The Christisen's

Finally got around to making a halfway decent tip extender for the Zeno. This extender can be used for sniffing the bus and resetting tips. The Sullins card edge connectors are a bit of a pain to get ahold of. They run a little over $4 a piece with a min qty of 10. Sullins will give samples, which is how I got mine. The best PN for this board would be EMC05DRYN-S13 rather than the EMC05DREN that I used.  Alternatively you could use a double row .100″ header with the pins bent over, which is what I have been using up to this point.

On a different note, I loaded the 90 count tip data into at 60 count tip and the Zeno powered up without any issues or flashing error codes. I did not actually sit and go through 90 uses but I think it is safe to say that any lower count tip can be transformed into a higher count tip.

SEE ALL POSTS ABOUT THE ZENO HACK!!!

Our reset Zeno tips have been working just fine for over a year now without any ill effects. There has been no noticeable change in the performance of the tip.

I would recommend that you backup your tip’s EEPROM before trying to reset it. That way you will have a backup in the event the macro’s below do not work. If you have a brand new tip I would advise you dump its contents before any uses. You can dump your tips contents with the following command at the “I2C>” prompt: [0xA1 r:127] To verify that your tip is indeed a 128 byte EEPROM send: [0xA1 r:255] and verify the contents start repeating at the 128 byte mark.

I have updated the macros to work with Bus Pirate firmware v5.10. With the old 60 count macro on newer BP firmware there seemed to be an issue with turning on the pull-ups before the power supplies, although I never fully investigated it. Also, the macros will not auto run TeraTerm. You must load the macro after you are already connected to the Bus Pirate. Thanks to Ben McClosky for the 90 count tip data dump!

60 Count Macro
90 Count Macro

Also, buy your Bus Pirate from one of Dangerous Prototypes distributors. I bought my second BP from Sparkfun not realizing that none of the proceeds went to Dangerous Prototypes.

SEE ALL POSTS ABOUT THE ZENO HACK!!!

See the updates!

Ever wonder if Zeno tips could be reset or hacked? I have. I find it hard to believe that a 45 count tip or 60 count tip (or whatever tip) is degraded beyond use after the face value count has been consumed. And at ~25 bucks a pop for a 60 use tip, it was at least worth looking into.

***WARNING: REUSE TIPS AT YOUR OWN PERIL***

Cracking open the Zeno revealed a Cypress cy8c27443 microcontroller with the I2C pins routed straight to the tip. Inside the tip is a 128 byte I2C eeprom, four 22 ohm resistors in parallel (heat source), a zener, a thermistor and one other resistor. If I can get to it I will post a schematic **POSTED**. So, with the arrival of my new Bus Pirate v3a by Ian Lesnet I began sniffing the bus. And as it turns out, the Zeno merely increments/decrements a couple of bytes in the tip’s eeprom to signal a use. Shortly after starting a treatment, the uC writes the following: 0x00 at address 64, increments decrements the byte at address 65 and decrements increments the byte at address 66. From there I manipulated bytes 65 & 66 until the Zeno indicated a full tip, which ended up being 0x3E and 0xC1 respectively for the 60 use tips I had on hand.

More to come:
I will be building a tip extender / breakout board for future tip resets and bus sniffing. I will also be looking more into an issue I was having with getting a tip to show full count when only writing to the money bytes at address 64 thru 66. Which very well may have been operator error with the BP as I fumbled around. To get around the issue I just wrote to the entire address range (see macro below).

TeraTerm Macro:
;This is a quick and dirty TeraTerm macro for resetting a 60 count Zeno tip.
;with Ian Lesnet’s Bus Pirate.
;
;Adjust your .ini file for proper Bus Pirate serial port settings.
;
;Requires TeraTerm version 4.27 or later
;
;Only tested with Bus Pirate Firmware v3.0

MyPort = 5

connect ‘/C=MyPort’
mpause 500
;Just Because
send 13
wait ‘HiZ>’
;Bus Mode Menu
send “m” 13
wait ‘(1) >’
;I2C
send “4” 13
wait ‘(1) >’
;Software I2C
send “1” 13
wait ‘(1) >’
;Fast I2C
send “2” 13
wait ‘I2C>’
;Pullups Menu
send “p” 13
wait ‘(1) >’
;Pullups On
send “2” 13
wait ‘Pull-up resistors ON’
;Power Supplies On
send “W” 13
wait ‘POWER SUPPLIES ON’
;Let I2C EEPROM Initialize
pause 1
;Write Data to EEPROM
send “[0xA0, 0, 0x08, 0x00, 0x41, 0x04, 0x97, 0x04, 0xC4, 0x04]” 13
wait ‘I2C>’
send “[0xA0, 8, 0x97, 0x09, 0x1B, 0x00, 0x36, 0x03, 0x00, 0x64]” 13
wait ‘I2C>’
send “[0xA0, 16, 0x0A, 0xF0, 0x96, 0x1E, 0x0A, 0xA5, 0x1E, 0xB4]” 13
wait ‘I2C>’
send “[0xA0, 24, 0x00, 0x78, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x0D]” 13
wait ‘I2C>’
send “[0xA0, 32, 0xC8, 0xFE, 0x3E, 0x01, 0xC2, 0x64, 0x32, 0x0A]” 13
wait ‘I2C>’
send “[0xA0, 40, 0x04, 0x4C, 0x02, 0xBC, 0x00, 0xE1, 0xFF, 0xF6]” 13
wait ‘I2C>’
send “[0xA0, 48, 0x3C, 0xB2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF]” 13
wait ‘I2C>’
send “[0xA0, 56, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF]” 13
wait ‘I2C>’
send “[0xA0, 64, 0x00, 0x3E, 0xC1, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF]” 13
wait ‘I2C>’
send “[0xA0, 72, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF]” 13
wait ‘I2C>’
send “[0xA0, 80, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF]” 13
wait ‘I2C>’
send “[0xA0, 88, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF]” 13
wait ‘I2C>’
send “[0xA0, 96, 0x54, 0x0A, 0x00, 0x01, 0x82, 0x44, 0x5F, 0xFF]” 13
wait ‘I2C>’
send “[0xA0, 104,0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF]” 13
wait ‘I2C>’
send “[0xA0, 112,0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF]” 13
wait ‘I2C>’
send “[0xA0, 120,0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF]” 13
wait ‘I2C>’
;Bus Mode Menu
send “m” 13
wait ‘(1) >’
;Set HiZ
send 13
unlink