GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | ||||||||||||||||||||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | ||||||||||||||||||||||||||||||||||||||||||||
GeezerVison is showing lincomatic.com — Getting your CueCat declawed I liked mine so much, it's been laying on my floor since I plugged
it in.
(Want to set up a mirror of this site? Grab this file: cuecat.zip)
Picked up a CueCat barcode scanner at RatShack ("You've got questions. We've got blank stares.") yesterday along with a few other odds 'n' ends. If the store actually carried the stuff in their commercial sales catalog, I'd be a happy camper - I don't need an animated Elvis Presley phone, I need a local source of microcontrollers and specialized ICs. But I digress... One of the things that has a few people worried is that the clerk at
Radio Shack takes down your name and address in their system before giving
you your CueCat. However, there doesn't appear to be a way of tying
a particular CueCat to a person at the time of purchase (although Digital
Convergence most likely can trace a CueCat back to a particular Radio Shack).
Although each CueCat has a unique serial identifier, each CueCat package
has the exact same barcode on the front (which is what the clerk scans
in). My goal was to find where that serial identifier lurks inside
the CueCat....
Opened up the package (threw away the software, natch - looks like it's available here, anyway) and immediately began to open up the scanner.
And here are two pics of the board with the shield carefully removed
(and the serial EEPROM forcefully removed :-)
semiconductor devices:
The component that caught my eye was this small 8-pin device (U1) on the top side of the board:
The scan doesn't really show the markings at all, but it's an ATC 93LC46, which is a 1kbit serial EEPROM. Unfortunately, ATC doesn't have datasheets for the device available on their page. Not to worry, as other manufacturers have 93LC46s available, such as Microchip and Holtek. The datasheet for Holtek's HT93LC46 is located here, and it's a closer match than the Microchip unit, as it implements an ORG pin to control how the memory is accessed (in the above picture, the ORG pin is tied to VSS - this would make the unit addressable by 128 8-bit words if it was actually a Holtek 93LC46, but the ATC unit appears to be setup the opposite way - more on this later...). A sharp-eyed [email protected] commented "Looking at the board pads near the EEPROM it appears they are used during the final test to program in the serial number. In cuecat2b.jpg the pads to the right show small indentations as though probes had been used to power-up the board and program it during final test." The first thing I tried was removing the 93LC46 from the board. However, I'm really not equipped to desolder SMT devices, so this was rather futile. So I simply soldered some wirewrap wire onto the pins to see what's going on. I hooked my trusty scope up to them and found that the data is read out of the 93LC46 only on powerup of the CueCat (about 100ms after powerup, to be exact). After this, I tried hooking up the 93LC46 to a PIC microcontroller (with a little bit of code that I whipped up) to see what lurks inside the serial EEPROM. Unfortunately, I managed to wipe the contents of the EEPROM (looks like it reads back all locations as 0xFF now). Oh well, at least I don't have that pesky serial number in there anymore. :-) Unfortunately, hooking up a microcontroller to erase the EEPROM is a little out of range for your average privacy-concerned individual. I'm guessing it should be possible to disable the serial number by cutting the CLK line to the EEPROM, which should be easy for anyone with a keen eye and a sharp X-acto knife. I'll have to wait until I get another CueCat before investigating what's inside the EEPROM. In the meantime, I've been looking to find exactly what EEPROM data areas are being scanned. WIth my trusty Tek TDS 210, I took a closer look at the CS (chip select), SK (clock) and DI (data input) lines. For those interested, the 93LC46 is an SPI (Serial Peripheral Interface) device - it uses a synchronous serial line to transfer data (your computer's serial port is asynchronous and doesn't use a separate clock line). The CS line is used to tell that particular chip that it's being talked to, otherwise it will ignore data being sent to it. Anyhow, the 93LC46 is sent a total of 9 commands (they are all read
commands, but more on this later). The CS line goes high a total
of 9 times (the first CS 'pulse' is extremely long, as the CS line goes
high as soon as the CueCat is powerd on), and I used this as a baseline
to see what was happening on the SK clock line (since my scope has only
2 channels, I can't look at every pin at once). I noted that there
were 27 clock pulses during each CS 'pulse', and I could see a gap between
clock pulses where the CS line went high-low-high. So I hooked up
the SK and DI lines to the scope and took a look at exactly what bits were
being sent:
OK, now the first thing to note is that the leading 0 is basically garbage,
as the first 1 is really a start bit (and not yet the beginning of a command).
