 15 41 d6 c9 64 1e  01 00 0f 00 00 00 00 04  |3E.A..d.........|
00000210  5f 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |_...............|
00000220  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000240  30 31 31 31 30 31 30 30  30 30 30 30 30 30 30 30  |0111010000000000|
00000250  30 30 30 30 30 35 39 30  38 38 30 30 30 30 30 30  |0000059088000000|
00000260  30 30 30 30 46 46 30 33  00 00 00 00 00 00 00 00  |0000FF03........|
00000270  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000380  00 00 00 00 00 00 00 00  01 01 1f 00 00 00 00 04  |................|
00000390  07 00 00 00 00 00 00 00  00 00 00 00              |............|
0000039c

Things of note:

Based on this article, the serial numbers should be stored in the first 7 bytes, so our wristband's serial number is 04:6B:2E:B2:E8:10:90.
Starting at byte 0x240/576d, we see our QR code data from earlier.

Analyzing the 24 Hour Fitness QR Code format

Raleigh Littles — Sat, 21 Jan 2023 22:29:20 +0000

24 Hour Fitness, like most gyms, lets you sign in with a QR code -- this QR code is generated in their iOS app and is only valid for a few minutes.

I wanted to see if I could create a QR code without using the application.

QR Code format

The QR code format looks like this:

MBR01234567|1673568280102|4248F3FA-FDEE-478E-B23E-22C3286B2FA8

Member ID

The first part is your 8-digit member ID. This ID is assigned when you sign up for a membership.

Timestamp

The next part is a timestamp:

Using any epoch converter, we can see when this QR code was generated:

❔ Unknown ID ❔

The next part is where things get tricky - I don't know what this field actually is. It looks like it can be either some kind of hash or ID, but for what?

Format

This field consists of 32 hexadecimal digits, with 4 hyphens, for a total length of 36. The segment lengths are 8, 4, 4, 4, and 12.

Variation?

I checked this field across 10 days of QR codes, and it was the same every time. So if it does change, it's on an interval of larger than 10 days (maybe every month?), or, it doesn't change.

Hash?

Since the data portion is 32 characters long, and an MD5sum is also 32 characters long, my first idea was that it was an MD5sum of some kind. But, that begs the question, of what?

I tested the MD5sum of my membership ID and that didn't work, which makes sense, carrying both the membership ID and it's MD5sum wouldn't make much sense.

I also tried the MD5sum of my date of my birth, which didn't work.

Device identification?

My first thought was that this field somehow identifies the current device that you're using. This would mean that if you installed the 24 hour fitness app on another device and used that to generate a QR code, the devices would have different ID fields. I unfortunately don't have a second device to test that hypothesis with.

If this field is used for device identification, it begs the question of, how is the application able to uniquely identify your device?

For iOS at least, there's a specific UDID field.

However, my device UDID didn't match any part of this field, which rules out that possibility.

Analyzing the Assembly from Modern Warfare II campaign (2022)

Raleigh Littles — Sat, 22 Oct 2022 05:27:17 +0000

This was originally posted to the Modern Warfare II subreddit, but it was deleted by the moderators for being off-topic :(

Some of you probably noticed that the missile control computers -- where you got asked to read the first letter of the second row and first column, etc -- had Assembly code shown.

I wanted to actually check if the Assembly made sense and was valid or if it was just garbage (shout-out to /r/ItsAUnixSystem).

Here's my annotated version* of the Assembly shown in the last mission

    # Put the base/frame pointer onto the top of the stack
    PUSHL %EBP

    # Make the base pointer point to the address of the stack pointer
    MOVL %ESP, %EBP

    # Lower the stack pointer by exactly 4 bytes. On x86 the stack "grows" down,
    # so it has to be decremented to make room for additional variables.
    SUBL $0x4, %ESP

    # "Zero out" the memory at address 0x00A9'FF1C
    MOVL $0X0, 0x00A9FF1C

    # Sets up a comparison between: 
    # * the contents of memory address 0x00A9'FF1C
    # * 0x636 (1590 in decimal).
    CMPL $0x636, 0x00A9FF1C

    # In the previous instruction, we compared the two values
    # (the result of that comparison is stored in separate registers)
    # This instruction is saying, if 0x636 is less than the value stored at address 0x00A9'FF1C, 
    # then "jump to" (i.e. set the program counter) address 0x001C'011AC
    JLE 0x001C011AC

    # Finally, jump to memory address 0x001C011B8
    JMP 0x001C011B8

This looks like a valid snippet so far.

