Reverse Engineer Inova Lightlink Wallboard

Got a hardware problem? ask for help

Re: Reverse Engineer Inova Lightlink Wallboard

Postby merlinn31 » October 2nd, 2014, 3:19 pm

I have access to a similar board and the person who manages it threw out the software last week


Why would they do that :(
merlinn31
 
Posts: 10
Joined: September 18th, 2014, 6:28 pm

Re: Reverse Engineer Inova Lightlink Wallboard

Postby billatq » August 9th, 2015, 5:04 pm

Ever get anywhere with this? I just picked one of these up this week. The modbus thing sounds promising, especially since it supports both ethernet and serial and has a concept of an extra address.
billatq
 
Posts: 2
Joined: August 9th, 2015, 5:01 pm

Re: Reverse Engineer Inova Lightlink Wallboard

Postby kaizen » August 11th, 2015, 2:04 pm

I also picked up one of these at Defcon last week. Did anyone figure out how to program it?
kaizen
 
Posts: 1
Joined: August 11th, 2015, 1:59 pm

Re: Reverse Engineer Inova Lightlink Wallboard

Postby moff3tt » August 13th, 2015, 10:17 am

[EDIT]: I too bought one at defcon to learn some new hardware/software. I'm trying to go the easy route and source documentation since reverse engineering is out of my league at the moment. Just FYI.

I attempted to create an account on Inova's support site, and they replied very quickly questioning me since I put "freelance IT" and "self employed" but after talking with a representative about the wall board this is what they had to say:

Hello I am sorry but that board is out of support and has not been supported in 8 to 10 years. Either way I do not have any documentation on the board. The only software that would run the board in proprietary and starts around $5000. I can get you in touch with our Account reps if you want. Please let me know if you have any questions.


Thank You,


Ryan Nader
Tech Support Manager


However, all is not lost. I recall a similar looking wall board at my old university. I also recall someone programmed it within the last 3-4 years. I am also friends with the old officers of the club that had ads on it before it just sort of stopped being used. I still have friends attending the university so I have reached out to them to find out if it is an Inova board and if so what the part number is. I also contacted the old president of the club asking about it. I will let you guys know what I find.
moff3tt
 
Posts: 2
Joined: August 13th, 2015, 10:12 am

Re: Reverse Engineer Inova Lightlink Wallboard

Postby freebie » August 13th, 2015, 7:22 pm

+1 for interest in this.

When I configure my machine as a router for the device, TCP port 5002 is open on the address it displays during boot up.
Opening that port in browser prompts a download of a 0 byte file... Telnet on that port connected but it was echoing back what I was sending, prefixed with some language garbage.

(There may be more ports open, that was according to the output of nmap 172.16.72.230 -Pn)

Was hoping this could be connected to a RPi or Arduino to show jukebox now playing, etc.

Getting more physically hacky, has anyone opened this up to see how the LEDs are communicating? Maybe it's possible to swap some boards inside in order to get rid of the janky 90's windows garbage interface and clean it up with a modern RESTful interface?

I can disassemble mine and take close up photos if there is interest. Not as hardware centric as I want to be, sadly.
freebie
 
Posts: 2
Joined: August 13th, 2015, 7:17 pm

Re: Reverse Engineer Inova Lightlink Wallboard

Postby hfiennes » August 13th, 2015, 11:10 pm

I got some at DEFCON too and having given up on the controller, we looked at the modules themselves:

- Each module is 40x8 pixels (so the 160x24 row displays have an array of 4x3 of these
- Each module row is daisychained and fed separately from the control board.
- Connections are 10 pin in/out and a hefty 5v power connector
- Each module has 10x8 bit shift registers and a 3 to 8 line decoder, plus a circuit that appears to be doing brightness control (it's an oscillator whose output is connected to one of the enables on the column driver shift register)

Some poking about revealed the 10 pin connector contains:

- Pixel clock (SCLK)
- Latch clock (RCLK)
- Three row address pins
- Row address latch pin
- Two data inputs, one for red and one for green. Red drivers are chained and green drivers are on a separate chain
- One ground pin
- One as yet unknown pin (might be brightness control)

The drive sequence is set address, address latch hi, RCLK pulse low, address latch lo, clock in pixels with positive pulses on SCLK, and repeat.

A little hacking about with an imp got it to light up, but I had to drop the panel voltage to 3.3v (the imp only drives at 3.3v and the panel's logic was not very convinced that this was high enough to be a logic 1). Going to play a bit more and see what can be driven simply; I think it should be scannable with an arduino and some bit-banging.
hfiennes
 
Posts: 4
Joined: August 13th, 2015, 10:57 pm

Re: Reverse Engineer Inova Lightlink Wallboard

Postby moff3tt » August 14th, 2015, 11:03 am

moff3tt wrote: *snip*
However, all is not lost. I recall a similar looking wall board at my old university. I also recall someone programmed it within the last 3-4 years. I am also friends with the old officers of the club that had ads on it before it just sort of stopped being used. I still have friends attending the university so I have reached out to them to find out if it is an Inova board and if so what the part number is. I also contacted the old president of the club asking about it. I will let you guys know what I find.