Also, the trailing 1s aren't really bits sent to the EEPROM - these are
clock pulses provided for the EEPROM to write out its data on the DO line.
So what we really have is a command like this:
So, the microcontroller reads in a total of 9 16-bit words from addresses 0x01 through 0x09 (I have no idea why they didn't start at 0x00). Note that in this sample scan .C3nZC3nZC3nYCNr2C3fWCNnY.fHmc.C3DZCxPWCNzWDNnX.
that the serial ID field is 18 characters long (or 9 16-bit words). I wonder if they're hiding anything nifty in the other 55 words? And why did they use a serial EEPROM? I would think that something like Dallas Semiconductor's silicon serial number would be a smaller, cheaper, totally non-volatile alternative, but maybe this gives DC better control over assigning IDs (perhaps there's a 'special' bar code that can be scanned in to rewrite the EEPROM?). I'm glad they used a 93LC46, though - you can desolder them and use them for other stuff... Anyhow, I'm now itching to try disabling the serial ID by cutting one of the traces to the 93LC46 - I don't have a virgin CueCat to try it on, but if anyone wants to give it a shot, cutting any of the traces as shown by the yellow 'cuts' in this photo should disable the serial number (or give floating voltages to really whack out what the microcontroller is reading back - you may even be able to get some 'random' serial numbers generated in this way).
Cuts from top to bottom disable the DI (data in), SK (clock), and CS (chip select).
Or, you can slice this line by the microcontroller to sever the DO (data out) line (I'd be inclined to try this one myself - the floating voltages could be fun here). Remember - you should only need to cut only one line to disable the serial ID - take your pick. Thanks to [email protected] for verifying this technique: " I just de-soldered the DO line(pin 4) of the 98LC46 (left it floating) on my 68-1965 CueCat and it worked great. Instead of getting the serial number, It returns garbage: .VlY8VlY8VlY8VlY8VlY8VlY8.fHmc.C3DWCNnZDhzXCNf0. Seems to be constant. They probably have the line pulled either high or low inside the Hyundai chip."
Picked up another CueCat last night - this one is the 68-1965-A model (supposedly more common) rather than the 68-1965 which is shown above. I'll be tearing apart this one later and posting the innards. How can you tell the difference? The A model has 4 small screws holding it together, the older one has two larger screws. The A has a small grommet for the wire on the cat's butt, and a large black square for the scanning window rather than the smaller rectangular opening on the 68-1965. But I'll let the pictures do the talking:
And now for the fun stuff...
Removing the metal shield from the board is easy - you simply need to desolder 4 different tabs on the plates (desoldering braid works very well for this). You'll note that the components on the model A have been simplified significantly - there is no more clear plastic lightpipe, the receptor appears to be a much more robust unit, the shielding is much more suited to large production runs (machine-insertable and solderable), there are fewer chips, and the board size has been reduced - certainly a more economical unit to produce. So, what makes the model A tick? U1: Toshiba TMP87PH47U (OTP
microcontroller)
Strangely, there are no manufacturer markings on chip U5, and I can find no references to a '93C4' semiconductor anywhere.
Despite the lack of clues based on the chip markings, I have a feeling that this is a serial EEPROM like the 93LC46 used in the earlier model CueCat, given that
Also, [email protected] pointed me to a very nice site to find chip data: http://www.hitex.com/chipdir/ Well, let's see if we can in fact disable the serial ID by slicing an appropriate line. I took a virgin model A (thanks Bill) and first scanned in a barcode to see what the normal output would be: .C3nZC3nZC3nZCNbZDhf7C3nX.fHmc.C3DZCxPWCNzWDNnX.
