Reverse engineering – Tim's Blog

A surprising IC in a LED light chain.

LED-based festive decorations are a fascinating subject for exploration of ingenuity in low-cost electronics. New products appear every year and often very surprising technology approaches are used to achieve some differentiation while adding minimal cost.

This year, there wasn’t any fancy new controller, but I was surprised how much the cost of simple light strings was reduced. The LED string above includes a small box with batteries and came in a set of ten for less than $2 shipped, so <$0.20 each. While I may have benefitted from promotional pricing, it is also clear that quite some work went into making the product cheap.

Analysis of the Gen2 Addressable RGB LED Protocol

The WS2812 has been around for a decade and remains highly popular, alongside its numerous clones. The protocol and fundamental features of the device have only undergone minimal changes during that time.

However, during the last few years a new technology dubbed “Gen2 ARGB” emerged for use in RGB-Illumination for PC, which is backed by the biggest motherboard manufacturers in Taiwan. This extension to the WS2812 protocol allows connecting multiple strings in parallel to the same controller in addition to diagnostic read out of the LED string.

Not too much is known about the protocol and the supporting LED. However, recently some LEDs that support a subset of the Gen2 functionality became available as “SK6112”.

I finally got around summarizing the information I compiled during the last two years. You can find the full documentation on Github linked here.

Analyzing a Copper String Light with unusual Phosphor Converted LEDs

After being amazed about finding a really clever implementation of powerline controlled LEDs in a low cost RGB “copper string light”, I bought a few other products in hope to find more LEDs with integrated ICs. At less than $4.00 including shipping, this was by far the cheapest LED string I bought. This one did not have any ICs inside, but I was still surprised about finding rather unusual phosphor converted LED technology in it.

Controlling RGB LEDs With Only the Powerlines: Anatomy of a Christmas Light String

The RGB curtain predictably turns into a mess of wires when not used according to instructions.

As should be obvious from this blog, I am somewhat drawn to clever and minimalistic implementations of consumer electronics. Sometimes quite a bit of ingeniosity is going into making something “cheap”. The festive season is a boon to that, as we are bestowed with the latest innovation in animated RGB Christmas lights. I was obviously intrigued, when I learned from a comment on GitHub about a new type of RGB light chain that was controlled using only the power lines. I managed to score a similar product to analyze it.

Power Analysis: Probing WS2812 RGB LEDs

Power analysis is a technique to probe the inner workings of an integrated circuit by measuring changes in the supply current. Whenever a logic gate switches, it will cause a tiny current spike that can be measured externally. By inspecting the temporal variation, especially in reaction to an external signal, it is often possible to deduce information about the construction of the IC.

A few years ago I used a logic analyzer to investigate the protocol of the, then new, WS2812 RGB LED. So, why not revisit this topic to test my newly acquired deep sampling oscilloscope?

SK9822 – a clone of the APA102?

Two years ago I took a deeper look into the APA102. Although it was more expensive than the common WS2812, and harder to come by, it had some intriguing properties. The main benefits are a timing-insensitive SPI interface, allowing easy interfacing to standard periphery, and a much higher PWM frequency of >19kHz, making the APA102 almost flicker free.

So much about that. Considering how things with LEDs from China go, it should not take too long for clones to appear? Indeed! Recently, several comments showed up on my blog, reporting about issues with APA102 LEDs they bought. It quickly turned out that these were SK9822, APA102 clones from the same company that already brought the SK6812 to us, a WS2812 clone.

One of these people was Mike. He developed the Weblight, a WebUSB controlled RGB LED. The prototype (shown below, red pcb) worked well, but when he commissioned a small production run (black pcb), the LED started to show odd update behavior. Mike was nice enough to share a couple of boards with me for further investigation.

Continue reading “SK9822 – a clone of the APA102?”

“Reverse engineering” a real candle

Two years ago, I spent some time analyzing the algorithm used in a candle flicker LED as commonly found in cheap artificial candles. I reverse engineered the algorithm from the flickering pattern and recreated the algorithm in software. Turns out this is of interest for many people who are searching for artificial candle algorithms – there is a surge of traffic every year around December. However, I just reverse engineered one of the controller ICs – this does not mean that this is a good approximation of a real candle.

But how to get there? First, we need to understand how a real candle behaves. In a recent comment, Gary made the excellent suggestion to record a real candle on video and analyze the data. I noticed something similar could be done in a very quick-and-dirty way, by connecting a photodiode to a digital storage oscilloscope.

Continue reading ““Reverse engineering” a real candle”

Understanding the APA102 “Superled”

A couple of weeks ago I reported about a new type of RGB-LED with integrated controller, the APA102. One of the interesting new features of this device is a two-wire SPI interface instead of the proprietary one-wire protocol of the more common WS2812. Many microcontrollers have hardware SPI functions, which allow easy control of these LEDs, as opposed to timing critical bit banging. But it turned out this was not the end of the story. As pointed out by Bernd in a comment, there is some discrepancy between the datasheet and the actual behavior of the devices when it comes to the “end frame”. Reason enough to subject the APA102 to more scrutiny.

The diagram below summarizes the APA102 protocol as found in the data sheet.

Continue reading “Understanding the APA102 “Superled””

Tear down of a cheap external USB battery

I recently received an external USB battery as a promotional gift (see image below). While I always thought of these as a superfluous gimmick, I realized that these devices could be quite useful as mobile power source for various projects. After all, dealing with lithium ion batteries in your own projects can be dangerous and you need additional circuitry to ensure charging and voltage conversion.

External USB batteries can be charged with a normal micro-b USB charger and are supposed to output stabilized 5V at above 1A. And they come fully integrated at a price point where it is difficult to get even the battery alone. See Aliexpress for example and many others. Since there is little reason to trust hardware at this price point, I decided to tear the device down to see whether all the necessary parts are there.

Continue reading “Tear down of a cheap external USB battery”

Follow up on Candle Flicker LEDs

I previously reported on reverse engineering a candle flicker LED. My approach was to extract the “flicker” pattern from the input current variation and to deduce the algorithm from statistical analysis.

Reverse engineering the controller chip

Of course there is another, more involved, approach. And that is to reverse engineer the circuit directly from the die. Andrew Zonenberg from Siliconpr0n decapsulated and imaged the controller chip from one of my LEDs. You can find his report here.

He managed to obtain very high-resolution optical microscopy images of the top-level metal. It turns out that the controller chip is manufactured in a relatively coarse CMOS process with one metal layer and 1-2 µm resolution. This is 1980ies technology. But of course, that is all that is needed for a circuit as simple as a flicker-LED.

Continue reading “Follow up on Candle Flicker LEDs”