Frustrating IDA/GDB Error: Bad register name is passed to getreg: PSR

The spoiler is that IDA does not operate properly with openocd 0.8.0, and you need to use openocd 0.7.0.

This one had us tearing our hair out!  Mostly because it’s unrecoverable, and immediately upon clicking OK to what seems to be a very minor complaint, IDA crashes very ungracefully without any database cleanup or other lifesaving maneuvers.

But somewhere along the line, we came across some page that mentioned openocd 0.8.0 broke some sort of interface for some other tool, and they were waiting for the tool to catch up.  Guess it’s the same here, IDA just has a little catching up to do.

For now, just ditch 0.8.0 and go back to 0.7.  That one should work fine.

Posted in Projects | Tagged , , | Leave a comment

Airwheel Debug Port and Calibration

Welcome Back!

This article continues our exploration of the Airwheel X3.  Last time, we disassembled the beast and took a peek around.  This time, we’ll break out the soldering iron and get to hackin’!

Unknown (ahem) Target – Research and Sleuthin’

First – how do we even start?  We have no f*cking clue what the micro is, and the topmark has been hopelessly annihilated!  Well not really completely removed, but let’s ignore that also for now.

Whatever will we do?  After all that obfuscation, there’s no way the developer would leave a live JTAG port conveniently pinned out and labelled, is there?

Well yes.  Yes, that’s exactly what has happened.

If you’ve seen the airwheel PCB, you have seen the main header connection down at the bottom.  There are a couple of conspicuously empty headers, and they just happened to bemarked: 3.3 SWCLK SWD GND

Here’s a pic that’s better than our own – we found it online here.

PCB_Headers

Hmm.  A little LMGTFY tells us that this is none other than the standard ST-Link connector.  So using our head grease trick, the ST-Link port evidence, and the fact that you can see the ST logo through the hot glue in above picture makes us suspect that the micro is an ST chip.   Wow!  See what we did there?

So let’s hook it up!  We chose to pipe our port out the side of the body, because who knows – maybe it’s completely feasible to debug arm code while carrying a laptop and riding an airwheel.  Charles would do it.  As far as connections go, you can safely ditch the 3.3V line and only connect the other 3 lines: SWCLK, SWD, and GND.  That’s all that’s needed when operating with an externally (USB) powered ST-Link anyway.

We chose to use a bit of ribbon cable to bring the port out to a standard 0.1″ header socket stuck into a little dremelled slot in the side of the case.  Le port hack is shown below.

ST-LINK_PortAnd the internal connection is just as simple – ribbon cable from the PCB headers over to the socket.  Plus copious amounts of hot glue to keep it all in place and quasi-splash proof.  Protip – Cover that debug port with tape to keep dirt and moisture out!

Ribbon_Cable

Interlude – Calibration header!

While we’re in here messing about, we might as well add a set of header pins between the SP and GND connections to allow us to start the calibration routine.  Here is a pic of the header in relation to the debug cable.

STLink_CAL

The calibration routine is started by powering up with SP shorted to GND.  With our little 2-pin header here, we just stick on the header clip and fire it up.  The control board side of the unit should be standing straight up for calibration, although it doesn’t need to be assembled.  So feel free to cal with the shell open, as long as the board is in the proper upright position.

The calibration routine takes gyroscope data as well as motor data during a short test.  Upon power up, the wheel will spin slowly forwards over 3 full rotations, then reverse over 3 full rotations.  Then the data is stored and the hellish beep alerts you that cal is done.

You should never need to enter cal unless you have seriously borked the unit.  And if you have, you probably know enough to get yourself out of the hole you’ve dug.  So think of the calibration as a fun piece of trivia you can set aside for never.

Back to the ST-Link Port

We’re not done identifying out the micro, so let’s get back to that!  We’ve found the easiest way to debug is to put the entire unit on it’s side when powering up.  It will immediately fault and give an annoying steady beep, but the motor won’t be running which helps a great deal.  Alternatively, just pull the 3 motor phases but that seems like a lot of work.

Now fire up your ST-Link adapter, and here’s what you’ll get.

Airwheel-STLink

Lookie here – A part ID!  So the mystery micro is an STM32F103C8T6, the same device as in the real and homebrew ST-Link V2, or the one that acts as an ST-Link on the Value Line Development board, as well as copious numbers of low-cost development boards like this one and this one.

Remind us sometime to tell you how to turn one of those cheapo dev boards into a spare ST-Link…

But for now – we’ve got it!  But maybe not.  The flash is read protected, which will severely hamper our debuggings and hackings.  Makes sense, but based on the number of clones out there we suspect that the read protection is either incredibly easy to bypass, or there is a very active market for “Production Data” of every new product manufactured in Shenzhen.  Either seems just as likely as the other, so drop us a line if you know which is which.

So it seems that this might be a build-from scratch effort.  Time to dust off those ST app notes on driving BLDC’s!

As a parting gift, we’ll provide you with a “No they didn’t!” moment from the lab here.

airwheel-flash2

Posted in Hacks, Projects | Tagged , , | Leave a comment

Airwheel X3 Teardown

Today we’re going to take a peek inside the clever and dangerous Airwheel X3.  We’ll show you how to disassemble the Airwheel, and also what’s inside an Airwheel.  Enjoy!

AW_black

For those who aren’t familiar, the Airwheel is kind of like a minimized Segway:  A motorized, single-wheel, self-balancing transportation unit.  It’s a single tire, hub motor, some control electronics, and a battery.

You stand on the foot platforms and the controller continuously solves the inverted pendulum problem.  You lean forward, it rolls forward to prevent itself from tipping.  You lean back, it rolls backwards.  With a bit of skill and a little practice, you too can zip around on this uber-slick (but heavy as hell) transportation unit like that guy from the old comic BC.

BC_guyClassic.  And nearly equal weight to the original.  Seriously fellas, get a lighter motor for Thor’s sake!

But we’re all here to see what’s inside, so let’s get to it.  Click any of the pics for a larger version.  Here’s the victim.

AW1

The ABS shell is held together by 7 screws on each side.  So yes, you must flip it over halfway to remove the OTHER 7 screws from the other side.

Yeesh, they sure got a good deal on screws!  The first 5 are obvious, as they ring the periphery of the wheel.  Note the scratches from entertaining crashes in many directions!

AW2

The next 2 are a bit less obvious, being tucked back into the handle.  Yank these two and let’s continue

AW3

Next, 6 heavier machine screws on each side hold the ABS shell to the hub/foot stand assembly.  Yup, that’s another 12.  Like I said, they got a good deal on screws.

AW4

Next, pull the non-control side of the shell up and away from the hub to separate the two halves.  They are mated by the (thin) charging and (thick) battery supply wires seen here.  In our case, the plugs were also hot-glued.  This is probably to keep them from rattling apart during use.

AW5

The non-control side of the shell contains the battery, initially hidden by an aluminum sheet.

AW6

Removing the 6 screws holding the plate (and breaking the warranty seals ooooohhh) allows us to take a peek at the battery.  Now that’s a Li-Ion pack!  57V?  Better lick the terminals to make sure it’s charged.

AW7Don’t really lick the battery terminals, fellas.  Or if you do have a camera ready and please realize that we disclaim all liability.  Still, send us the pic.

The control side of the shell is tethered to the hub motor via it’s power cable.  Be careful not to yank it too hard.

AW8

Again, removing the aluminum plate allows us to see the control side of the Airwheel.

AW9

Beautiful.  A teensy little board can crank out 500W of physics-solving rage with 6 mosfets, a micro and a gyroscope chip.  It’s a great age to be alive.

A closer look at the board reveals that the micro and the gyro chip numbers have been milled off in an incredibly clean manner.  Neat!

AW10

But even this advanced obfuscation method falls to the good ‘ol head grease trick.  Swab your sweaty brow with a finger, and quickly wipe across the milled surface: The shine will be removed from all the raised portions, leaving a pretty good contrast in the etched divots of the original part number.  A sideways flashlight and some careful angling will usually reveal what was once missing.

In this case, it looks like an ST ARM Cortex M3 micro and an Invensense gyro.  A couple of what may be op-amps are the only other two chips on the board.  Super minimal, but they did a great job on the control loop – it feels and responds beautifully to the interesting problem of how to keep a fat dumb human upright.

We hope to look a bit more in to this fun little device in the future.  There’s a pesky speed limit which really must be removed, and a couple other possible hacks that are in the idea hopper.  So if anyone wants to collaborate on hacking this bugger, drop us a line using the contact page, and we can swap all those tasty secrets that aren’t yet suitable for public release.

Cheers!

Posted in Projects, Reviews/Teardowns | Tagged | 6 Comments