Let me first say I am only a hobbyist self taught and by no means any sort of technician.

My brother owns a very popular manufacturers telescope and suddenly it stopped working and failed to power on.

As it was out of warranty he asked me to take a look at it due to the cost of the repair was more than the cost of a replacement.

When I received it from him I soon discovered there was a direct short between ground and the +12v rail in the computerised mount..

I contacted the manufacturer who wouldnt offer any real assistance, and only kept telling me i need to purchase an upgraded mainboard for the mount.

I dont give up quite so easy

I worked my way through the board and soon discovered that there was no real supply protection circuitry within the mount and having tested all of the surface mount caps and regulator which would usually give this type of fault i turned to what was left, just the main IC's.

i desoldered the 80pin kinetis  MK20DX256VLK10 and replaced it with a blank chip and bingo, the mount powered up.

obviously it wouldnt work as there was no software on it.

I then contacted the manufacturer of the mount again and explained the issue was the main processor and discussed with them the lack of protection circuitry, they assured me the updated main board has better protection and I would need to still purchase a new board.

I asked them if it was possible to get the firmware for the processor as I could not read it from the damaged chip so I could at least get this board back up and running, they wouldnt help me with it

As my father always said tho, theres always more than 1 way of skinning a cat

I know the manufacturer releases bugfix's for their hardware, so I turned my attention to their latest bugfix update package..

It is released as a java package( im not a computer programmer either by the way)

but I do know winzip can be used to unpack java,

I ended up with a full directory of about 100 java files which I started going through to give me some ideas of what and where to look at.

at the same time I wanted to understand how the package updated the kinetis chip,

from the update instructions, i knew the software used a serial connection to the hand controller

I made up a serial lead and instead of connecting it to the hand controller i connected it to a raspberry pi,

i wrote a small python script to capture any binary data from the pc that i was running the update software on,

it didnt capture very much so i started echong it to the screen using a bin2hex library.

after a while of looking at it, i noticed there was something common within it, basically a set of 3 bytes,

i inserted a line break at every occurance of these bytes and soon realised they were basically being used as start and stops.

I looked for these bytes in the java code and then learned that these were indeed the start and stop bytes, the next pair of bytes was an instruction byte followed by the data and then length and then a checksum.

knowing all this, i then connected the raspberry on a seperate serial port to the hand controller, and ran the update again.

i now could see data coming back from the hand controller as well, the hand controller was looking for any attached hardware.

i knew without any software on the mount it would not see the mount. so i started digging further into the java software.

I found when it searched for the software on particular responses it would read in some binary files, i managed to figure which binary files was associated with each type of hardware and most importantly which ones was used for the mount i was working on.

each of the binary files had their own file headers and data sections which i was able after many hours to figure out.

there was in total 7 binary files required for the mount and each file was lightly encrypted with the exception of one.

I read up on the kinetis bootup and found it could be programmed in such a way that the bootloader could be at the top or bottom of memory,

the mount had a 2nd large flash chip in it which was unharmed, and knowing the way the kinetis chip maps memory and uses a flash chip i knew the bootloader would have to start at address 0x0h and the most it could use was 400 bytes.

i dug into the java many times rerunning and recapturing responses from the hand controller and started inserting my own responses from what i was learning.

after a few days i finally was able to capture the bootloader being sent from the suspected binary file to the hand controller which should pass it to the motor controller.

obviously the hand controller couldnt pass it as it was my responses on the raspberry  that triggered it being sent from the upgrade package it wasnt the hand controllers.

but i had now got the bootloader stored in its binary decrypted format on the raspberry

now the easy bit

burn the bootloader to the kinetis chip,

i found the pads for what should be a jtag interface on the board and tried to burn the bootloader via that, it was quickly apparent that it wasnt working. after some tracing i discovered that it wasnt completely connected and had to solder a thin wire directly to the unconnected pin on the kinetis chip.

as soon as i did this i was able to program the bootloader in.

woohoo, getting somewhere ))

fingers crossed now,

i ran the upgrade package again, still capturing everything on the raspberry.

bingo!!!!!

i could now see the hand controller replying to the upgrade software that there is a mount attached.

i selected the mount and software package within the upgrade application and i was able to fully update the mount with the latest software )))

My brother is a happy bunny now, his mount completely working again for the price of a £10 chip and some time and patience.

Im happy as i was able to fix it for him and learned so much in the process )

I have since connected the raspberry between the hand controller and the mount and captured all the commands on that for its movement and speed controls etc,

The intention is to write a small program that will interface between an open source PC application and the mount so he can use it connected to the PC as a computer controlled mount for looking at distant galaxies and nebulas.

