Hacking the E-mag?

[jeffremiller]

I just bought an E-mag and the Linux Geek in me just can't stand to wait...

Has anyone started hacking the E-mag? I see the 14 PIN socket on the board (for a PBASIC Stamp?) Does anyone have board specifics, such as Flash size, programming interface, etc,etc)

A couple of ideas that have already crossed my mind:

ambient emperature sensor / display on LED
shot count alarm speaker or vibration?
game timer alarm speaker or vibration?
Battery level indicator on LED

I guess you can see where I'm going ith this... Just something to play with.

Is there a group developing this type of "non-essential" creature comforts?

I'd love to help.

J_

[Bartman]

Yea, we have a flash programer, jsut waiting for my last tourney in august. Then I plan to strip out the burst modes, and make teh gun semi only.

with the extra space in the flash, I want to add a anticop eye, using the post for burst mode as a conectore for teh eye.

Keep posting here, and as we get closer to ripping the chip out, we can both get together and talk.

Bartman
team I have no Idea
www.ihni.org

[jeffremiller]

A second board would be the ultimate but I'd settle for the tech specification and programming info on the one I have. I've started researching the Paralax PBASIC stamp and I see mega potential in it. Most of it is just "giggle" features such as the termometer and humidity but the game/ammo alarm I saw mentioned in a review as a possible enhancement. If AGD is reading this, let me see the code and play with it for awhile.

I'll sign non-disclosures, etc. I just want to see this platform exploited to it's fullest!

J_

[Bartman]

Well, I have almost finished the drawing for my new body. after I turn that, I will be ready to figure out 2 things, one the ACE(or something similar) and how I am going to add it to the board. I am hopping like heck this will help stop my chopping problems.

I have a friend going to get to work on the chip soon, to see if we can get into it, and change it to serve my purposes better.

Any ways, I hope this doesn't get closed so we can keep exchanging Info about the Hack.

Bartman
team I have no Idea
www.ihni.org

[jeffremiller]

If you look inside the grip there is a vertical row of 14 sockets for a stamp... looks like this will fit.

http://www.radioshack.com/product.as...Fid=900%2D3272

That way, you should have to actually hack the existing flash load or the board much. This stamp has access to the I/O lines on the board and can run independent programs.

I guess it depends on what you want to do to the thing.

J_

[jeffremiller]

OK... I'm going to test this pinout tonight and see if voltage is present on the corect pins. If so, I think this is what I need. Sorting out the I/O lines is going to be a pain. Perhaps someone with AGD would be kind enough to post the pin-outs?


<table BORDER WIDTH="100%" NOSAVE >
<tr>
<td>Pin</td>

<td>Name</td>

<td>Description</td>
</tr>

<tr>
<td>1</td>

<td>VIN</td>

<td>Unregulated power in: accepts 5.5 - 15 VDC (6-40 VDC on BS1-IC
rev. b), which is then internally regulated to 5 volts. May be left unconnected
if 5 volts is applied to the VDD (+5V) pin.

</td>
</tr>

<tr>
<td>2</td>

<td>VSS</td>

<td> System ground: connects to PC parallel port pin 25 (GND) for

programming.</td>
</tr>

<tr>
<td>3</td>

<td>PCO</td>

<td>PC Out: connects to PC parallel port pin 11 (BUSY) for

programming.</td>
</tr>

<tr>
<td>4</td>

<td>PCI</td>

<td>PC In: connects to PC parallel port pin 2 (D0) for programming.</td>
</tr>

<tr>
<td>5</td>

<td>VDD</td>

<td>5-volt DC input/output: (Also called +5V) if an unregulated voltage
is applied to the VIN pin, then this pin will output 5 volts. If
no voltage is applied to the VIN pin, then a regulated voltage between
4.5V and 5.5V should be applied to this pin.</td>
</tr>

<tr>
<td>6</td>

<td>RES</td>

<td>Approximately 4.2 volts, causing the BASIC Stamp to reset. Can
be driven low to force a reset. This pin is internally pulled high
and may be left disconnected if not needed. Do not drive high.</td>
</tr>

<tr>
<td>7-14</td>

<td>P0-P7</td>

<td>General-purpose I/O pins: each can sink 25 mA and source 20mA. However,
the total of all pins should not exceed 50 mA (sink) and 40 mA (source).</td>
</tr>
</table>



[This message has been edited by jeffremiller (edited 07-03-2001).]