And the first example, which is from the "Dark Water" mission:

    PUSHL %EBP
    MOVL %ESP, %EBP

    # It's kind of odd that this is here, since it's basically a useless instruction.
    # Unless it was done intentionally to show that there's no local variables going to be used.
    SUBL $0x0, %ESP
    MOVL $0x8, 0x00A9FF1C
    CMPL $0x65, 0x00A9FF1C
    JLE 0x001C011AC
    JMP 0x001C011B8

This is very similar to the other snippet -- using the same instructions, just some different values. Seems to mostly check out. Good job Infinity Ward.

DISCLAIMER: I'm not an expert in x86 assembly.

Nexigo Iris Webcam Remote communication guide

Raleigh Littles — Wed, 05 Oct 2022 04:01:22 +0000

For use with Nexigo Iris 4K Webcam (N1000), ASIN: B0BDFF4WD7

https://www.amazon.com/gp/product/B0BDFF4WD7/

Scan Codes

(probed via ir-keytable)

POWER BUTTON

31480.978201: lirc protocol(nec): scancode = 0x481b
31480.978221: event type EV_MSC(0x04): scancode = 0x481b
31480.978221: event type EV_SYN(0x00).

HDMI video format (button 5)

31569.742325: lirc protocol(nec): scancode = 0x4820
31569.742329: event type EV_MSC(0x04): scancode = 0x4820
31569.742329: event type EV_SYN(0x00).
31569.822167: lirc protocol(nec): scancode = 0x4820 repeat
31569.822187: event type EV_MSC(0x04): scancode = 0x4820
31569.822187: event type EV_SYN(0x00).

Auto-Framing/Tracking (button 6)

31596.518149: lirc protocol(nec): scancode = 0x4822
31596.518167: event type EV_MSC(0x04): scancode = 0x4822
31596.518167: event type EV_SYN(0x00).
31596.594162: lirc protocol(nec): scancode = 0x4822 repeat
31596.594166: event type EV_MSC(0x04): scancode = 0x4822
31596.594166: event type EV_SYN(0x00).

Pip/Facial Enhancement Button (Button 7)

31696.819974: lirc protocol(nec): scancode = 0x4821
31696.819979: event type EV_MSC(0x04): scancode = 0x4821
31696.819979: event type EV_SYN(0x00).
31696.898185: lirc protocol(nec): scancode = 0x4821 repeat
31696.898203: event type EV_MSC(0x04): scancode = 0x4821
31696.898203: event type EV_SYN(0x00).

Zoom-

31731.802189: lirc protocol(nec): scancode = 0x4804
31731.802195: event type EV_MSC(0x04): scancode = 0x4804
31731.802195: event type EV_SYN(0x00).

Zoom+

31750.070193: lirc protocol(nec): scancode = 0x4800
31750.070212: event type EV_MSC(0x04): scancode = 0x4800
31750.070212: event type EV_SYN(0x00).

Arrow Up

31774.789925: lirc protocol(nec): scancode = 0x4805
31774.789931: event type EV_MSC(0x04): scancode = 0x4805
31774.789931: event type EV_SYN(0x00).
31774.866058: lirc protocol(nec): scancode = 0x4805 repeat
31774.866081: event type EV_MSC(0x04): scancode = 0x4805
31774.866081: event type EV_SYN(0x00).

Arrow Left

31792.989315: lirc protocol(nec): scancode = 0x4808
31792.989321: event type EV_MSC(0x04): scancode = 0x4808
31792.989321: event type EV_SYN(0x00).
31793.066183: lirc protocol(nec): scancode = 0x4808 repeat
31793.066189: event type EV_MSC(0x04): scancode = 0x4808
31793.066189: event type EV_SYN(0x00).

