<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Hacking With Gum &#187; POV</title>
	<atom:link href="http://hackingwithgum.com/tag/pov/feed/" rel="self" type="application/rss+xml" />
	<link>http://hackingwithgum.com</link>
	<description>A Hardware Hacking Blog</description>
	<lastBuildDate>Tue, 23 Mar 2010 00:47:02 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>Cenzic POV Fan Toolkit</title>
		<link>http://hackingwithgum.com/2009/10/08/cenzic-pov-fan-toolkit/</link>
		<comments>http://hackingwithgum.com/2009/10/08/cenzic-pov-fan-toolkit/#comments</comments>
		<pubDate>Fri, 09 Oct 2009 02:56:56 +0000</pubDate>
		<dc:creator>cheffner</dc:creator>
				<category><![CDATA[Hacks]]></category>
		<category><![CDATA[Tools]]></category>
		<category><![CDATA[Cenzic]]></category>
		<category><![CDATA[POV]]></category>
		<category><![CDATA[Python]]></category>

		<guid isPermaLink="false">http://hackingwithgum.com/?p=366</guid>
		<description><![CDATA[In order to make hacking my Cenzic POV fan easier, I created a small tool kit consisting of a couple of Python scripts to aid in the creation of character maps and EEPROM images for the fan. The first Python script, ascii2cenzic.py, was mentioned in my original article; you simply pass it the ASCII text [...]]]></description>
			<content:encoded><![CDATA[<p>In order to make hacking my <a href="http://hackingwithgum.com/2009/10/06/hacking-the-cenzic-pov-fan/">Cenzic POV fan</a> easier, I created a small <a href="http://hackingwithgum.com/wp-content/uploads/cenzic_pov_toolkit.zip">tool kit</a> consisting of a couple of Python scripts to aid in the creation of character maps and EEPROM images for the fan.</p>
<p>The first Python script, ascii2cenzic.py, was mentioned in my original article; you simply pass it the ASCII text that you want the fan to display, and it will generate the binary data that you need to load onto the fan&#8217;s EERPOM using <a href="http://www.lancos.com/prog.html">PonyProg</a>. It has been updated to support uppercase alpha numeric characters, some punctuation, and smiley and frowney faces.</p>
<p>If you want to display an image that the ascii2cenzic script doesn&#8217;t support, you have to figure out the necessary byte patterns. This can be time consuming, so the second script included in the tool kit is graph2hex.py. Graph2hex will take a 5&#215;7 character ASCII art image and generate the five byte sequence needed in order to display that image on the fan. There are two important notes regarding the use of this tool:</p>
<ol>
<li>The image MUST be 5&#215;7 characters, no more, no less</li>
<li>Zeros in the ASCII art image will be where the LEDs are turned on; anything else is considered &#8220;off&#8221;.</li>
</ol>
<p><span id="more-366"></span></p>
<p>There is also an example ASCII art image of a smiley face included in the zip file, example_graph.txt. Note that there are five columns, with seven rows each, no more, no less:</p>
<blockquote><pre>
11111
01110
11111
11011
11111
01110
10001
</pre>
</blockquote>
<p>To make the image clearer, you can replace all the 1&#8242;s with spaces. Be careful with this though, it&#8217;s easy to accidentally add extra white space and then you&#8217;ll be left wondering why graph2hex is throwing errors:</p>
<blockquote><pre>

0   0

  0  

0   0
 000
</pre>
</blockquote>
<p>Running graph2hex on this file produces the five byte sequence needed to properly display this image:</p>
<blockquote><p>c:>python graph2hex.py example_graph.txt<br />
0xBD,0x7F,0x6F,0x7F,0xBD</p></blockquote>
<p>Once you have these bytes, you can add an entry to the ascii_table dictionary in ascii2cenzic.py (note that the key in the dictionary must be ONE character):</p>
<blockquote><p>&#8230;<br />
&#8216;)&#8217; : [0xBD,0x7F,0x6F,0x7F,0xBD], #Close paren displays a smiley face<br />
&#8230;</p></blockquote>
<p>You can download the tool kit <a href="http://hackingwithgum.com/wp-content/uploads/cenzic_pov_toolkit.zip">here</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://hackingwithgum.com/2009/10/08/cenzic-pov-fan-toolkit/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Hacking The Cenzic POV Fan</title>
		<link>http://hackingwithgum.com/2009/10/06/hacking-the-cenzic-pov-fan/</link>
		<comments>http://hackingwithgum.com/2009/10/06/hacking-the-cenzic-pov-fan/#comments</comments>
		<pubDate>Wed, 07 Oct 2009 01:26:48 +0000</pubDate>
		<dc:creator>cheffner</dc:creator>
				<category><![CDATA[Hacks]]></category>
		<category><![CDATA[Black Hat]]></category>
		<category><![CDATA[Cenzic]]></category>