After this, I cracked it open and decided to chop the DO line as such:
Swiping the unit over the same barcode now yielded: .BM5UBM5UBM5UBM5UBM5UBM5U.fHmc.C3DZCxPWCNzWDNnX.
Aw, poop. It seems this works a little too well. Or does it? I then ran the output through the great Larry Wall's frighteningly compact perl decoder (which he calls the 'tattooable version'): #!/usr/bin/perl -n
and got this: .BM5UBM5UBM5UBM5UBM5UBM5U.fHmc.C3DZCxPWCNzWDNnX.
Success! Apparently the 'validity' of the serial number is entirely dependent on how the particular decoder program processes the encoded string. (As a note, Michael Rothwell's latest decoder, FooCat v0.1.2 now processes a 'declawed' CueCat string without error) So, what's next? Well, I'll be working on adding a button to turn
on the unit (thus conserving power for laptop/portable users), I'll add
in an enable/disable switch for the serial ID, and I'll be checking the
total power draw of the unit (to see if it will work with this little gizmo:
Happy
Hacking Cradle) So stay tuned!
Although I have yet to get one myself, it seems that many of you have a slightly different 'A' model with the microcontroller encased in an epoxy blob rather than as a standard SMT device. Ben Winslow offers the following detailed information on this model: "There's another cuecat model amongst the world as well as the two you have on the dissection page. Though the part number is still 68-1965-A, the sticker on the bottom reads '06A000' in purple ink. It bears a great similarity to the 05A00, though there are some notable differences. The top of the unit has two more capacitors: one to the right of the potentiometer (which I recently discovered from a barcode mailing list controls scanning speed), and one to the write of the crystal. The circuit board says (HM+H Rev 1.1) with 016-000370-10208 beneath that, and the crystal says 'S24.000' (which I assume is 4mhz prefixed by a part #). Etched on the board on the bottom (below the shielding) is "MB-BR338HM R1.1" The backside is also quite similar, though the CPU appears to be custom now and is encased in a blob of epoxy. The rest of the back and front appear to be the same (same chips as well), though I don't have my soldering iron handy so I can't check beneath the shield. The only other difference I noticed with that the circuit board that provides power to the LEDs has "2300" instead of "1700" on it. Everything else appears to be the same." Ben followed up with a claification on the potentiometer: "By the
by, the current conclusion on the potentiometer is that it controls the
gain (which affects the scanning speed in some cases...)"
Well, I've gotten over 4000 hits on the page so far, and now there's even a link on Linux Weekly News! Talk about exceeding all of my expectations! Stephen Satchell pointed me to his excellent site where he actually dissects the CueCat barcode 'Cue' itself. If you're wondering how the information is actually encoded in a bar code, check it out: http://www.fluent-access.com/wtpapers/cuecat/index.html [email protected] sends this rather ironic discovery:
[email protected] pointed out a page showing how to (re)program a 93c[456]6 serial EEPROM using only your parallel port: http://www.unix.cslab.tuwien.ac.at/~ackerman/faz_eep.htm Now you can change your CueCat serial ID to whatever you want! And David Forbes notes that DC's EULA (http://www.digitalconvergence.com/ula.html) not only states that the CueCat is only 'on loan' to the user, but also that "you may not reverse engineer, disassemble, modify, rent, lease, loan, sublicense, or distribute the :CueCat reader". Oops. In addition, I'm supposed to notify DC "of any information derived from reverse engineering or such other activities, and the results thereof will constitute the confidential information of Digital:Convergence that may be used only in connection with the Software and :CueCat reader". Well, here's your notification, I guess. "Your rights under this License will terminate automatically without notice from Digital :Convergence if you fail to comply with any term(s) of this License". I had rights? Really? How very nice of them! Since my rights are now terminated, I guess they'll be knocking on my door any day now to get their stuff back... Finally, I've had several inquiries as to how much it actually costs
DC to produce a CueCat. I honestly don't know enough about large-scale
electronics production to hazard a guess (though I've heard guesses of
around $5 ea.). If anyone has some actual cost data or thoughtful
estimates, I'd be interested to hear it!
