Emulating a HID Device

I've been hacking around with some Atmel microcontrollers and I thought I've give this project a try. Due to circumstances out of my control, taking a pedometer to work is not possible as it is not permitted on site. However, this pedometer is directly related to a health fund that gets money from my employer based on how active you are. I've already done something like this:

Yes, it get the job done, but at the expense of time... So, now I am going one step further. Using either a Pro Trinket or Teensy (images below), I was planning on faking things out. Instead of plugging this into my computer

I'll plug this in! :)

The next step was to setup setup the boards to emulate the USB HID device. For the Pro Trinket, I used VUSB and for the Teensy, I used LUFA. The VUSB API was a bit more involved and took a bit longer to get working as documentation seems sparse from my searches. Using Dean's LUFA library, it was very easy to setup and get configured. Since the Pro Trinket uses a slightly less sophisticated microprocessor (ATmega 328p), there is no USB support in that chip. However, Teensy's chip is the ATmega 32U4 which does have USB support and can use the LUFA stack. Either way, I thought I'd give both a shot.

After getting both configured, if I run the 3rd party software provided by Virgin Healthmiles, it now thinks I've plugged in the "real" pedometer. First step done! Drink a few beers and celebrate!

The next step is where I am currently stuck... Decoding their USB protocol. I have uploaded data many times using the real pedometer and captured the USB communication. Here is some sample data.

I've tried sending back the data I captured (using wireshark), but no dice. So they have some smarts built in, but I can't pinpoint it just yet. To complicate things more, the 3rd party software only supports Windows and Mac. Mac has good tools, but nothing to capture USB! I've tried to setup a VM on my linux box, but wine does not support all win32 API's the 3rd party software is calling. So I am writing the code on linux, uploading with avrdude and testing on Windows. Fun times.... Perhaps I should bit the bullet and install the development environment on windows. talk about humbug!

So.... my question for some of you readers out there. What are some common techniques used for this? What are things I can try to decode the data? My serial number seems to be encoded in the data, but I have yet to figure it out as things are either encrypted or on the bit fields and not at the byte boundaries. Any one have advice/suggestions as I'm all ears! Even better.... anyone want to join me with this project?!

Github!

Finally got around to posting some code to github... long overdue!
https://github.com/kamaaina/cpp-projects

GPS with OLED

Wow, it's been a while since I've made a post... I've been playing around with the the Adafruit GPS for a while now as well as messing with different OLED's as well. I came across a board from @mikerankin that combined both into one with an Arduino Pro Mini. AVR programming has also been taking a lot of my spare time and so I thought this would be a great project to consolidate everything I've learned so my goal was to write native C code compiled with avr-gcc and upload it to the board with avrdude instead of using the Arduino IDE (though that works with this board and would be much easier; but where's the challenge there!). Here are a few pics from the work in progress...

These pictures show the main screen and the board itself. Upper left corner is the temperature reading, upper right is the number of satellites that the GPS receiver is connected to. Bottom shows the format of the time (12h or 24h format is supported). Bottom right is the date and in the middle is the time.

This picture shows the trip summary as it tracks distance much like an odometer of a car. I changed the distances from metric to US measurements, but forgot to change the labels accordingly (oops! I know what I'll be doing after I post this)

This next screen shows the altitude (upper left), number of satelliets (upper right), course (below number of satellites) and speed in miles per hour.

This is the back of the GPS Board and you can see the Atmega 328 microprocessor , FTDI chip, resistors, LEDs, etc. You can refer to Mike Rankin's page for schematics and other details.

These pictures show the status LED for the lipo battery (red is charging and green is charged).

Lastly, this is a side view of the board. You can see the GPS module that the OLED hovers above on.

There are many more features that I have not discussed (ie. resetting the trip meter, saving a lat/lon position, saving data, etc). Those are all included in the original sketch which was done by Karman and posted to his blog. However, that sketch didn't work out of the box for me and kept crashing. I've since modified it to toggle between metric and US measurements, fix the crashing bug, and a few other minor fixes with some graphics and font modifications.

ATtiny85 and V-USB on a breadboard

Using an ATTiny85 chip, I programmed it to emulate a USB device and stuck it on a breadboard with a mini USB breakout board. It's not the nicest layout on a breadboard, but it gets the job done. Plugging the USB cable into the computer, it runs the code and a USB slave device shows up. I have a custom driver communicating with the chip over USB.

Trinket with V-USB

A few months ago I stumbled upon Joonas Pihlajamaa's tutorial about AVR ATtiny USB Tutorial. His tutorial is very informative and got me interested in communicating with AVR chips via USB. In his tutorial, he used an ATtiny2313 chip on a breadboard with different components to demonstrate things. Since, I'm not an electrical engineer and don't know too much about putting all that together I didn't pursue his setup.

