Hacking The Cenzic POV Fan October 6, 2009

At Black Hat this year the Cenzic booth was giving away some portable personal fans, with a slight twist: these were persistence of vision fans. I’d only ever seen one other POV fan, and it wasn’t portable, so the Cenzic fan seemed like a prime candidate for hacking.

Not having any prior experience with POV, I started poking at things to see how it worked. It turns out that Cenzic made it very easy to access the fan’s EEPROM chip, and with a simple RS232-to-I2C interface you can re-write the EEPROM on this device to make it display whatever you like:

Get the Flash Player to see this player.

Disassembly was pretty simple, as all the plastic covers can be pried off with your fingers or a small screwdriver. The first step to taking the Cenzic fan apart was to gently pry up the small cover on the front of the fan:

Cenzic POV Fan

Cenzic POV Fan

Header Cover Removed

Header Cover Removed

This revealed a four pin header, which was very encouraging. Note that this is really all the disassembling you’ll need to do in order to re-program the EEPROM.

Next, prying off the plastic cap revealed the fan blades that double as a sheath for the LED strip:

Fan Cap Removed

Fan Cap Removed

Prying off the cover below that allowed access to the circuit board:

Fan Circuit Board

Fan Circuit Board

Here you can see the two springs that sit between the circuit board and fan body to supply power to the circuitry while the fan is spinning:

Brush Springs

Brush Springs

The hardware in the Cenzic fan is pretty sparse: an unknown controller (covered with epoxy), a few resistors and capacitors, and a single EEPROM chip located right next to the four pin header:

A Closer View Of The Circuit Board

Closer View Of The Circuit Board

The EEPROM chip is a 24C02N, which is a 2Kb I2C EEPROM chip. The four pin header attaches to the 24C02, allowing it to be read from and re-written. The header pin out from bottom to top, as pictured above, is: GND, SDA, Vcc, SCL:

24C02 Header Pin Out

24C02 Header Pin Out

In order to read and write to the EEPROM chip, a simple serial to I2C interface was required. I built the serial adapter circuit found on Chiprecharge.com, which works nicely with PonyProg. This circuit drops the RS-232 voltage on the data and clock lines down to 5v via a pair of zener diodes, and provides 5v power to the EEPROM chip:

PonyProg EasyI2C Serial Interface

PonyProg EasyI2C Serial Interface

Attaching the adapter to the fan’s four pin header allowed me to read out the contents of the EEPROM chip:

Dumping The EEPROM

Dumping The EEPROM

PonyProg Data Dump

PonyProg Data Dump

And here’s what the above data displays on the POV fan:

The data dump obtained from the Cenzic fan may need some explanation. If you watched the above video, you saw that the original Cenzic message was broken into five parts:

  1. SECURE
  2. YOUR
  3. WEB APPS
  4. WITH
  5. CENZIC

The first byte of data in the EEPROM tells the controller how many parts there are to the message (in this case, five, or 0×05).

Following the 0×05 is the byte 0×06; this is the number of letters in the first part of the message (“SECURE”). Each part of the message is prefixed with its string length in bytes.

Each letter is displayed on a 5×7 matrix, that is, there are 7 LEDs aligned vertically, and each letter gets 5 pulses as the LED array moves around in a circle (5 LEDs in width, 7 LEDs in height).

Each of the vertical LED patterns (5 per letter, since each letter is 5 LEDs in width) are describe by a single byte. The first part of the original message is “SECURE”, which is 6 characters long. Therefore, the size of the first part of the message when stored in EEPROM is 6 * 5 = 30 bytes. If we go to offset 0×20 (which is the next byte after the 30 “SECURE” bytes), we see the number 4, which is the string length of the second part of the message (“YOUR”). The microcontroller reads these patterns from the EEPROM until all parts of the message have been displayed, at which point it starts the message over again.

Each byte in the message represents a vertical LED display pattern, with the high-order bit in each byte controlling the bottom LED, and the low-order bit controlling the top LED. A 1 indicates that the corresponding LED is off, while a 0 turns the LED on; however, there are only 7 LEDs, and 8 bits in each byte, so something has to give. The fourth lowest-order bit is ignored, and can be set to either a 1 or a 0 without affecting the resulting display.

Because the fan rotates in a counter-clockwise direction, the letters entered in the EEPROM are a mirror image of what will be displayed; that is, when displaying a message, the controller starts at the end of a message, and works its way backwards. So, the first five bytes in the first message tell the controller how to display the letter “E”, although if you visually mapped out the bit patterns for these five bytes, you would see that the “E” is actually backwards (again, it needs to be a mirror image of what should be displayed).

To help visualize this, take a look at how to display the letter “E”. First, map out a mirror image of the letter on a 5×7 grid:

00000  <- Low order bits
    0
    0
00000  <- This row of bits will be ignored
00000
    0
    0
00000  <- High order bits

Now, fill in everything else with 1′s:

00000  <- Low order bits
11110
11110
00000  <- This row of bits will be ignored
00000
11110
11110
00000  <- High order bits

The resulting hex values for each column of bits is, from left to right:

0×66,0×66,0×66,0×66,0×00
 

And the resulting image that will be displayed by the fan is:

00000
0
0
00000
0
0
00000

In order to make it easier to load new text onto the Cenzic fan, I wrote a Python script to translate ASCII text into a data dump that can be loaded into the fan’s EEPROM using PonyProg. Currently it only supports uppercase letters and smileys, but if you understand the above description, it’s easy enough to modify the script to produce any pattern you’d like. Usage is fairly straightforward; to generate a message that displays “Hello World”:

C:\>python ascii2cenzic.py hello world > hello.bin
 

The resulting hello.bin file can then be opened with PonyProg and written to the EEPROM chip:

Configure PonyProg I/O Settings

Configure PonyProg I/O Settings

Write Data To EEPROM

Write Data To EEPROM

19 Comments
Erin Swanson October 7th, 2009

Thanks for showing our fan and we loved your hacking tips! We’ll be summarizing all your hard work on our blog with links back to your site.

Craig October 7th, 2009

Thanks Erin! It was definitely the best schwag at BlackHat this year, glad I snagged one!

[...] order to make hacking my Cenzic POV fan easier, I created a small tool kit consisting of a couple of Python scripts to aid in the creation [...]

[...] fan-based POV display we’ve seen but it’s still a fun device to tinker with. They hacked into the EEPROM on the device in order to change the message the fan [...]

[...] fan-based POV display we’ve seen but it’s still a fun device to tinker with. They hacked into the EEPROM on the device in order to change the message the fan [...]

Jelle October 11th, 2009

maybe this fan will be hackable too: http://www.dealextreme.com/details.dx/sku.29154 ? It is not really clear if the header cover is there too, but I just hope the mechanism is the same. I’ll see, I ordered one.

Craig October 11th, 2009

Jelle,

Nice find! Those do in fact look exactly like the Cenzic fans. Cenzic actually gets the fans from a third-party supplier (http://nadel.com/); the fans are cheap, but the minimum order there is 250. I would expect that the fans from Deal Extreme come from the same supplier, and at $3.99 with free shipping, they look like a good deal!

Jelle October 26th, 2009

I just got my fan today from DX, and unfortunately it is not quite the same. There is not header on the pcb, and no separate flash. it is unclear to me how these units are programmed; there are some blank pads on the pcb, maybe they provide the i2c interface. An alternative might be that they are programmed before the board is soldered, but that might be a problem with low volume orders.

Craig October 28th, 2009

Jelle,

That’s a bummer! Would it be possible to post some pictures of the DX fan PCBs? I’d be interested to have a quick look-see.

Also if you really want one, I do have an extra Cenzic fan that I could send you – if you’re interested, drop me an email (https://hackingwithgum.com/contact/).

Brian November 1st, 2009

I’m getting one of those Dealextreme fans. I got a question. How am I suppose to use python? I’m new to it and was stuck in visual basic for a programming course.

Craig November 1st, 2009

Brian,

I assume that you’re running Windows, so you’ll need to download and install the Python interpreter for Windows ( http://www.activestate.com/activepython/ ). The python scripts need to be run from the command line, so open up a command prompt, cd to the directory where you saved the scripts, and run them from there. That should be all there is to it!

Boomer November 23rd, 2009

I have another chinese fan that doesn’t have the header of outside eeprom. Its a Boss/Roland one I got at the NAMM show a few years ago. has anyone made any progress with this one? I can make a scan for anyone interested. there are 15 pads on one side so guessing is going to take a loooong time. there are no unpopulated pads besides that.

I wish that epoxy-ing your ICs was illegal :)

[...] Full story, tutorial and videos at https://hackingwithgum.com/2009/10/06/hacking-the-cenzic-pov-fan/ [...]

JJ June 9th, 2010

Thanks for the tutorial. It was a great starting point for hacking a similar product.

Michael July 22nd, 2010

My work is now handing this out at trade shows, however at the cap, there is a small piece that removes to expose a small 5 pin port

http://i18.photobucket.com/albums/b109/ursusblue/IMAG0047.jpg

Orlando Kaigle March 4th, 2011

Nice post. I was checking continuously this blog and I’m impressed! Extremely helpful info specifically the last part :) I care for such information much. I was seeking this certain information for a long time. Thank you and good luck.

Ruth Ranck March 14th, 2011

maintain at it man, your nearly there , thanks for the read!

Michael H. March 14th, 2011

Anyone try to program the 5 pin port version? The basic 4 pins are still there but arranged differently. The 5th pin goes to pin 1 of the IC. The reference to the pin is PA0. I have not gone any further in trying to data dump.

Michael H. March 14th, 2011

Tried dumping data with the USB to I2C adaptor but come to find out Pony cant see the USB port. Anyone know how to assign my USB port to look like a COM port?

Leave a Reply