Arrow Right

31811.896996: lirc protocol(nec): scancode = 0x480a
31811.897001: event type EV_MSC(0x04): scancode = 0x480a
31811.897001: event type EV_SYN(0x00).
31811.974183: lirc protocol(nec): scancode = 0x480a repeat
31811.974188: event type EV_MSC(0x04): scancode = 0x480a
31811.974188: event type EV_SYN(0x00).

Arrow Down

31834.158809: lirc protocol(nec): scancode = 0x480d
31834.158814: event type EV_MSC(0x04): scancode = 0x480d
31834.158814: event type EV_SYN(0x00).
31834.238182: lirc protocol(nec): scancode = 0x480d repeat
31834.238187: event type EV_MSC(0x04): scancode = 0x480d
31834.238187: event type EV_SYN(0x00).

OSD Info/Home button (button 10)

31856.146183: lirc protocol(nec): scancode = 0x4809
31856.146201: event type EV_MSC(0x04): scancode = 0x4809
31856.146201: event type EV_SYN(0x00).

Preset/AI sensitivity button (button 11)

31890.666160: lirc protocol(nec): scancode = 0x480f
31890.666180: event type EV_MSC(0x04): scancode = 0x480f
31890.666180: event type EV_SYN(0x00).

Mute (button 12)

32155.217760: lirc protocol(nec): scancode = 0x4823
32155.217765: event type EV_MSC(0x04): scancode = 0x4823
32155.217765: event type EV_SYN(0x00).
32155.294156: lirc protocol(nec): scancode = 0x4823 repeat
32155.294161: event type EV_MSC(0x04): scancode = 0x4823
32155.294161: event type EV_SYN(0x00).

Backlight Compensation (button 13)

32185.362182: lirc protocol(nec): scancode = 0x4824
32185.362201: event type EV_MSC(0x04): scancode = 0x4824
32185.362201: event type EV_SYN(0x00).

Numpad: #1

32208.506180: lirc protocol(nec): scancode = 0x480c
32208.506187: event type EV_MSC(0x04): scancode = 0x480c
32208.506187: event type EV_SYN(0x00).

Numpad: #2

32228.606184: lirc protocol(nec): scancode = 0x4811
32228.606191: event type EV_MSC(0x04): scancode = 0x4811
32228.606191: event type EV_SYN(0x00).

Numpad: #3

32244.334191: lirc protocol(nec): scancode = 0x480e
32244.334209: event type EV_MSC(0x04): scancode = 0x480e
32244.334209: event type EV_SYN(0x00).

Numpad: #4

32259.654214: lirc protocol(nec): scancode = 0x4810
32259.654233: event type EV_MSC(0x04): scancode = 0x4810
32259.654233: event type EV_SYN(0x00).

Numpad: #5

32277.394109: lirc protocol(nec): scancode = 0x4815
32277.394115: event type EV_MSC(0x04): scancode = 0x4815
32277.394115: event type EV_SYN(0x00).

Numpad: #6

32295.966162: lirc protocol(nec): scancode = 0x4812
32295.966167: event type EV_MSC(0x04): scancode = 0x4812
32295.966167: event type EV_SYN(0x00).

Numpad: #7

32312.730186: lirc protocol(nec): scancode = 0x4814
32312.730192: event type EV_MSC(0x04): scancode = 0x4814
32312.730192: event type EV_SYN(0x00).

Numpad: #8

32333.400294: lirc protocol(nec): scancode = 0x4819
32333.400301: event type EV_MSC(0x04): scancode = 0x4819
32333.400301: event type EV_SYN(0x00).
32333.478174: lirc protocol(nec): scancode = 0x4819 repeat
32333.478179: event type EV_MSC(0x04): scancode = 0x4819
32333.478179: event type EV_SYN(0x00).

Numpad: #9

32346.958163: lirc protocol(nec): scancode = 0x4816
32346.958169: event type EV_MSC(0x04): scancode = 0x4816
32346.958169: event type EV_SYN(0x00).

Numpad: #0

32895.746183: lirc protocol(nec): scancode = 0x481d
32895.746188: event type EV_MSC(0x04): scancode = 0x481d
32895.746188: event type EV_SYN(0x00).

Asterisk (*)

32919.054163: lirc protocol(nec): scancode = 0x4818
32919.054169: event type EV_MSC(0x04): scancode = 0x4818
32919.054169: event type EV_SYN(0x00).