Update: The board at my old university is not of the same model but I haven't yet confirmed that it is not the same make. The person who was in charge of it got fired a few years ago but left the computer and software to the same club I have a lot of friends with. Hoping to talk them into removing it from the ceiling it's hanging from. Even if it isn't the same make I wonder if the hardware is the same or similar enough we could at least have some sort of start with the software to run that board perhaps.

Another avenue would be finding out if the boards that are listed here have the same underpinnings as our boards.

Of course gutting the control boards that are in it and replacing them with modern components that will just run the led boards like they're any other electronics project seems to be the easiest way for these esoteric boards.
moff3tt
 
Posts: 2
Joined: August 13th, 2015, 10:12 am

Re: Reverse Engineer Inova Lightlink Wallboard

Postby Overlord-Cob » August 18th, 2015, 1:59 pm

Hey, I also picked up one of these at DefCon. Anyone here figured it out yet?
Overlord-Cob
 
Posts: 1
Joined: August 14th, 2015, 4:40 pm

Re: Reverse Engineer Inova Lightlink Wallboard

Postby billatq » August 23rd, 2015, 4:32 pm

I was playing with this a bit today. Like other folks, I noticed that there is something listening at port 5002 that doesn't seem to be all that useful. When the hardware turns on, it doesn't send out anything interesting onto the network when it starts up either.

The output on 5002 seems to be something that will take a command and echo it back out, but it doesn't look like it's anything particularly standard. I sent gibberish over the wire and hit return (0x0d 0x0a) and got back a response with a 28 byte payload that always ends in 0x0 0x0 0x0 0x1. The beginning of the data is something like 0xff, 0xf4, 0xff, 0xfd, 0x06, followed by the thing that I put in, which has been truncated down, it appears.

I went ahead and cracked the thing open to look around. I noticed a few interesting things. It looks like this driver board has up to 10 output that go to led controllers, but there are only three in use. It looks like each one is a line of leds that are daisy chained together. It uses an HCT244 driver to run each one of those.

The CPU is a Motorola XPC860DECZP50C1, which is in the PPC MPC860 family. It has a built-in 10Mbit ethernet interface, and actually can drive a number of lines out, enough to run a display like this with enough switching. I'm kind of surprised there's an FPGA at all.

On an led driver board board itself, it looks like each LED (an LTP-23548AA-NB) is driven by a TPICB595 shift register and a CTS 768163390G resistor. It looks like there is another HC244 for the daisy chained driver.

My guess for how this thing works is that it's a big shift register and that you write a byte at a time into the register and strobe the the clock. Seems simpler than figuring out the monitor.

Note that this all uses 5V logic that requires a minimum of 4.5V per the datasheets, so I could see why a 3.3V system wouldn't work here. Next step I think is to start fiddling with the pins on a driver board and see if I can get it to do anything interesting.
billatq
 
Posts: 2
Joined: August 9th, 2015, 5:01 pm

Re: Reverse Engineer Inova Lightlink Wallboard

Postby hfiennes » August 23rd, 2015, 6:42 pm

Having given up with the controller board, I built one with an Arduino and an imp :)

Essentially, the Arduino bit-bangs the display - 6 bits at a time (R & G for each 8-row segment per clock from an in-ram framebuffer - and takes updates to this framebuffer over serial. The screen format is a bit strange to allow the arduino to be doing nothing hard, but the imp converts buffers before it pushes them down to the display. The UART link runs at 500kbit between the two (which, given the simplistic format I've picked for both RAM framebuffer and serial, means 1280 bytes per frame or almost 40Hz update at 500kbit). The imp is doing font rendering and can be pushed updates via HTTP (or it can fetch stuff and display it). Not had time to play with graphics yet but yeah, this is obviously pixel addressable.

There are zero components needed, just wiring. I suspect that as I've got 4 of these displays from DEFCON, I'll knock out a quick PCB for an arduino shield which has the three 10-way display matrix connectors on it... likely to get a whole panel made so there will be spares if anyone needs them, I'll tidy the code a bit and publish that at the same time.

I'm fairly bemused as to why Inova needed an FPGA and PPC to drive this thing... though that controller would also do bigger displays, I guess.

IMG_5671.JPG


IMG_5670.JPG


IMG_5669.JPG
hfiennes
 
Posts: 4
Joined: August 13th, 2015, 10:57 pm

PreviousNext

Return to Help me! Hardware

Who is online

Users browsing this forum: Bing [Bot] and 2 guests