Monday, July 23, 2007

Salvaging LCDs from all the wrong places

I've always had this urge to salvage components from unused, unneeded, broken gadgets, especially when it comes to LCDs. This one is in an Ascom Eurit 22 ISDN telephone, the handset I've already modified (added a pair of jacks ) for use with a PC, was using it mainly for Skype.

The base unit however resisted a previous attempt at modification where I tried reading the flash and modifying the firmware to make it do something else other than what an ISDN phone is supposed to do. There wasn't much info on the MPU either.. I remember finding some compiler for it on a Renesas site but never actually got down to anything serious because of the issues with reading the flash.

A few days ago out of boredom I took another look at the PCB and the display controller. It's a PCF8578T from Philps. I realized that it works through I2C so I booted up Knoppix , quickly compiled milksop's milk app, connected the I2C pins to the lpt port and started a CheapI2C sniff, after several failed attempts in Windows with BSLA's I2C decoder (had to poke the exe into actually doing anything without a BSLA besides showing demo data) I had some trouble with milk app at first because it doesn't like hyperthreading.

After disabling hyperthreading it worked like a charm though. I got the output:

Milksop GPL Reflasher - 0.20 - (c)2002 [email protected]

CheapI2C on printer port at 0x378

Entering capture mode, your PC will appear frozen - press any key to end

Starting realtime...

Stopped realtime...

Monitoring completed

12.064mS: 3C W 55

1.867 S: 3C W E0 88 70 00 28 00 44 00 28 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 3A B8 1B B0 01 28 00 . p . ( . D . ( D . . . . . . . . . . . . . . ( : . . . . ( .

Now 3C being 0111100 is the I2C Slave ID for the PCF8578, 55 is a SET MODE command that just sets up and activates the display, and on the next line is an actual RAM ACCESS command that is used to modify the display ram aka. write to the display. I did several I2C captures this way.

Then I cut the trace connecting the PCF's I2C pins to the phone's MPU and coded up an app to drive it from the LPT port. For every character on the display 2 bytes are sent after E0 88 70, then after the 14 characters of the display there's a final byte the works the last 3 icons ( the A B C )

The configuration is like this:

So here's the outcome. Driving it off the LPT port.

Netelligent modification

Well I received a 233MMX Compaq Armada with some PCMCIA lan cards from a friend. Since finding a dongle seemed to be near impossible and probably would've been too expensive to be worth it I ended up taking one apart. I guessed the pinout, it worked on the first try. Basically just followed the traces to the LAN magnetics chips and hooked up the two pairs of the CAT5 to those.

The cards are both labeled Compaq NETELLIGENT 10/100 PC CARD (they are actually Xircoms based on the Xircom Dingo chip). One had two dongle connectors while the other had only 1.. that's the one I opened up. Wired it up like so:

from left to right, TX+(RJ45 pin 1) TX-(RJ45 pin 2) RX+(RJ45 pin 3) RX- (RJ45 pin 6)

If you ended up here while looking for info on this praticular lan card and you either have a suitable connector or want to solder into the connector without opening up the card or something then you would want to know that those points I soldered to should correpsond to pin 1,2,14,15 on the (now removed) 15pin dongle connector probably in that order. I just didn't want to solder onto the pads because they were too close together and I had no connector.


got IP from my DHCP, success!

Apply epoxy, and even more epoxy

Apply shrink tubing and a desoldered RJ45 connector from broken pci lan card (and some more epoxy for good measure), Enter the Ghetto Dongle.