Number-sign/Pound key (#)

32967.257820: lirc protocol(nec): scancode = 0x481a
32967.257825: event type EV_MSC(0x04): scancode = 0x481a
32967.257825: event type EV_SYN(0x00).
32967.334093: lirc protocol(nec): scancode = 0x481a repeat
32967.334097: event type EV_MSC(0x04): scancode = 0x481a
32967.334097: event type EV_SYN(0x00).

ZJBox TV converter remote communication guide

Raleigh Littles — Mon, 01 Aug 2022 06:17:00 +0000

From ASIN: B07Z5RGLK6

Button scancode dump below captured via ir-keytable

STANDBY

385.606275: lirc protocol(necx): scancode = 0xbf59
385.606298: event type EV_MSC(0x04): scancode = 0xbf59
385.606298: event type EV_SYN(0x00).
385.685154: lirc protocol(necx): scancode = 0xbf59 repeat
385.685168: event type EV_MSC(0x04): scancode = 0xbf59
385.685168: event type EV_SYN(0x00).

AUTO SEARCH

562.607456: lirc protocol(necx): scancode = 0xbf58
562.607477: event type EV_MSC(0x04): scancode = 0xbf58
562.607477: event type EV_SYN(0x00).
562.685116: lirc protocol(necx): scancode = 0xbf58 repeat
562.685136: event type EV_MSC(0x04): scancode = 0xbf58
562.685136: event type EV_SYN(0x00).

GOTO

600.219850: lirc protocol(necx): scancode = 0xbf18
600.219872: event type EV_MSC(0x04): scancode = 0xbf18
600.219872: event type EV_SYN(0x00).
600.297180: lirc protocol(necx): scancode = 0xbf18 repeat
600.297202: event type EV_MSC(0x04): scancode = 0xbf18
600.297202: event type EV_SYN(0x00).

MUTE

626.195542: lirc protocol(necx): scancode = 0xbf19
626.195564: event type EV_MSC(0x04): scancode = 0xbf19
626.195564: event type EV_SYN(0x00).
626.273072: lirc protocol(necx): scancode = 0xbf19 repeat
626.273092: event type EV_MSC(0x04): scancode = 0xbf19
626.273092: event type EV_SYN(0x00).

EPG

645.086527: lirc protocol(necx): scancode = 0xbf4d
645.086550: event type EV_MSC(0x04): scancode = 0xbf4d
645.086550: event type EV_SYN(0x00).
645.169134: lirc protocol(necx): scancode = 0xbf4d repeat
645.169156: event type EV_MSC(0x04): scancode = 0xbf4d
645.169156: event type EV_SYN(0x00).

662.736869: lirc protocol(necx): scancode = 0xbf0e
662.736891: event type EV_MSC(0x04): scancode = 0xbf0e
662.736891: event type EV_SYN(0x00).
662.813140: lirc protocol(necx): scancode = 0xbf0e repeat
662.813149: event type EV_MSC(0x04): scancode = 0xbf0e
662.813149: event type EV_SYN(0x00).

PAGE+

679.450161: lirc protocol(necx): scancode = 0xbf0d
679.450169: event type EV_MSC(0x04): scancode = 0xbf0d
679.450169: event type EV_SYN(0x00).
679.529141: lirc protocol(necx): scancode = 0xbf0d repeat
679.529164: event type EV_MSC(0x04): scancode = 0xbf0d
679.529164: event type EV_SYN(0x00).

AUDIO

914.464842: lirc protocol(necx): scancode = 0xbf51
914.464864: event type EV_MSC(0x04): scancode = 0xbf51
914.464864: event type EV_SYN(0x00).
914.541108: lirc protocol(necx): scancode = 0xbf51 repeat
914.541132: event type EV_MSC(0x04): scancode = 0xbf51
914.541132: event type EV_SYN(0x00).

REC

950.420234: lirc protocol(necx): scancode = 0xbf12
950.420256: event type EV_MSC(0x04): scancode = 0xbf12
950.420256: event type EV_SYN(0x00).
950.497120: lirc protocol(necx): scancode = 0xbf12 repeat
950.497132: event type EV_MSC(0x04): scancode = 0xbf12
950.497132: event type EV_SYN(0x00).

