Reader contribution

Simon’s tried out my code to see if it’ll work on a newer inverter, the CMS-5000. Unfortunately the library as it stands doesn’t quite work. So let’s take a closer look at the packets:

First we reset the inverter:

SEND -> aaaa 0100 0000 0004 00 0159

Discover inverters:

SEND -> aaaa 0100 0000 0000 00 0155

RECV <- aaaa fe00 0000 0080 0a 52353634363033303631 04fd OK

Mostly OK so far, but something that strikes me is that the first byte (0xFE) of what I assumed to be the source address seems to have some other significance (it’s not 0×0000). Moving on…

Register the inverter with address “0001”:

SEND -> aaaa 0100 0000 0001 0c 523536343630333036310001 0384

The inverter acknowledges

RECV <- aaaa fe01 0000 0081 01 06 02db OK

So even though the first byte of the address 0xFE is incorrect, things still seem to be working.

Now we try to find what status fields the inverter gives:

SEND -> aaaa 0100 0001 0101 00 0158

RECV <- aaaa fe01 0000 0181 01 15 02eb OK

This bit here is the interesting bit. First, (if my assumptions about the comms protocol were correct), the inverter only gives 2 fields: 0×01 and 0×15. That’s really few compared with the ones I’ve seen before. Not only that, but we don’t yet know what the field 0×15 is for. Basically I assumed that the reply I get is a listing of the status fields, but instead I get something else.

So let’s query the inverter for its status:

SEND -> aaaa 0100 0001 0104 00 015b

RECV <- aaaa fe01 0000 0184 12 05dc003c071c0abe1290139a009900e8034a 080f OK

So here we have the full status update from the inverter. We can’t decode what it’s saying, because it doesn’t quite match the status field query. This is why the pv library is failing to interpret this packet based on the received structure that was supposedly just 2 fields long.

What does this mean?

In the most basic level, there are a few assumptions + generalisations that I’ve made which turned out to be inaccurate, hence it’s not working for a different model inverter.

What we’d need now is a capture of the raw communication between the official monitoring software and the inverter to get a better understanding of what’s going on.

So, I went and bought the module, cracked the netbook open and added Bluetooth, all without spending truckloads of money.

Why Bluetooth?

Why do I like Bluetooth so much? I use it to connect my Microsoft Bluetooth Mobile Keyboard 6000 (it’s a fantastic piece of hardware), my Microsoft Bluetooth Notebook Mouse 5000 and my Microsoft IntelliMouse for Bluetooth. The best thing is, I don’t need to attach any dongles, and when I have everything paired, docking the netbook while working on a desk simply involves putting it down and connecting the external monitor. No USB cables to muck around with.

Bluetooth PAN is also great way to get wireless Internet tethering from my phone, and much more power efficient than using Wi-Fi tethering.

Getting the parts

The first step was to see what I needed to add Bluetooth to the netbook. HP’s specifications say Bluetooth v2.0 was indeed an option for this particular netbook. So it means all I needed to do was find the Bluetooth module’s part number, order it and install it. I love it when PC manufacturers publish the maintenance and service guides for the laptops, because it just makes life much easier to perform DIY post-warranty service.

To my horror, ordering HP’s official Bluetooth module costs an arm and a leg, and it doesn’t even include the connection cable between the system board and the module! So I looked for alternatives on eBay.

It was soon obvious that there are overwhelmingly many different Bluetooth modules for laptops. In general, manufacturers design their computers so that the parts are interchangeable between devices. So I searched for "HP Bluetooth Module" and went through the list. Eventually I found a listing for Broadcom BCM2046 Bluetooth 2.1 module plus the cable for roughly AUD$20. Sweet! What’s more, the listing claims that this part was compatible with the HP Mini 2133 and 2140 netbooks. The fact that it also came with 4 screws was rather curious, because the HP Mini 2140 only uses double-sided adhesives to attach the module.

Anyhow, I was willing to give that a try. The most important thing is that the module was compatible (that I didn’t know in advance; it just should work and looks about right), and that the cable had the correct adapters (I had to take the eBay seller’s word for it).

Installing the module

Receiving the goods after about a week and a half, it was time to perform the surgery and disassemble the netbook. First the keyboard came off, exposing the hard drive and the DDR2 memory.

Unfortunately for the HP Mini 2140, the Bluetooth module was located under the palmrest and left of the touchpad. So it’ll take a little more effort to access it. It turns out that even though my netbook didn’t come with Bluetooth, the double-sided adhesive that holds the Bluetooth module in place actually came with the system board. Excellent. That makes my job so much easier.

Final thoughts

For for a mere $20, my little HP Mini-Note 2140 netbook now has Bluetooth! What’s more, the particular module that I bought was Broadcom BCM2046, which is Bluetooth v2.1. Had I gone with official HP parts, not only would it have costed me more than 5x more money, it was only Bluetooth 2.0. Not that there’s very much difference, but 2.1 is meant to give higher data rates and use less power.