		<category><![CDATA[POV]]></category>

		<guid isPermaLink="false">http://hackingwithgum.com/?p=308</guid>
		<description><![CDATA[At Black Hat this year the Cenzic booth was giving away some portable personal fans, with a slight twist: these were persistence of vision fans. I&#8217;d only ever seen one other POV fan, and it wasn&#8217;t portable, so the Cenzic fan seemed like a prime candidate for hacking. Not having any prior experience with POV, [...]]]></description>
			<content:encoded><![CDATA[<p>At Black Hat this year the <a href="http://www.cenzic.com">Cenzic</a> booth was giving away some portable personal fans, with a slight twist: these were persistence of vision fans. I&#8217;d only ever seen one <a href="http://fascinations.com/unique-toys-gifts/fansee.htm">other</a> POV fan, and it wasn&#8217;t portable, so the Cenzic fan seemed like a prime candidate for hacking.</p>
<p>Not having any prior experience with POV, I started poking at things to see how it worked. It turns out that Cenzic made it very easy to access the fan&#8217;s EEPROM chip, and with a simple RS232-to-I2C interface you can re-write the EEPROM on this device to make it display whatever you like:</p>
<div id="hacked_cenzic_fan.flv"><a href="http://www.macromedia.com/go/getflashplayer">Get the Flash Player</a> to see this player.</div>
<p><script type="text/javascript">
var sd = new SWFObject('https://media.dreamhost.com/mediaplayer.swf','mpl','550','433','8');
sd.addParam('allowscriptaccess','always');
sd.addParam('allowfullscreen','true');
sd.addVariable('height','433');
sd.addVariable('width','550');
sd.addVariable('file','http://hackingwithgum.com/wp-content/uploads/2009/10/hacked_cenzic_fan.flv');
sd.write('hacked_cenzic_fan.flv');
</script></p>
<p><span id="more-308"></span></p>
<p>Disassembly was pretty simple, as all the plastic covers can be pried off with your fingers or a small screwdriver. The first step to taking the Cenzic fan apart was to gently pry up the small cover on the front of the fan:</p>
<div id="attachment_316" class="wp-caption aligncenter" style="width: 235px"><a href="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2496.JPG"><img class="size-medium wp-image-316" title="Cenzic POV Fan" src="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2496-225x300.jpg" alt="Cenzic POV Fan" width="225" height="300" /></a><p class="wp-caption-text">Cenzic POV Fan</p></div>
<div id="attachment_317" class="wp-caption aligncenter" style="width: 310px"><a href="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2498.JPG"><img class="size-medium wp-image-317" title="Header Cover Removed" src="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2498-300x225.jpg" alt="Header Cover Removed" width="300" height="225" /></a><p class="wp-caption-text">Header Cover Removed</p></div>
<p>This revealed a four pin header, which was very encouraging. Note that this is really all the disassembling you&#8217;ll need to do in order to re-program the EEPROM.</p>
<p>Next, prying off the plastic cap revealed the fan blades that double as a sheath for the LED strip:</p>
<div id="attachment_318" class="wp-caption aligncenter" style="width: 310px"><a href="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2499.JPG"><img class="size-medium wp-image-318" title="Fan Cap Removed" src="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2499-300x225.jpg" alt="Fan Cap Removed" width="300" height="225" /></a><p class="wp-caption-text">Fan Cap Removed</p></div>
<p>Prying off the cover below that allowed access to the circuit board:</p>
<div id="attachment_319" class="wp-caption aligncenter" style="width: 310px"><a href="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2501.JPG"><img class="size-medium wp-image-319" title="Fan Circuit Board" src="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2501-300x225.jpg" alt="Fan Circuit Board" width="300" height="225" /></a><p class="wp-caption-text">Fan Circuit Board</p></div>
<p>Here you can see the two springs that sit between the circuit board and fan body to supply power to the circuitry while the fan is spinning:</p>
<div id="attachment_320" class="wp-caption aligncenter" style="width: 310px"><a href="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2505.JPG"><img class="size-medium wp-image-320" title="Brush Springs" src="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2505-300x225.jpg" alt="Brush Springs" width="300" height="225" /></a><p class="wp-caption-text">Brush Springs</p></div>