And now for some more hardware info:
Note that the blue and yellow wires don't connect to anything on the mini-DIN connector (though there are traces on the circuit board that go to these pins). I chopped the red power line on my model 'A' and hooked up my multimeter
inline with the unit and found that it draws only 22.5 mA - looks like
the Happy Hacking
Cradle will work quite nicely after all! Anybody out there have
one for their Palm? I figure this is a solution just waiting to find
the right niche... (Inventory? Grocery shopping?)
Now over 5000 hits and growing! I managed to get a copy of the datasheet for the Hyundai microcontroller used in the 68-1965 model (the link waaay up at the top of the page for the micro has been updated as well). Several people have asked how I've gotten such clear high-res pictures of the circuit boards. Well, I have a prototype Minolta with a custom ground Carl Zeiss lens, a digital camera back and... Oh, I'm a rotten liar - I tossed the boards onto an HP ScanJet and scanned them in at 600 dpi. For the regular shots I used an Olympus C-2000 Z (quite a nice camera - only thing I don't like is that it uses these 'SmartMedia' cards instead of the CompactFlash cartridges that normal people use - takes forever to get images off of the floppy adapter...). Yet more software has been poppoing up lately - Azalea Software has released AzaleaQTools, which is a nice little bundle of software (for both Linux and Windows! with source!) that can be used to create barcodes compatible with the CueCat (which Azalea craftily refers to only as a "recently released free or low-cost scanner"). Nab it at http://www.azalea.com/QTools/ Stephen Wooding has put together some Java classes to handle the data generated by the CueCat (as well as a sample program that utilizes them). Snag it from http://popbeads.org/Software/CCScan/ I wonder if DC has gotten the idea that they've lost the battle?
(18SEP2000) The guys at Azalea are really hard at work pounding on code - latest news is that they're working on Mac barcode fonts - keep an eye on their site, as I'm sure we'll be seeing more goodies from them! Mega thanks go to Sean Kauffman, who supplied these pics of the 07A00:
Note that this version is one of the 'epoxy-blob' CueCats, and it's simply a cost-reduction technique as DC appears to be continually refining and further simplifying the design - it's certainly a cheaper unit to produce in quantity than the original 68-1965! I'll take a closer look at the pics later and see what can be done to 'declaw' this version... (anybody got access to an X-ray?) Several people have noted that DC's EULA seems to be changing as they see fit... Note that the EULA that is posted at http://www.wizkid.org/cuecat/index.htm and the current EULA at http://www.digitalconvergence.com/ula.html don't quite match up... Specifically, they added bits pertaining to the CueCat hardware itself, which was originally not even mentioned in the EULA. Dunno about anyone else, but switching around the EULA as such seems like a really slimy trick. As Michael Ducy stated, "What license am I bound to? The one that was up one digital's site when i got my cuecat or the "revised" one?" Have a look at Michael's site here: http://s1066194.umsl.edu/cuecrap/index.html and the Slashdot story here: http://slashdot.org/article.pl?sid=00/09/18/1129226&mode=thread Also, I had to grin when I saw the "What's New" heading on DC's main page: "On Sept. 15, 2000, Digital:Convergence Corporation experienced a security breach that may have exposed certain members' names and email addresses. The company was alerted of breach efforts by Peter Thomas at Securitywatch.com. The company has secured the site and is conducting a thorough security examination." Although their press release made it sound like they were actively cracked, it was really just a case of being sloppy - they really should know better than to keep user information in a plaintext file easily accessed from their website... Michael Rothwell was interviewed on Internet
News Radio - check his site
for the MP3...
