VR headset for under a hundred quid

geeek-vr-box-virtual-reality-glasses-3d-brilI’ve been pulling together the parts to build a VR headset for less than 100 quid. This isn’t as easy as you might think. In order to achieve it, I’m using a VR Box to provide the headset and lenses which isn’t bad. For the screen and accelerometers I managed to pick up a HTC One M8 for £60 which was an absolute bargain. With this set up, the google goggles demos run very well. The 1080p screen on the HTC One M8 is perfect for the display. The grill between pixels is minimal compared to the Oculus DK2. It’s still not as good as an oculus in terms of accelerometer lag and lens quality, but it is significantly cheaper.

I spent some time reading this instructables now I’m all set to try out Kinoni with the headset.

In order to extend it’s abilities I’m adding IR reflectors to the headset to allow head tracking with a camera. The tracking would have to be based on brightest spots with an IR source and scotchlite reflectors. I can only really get x/y working for head tracking on a single standard desktop HD cam. This is due to the distance between the reflective spots on the headset being too small to estimate depth. By adding a second camera it would be easier to calculate the headset’s relative 3D position in space. If you were going to add a second camera, would it make sense to use a Kinect instead?

Ennio Wifi Doorbell: The saga continues.

ennio cameraI managed to get around to playing with the Ennio wifi doorbell a little more, trying to figure out how all of it works. It seems I have to learn a few things about UDP, however with a quick and dirty tcpdump on my openwrt router (which I was hacking in other ways earlier) to an NFS share on my RAID I managed to collect a chunk of worthwhile data while my phone interacted with the camera.

Capture results

As far as I can tell without capturing all of the data of all of the interactions it goes something like this:

  • Phone sends a broadcast request of some kind and the doorbell responds with a packet with it’s name to the UDP port specified by the initial contact.
  • The phone logs into the device using the username and password provided by doing by sending a hex encoded ASCII string, with some preamble bytes:

Continue reading →

Ennio Doorbell internal teardown

Here are the results of taking apart the Ennio wifi doorbell. I haven’t had a chance to dump the memory from this device yet, but I received a request to take some photos of the internals. Here are those photos;
Ennio memory chip Ennio camera module Ennio main board reverse side Ennio SoC module Ennio SoC module reverse side. Ennio internals unhooked

 

 

 

 

 

 

 

 

 

 

The SoC is a RaLink RT5350, the data sheet for the chip can be found here. I guess some of the pins on the wide connector are for programming the memory chip (JTAG). I just need to work out which ones.

I’m looking for memory dump options, at first I wanted to mount my NFS server onto the device and dump to a file there, however that won’t work due to NFS being missing from the device. The other option is to dump it to telnet using base64 encoding, then decode it on the other side… This would be less than ideal but still possible. I need to boot the device up again to figure out what to do next.

Setting up a cross compile toolchain to build new binaries might be the best option for getting what I need out of this thing. Although I doubt the source code for the IPCam will be available to me.

The most important thing for me to do is to disable the wifi hardware. Once disabled it’s safe to actually put the hardware on the wall outside. I will likely need to take it down at some point, if I intend to flash the memory. I still wouldn’t recommend buying an Ennio wifi doorbell, or any of the variations out there. The failure point is the OS which is a black box of obscurity over security. I would love to have the time to develop a better open-source OS to run on these things which would work on foscam, wansview and others too. Like OpenWRT but for IPCams.

Hacking the Ennio Wifi Doorbell

ennio cameraI recently purchased a Ennio Wifi Doorbell in order to have a doorbell, and also have an outdoor front of house security camera. It seemed like pretty much the only option available.

The camera is fairly easy to set up in the way it was intended. Install an app from the app store, and pair it (with magic, or zeroconf/bonjour) with your phone.

When the button is pushed a push notification arrives on your phone, I’m not quite sure how this happens yet but I’ll dig further. The camera sends a photo with the push notification and also allows streaming of video from the camera.

As far as I can tell both of these things work over 3G as well as Wifi flawlessly with a horrifying app UI.

First things first, is it secure?

With this thing going on the front of my house I want to know if it’s possible to break into it or in some other way use it to break into my network.