PAGE-

969.252084: lirc protocol(necx): scancode = 0xbf11
969.252103: event type EV_MSC(0x04): scancode = 0xbf11
969.252103: event type EV_SYN(0x00).
969.329110: lirc protocol(necx): scancode = 0xbf11 repeat
969.329125: event type EV_MSC(0x04): scancode = 0xbf11
969.329125: event type EV_SYN(0x00).

1702.105577: lirc protocol(necx): scancode = 0xbf45
1702.105598: event type EV_MSC(0x04): scancode = 0xbf45
1702.105598: event type EV_SYN(0x00).
1702.185141: lirc protocol(necx): scancode = 0xbf45 repeat
1702.185151: event type EV_MSC(0x04): scancode = 0xbf45
1702.185151: event type EV_SYN(0x00).

CH+

1722.105147: lirc protocol(necx): scancode = 0xbf06
1722.105169: event type EV_MSC(0x04): scancode = 0xbf06
1722.105169: event type EV_SYN(0x00).

EXIT

1754.793117: lirc protocol(necx): scancode = 0xbf05
1754.793125: event type EV_MSC(0x04): scancode = 0xbf05
1754.793125: event type EV_SYN(0x00).

VOL-

1783.075211: lirc protocol(necx): scancode = 0xbf5a
1783.075217: event type EV_MSC(0x04): scancode = 0xbf5a
1783.075217: event type EV_SYN(0x00).
1783.153116: lirc protocol(necx): scancode = 0xbf5a repeat
1783.153136: event type EV_MSC(0x04): scancode = 0xbf5a
1783.153136: event type EV_SYN(0x00).

1802.260812: lirc protocol(necx): scancode = 0xbf1a
1802.260834: event type EV_MSC(0x04): scancode = 0xbf1a
1802.260834: event type EV_SYN(0x00).
1802.337121: lirc protocol(necx): scancode = 0xbf1a repeat
1802.337128: event type EV_MSC(0x04): scancode = 0xbf1a
1802.337128: event type EV_SYN(0x00).

VOL+

1825.826664: lirc protocol(necx): scancode = 0xbf1b
1825.826686: event type EV_MSC(0x04): scancode = 0xbf1b
1825.826686: event type EV_SYN(0x00).
1825.905121: lirc protocol(necx): scancode = 0xbf1b repeat
1825.905128: event type EV_MSC(0x04): scancode = 0xbf1b
1825.905128: event type EV_SYN(0x00).

FAV

1852.354350: lirc protocol(necx): scancode = 0xbf55
1852.354372: event type EV_MSC(0x04): scancode = 0xbf55
1852.354372: event type EV_SYN(0x00).
1852.433125: lirc protocol(necx): scancode = 0xbf55 repeat
1852.433145: event type EV_MSC(0x04): scancode = 0xbf55
1852.433145: event type EV_SYN(0x00).

CH-

1869.263786: lirc protocol(necx): scancode = 0xbf16
1869.263807: event type EV_MSC(0x04): scancode = 0xbf16
1869.263807: event type EV_SYN(0x00).
1869.341110: lirc protocol(necx): scancode = 0xbf16 repeat
1869.341117: event type EV_MSC(0x04): scancode = 0xbf16
1869.341117: event type EV_SYN(0x00).

TV/RADIO

1889.086846: lirc protocol(necx): scancode = 0xbf15
1889.086866: event type EV_MSC(0x04): scancode = 0xbf15
1889.086866: event type EV_SYN(0x00).
1889.169150: lirc protocol(necx): scancode = 0xbf15 repeat
1889.169169: event type EV_MSC(0x04): scancode = 0xbf15
1889.169169: event type EV_SYN(0x00).

DIGIT: 1

1909.041733: lirc protocol(necx): scancode = 0xbf52
1909.041752: event type EV_MSC(0x04): scancode = 0xbf52
1909.041752: event type EV_SYN(0x00).
1909.121110: lirc protocol(necx): scancode = 0xbf52 repeat
1909.121127: event type EV_MSC(0x04): scancode = 0xbf52
1909.121127: event type EV_SYN(0x00).