(20SEP2000) Things just aren't settling down, are they? SecurityFocus.com has an article on the whole mess (I have to say, being interviewed by one of the most infamous hackers of all time was quite a thrill!) and there's yet another article on Slashdot. David Bilodeau noted that "the code on the bottom is very similar to Radio Shack's own method of date coding the manufacture of its items - 05A00 is May, 2000. 07A00 is July, 2000, etc. Can't remember what the "A" is but it might just be the May "A" run, and then if they ran more in May it would be 05B00, etc." Tim Kerby, who hails from Scotland, shares his insights on the actual
workings of the CueCat:
And if anyone hasn't seen this goodie yet, here's Pierre-Philippe Coupard's instructions on making a CueCat RS-232 pod. I was a bit confused from seeing that Pierre hadn't used the clock line in any way, and when I asked him about it he replied: "John Rigby, the author of the original hack, clocked several CueCats at around 8000 bauds quite reliably, so I assume the speed is preset." Neat hack! Pierre also cautions that it may not work with all machines: "I can tell you right now that more than one computer will not work with it : the signal that the 7404 spits out is TTL, and so the pod relies on the PC to be able swallow TTL on the RS232 line." Finally, although I've heard from many happy people that have successfully
'declawed' their CueCat, I have yeat to hear whether or not a 'declawed'
unit will still work with DC's software - if anyone has info, please let
me know!
(24SEP2000) I'm amazed that people are actually selling these on Ebay. Well, I guess it's a little cheaper than ordering one for $10 from DC... If you haven't seen it already, have a look at Michael Ducy's Cordless CueCat (turn your CueCat into a useful flashlight!). Jack Andrews contributed the following scans of his CueCat innards (06A00):
Charles Sullivan sent in these of his 06A00:
Note that it's similar to Sean Kauffmann's 07A00, but Sean's has the designation (FM+H Rev 0.3) screened on the board while the above shows (TM+H Rev 0.3). Minion has been doing a little work on creating a Win32 decoder - his site is at http://www.jaggedsoft.com/cuedog/ Several people have also confirmed that a declawed CueCat will still work fine with the CRQ software. Glenn Powers is giving DC hell over the fact that they are sending out unsolicited CueCats via the USPS yet their EULA still claims that the item is on loan... Wayne Buckhanan passed on his findings on the pinouts of the CueCat
mini-DIN connectors:
Phill K dropped me a line regarding CueCat versions and electronics
production:
Sherrod Munday wrote in with some very interesting info on the small 5-pin serial ID chip that is showing up on some CueCat revisions. Note that U5 is the normal 8-pin 93LC46 and U6 is the smaller 5-pin device that fits in the same spot on the board. Physical Description and Layout
With the board oriented so that the silkscreened "U6" is right-side-up, the three-legged side is on top, and the two-legged side is toward the bottom of the circuit board. Immediately adjacent to the chip are eight unused pads on the circuit board: they are spaced out to accept a chip the same size as the ATC93LC46 (used on the original model 68-1965). There are four pads on the right of the chip, and four pads to the left. Pinout: I'll use letters, since I can't tell which is pin one on the chip (I know, this isn't very good, but I can't tell anything about the chip). This layout is given with the PCB in the same orientation as described above -so that you can read "U6" right side up. A B C
Pin Connection
So it's apparently a 4-connection device, with 2 for power and 2 for data. Observations:
Therefore, the pinout would be:
My only lingering thought is that the chips may have come already pre-serialized prior to installation, and that "N/C" pin really would be Data In. Of course, if this device allows writing on the Data Out pin based on the voltage present, who knows... Surgery time......
Results
Pre-snip scan
Post-snip scan
Note that declawed version 07A00 outputs the same S/N as the first 68-1965A that you reviewed. So apparently, even though they seem to have gone to a custom microcontroller and changed the serial data chip, the functionality is the same. Out of curiosity, I tried placing the ATC93LC46 chip from my original model 68-1965 into the correct orientation on the 07A00, hoping it would pick up the identity of the older unit. No luck. My next project, if I'm daring enough: To Dremel-tool off the epoxy
from the uC and find out what it is. Hopefully I could do this without
destroying it...