[RobAGD]

Well as I recall the current board dont really support the BASIC stamps. There was a memory issue that intern left the code out to use it.

Support for the BASIC chip will go away on the next set of boards to be made.

-Robert

[AGD]

Guys,

Yes the pinouts were for the Basic Stamp but we put that on hold when it became apparent that the industry was going away from programable chips. Anti chop eye software is under development now and not worth you spending time on. At any rate the memory in the chip is almost full so you dont have much room to play with anyway.

AGD

[jeffremiller]

But I still have this burning desire to hack the code. I don't want F/A I don't really even need an ACE. I want other features!

Features that AGD probably wouldn't consider such as temperature, humidity, alarm and vibration for the shot counter and timer, possibly a bootup sound, programmable LED messages for team name or my name or something.

I know I've read that the alarm was being considered as well as a battery level indicator but It's not the same as doing it yourself.

Please, would AGD consider showing a few of us the code used? I called but the guy I talked to recommended that this is the place to post such questions. Any experimental load images, etc?

J_

[RobAGD]

There are no codes to hack, it's not an angel with codes liek NICKLES08 SILVER11 blah blah blah

There is no FA in the guns, the code ( meaning the program that allowed it ) was removes.

ROF might be tweakable as thats just a user set varable with a max setting limit.

-Robert

[donggie]

Originally posted by RobAGD
There are no codes to hack, it's not an angel with codes liek NICKLES08 SILVER11 blah blah blah

There is no FA in the guns, the code ( meaning the program that allowed it ) was removes.

ROF might be tweakable as thats just a user set varable with a max setting limit.

-Robert

Has anyone figured out how to "tweak the ROF?

If so, How?

Don

[Have Blue]

Well, I just ordered an AVR programmer and a BASIC stamp - after talking with Jeff at tech training this past weekend, I'm going to take a stab at porting the Warlord code over to the E-Mag.

While not truly hacking the board, would anyone be interested in replacing their E-Mag's red display with a nifty green unit? I'd like to gauge the demand to see if it's worth ordering a bunch...

[donggie]

What's the cost? Hard Install?

Anyone figure out how to at least remove the limiters on the board?

Don

[RobAGD]

Actually I want a nifty Blue LED

-Robert

[Sledgehammer]

I'd <b>LOVE</b> a green LED

[Have Blue]

Blue LEDs not available, sorry... The choices are green, yellow or orange. Cost would probably be $40, installation is a snap (pop out the old one, plug in the new one).

[Have Blue]

Well, even though the response seems minimal, I may go ahead and order a batch of the green displays.

In other news, I've successfully downloaded the v1.35 code from an E-Mag board - many thanks to jeffremiller for his assistance :-) Now to see about porting my Warlord code for the Tribal over to the E-Mag...

I used a Kanda ISP programmer (not the USB programmer that AGD uses, though - I'm way too cheap for that) to do this, though I'm sure other makes of ISP programmers can do just as well. If you have an ISP programmer, here's the pinouts on the E-Mag board that are of interest:



I'm rather surprised that AGD went with this particular processor to interface with a display (that doesn't have an internal character set) _and_ with the original intent to interface with a Basic stamp - there just isn't a lot of codespace left in v1.35 - only about 78 bytes (and note that the AVR uses 16-bit long instructions, so 2 bytes per instruction!). Anybody know if AGD will continue to use this microcontroller for future versions of the board? I think that the code could be compacted down a little bit - there's around 104 bytes beginning around 0x48 that look like a table of data. However, only the low (or it the high?) byte is used - with a little extra work to utilize the other byte (or maybe moving some of the data to unused space in the EEPROM), you could probably squeeze 40-50 bytes more space out of the program.