A feature of this course is that it is heavily industry-focused, and every week, we have successful real-world entrepreneurs (not just a lecturer) as guest speakers to share their experience and expertise.

Ask TVC is a site our group have launched to share this exclusive opportunity with the world. If you are running a business, or thinking about getting into the game, then fire your questions away. We’ll gather the top rated questions for each speaker and we’ll post the answers after the lecture.

The answers to Tjoos.com (Kim Chen and Bart Jallema) questions are now posted, and we still have Viocorp (Ian Gardiner), Omnisio (now YouTube; Ryan Junee), Atlassian (Mike Cannon-Brookes), and many more to come!

So check us out at asktvc.nfshost.com and let us know what you think.

However, there was a bit of drama behind why I made the change – unfortunate, but a valuable experience indeed. My website was hacked.

On 3 Aug 10 at 1532h, I received a notification email from my blog telling me that a password reset via forgotten password function has been actioned successfully. Knowing that I am the only registered blog user, this was one of two scenarios: either it was a hoax email, or my blog had been compromised (I’ve blurred the name of the hacker who claimed to be responsible, to protect his/her identity):

By the time I read the email, I was on my way home from uni, so the only thing I could do was to assess the situation to find out what has happened. Loading up my website from my phone, it was very clear that my website had been compromised. The immediate action for this security breach was to shut it down completely, but unfortunately I didn’t have access to my web host password then. It’ll have to wait until I get home. I seems that it was a website defacing attack, hopefully with minimal damage.

So, by 1730h, I’ve suspended the entire website first to stop the defacement from being accessible by the public, and then I proceeded to assess the damage. The database content was intact, WordPress itself was intact and functional, and the only damage I could find was to the WordPress theme. That black page really does not look like Sadish’s MistyLook theme. I’ve established what I needed to do fix the damages and recover from this incident. While I’m at it, why not choose a new theme for a makeover!

At 1945h, I reactivated my website, regained control over my WordPress account, but restricted it so no one else has access to the site while it was staging. By 2400h, and after a period of testing, my blog was good to go again. With a brand new theme to replace one that was hacked.

Now, what I still don’t understand is, how was it possible that my account email address was changed (so password reset could succeed). Was it through some kind of SQL injection? Have you had a similar experience, and what did you do?

All that I’m worrying about now is whether or not a backdoor was left somewhere I couldn’t find… Without knowing the mechanism of entry, how do I take steps to ensure that it doesn’t get exploited the same way again?

pv can be found at http://pv.codeplex.com/, and should work for you if you have a Carbon Management Solutions CMS-2000 or Schneider Electric SunEzy 600E (judging from a sample protocol exchange).

I’ll have to give full credit to the folks at http://www.solarfreaks.com/cms2000-inverter-rs232-serial-port-hack-cms-2000-rs232-t271.html who did the initial work on reverse engineering the communication protocols. Building on what has already been done on working out the protocol, and doing a bit of reverse engineering myself, the library supports sending arbitrary data frames for further exploring, as well as the known protocols.

JinbaIttai wrote a Perl script to poll the inverter, but unfortunately I don’t particular like Perl. So, I decided to write my own in my language of choice – Python. Also, a word of thanks to Ingmar for providing a sample of the protocol for the SunEzy 600E.

There are still quite a number of data fields that remains a mystery – getting a hold of the protocol from the CMS-10000 would really, really help.

Here’s a list of the features in the library:

• Craft custom frames to be sent to the serial port
• Reads inverter parameters and status information
• Verifies checksum for received frames
• Enumerates all known messages for quick reference

The module comes with a working example. Just run the package like so:

The code for this sample can be found in __main__.py.

• Carbon Management Solutions CMS-2000 grid interactive inverter
• 10x Solar Enertech SE185-72M 185W Monocrystalline Silicon PV Modules

During the installation, they’ve kindly put a Cat5 cable through the house for the RS-232 serial connection from the PV inverter to the computer. The CMS-2000 is basically a re-badged Solar Energy Australia “Orion” grid feed inverter, which comes with monitoring software “Pro Control” to log data from the inverter. Armed with this software, we can now pull some interesting data to see how much energy we generate at various times throughout the day.

The only problem is, it doesn’t make sense to have a computer switched on 24×7 just to monitor the inverter box – it’d be a massive waste of energy. So the fun begins when I want to monitor the solar inverter from a low-power, embedded computer which is actually a QNAP TS-109 NAS running my favourite Debian linux. More on this in upcoming posts.

Mac users, lucky you. You get a Terminal utility called “say” that converts text to speech. Windows doesn’t come with this tool, so I thought, it couldn’t be that difficult to make my own command line speech synth tool for Windows.