Wow, an impressive amount of reverse-engineering in your example. Also you have the satisfaction you can tell the manufacturer (politely) that it's a shame they didn't design mount version 1 properly but you still don't need their upgraded mount.

Another side of me thinks with effort and self-taught skills like that you'll never be out of work or demand !

Feel free to post some blogs on Element14 about any future teardowns or hardware hacks you get up to, they'll make good reading I'm sure

Thankyou,

I do get a fair few people bringing me things to fix  

I have since contacted the manufacturer of the telescope to advise them how I was able to fix my brothers scope, and I know the fault is a common issue from reading the astronomy forums. The manufacturer has actually asked me not to publish the dumped image as they do not want their firmware copied. being honest tho, i would like to publish it so other people could fix their own telescopes mainly because i feel the manufacturer was so unhelpful and was just using the fault as an opportunity to take even more money from their customers. Its not as if these mounts and telescopes come cheap.

while fixing the mount I was also in contact with the UK's largest astronomy shop and their technicians, these guys was at least trying to be helpful, and also a more local small astronomy 2nd hand dealer. I have told both of these how I repaired it but have not given them the firmware. The large store was quite amazed how I did it and have never heard of someone able to repair the fault before.

The local store has actually asked me to fix one of their mounts for them, they have a larger mount by the same manufacturer with what they believe is a similar issue

They are going to drop it to me after Christmas for me to take a look at for them

I am pretty sure I can do it the same way as most of the manufacturers mounts use the same software to update their telescopes

I also now know when the updater completes it does lock the kinetis chip to protect the chip from being read so the manufacturer really does not want people to get their hands on it.

during the final captures i was able to capture all the software for the telescope, including all the star mapping data, location data everything, i have the complete images of both the kinetis chip which is really used just for the bootloader and update control and the extended memory flash chip which stores all the star and location data and configuration settings etc. each type of data is stored at specific memory locations and each block of data has calculated checksums. I have figured out each location and the checksum routines, the checksum is actually a modified crc16 checksum and can be easily reversed so i wrote a small routine to do it

As for releasing the firmware on the astronomy forums so people can repair their own mounts, I havent done this yet as I really dont understand where I would stand legally and could I get in trouble for releasing it or not in its raw image format decrypted.

Im sure I am fine explaining how I have done it so others can follow what I have done but as for releasing the actual firmware I think would be a bit of a grey area and I am a bit concerned that i might get in trouble if i was to release it.

Thankyou,

I do get a fair few people bringing me things to fix  

I have since contacted the manufacturer of the telescope to advise them how I was able to fix my brothers scope, and I know the fault is a common issue from reading the astronomy forums. The manufacturer has actually asked me not to publish the dumped image as they do not want their firmware copied. being honest tho, i would like to publish it so other people could fix their own telescopes mainly because i feel the manufacturer was so unhelpful and was just using the fault as an opportunity to take even more money from their customers. Its not as if these mounts and telescopes come cheap.

while fixing the mount I was also in contact with the UK's largest astronomy shop and their technicians, these guys was at least trying to be helpful, and also a more local small astronomy 2nd hand dealer. I have told both of these how I repaired it but have not given them the firmware. The large store was quite amazed how I did it and have never heard of someone able to repair the fault before.

The local store has actually asked me to fix one of their mounts for them, they have a larger mount by the same manufacturer with what they believe is a similar issue

They are going to drop it to me after Christmas for me to take a look at for them

I am pretty sure I can do it the same way as most of the manufacturers mounts use the same software to update their telescopes

I also now know when the updater completes it does lock the kinetis chip to protect the chip from being read so the manufacturer really does not want people to get their hands on it.

during the final captures i was able to capture all the software for the telescope, including all the star mapping data, location data everything, i have the complete images of both the kinetis chip which is really used just for the bootloader and update control and the extended memory flash chip which stores all the star and location data and configuration settings etc. each type of data is stored at specific memory locations and each block of data has calculated checksums. I have figured out each location and the checksum routines, the checksum is actually a modified crc16 checksum and can be easily reversed so i wrote a small routine to do it

As for releasing the firmware on the astronomy forums so people can repair their own mounts, I havent done this yet as I really dont understand where I would stand legally and could I get in trouble for releasing it or not in its raw image format decrypted.

Im sure I am fine explaining how I have done it so others can follow what I have done but as for releasing the actual firmware I think would be a bit of a grey area and I am a bit concerned that i might get in trouble if i was to release it.