The EEPROM is fun to play with, too - I've rolled the shot counter back to 0 on this board somehow. Haven't quite figured out the shot storage yet, but 0x04 appears to be the LSB of the shot count.

I'd post a link to the .hex file that I sucked off the board as well as the disassembled code, but I'd first like to know if Tom would sue and/or castrate me for doing so...

[donggie]

Great NEWS!!!! the developments... not the sueing and castration. Would like to get a hold of that code if it's possible since I'm trying to work out something similar. Granted I do not have the tech knowledge to do it myself, I am currently working with someone who apparently won't even touch it without that code. Anyway, any assistance you could provide would be greatly appreciated.

Don

[Potatoboy]

I wouldn't distribute that source or the Hex if i were you. The Emag software is under copyright and it is not open source. Technically, even the dumping of the board that you have done is in violation of the DMCA. Not that I support the DMCA or don't approve of what you're doing, but I'd be real careful if I were you. No matter how cool the company is, they usually don't like people infringing on their Intellectual Property.

[jeffremiller]

Probably a good point Potatoboy.... better keep even the hex code private.

Showing how to pull the code shouldn't violate anything...but the actual act of doing it is definitely debatable.

As far as the DMCA... well... don't get me started.

But since you did bring it up... anyone else have a DeCSS T-shirt?

J_

[Have Blue]

Actually, I don't believe that dumping the board would be in violation of the DMCA. However, posting the description of how I did it along with the picture could concievably be in violation IF there were, as the law states, a 'technological measure that effectively controls access to a work' in place. But in this case, there is no measure in place that controls access - the code is there for anyone with an AVR ISP programmer. v1.37 is a different matter, as it is read protected. But then again, I'm not a lawyer.

At any rate, I won't post the .hex or disassembled code until AGD either grants or denies permission.

[Have Blue]

Oh, one other thing I should note... When I dumped the code, I had the E-Mag board power off and removed the LED display (so as not to cause excessive current drain). The E-Mag board was thus being powered by the ISP programmer. However, it is possible to have the target (E-Mag) board powered separately according to Atmel's ISP datasheet.

[Have Blue]

Well, now this is interesting... Tom said at tech training that the output pulse to the solenoid is 40ms long. However, I just scoped the output on a v1.37 board and it's only 30ms. Did the pulse duration get changed at some point, Tom?

[Kevmaster]

maybe this is just my non electrical mind speaking, but wouldnt a "Morlock" board from Kenshaw Mountain Markers be an easier upgrade? youd lose the LED, but you would gain a ACE and many firing modes. that is...assuming it would fit in there...but the little booger is pretty small
here is KMM's site: http://exarin.com/

i know i saw a pic SOMEWHERE of the board being someting like the size of two pennies. its pretty damn tenie

[donggie]

I'm already talking with them.


don

[Have Blue]

Sure, it would be easier, but I want to have my own hardware or software. I should be able to cram one of my Warlords into the E-Mag frame as it is, but I'd like to hack on the stock board some to gain familiarity with the Atmel, and possibly develop a software upgrade.

[donggie]

Have Blue,

That's a good idea. Please keep us informed of any developments or assistance we might provide.

Don

[Have Blue]

More hacking results....

The alpha characters stored (and thus able to be displayed) are: ABCDEGHLMOPRST (if you try displaying a character not in the set, a colon is displayed). You can thus modify the startup 'AGD x.xx' message to anything using those characters....

[donggie]

Nice... hows the carry over of the warlord program going?

Don

[Have Blue]

Porting over the Warlord code is slow going. I have a fantastic compiler for PIC development, but nothing for working with AVR micros. Been playing with GCC-AVR, though, and it may suit my needs (the price is right, anyway).