DIGIT: 2

1926.708765: lirc protocol(necx): scancode = 0xbf50
1926.708786: event type EV_MSC(0x04): scancode = 0xbf50
1926.708786: event type EV_SYN(0x00).
1926.785108: lirc protocol(necx): scancode = 0xbf50 repeat
1926.785122: event type EV_MSC(0x04): scancode = 0xbf50
1926.785122: event type EV_SYN(0x00).

DIGIT: 3

2209.224398: lirc protocol(necx): scancode = 0xbf10
2209.224417: event type EV_MSC(0x04): scancode = 0xbf10
2209.224417: event type EV_SYN(0x00).
2209.301108: lirc protocol(necx): scancode = 0xbf10 repeat
2209.301125: event type EV_MSC(0x04): scancode = 0xbf10
2209.301125: event type EV_SYN(0x00).

INFO

2231.529061: lirc protocol(necx): scancode = 0xbf13
2231.529086: event type EV_MSC(0x04): scancode = 0xbf13
2231.529086: event type EV_SYN(0x00).
2231.605140: lirc protocol(necx): scancode = 0xbf13 repeat
2231.605162: event type EV_MSC(0x04): scancode = 0xbf13
2231.605162: event type EV_SYN(0x00).

DIGIT: 4

2250.642133: lirc protocol(necx): scancode = 0xbf56
2250.642155: event type EV_MSC(0x04): scancode = 0xbf56
2250.642155: event type EV_SYN(0x00).
2250.721123: lirc protocol(necx): scancode = 0xbf56 repeat
2250.721143: event type EV_MSC(0x04): scancode = 0xbf56
2250.721143: event type EV_SYN(0x00).

DIGIT: 5

2269.372284: lirc protocol(necx): scancode = 0xbf54
2269.372305: event type EV_MSC(0x04): scancode = 0xbf54
2269.372305: event type EV_SYN(0x00).
2269.449135: lirc protocol(necx): scancode = 0xbf54 repeat
2269.449148: event type EV_MSC(0x04): scancode = 0xbf54
2269.449148: event type EV_SYN(0x00).

DIGIT: 6

2285.964257: lirc protocol(necx): scancode = 0xbf14
2285.964281: event type EV_MSC(0x04): scancode = 0xbf14
2285.964281: event type EV_SYN(0x00).
2286.041149: lirc protocol(necx): scancode = 0xbf14 repeat
2286.041170: event type EV_MSC(0x04): scancode = 0xbf14
2286.041170: event type EV_SYN(0x00).

UNDERSCORE

2300.343664: lirc protocol(necx): scancode = 0xbf17
2300.343683: event type EV_MSC(0x04): scancode = 0xbf17
2300.343683: event type EV_SYN(0x00).
2300.421166: lirc protocol(necx): scancode = 0xbf17 repeat
2300.421186: event type EV_MSC(0x04): scancode = 0xbf17
2300.421186: event type EV_SYN(0x00).

DIGIT: 7

2314.848627: lirc protocol(necx): scancode = 0xbf4e
2314.848649: event type EV_MSC(0x04): scancode = 0xbf4e
2314.848649: event type EV_SYN(0x00).
2314.925140: lirc protocol(necx): scancode = 0xbf4e repeat
2314.925160: event type EV_MSC(0x04): scancode = 0xbf4e
2314.925160: event type EV_SYN(0x00).

DIGIT: 8

2329.340661: lirc protocol(necx): scancode = 0xbf4c
2329.340680: event type EV_MSC(0x04): scancode = 0xbf4c
2329.340680: event type EV_SYN(0x00).
2329.421125: lirc protocol(necx): scancode = 0xbf4c repeat
2329.421140: event type EV_MSC(0x04): scancode = 0xbf4c
2329.421140: event type EV_SYN(0x00).

DIGIT: 9

2346.363575: lirc protocol(necx): scancode = 0xbf0c
2346.363579: event type EV_MSC(0x04): scancode = 0xbf0c
2346.363579: event type EV_SYN(0x00).
2346.441089: lirc protocol(necx): scancode = 0xbf0c repeat
2346.441106: event type EV_MSC(0x04): scancode = 0xbf0c
2346.441106: event type EV_SYN(0x00).