Jack Hintry noted that his CueCat has the same 5-pin chip, but with the inscription 'M00P'. I'm wondering if the lettering on this device (so far we have M00P, L00F and L071) is shorthand for the serial number contained inside. Could this be something like Dallas Semiconductor's silicon serial number? Finally, here's a very simple mod that's perfect for laptop/portable
users:
(25SEP2000) Louis Papineau wrote in to say "If you start DC's software with CAPS LOCK ON, and you turn it off and try to scan, it can't register the scan and vice versa. You have to have the caps lock in the same toggle as when you started the software." *sigh* And DC wonders why people are compelled to write their own software... Michael
Rothwell has gotten a reply to the letter he sent to DC's lawyers,
but it's just as vague
as the first one. Not too surprising, I suppose.
(26 SEP2000) Doug Good has a great site up for you Delphi coders out there - have a look at http://www.angelfire.com/pa4/cuecat. Checked up on Michael Rothwell's page, and Stephen Satchell has some interesting thoughts on DC's rationale for who to send nasty letters to - it seems that DC may primarily be trying to crack down on software that is used to "establish links between barcodes and Web content". That is, if your software takes a bar code and fetches a particular web page based on that input, DC gets mad. Stephen is also guessing that the firmware revision number is embedded in the CueCat serial number - read more here. But enough about that, back to hardware. A.D. (who apparently
has some really fun toys at work) was kind enough to bombard his CueCat
07A00 FM+H Rev 0.3 board with radiation in an attempt to see what's hidden
under those blobs of epoxy. Although the resolution isn't quite enough
to give much information (you can just barely make out the circular epoxy
blobs), it still makes for a very cool picture!
Jack Hintry supplied the following pictures of his board with the mysterious 5-pin serial number device:
Note that Jack has successfully declawed this one by slicing through
one of the traces (this is presumably the DO line for this device).
Can anyone identify this mystery chip?
(29SEP2000) Came in to work this morning, and our secretary handed me two sheets and asked if I knew anything about it. Sure enough, I got the letter from Kenyon & Kenyon. Here it is:  
(The letter was addressed to my boss, who is listed as owner of the domain (but I admin the site) - I've blacked out the name and address, as he's really a cool guy, and I don't want to drag him into the mess.) For what it's worth, K&K sent it to our old address - kudos to Fedex for getting delivered properly. K&K or DC, please email me for my correct correspondence address (which I had originally posted, and I know you guys read the page). Note that the letter is just like the one sent to Michael Rothwell and other software developers. Leave it to a lawyer to be so incredibly vague. Anyhow, this would seem to invaildate Stephen Satchell's theory that
DC's beef is with software, as I've been careful to focus only on hardware.
Look, guys, you don't control the hardware - you're giving it away.
Please grow a clue.
(1OCT2000) Man, what a busy weekend... Had this article show up on Slashdot, and then our connection pretty much died due to the load. Note to small-time web admins - if your site shows in a Slashdot article, be sure you have mirrors in place. (Even better would be if CmdrTaco implemented automatic mirroring of a site prior to an article being posted on Slashdot). Anyhow, at my employer's request, I took the entire site offline and moved the page and files to my own personal server (air-soldier.com). The last thing I want to do is legally endanger my employer in any way - this is my fight, not theirs. So now that the page is on my own machine, hopefully I'll get a personalized letter from Mr. Rosini. The site now has a great many mirrors - a big thanks to everyone that has set one up - you guys are helping keep this information free. Rather than list them all, check http://666pack.org/cuecat/Mirrors.asp for a very comprehensive list of cuecat-related sites and mirrors. (And by all means, if you're running a mirror, add it to the list!) DC has now royally pissed me off, and I'll be putting even more effort
into toying with this wretched little plastic beast. In fact, I've
now created the 5-minute guide to declawing all the CueCat models: 5minute.html.