<p>The hardware in the Cenzic fan is pretty sparse: an unknown controller (covered with epoxy), a few resistors and capacitors, and a single EEPROM chip located right next to the four pin header:</p>
<div id="attachment_321" class="wp-caption aligncenter" style="width: 310px"><a href="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2502.JPG"><img class="size-medium wp-image-321" title="A Closer View Of The Circuit Board" src="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2502-300x225.jpg" alt="A Closer View Of The Circuit Board" width="300" height="225" /></a><p class="wp-caption-text">Closer View Of The Circuit Board</p></div>
<p>The EEPROM chip is a 24C02N, which is a 2Kb I2C  EEPROM chip. The four pin header attaches to the 24C02, allowing it to be read from and re-written. The header pin out from bottom to top, as pictured above, is: GND, SDA, Vcc, SCL:</p>
<div id="attachment_330" class="wp-caption aligncenter" style="width: 310px"><a href="http://hackingwithgum.com/wp-content/uploads/2009/10/24c02n_header.jpg"><img class="size-medium wp-image-330" title="24C02 Header Pin Out" src="http://hackingwithgum.com/wp-content/uploads/2009/10/24c02n_header-300x300.jpg" alt="24C02 Header Pin Out" width="300" height="300" /></a><p class="wp-caption-text">24C02 Header Pin Out</p></div>
<p>In order to read and write to the EEPROM chip, a simple serial to I2C interface was required. I built the serial adapter circuit found on <a href="http://www.chiprecharge.com/hardeng.html">Chiprecharge.com</a>, which works nicely with <a href="http://www.lancos.com/prog.html">PonyProg</a>. This circuit drops the RS-232 voltage on the data and clock lines down to 5v via a pair of zener diodes, and provides 5v power to the EEPROM chip:</p>
<div class="wp-caption aligncenter" style="width: 534px"><a href="http://www.chiprecharge.com/hardeng.html"><img title="PonyProg EasyI2C Serial Interface" src="http://www.chiprecharge.com/images/siprogeng.jpg" alt="PonyProg EasyI2C Serial Interface" width="524" height="307" /></a><p class="wp-caption-text">PonyProg EasyI2C Serial Interface</p></div>
<p>Attaching the adapter to the fan&#8217;s four pin header allowed me to read out the contents of the EEPROM chip:</p>
<div id="attachment_322" class="wp-caption aligncenter" style="width: 310px"><a href="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2506.JPG"><img class="size-medium wp-image-322" title="Dumping The EEPROM" src="http://hackingwithgum.com/wp-content/uploads/2009/10/CIMG2506-300x225.jpg" alt="Dumping The EEPROM" width="300" height="225" /></a><p class="wp-caption-text">Dumping The EEPROM</p></div>
<div id="attachment_342" class="wp-caption aligncenter" style="width: 310px"><a href="http://hackingwithgum.com/wp-content/uploads/2009/10/original_cenzic_data_dump.jpg"><img src="http://hackingwithgum.com/wp-content/uploads/2009/10/original_cenzic_data_dump-300x126.jpg" alt="PonyProg Data Dump" title="PonyProg Data Dump" width="300" height="126" class="size-medium wp-image-342" /></a><p class="wp-caption-text">PonyProg Data Dump</p></div>
<p>And here&#8217;s what the above data displays on the POV fan:</p>
<p><script src="https://media.dreamhost.com/ufo.js" type="text/javascript"></script></p>
<p style="visibility: visible;" id="original_cenzic_fan.flv"><object data="https://media.dreamhost.com/mediaplayer.swf" type="application/x-shockwave-flash" height="433" width="550"><param value="#FFFFFF" name="bgcolor"><param value="file=http://hackingwithgum.com/wp-content/uploads/2009/10/original_cenzic_fan.flv&amp;#038;showdigits=true&amp;#038;autostart=false" name="flashvars"></object></p>
<p><script type="text/javascript"> var FO = { movie:"https://media.dreamhost.com/mediaplayer.swf",width:"550",height:"433",majorversion:"7",build:"0",bgcolor:"#FFFFFF", flashvars:"file=http://hackingwithgum.com/wp-content/uploads/2009/10/original_cenzic_fan.flv&#038;showdigits=true&#038;autostart=false" };UFO.create(FO,"original_cenzic_fan.flv");</script></p>
<p>The data dump obtained from the Cenzic fan may need some explanation. If you watched the above video, you saw that the original Cenzic message was broken into five parts:</p>
<ol>
<li>SECURE</li>
<li>YOUR</li>
<li>WEB APPS</li>
<li>WITH</li>
<li>CENZIC</li>
</ol>
<p>The first byte of data in the EEPROM tells the controller how many parts there are to the message (in this case, five, or 0&#215;05).</p>
<p>Following the 0&#215;05 is the byte 0&#215;06; this is the number of letters in the first part of the message (&#8220;SECURE&#8221;). Each part of the message is prefixed with its string length in bytes.</p>