DIGIT: 0

2362.163338: lirc protocol(necx): scancode = 0xbf0f
2362.163360: event type EV_MSC(0x04): scancode = 0xbf0f
2362.163360: event type EV_SYN(0x00).
2362.241140: lirc protocol(necx): scancode = 0xbf0f repeat
2362.241161: event type EV_MSC(0x04): scancode = 0xbf0f
2362.241161: event type EV_SYN(0x00).

REV

2389.586492: lirc protocol(necx): scancode = 0xbf4a
2389.586515: event type EV_MSC(0x04): scancode = 0xbf4a
2389.586515: event type EV_SYN(0x00).
2389.665124: lirc protocol(necx): scancode = 0xbf4a repeat
2389.665140: event type EV_MSC(0x04): scancode = 0xbf4a
2389.665140: event type EV_SYN(0x00).

FWD

2403.819907: lirc protocol(necx): scancode = 0xbf48
2403.819929: event type EV_MSC(0x04): scancode = 0xbf48
2403.819929: event type EV_SYN(0x00).
2403.897159: lirc protocol(necx): scancode = 0xbf48 repeat
2403.897179: event type EV_MSC(0x04): scancode = 0xbf48
2403.897179: event type EV_SYN(0x00).

2418.657605: lirc protocol(necx): scancode = 0xbf08
2418.657624: event type EV_MSC(0x04): scancode = 0xbf08
2418.657624: event type EV_SYN(0x00).
2418.737122: lirc protocol(necx): scancode = 0xbf08 repeat
2418.737132: event type EV_MSC(0x04): scancode = 0xbf08
2418.737132: event type EV_SYN(0x00).

2455.686572: lirc protocol(necx): scancode = 0xbf0b
2455.686594: event type EV_MSC(0x04): scancode = 0xbf0b
2455.686594: event type EV_SYN(0x00).
2455.765130: lirc protocol(necx): scancode = 0xbf0b repeat
2455.765150: event type EV_MSC(0x04): scancode = 0xbf0b
2455.765150: event type EV_SYN(0x00).

PLAY (RED)

2472.939168: lirc protocol(necx): scancode = 0xbf42
2472.939190: event type EV_MSC(0x04): scancode = 0xbf42
2472.939190: event type EV_SYN(0x00).
2473.017155: lirc protocol(necx): scancode = 0xbf42 repeat
2473.017180: event type EV_MSC(0x04): scancode = 0xbf42
2473.017180: event type EV_SYN(0x00).

TIMESHIFT (GREEN)

2523.397132: lirc protocol(necx): scancode = 0xbf40
2523.397151: event type EV_MSC(0x04): scancode = 0xbf40
2523.397151: event type EV_SYN(0x00).
2523.465141: lirc protocol(necx): scancode = 0xbf40 repeat
2523.465148: event type EV_MSC(0x04): scancode = 0xbf40
2523.465148: event type EV_SYN(0x00).

STOP (YELLOW)

2552.000912: lirc protocol(necx): scancode = 0xbf00
2552.000932: event type EV_MSC(0x04): scancode = 0xbf00
2552.000932: event type EV_SYN(0x00).
2552.077107: lirc protocol(necx): scancode = 0xbf00 repeat
2552.077124: event type EV_MSC(0x04): scancode = 0xbf00
2552.077124: event type EV_SYN(0x00).

USB (BLUE)

2570.199084: lirc protocol(necx): scancode = 0xbf03
2570.199108: event type EV_MSC(0x04): scancode = 0xbf03
2570.199108: event type EV_SYN(0x00).
2570.281198: lirc protocol(necx): scancode = 0xbf03 repeat
2570.281204: event type EV_MSC(0x04): scancode = 0xbf03
2570.281204: event type EV_SYN(0x00).