In came Adafruit's Trinket which is conveniently mounted on a PCB and has a USB interface with a ATtiny85 chip. I then set out to try to replicate his tutorial on this hardware. I didn't know much about avr-gcc so I got to learn about that in the process. In my prior post, I detailed out how to setup your environment, compile a simple program, and upload it to the trinket so refer to that if you are reading this first.

A lot of the magic happens in the V-USB library which does most of the heavy lifting for us. Since the ATtiny85 doesn't have a USB stack on that chip, we must use this library and software to emulate it. The configuration from Joonas' tutorial was a bit different as port's and pins differ between the ATtiny2313 and ATtiny85. 99% of the code is already listed in his tutorial so I am not going to re-invent the wheel here as you can refer to his tutorial for the code. Here is the hex file you will need to upload to the trinket. Using his usbtest binary, you can interface with your trinket over USB!

avr-gcc adafruit trinket example

I've been interested in learning more about programming microcontrollers and saw that Adafruit has a low cost board (called trinket) that is very convenient since it can be programmed over USB. When I first got my hands on this, I was making sketches for it using the Arduino IDE, but wanted to dive in at a lower level and be able to write C code and reprogram the Attiny85 chip that is on board. There are many different ways to do this, but here is the way I went about doing it.

Install the following packages

sudo apt-get update
sudo apt-get install gcc-avr gdb-avr binutils-avr avr-libc avrdude

You should now have an environment that you can compile and link code for Atmel microprocessors. The last package (avrdude) is what we will use to program the chip. Here is an example of how to blink the LED on pin 1 of the trinket (the red LED).

// blink.c
#include <avr/io.h>
#include <util/delay.h>

// prototype
void wait_sec(int seconds);

int main (void)
{
   // direction register
   DDRB |= 0x03; // pin 0 and pin1 as output
   while(1)
   {
      PORTB |= 0x02; // LED ON
      wait_sec(1); // sleep
      PORTB &= 0x01; // LED OFF
      wait_sec(1); // sleep
   }
   return 0;
}

// sleeps the specified amount of seconds
void wait_sec(int seconds)
{
   int i;
   for(i=0; i<seconds; i++)
      _delay_ms(1000);
}

You can compile the code with avr-gcc. At the time of writing this post, I'm using avr-gcc version 4.7.2. For this contrived example, I will not create a makefile, but it's usually good practice to do so.

avr-gcc -I. -I. -g -mmcu=attiny85 -DF_CPU=8000000UL -Os -fpack-struct -fshort-enums -funsigned-bitfields -funsigned-char -Wall -Wstrict-prototypes -Wa,-ahlms=blink.lst -c blink.c -o blink.o
avr-gcc -Wl,-Map,myproject.out.map -mmcu=attiny85 -lm  -o myproject.out blink.o 
avr-objcopy -j .text                    \
  -j .data                       \
  -O ihex myproject.out myproject.hex
avr-objcopy -j .eeprom                  \
  --change-section-lma .eeprom=0 \
  -O ihex myproject.out myproject.ee.hex
avr-objcopy: --change-section-lma .eeprom=0x0000000000000000 never used

If things went smoothly, you should now have a file called myproject.hex. This is the binary we will program the chip with using avrdude. To program the trinket, press the reset button so the red LED blinks which signifies it's in bootloader mode. Execute the following to upload and program the chip.

sudo avrdude -c usbtiny -p attiny85 -U flash:w:myproject.hex

avrdude: AVR device initialized and ready to accept instructions

Reading | ################################################## | 100% 0.00s

avrdude: Device signature = 0x1e930b
avrdude: reading input file "myproject.hex"
avrdude: input file myproject.hex auto detected as Intel Hex
avrdude: writing flash (116 bytes):

Writing | ############################                       | 55% 0.03savrdude: 6 retries during SPI command
Writing | ################################################## | 100% 0.07s



avrdude: 116 bytes of flash written
avrdude: verifying flash memory against myproject.hex:
avrdude: load data flash data from input file myproject.hex:
avrdude: input file myproject.hex auto detected as Intel Hex
avrdude: input file myproject.hex contains 116 bytes
avrdude: reading on-chip flash data:

Reading | ################################################## | 100% 0.01s



avrdude: verifying ...
avrdude: 116 bytes of flash verified

avrdude: safemode: Fuses OK

avrdude done.  Thank you.

Once the chip is programmed, you should see the blink code running.

I2C Library for BBB and Pi

I've been getting numerous requests to share my I2C Library. There are a few other things I'm adding to my github repository before I publish it, but in the meantime, here is the I2C library. Using and/or downloading it means you do so at your own risk.

This is nothing fancy as I only did what I needed to for my projects. This library works on both Raspberry Pi and BeagleBone Black for my Adafruit 128x64 OLED module.

i2c.cpp and i2c.h