<p>Each letter is displayed on a 5&#215;7 matrix, that is, there are 7 LEDs aligned vertically, and each letter gets 5 pulses as the LED array moves around in a circle (5 LEDs in width, 7 LEDs in height). </p>
<p>Each of the vertical LED patterns (5 per letter, since each letter is 5 LEDs in width) are describe by a single byte. The first part of the original message is &#8220;SECURE&#8221;, which is 6 characters long. Therefore, the size of the first part of the message when stored in EEPROM is 6 * 5 = 30 bytes. If we go to offset 0&#215;20 (which is the next byte after the 30 &#8220;SECURE&#8221; bytes), we see the number 4, which is the string length of the second part of the message (&#8220;YOUR&#8221;). The microcontroller reads these patterns from the EEPROM until all parts of the message have been displayed, at which point it starts the message over again.</p>
<p>Each byte in the message represents a vertical LED display pattern, with the high-order bit in each byte controlling the bottom LED, and the low-order bit controlling the top LED. A 1 indicates that the corresponding LED is off, while a 0 turns the LED on; however, there are only 7 LEDs, and 8 bits in each byte, so something has to give. The fourth lowest-order bit is ignored, and can be set to either a 1 or a 0 without affecting the resulting display.</p>
<p>Because the fan rotates in a counter-clockwise direction, the letters entered in the EEPROM are a mirror image of what will be displayed; that is, when displaying a message, the controller starts at the end of a message, and works its way backwards. So, the first five bytes in the first message tell the controller how to display the letter &#8220;E&#8221;, although if you visually mapped out the bit patterns for these five bytes, you would see that the &#8220;E&#8221; is actually backwards (again, it needs to be a mirror image of what should be displayed).</p>
<p>To help visualize this, take a look at how to display the letter &#8220;E&#8221;. First, map out a mirror image of the letter on a 5&#215;7 grid:</p>
<blockquote>
<pre>00000  &lt;- Low order bits
    0
    0
00000  &lt;- This row of bits will be ignored
00000
    0
    0
00000  &lt;- High order bits</pre>
</blockquote>
<p>Now, fill in everything else with 1&#8242;s:</p>
<blockquote>
<pre>00000  &lt;- Low order bits
11110
11110
00000  &lt;- This row of bits will be ignored
00000
11110
11110
00000  &lt;- High order bits</pre>
</blockquote>
<p>The resulting hex values for each column of bits is, from left to right:</p>
<blockquote><p>0&#215;66,0&#215;66,0&#215;66,0&#215;66,0&#215;00<br />&nbsp;</p></blockquote>
<p>And the resulting image that will be displayed by the fan is:</p>
<blockquote>
<pre>00000
0
0
00000
0
0
00000</pre>
</blockquote>
<p>In order to make it easier to load new text onto the Cenzic fan, I wrote a <a href="http://hackingwithgum.com/wp-content/uploads/2009/10/ascii2cenzic.txt">Python script</a> to translate ASCII text into a data dump that can be loaded into the fan&#8217;s EEPROM using PonyProg. Currently it only supports uppercase letters and smileys, but if you understand the above description, it&#8217;s easy enough to modify the script to produce any pattern you&#8217;d like. Usage is fairly straightforward; to generate a message that displays &#8220;Hello World&#8221;:</p>
<blockquote><p>C:\&gt;python ascii2cenzic.py hello world &gt; hello.bin<br />&nbsp;</p></blockquote>
<p>The resulting hello.bin file can then be opened with PonyProg and written to the EEPROM chip:</p>
<div id="attachment_344" class="wp-caption aligncenter" style="width: 305px"><a href="http://hackingwithgum.com/wp-content/uploads/2009/10/pony_prog_config.jpg"><img class="size-full wp-image-344" title="Configure PonyProg I/O Settings" src="http://hackingwithgum.com/wp-content/uploads/2009/10/pony_prog_config.jpg" alt="Configure PonyProg I/O Settings" width="295" height="292" /></a><p class="wp-caption-text">Configure PonyProg I/O Settings</p></div>
<div id="attachment_343" class="wp-caption aligncenter" style="width: 834px"><a href="http://hackingwithgum.com/wp-content/uploads/2009/10/writing_to_device_ponyprog.jpg"><img class="size-full wp-image-343" title="Write Data To EEPROM" src="http://hackingwithgum.com/wp-content/uploads/2009/10/writing_to_device_ponyprog.jpg" alt="Write Data To EEPROM" width="824" height="408" /></a><p class="wp-caption-text">Write Data To EEPROM</p></div>
]]></content:encoded>
			<wfw:commentRss>http://hackingwithgum.com/2009/10/06/hacking-the-cenzic-pov-fan/feed/</wfw:commentRss>
		<slash:comments>25</slash:comments>
		</item>
	</channel>
</rss>

