4

My girlfriend recently bought a product for her skin, its basically a mask with lights on the inside that runs a power cord similar to an auxiliary cord into an auxiliary port on a mini controller. It is only good for 30 uses, every time you turn it on, an lcd screen counts down til it hits 0, then you have to buy a new controller.

I find it extremely wasteful to buy a new plastic controller after 30 uses. My question is it possible to somehow connect this device to my laptop through the aux port or aux port extension and modify the code written on it.

I work as a web developer by trade, so I am no stranger to code. I just need to know how to connect it, read the code and compile the code, etc, to modify the counter or remove it.

It is ЯU 94v-0 mini controller (Yes, the R is backwards) enter image description here

enter image description here

Interestingly enough if I plug the mask into my iPhone or Mac, it will power one set of lights (there are two types/sets), but not the other.

Thanks in advance for the hackery advice.

Rishikesh Raje
  • 8,556
  • 2
  • 16
  • 31
NicholasByDesign
  • 781
  • 1
  • 11
  • 33

2 Answers2

2

I Have Better IDEA! Just buy new device (This device has an memory ATMLH436, which is basically same as AT24C02 eeprom chip), disconnect the WP pin and connect it only with the VCC pin, it then can't write the counter down (since it will be write protected), every time you pull the batteries out and in again, it will be as fresh as new. Should work like a charm :D

Here is the historical answer, maybe usefull to someone in the future:

How to hack instruction.

This device has an memory ATMLH436, which is basically same as AT24C02 eeprom chip, which is an EPROM with I2C interface, it is 2 KBytes memory. And the counter is most likely stored on this element.

You need to buy a new device, connect the not used eeprom to a i2c programator (you need to buy one, or ask a friend, I remeber this as a simple device connected to a rs232 port, but you can find one for usb), read the memory content and store it in a file and then you can use this file to reprogram the eprom to the original "new" state every time you want.

How to connect the i2c eeprom to mac:

hmmm, you need to have an i2c programator, that's first step. Check the one you're about to buy if it has a Macintosh compatible software for reading/ writing. If not, maybe use other computer.

remeber that in order to be able to program the device you need to connect the pin 7 (Write protect pin) to the ground. Here's the chip spec: http://www.atmel.com/Images/doc0180.pdf

Basically in oreder to communicate with the device you need:

know the address of the device - it is set by the A0,A1,and A2 pins connected either to ground or VCC - the programator soft will require that address.

connect the SDA, SCL and GND pins to the programator.

the chip need power supply of 5V connected beetween GND (-) and VCC (+) to operate.

In order to program the WP pin needs to be connected to GND.

There are big chances that: A0,A1,A2 and WP are grounded, but I can't be sure. In case of this scenario the address of the device is 1010000 and there's nothing left that needs to be done in oreder to program it. I assume if the WP pin is not grounded you can disconnect it from whatever it is connected to and hardwire it to ground - should not affect normal operation of the device. probably you don't need to unsolder the chip in order to be able to read/write it, you need to connect GND, SDA, SCL and VCC. I would make a connector for these 4 pins to have it accessible from ouside of the device.

In order to make my life easier for many reprogram cycles, I would solder some connector to not have to disssassemble the device each time I need to reprogram it.

There are small chances that the counter is in the fat black round dot on the PCB, in which case there's nothing you can do to reset it since it is some custom chip without spec - if you have a great lab with X-RAY machine (like https://www.hawkerrichardson.com.au/electronic-production-systems/inspection-test-a-repair/unicomp-ax-8200) and other such stuff + lot of experience you could :) but rather not many people have such toys since they are very expensive :)

There are some pins to connect to the rounded chip, but I don't have any idea how to use them, what's the protocol or anything...

but if they could produce eprom inside of it, they wouldn't probably use any additional external eeprom because of the costs. But since eeprom production is not so easy as the regular chip, they use rather external memory from other supplier rather that producing one by themself - it's one logical argument that the counter is there in the AT24C02.

Krzysztof Cichocki
  • 6,294
  • 1
  • 16
  • 32
  • I'll take your word for it and that sounds like a good solution, based on what I just read about EPROM and how memory is stored based on the info you gave me. Just one last thing, I am new to micro controllers. How would I go about connecting the eprom to my mac to read the memory content? I can not seem to find a resource on where to start. – NicholasByDesign Dec 12 '16 at 08:03
  • Arduino would be a good solution to use for dump / modify eeprom, you would need to solder to those pins of eeprom and connect them to your Arduino using I. E breadboard – koper89 Dec 12 '16 at 08:09
  • WP to Vcc didn't work, still counting down. Interesting part is that SDA and SLC are both grounded - you can see it on a picture. I am not interested in making this device work but rather curious how does it use this EEPROM. pins 1,2,3,4 - goes to main controller, ** 5,6 - shortcutted and grounded**. 7 - wan't connected anywhere, 8 - was on Vcc. – user2932688 Nov 23 '17 at 17:43
1

The correct way to hack this thing would be to listen to the I2C communication line with a scope. Note the exact binary sequence.

Then remove the external eeprom entirely and replace it with another MCU, which only has one task and that is to reply as the main MCU expects it to do. Though of course it never saves the down-counter.

Essentially you'd get this sequence each time you power up:

  • Main MCU: "Hello my eeprom, can I get the counter?"
  • Hack MCU: "Err yes I am totally an eeprom, the counter is 5."
  • Main MCU: "Store the counter value 6".
  • Hack MCU: "Roger that" (does nothing).

You'll get the same sequence over and over.

To succeed you need to know: microcontroller programming, I2C, basic electronics, soldering.

Lundin
  • 195,001
  • 40
  • 254
  • 396
  • I Have Better IDEA! Just buy new device (This device has an memory ATMLH436, which is basically same as AT24C02 eeprom chip), disconnect the WP pin and connect it only with the VCC pin, it then can't write the counter down (since it will be write protected), every time you pull the batteries out and in again, it will be as fresh as new. Should work like a charm :D – Krzysztof Cichocki Dec 12 '16 at 11:32
  • @Loundin There are some credits for you, without your post, I wouldn't remeber that WP-ing the chip will do exactly what you described, but with much less effort from the side of hacker :D Thanks a lot! – Krzysztof Cichocki Dec 12 '16 at 11:40
  • @KrzysztofCichocki The question is if the MCU does a read-back of the memory or not, to ensure it was properly programmed. – Lundin Dec 12 '16 at 11:56