After a bit of research, I found that it’s really quite easy to make thanks to the Speech libraries in the .NET framework. Yep – no more than 30 lines of spaced out C# code:

using System;
using System.Speech.Synthesis;
 
namespace speech
{
    class say
    {
        static SpeechSynthesizer synth = new SpeechSynthesizer();
 
        static void Main(string[] args)
        {
            if (args.Length == 0)
            {
                InteractiveMode();
                return;
            }
 
            synth.Speak(string.Join(" ", args));
        }
 
        static void InteractiveMode()
        {
            string line;
            while ((line = Console.ReadLine()) != null)
            {
                synth.Speak(line);
            }
        }
    }
}

This application can either take its input as command line arguments, or from standard input if it is started without any arguments.

For example:

say.exe foo
(computer says “foo”)
say.exe foo bar
(computer says “foo bar”)
say.exe “foo bar”
(computer says “foo bar”)
say.exe
(computer waits for further input)
foo bar
(computer says “foo bar” then waits for further input)
CTRL+Z then ENTER exits the application

Source code: Speech Synthesiser VS10 Project (.zip, 38KB)
Binary file: say.exe (.exe, 7KB) requires .NET Client Profile 4.0

Enjoy!

I would have to say that this course is one of the least enjoyable and least rewarding courses I’ve done over the years, and would strongly advise those doing Telecommunications Engineering at USYD to not take this course.

Read on for a brief review of the course.

This course was designed to give an insight into a range of mobile communication technologies, as well as some experience in research.

Even though it is a level 5 course, suitable for final year undergraduates or postgraduates, the course doesn’t go into the topics covered with enough detail to be satisfying. It turned out that much of the course is far too general – knowing that something exists and having a vague idea of what it’s used for would be enough to pass the course. I expected that to be assumed background knowledge so that we can dig into each of the topics in detail during the course. Instead, it was all that’s required.

Looking back having finished this course, it’s difficult to point identify much new knowledge I’ve gained from this course, because most of them have been touch on in the past in previous courses. Of the amount of knowledge actually gained, it really doesn’t seem to be all that useful for any intents and purposes.

I was impressed that teaching staff did personally solicit feedback from students to try and improve the course, but unfortunately in the process of giving feedback, I’ve been subjected to numerous reasons why I’m wrong about the quality of the course, and how I’m supposed to to like it. So much for actively listening to feedback. The stunning results are evident when you look at what’s actually been taught in this course. The latest and greatest in mobile technology (as at about 7 years ago). That’s why we’re still learning about AMPS as a mobile phone system, the reason why we apparently haven’t implemented E911 service, and what the lecturer believes we should expect to see in fourth generation (4G) mobiles and why it’s apparently still a fantasy. As I said, this course is overly outdated.

How about an introduction to research? Surely that can’t become outdated. After all, research is a skill. Things like writing a literature survey we still do today! Unfortunately this course’s idea of research was reflected in the assignment. Randomly allocated groups of 4 students were assigned a topic (no choice given!) and was tasked to “summarise” 5 IEEE academic papers in 3 pages of writing including abstract, intro, conclusion and references. That’s right – not a literature survey but just a 5 summaries of papers restricted to being IEEE published. So why are we not allowed to “summarise” possibly better written papers from a non-IEEE journal/conference? Maybe that’s what research is about.

For the course tutorials, what happens is that there is a tutor tasked to read out answers to a series of homework questions we were required to complete before class. Sounds marginally reasonable right? Think of it this way: You’ve just spent a number of hours interpreting poorly written questions and subsequently finding out the required information to write a response. We’re limited by the length of response so there’s no point in going into detail. Having done all that studying, you sit into the 1-2 hour long tutorial just to listen to sample answers read out to you, some of which are obviously inaccurate or incorrect based on the state of today’s technology.

All up, the combination of outdated, shallow content and poorly designed assessments make for an unenjoyable and unrewarding course. My study notes have now been uploaded and is available on my USYD page.

Meanwhile, I’m finalising my course notes for the ELEC5616 Computer and Network Security course, which is among the best courses I’ve done.

I noticed something rather interesting, while digging through the “HTC Test Tool” package. There is apparently a “normal app” called BatteryTool:

    <App xmlns=""
        ProductID="{ae2781c8-7afb-4e16-a643-c9c0ff33fc15}"
        Title="BatteryTool" RuntimeType="SilverLight" Version="1.0.0.0"
        Genre="NormalApp"  Author="" Description="" Publisher="">
...

But yet when we take a look inside the Silverlight .xap file, there is a dll called “COMInterface.dll”. The guess is that HTC’s using COM interop from within the Silverlight application to get access to lower level OS resources.

So even though apps should be running inside its own tightly sealed container in Windows Phone 7, I think it’s quite possible to break out of it via COM. Unfortunately this (ARM?) dll won’t quite work in the x86 WP7 Emulator…