You don't need to know a thing about electronics - now anyone can easily
declaw their CueCat. If you want a copy to put on your own web page
or mail to a friend, grab this file: 5minute.zip
I noted with interest Wallace Lee's comment on Slashdot - apparently Wallace had sent a message off to DC asking for a method to return his CueCat as he didn't agree with the EULA: Today, I got this response from Charles Richardson of DC. Dear Wallace, The
Cat is yours to do with as you please. I would suggest that you give it
At 06:00
PM 9/28/00, you wrote:
"The Cat is yours to do with as you please". Huh. Given the letter I got, I'd beg to differ. So I sent off a message to Mr. Richardson: Mr. Richardson -We'll see what happens. I'm guessing I'll get no reply on the matter. Anyhow, back to the hardware...
Jonathan Buzzard figured out what the 4066 quad bilateral switch is
used for in the CueCat:
Roughly when the :CueCat (or any other keyboard wedge device for that matter) wants to send some data to the computer it opens these switches breaking the connection between the keyboard and the computer. The onboard microprocessor will then pull the clock line low on the keyboard side to prevent the keyboard trying to send any scan codes to the computer. The onboard microcontroller then sends the keyboard scan code data to the computer as per normal. When this has finished it closes the switch and lets the clock line go high again. Obviously the microcontroller has to watch the clock and data lines so that it does not break the connection between the keyboard and computer when they are in the middle of talking to one another. Hope this helps."
(2OCT2000) Well, DC has found the page's new location, but no hits from K&K yet.... Leonid Broukhis has been toying a good bit with comparing differences
between firmware revisions on the CueC... er, a 'certain free barcode reader'...
The revisions (apparently noted by the last two digits of the serial number)
do differ slightly in the types of codes that can be read - see his work
at http://www.mailcom.com/BarcodeTest/.
Leonid has even managed to create a barcode that returns random garbage
with a rev.02 scanner!
Shakki pointed me towards this interesting post: http://www.topica.com/lists/pla_upl/read/message.html?mid=1702776249
Apparently, it's possible to disable the CueCat's (ridiculously weak) encryption
by tying a particular line of the microcontroller to +5v. Seth Henry
confirmed that it does in fact work - I'll give it a try myself later.
Louis Papineau has found yet another bug in the CRQ software: "When you install the software, it asks which browser you want to use. I have both IE5.? and Netscape 4.72 installed, IE being the registered browser. I told the CRQ software to use Netscape. I checked the registry and it is confirmed that it should use Netscape. However, whichever browser you have open is the one it will use,
not necessarily the one you have chosen."
And lo and behold, Charles Richardson actually replied to my email:
This is not a support issue. We do not have a way for a customer to conveniently return unwanted Cats. I do not intend to engage you in a discussion involving the legality of my response. To which I just replied:
Charles replied promply once again:
Well, at least someone over there has a sense of humor...
Thanks Charles, I appreciate the help.
(3OCT2000) Why eth0 keeps dying on the server is beyond me... I've gotta keep a close eye on it, it seems... Seth Henry has set up a web page showing how to perform Jeff Dobkin's encryption removal hack on a CueCat (just updated with info on older boards). Michael Rothwell also has this info mirrored at http://www.flyingbuttmonkeys.com/foocat/cue-decrypt/ Joe S is eagerly awaiting his cease & desist letter now that he's created a cold fusion script to decode CueCat output: http://devex.allaire.com/developer/gallery/info.cfm?id=71C8BC46-9499-11D4-AAA700508B94F380&method=full Braddock Gaskill has a site up about DC and the CueCat as well as a little info on the other device (the audio cable that most people have overlooked) that DC is distributing: http://braddock.com/dc/ Oh, and I'm in one of the latest news articles, too... (grins proudly) I started a list of everyone who's gotten nastygrams from K&K here. If I've missed anyone, let me know... Hopefully I'll be able to redo this page sometime soon - it's getting
pretty big...
(5OCT2000) The lawyers are still hammering out those letters, it appears - Andy Wysocki of http://cuecat.bearsoft.com/ is the latest recipient of a K&K nastygram. Jason Andrade has a mirror up for the Aussies (the site isn't available internationally, it seems) here and here. Among the many things that I need to do, setting up a nice mirror list is among them... Just in case Allaire takes a dim view of Joe S's cold fusion scipt, the files are here. Minion added a pic and instructions to his page
showing how to perform the decrypt hack on a 06A00 CueCat (note that units
with the same date sticker don't necessarily use the same PCB).