Liftmaster 811LM teardown/programming instructions

Raleigh Littles — Thu, 23 Jun 2022 07:13:18 +0000

About

LiftMaster 811LM Encrypted DIP with Security+ 2.0 Technology Remote Control

ASIN: B0071EYRGG
FCC ID: HBW7471
IC: 2666A-7471

Teardown

Front

Back

Programming Instructions

Push blue button (SW4) to put into programming mode
Verify that yellow LED (SW5) lights up
Push black button (SW2) amount of times to toggle through frequencies

# of presses	Device Security Type
1	Security+ 2.0®
2	315 MHz DIP
3	390 MHz DIP

Verify that gate receivers responds (either via LED or by actual gate opening)
Push blue button again to exit programming mode
Verify yellow LED turns off

Teardown of Automatic OBD dongle

Raleigh Littles — Wed, 23 Dec 2020 01:27:36 +0000

Background

In January of 2019, I purchased an Automatic® car tracker. It was a simple piece of hardware that would connect to your car's on-board diagnostics (OBD) port, and was equipped with Bluetooth and LTE. I bought it mainly to be able to log my trips, as I wanted to get a picture on exactly how much I was driving.

Fast forward

This year, the company announced they were going out of business, and would shut down the service immediately.

https://www.theverge.com/2020/5/1/21244295/automatic-labs-vehicle-tracking-service-covid-19-pandemic-rebate-may-28th

Motivation

Once the service was shut down, I realized my $99 dongle basically became a paperweight. Or did it?

After all, I still had the hardware, I just don't have the infrastructure supporting it.

I wanted to see if there was a way to salvage this part and hopefully turn it into something useful again.

Goal

Before I can figure out a way to use this dongle, I first have to take it apart and figure out exactly what parts on it and how I can try to connect to it.

That's what this post exactly is -- a teardown. My goal in publishing this is that others who have this dongle can get the information they need on the part without having to physically open their unit.

Pieces

Connector

To start, let's examine the (back) of the OBD connector.

Remember that you're looking at this from the back view so:

Pin 1 is at the top right, Pin 8 at the top left
Pin 16 at the bottom right, Pin 9 at the bottom left

You'll also notice that there's 2 empty pins: pin #9 and #13.

If you search for the OBD pinout diagram online, you'll see that these 2 pins are labelled as 'vendor's choice' or something to that effect.

https://en.wikipedia.org/wiki/On-board_diagnostics#OBD-II_diagnostic_connector

Board

The OBD module itself has arranged horizontally, in 3 parts. Each of the images of the board provided has a number on it -- so when fully assembled, if you look at the board from the side:

1 < - top
6 < - bottom
5 < - top
3 < - bottom
4 < - top
2 < - bottom

(Just look at the pictures below and I promise it'll all make sense)

Bottom layer

Here's the bottom view of the bottom layer.

Here's the top view of the bottom layer.

We see that this PCB holds the "OBD sim board" on one side, and what looks to be the wireless radio on the other side.

We can lookup the IMEI given, on any number of IMEI databases to get some more information about it: https://www.imei.info/?imei=354421076447994

The IMEI lookup tells us the manufacturer is U-BLOX and the model is "SARA-U260", so armed with this information we can consult the datasheet to learn more about it.

https://www.digchip.com/datasheets/download_datasheet.php?id=8846450&part-number=SARA-U260-00S

It looks to be a standard, run-of-the-mill HSPA/GSM modem, not unlike what you would find in cell phones several years ago. The antenna connectors - ANT 801 and 802 - are housed on the other side of the board.

Middle layer

Here's the top view of the middle layer.

This piece is labelled "OBD IO board". This piece has a QR sticker with a marking underneath.

Here's the bottom view of the middle layer.

A lot of small parts, but sadly nothing really identifiable unfortunately.

Top layer

Here's the top view of the top layer.

This part is labelled "OBD main", but doesn't seem to offer much else in terms of information. There's a QR code, but the ID on it differs from the piece we saw in the middle layer only by one character (A vs B), meaning the sticker was probably only used during the assembly process.

Here's a closeup of it.

Here's the bottom view of the top layer.

One thing we see right away is that this part contains our flash chip -- a Macronix MX25L1606EZNI-12G.

According to Digikey, this is a 16 MB Flash SPI chip. https://www.digikey.com/en/products/detail/macronix/MX25L1606EZNI-12G/2744758

There's a couple of other parts on this side of the board, but the etching on them has been rubbed off to the point where it's basically illegible.