The short answer, this device is about as secure as a wet paper bag with a block of gold in it. This, although a major downside from a consumer perspective, leaves many open opportunities for the hardware hacker. Continue reading →

Update: ESP8266 WiFi server complete (enough)…

Photo 01-05-2015 16 19 46So a new Arduino arrived today after the connectors gave out on my older ones. It’s a cheap UNO clone and will be followed by a selection of Nano’s for various coming projects. I added support to my ESP8266 project for lightsOn, lightsOff, and setting a value for the lights on. Which can be found in the github repo. The server responds with a simple JSON string explaining the current state of the light, and can be adjusted by sending particular HTTP requests. Continue reading →

Upgrades… Salus RT500RF 868MHz wireless boiler control

RT500RFI’ve just received a Salus RT500RF in the post. I’m pretty much all prepared to hack this thing, at first I’ll sniff the airwaves with the RTL-SDR and try and get a handle on how it works. There’s been at least one blog article regarding this unit so I’ll also have a dig around them and see what they can tell me too. The idea is to get the Raspberry Pi with the 868MHz RFM12B to send a signal to turn the heating system on/off, and if possible, interrogate the current state of the boiler.

This will be the first stage in smartening up the house. The OWL CM160 and the Salus RT500RF are the first devices that I’m going to mess with as they’re the most useful to me right away. Next I’ll be turning my hand to Oregon Scientific weather sensors, Wireless door bells and other hardware on the 433/868 bands. These bands of course are used in Europe and some other locations, the equivalent is 315/915 for the US. So if you’re following my work then make sure you pick up the right bands for your location. It’s always best to buy radio transmitters and receivers in your own country because the likelihood of anything being on sale which isn’t allowed is reduced.

[auction-affiliate tool=”lister”]

Top 10 Arduino Sensor Boards & add ons

I thought I’d put down a little list of my top 10 things I do with my Arduino boards at home. I’ve been experimenting a lot with ambient circuits, up cycling and things like that so you could say that these things are skewed towards that kind of thing.

  • UltrasonicUltrasonic Sensors – be careful with these, I bought a pack of 4 from a dodgy supplier and the MAX232 chips had a bug which causes them to overheat rapidly and they get hot enough to burn stuff. You can use these in a lot of things, I’m currently using two as the eyes for a small robot I built to keep the cat occupied.
  • PIR Sensors – these are cheap and cheerful little blighters. Ambient circuits usually require some kind of human interaction, so ultrasonic and PIR are both decent ways to do that. Depending on how you direct them and mix them they can become quite an human interaction tool.
  • Bluetooth HC-06 – With speeds up to 250kbps the HC-06 is perfect for fast remote serial ports which can be accessed easily from a computer or android device. The HC-06 unlike the HC-05 is reprogrammable, you can hack it in various ways messing with it’s internal setup for the serial port. This is the fastest and easiest way to add a radio to a remote device that I’ve found, and I’ve tried NRF24’s, RF12’s, Wifi shields and other means. These are certainly in the category of just works(tm).
  • WS2811 RGB LED Strip – Unlike the 2801 the 2811 has individually addressable LED units, whereas the 2801 has 2 LEDs per controller. It works well with the FastLED library and lets you separate the LEDs onto individual faces of a 3D shape. They’re also significantly cheaper than BlinkM’s are and much easier to obtain in large quantities.

[auction-affiliate tool=”lister”]

  • Gyroscope – If your project has any moving parts, it’s a good idea to put an accelerometer in there, it can give you feedback in interesting ways. Very useful to have on around.
  • MSGEQ7 – With no particularly easy way to say it, it’s an equaliser IC this little chip will take a sample of audio and tell you the value of it on 7 different frequency bands. It’s useful for doing things like defining colours to be illuminated in time with music and things of that nature. Microphones will need a little amplifier to get them working but it’s a genius little chip.
  • DHT11 – Another favourite of mine is the DHT11, temperature and humidity. You can connect these up to one of these mini arduino+rfm12b boards and you’ve got a thermometer and humidity sensor anywhere.
  • rfidRFID Kit – This cheap and cheerful RFID kit can be used in all kinds of ways, creating proximity based installations or interactive spaces where each object in the space has it’s own unique ID.
  • Motor shield – There are tonnes of motors laying to waste because they’re not re-used, I collect them up and put them to work when I need one so a motor shield is always useful to have. Obviously you can always bang something together with a few transistors, but a decent motor shield for testing is always handy.
  • Screw shield – always handy to have around a screw shield can save a lot of time when prototyping.

[auction-affiliate tool=”lister”]