(8OCT2000) Sore after a great day of paintball yesterday - go blue team! Bill has a great hardware site up at http://cexx.org/cuecat.htm where he shows how to perform serial number removal and encryption removal using his (TM+H Rev 0.3) as an example. He also notes some odd behavior when jumpering +5v to a particular processor line. Matt Purgar has whipped up a Visual Basic .BAS module to handle decoding for anyone who would like to understand how it works: http://longisland.poly.edu/~mpurga01/DecodeCAT.zip Happy Hacking Cradle users, rejoice! Tom Zerucha has coded a little
program for use with the CueCat. Check the bottom of http://www.execpc.com/~tz/
And it's even GPL'ed!
22OCT2000) Apologies for not getting any updates in lately, and for being terribly slow on responding to emails - been quite busy the past 1.5 weeks... First off, Bob W was inspired by A.D.'s x-ray, and did some playing
of his own with some equipment that he has access to. He writes:
Fantastic photos - thanks Bob!
Chrylis has done a little bit o' Perl coding - grab his script here,
and read the following for a bit of info:
I discovered a rather disturbing behavior of our favorite feline
as well; some barcodes don't scan correctly left-to-right but scan fine
right-to-left. Try "234567" and "23456789" in Azalea coding for examples."
For those of you with the 2-screw model (68-1965), Seth Henry dug up this hack (I'm not sure who to properly attribute it to) that will decrypt your scanner's output: The 2 screw case, Hyundai CPU version can be converted to plain ASCII output by lifting pin 10 of the Hyundai CPU. Pin 10 is normally connected to ground, so if you solder a wire from 5v to pin 10, you will have a short! Do not do this, instead seperate pin 10 from ground. When pin 10 is unsoldered (or cut), it will float high, no need to solder it to anything. Pin 10 can be found on the lower right side of the bottom row of
pins when orienting the CPU so that the word "Hyundai" is right side up.
Pin 11 is the last pin on the right of the bottom row. Pin 10 is just to
the lef
If you're good with the soldering iron, you can solder a wire to
pin 10, connect it to a switch, then use the switch to convert from normal
encrypted out put to plain ASCII output. Pin 10 is only read by the
CPU at power-up and reset, so you'll have to either unplug and replug the
keyboard connector, or momentarily connect pin 4 (pin 4 is the reset line
of the Hyundai CPU)
This modification has been verified on board version: K023A016 REV:C
date code: 0024
If you've tired of playing with your CueCat and would just like to destroy
the thing, get in touch with Dr.
Cliff - he's willing to put up a webpage
of 'altered' units in the vein of some of his other, ahem, projects....
:-)
I swear, is there a programming method that hasn't been used to decode
the CueCat output? Brandon Hall pointed me to his implemenation in
Flash (requires the Flash 5 plugin), named appropriately FlashFeline
(source can be snagged at http://chattyfig.figleaf.com/source/FlashFeline.fla).
He notes:
A Radio Shack employee (we'll call him 'Scane') wrote in with a few
tidbits:
Scane managed to quickly snag a few pics of the USB scanner while the
manager stepped out of the store:
The obvious differences inside are the 4 USB wires and the addition
of a number of capacitors, and of course the overall arrangement of circuitry."
Pete Callahan inquired with DC about their breach of security a few weeks back: Mr. Eschbach,And Pete got the following response: Mr.Callahan,
Comments? Additions? Mail me: haveblue at execpc dot com Thanks for all the info, additions, and your kind words - this page has been a lot of fun and the enthusiastic feedback makes it all worthwhile! My, my... Look who's been showing up in the logs: log capture (207.158.100.67 is dallas.digitalconvergence.com) Hi guys! Hope you like the page!
View these other fine CueCat pages: CueCat Mirror
List
| ||||||||||||||||||||||||||||||||||||||||||||
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |
