Close

8. A working firmware for the Attiny85

A project log for Reverse engineering wireless plugs

Attempt to control Nexa MYCR-1000 wireless plugs with Raspberry Pi

suikalesuikale 03/22/2022 at 15:570 Comments

The previous code I wrote worked perfectly fine if the Raspberry Pi would send just one byte containing critical information to the Attiny85. However you can just cram so little information to 8 bits. When trying to send two or more bytes everything failed, and it took me ages to figure out why. The short answer to this question is timings.

At first when the Attiny received data it had no way of knowing if it would receive 1 or more bytes. It would just cram everything it received into a FIFO buffer. But the write operation to that buffer was so slow that it would not keep up with the SPI bus. Data would get corrupted because the previous interrupt caused by the SPI write was not over when the new one would begin. This was the most infuriating part to debug without using GDB (yeah, I'll need to learn how to use that properly) only with just a logic analyser. To overcome this problem I had to lower the SPI frequency from 2MHz to 250 KHz.


Then I encountered another problem. The Attiny would start unloading the buffer before all the data was written to it. So then I had to learn about the hardware timers and how to use them to delay the buffer unloading operations a bit. At the moment the Attiny waits 0.13056 seconds before it looks into the buffer. (calculated with p * t * 1 / f, where prescaler = 1024, timer count = 4*255, frequency = 8000000). It works fine when receiving 1 to 5 bytes, but fails with more. So I'll need to find out a better way to trigger the interrupt that launches buffer handler.

But now the code works perfectly in this usecase. You can emulate all the 4^13 different remotes and hardcode in your bought remotes. All the devices, states and groups work as expected. Also while testing and pondering the logic behind my code I foud out that I made a mistake while pentesting the differences with Klik aan Klik uit and Nexa codes. The payloads sent by the remotes might be the same, but the timings differ so much that the KaKi code does not work with the Nexa devices without adjusting the timings.

Now I'll need to write a controller to send the necessary bytes from the Raspberry Pi side to the Attiny.

Discussions