Connor McMillan

connor@mcmillan.website – http://github.com/mibs510

OpenWRT for WS-WN529B3

My previous attempt was trying to get OpenWrt running on a WL-WN575A3 which I ran to dead end as far as making it usable. I’ve got a hold on a WS-WN529B3 which happens to run on the same hardware just with an additional possible UART port which I’ve yet to determine which pin hole belongs to RX, TX, GND, and VCC. It is running on a OpenWrt root file system as seen on the telnet login page, the password is not set by the web interface like the previous device and is locked out. The possibilities on this device is unlike the other, since we know it’s running on a OpenWrt root file system there is a chance to (a) use a vanilla OpenWrt image + kernel module or (b) use the existing kernel on the device but reintroduce a vanilla OpenWrt root file system. I’m hoping that the kernel module for the radio wasn’t written like the other where the kernel module managed everything from startup to configuration but instead like any other typical wireless module.

Continue reading

OpenWRT for WL-WN575A3

The brother got one of these hoping to strengthen the wireless signal upstairs but it couldn’t connect to the original AP downstairs due to a weak signal at all outlet locations. Since he has no use I asked to use it for fun. I began by taking it apart and examining any signs for easy UART access but found no luck . Wavlink has no intentions of making their devices secure, a telnet port was found open on port 23, this is the same scenario for most of their other products. Some of Wavlink’s products are sold with heavily customized OpenWrt images already running, although this one isn’t the intention is that it will.

Continue reading

MS43 CAN BUS

Eventually this will also be posted onto ms43wiki.com page but for the sake of leaving personal comments I’ve decided to first post it on here first. Ever since I’ve been interested in converting my cluster from analog to digital I’ve been think of the most obvious ways of pulling data off from the DME/ECU to display them digitally. We know that all cars have at least one type of OBDII standard communication whether it is CAN, K-Line, L-Line, etc identifying the protocol is as easy looking at the OBDII port on your vehicle and examining which pins are present. My BMW Z3 is running on a K-Line bus which I’ve confirmed on Torque as ISO9141-2 at 5 baud. Unfortunately for arduinos a shield supporting K-Line protocol is not as popular as the CAN BUS protocol. Sparkfun has a shield which supports many OBDII protocols including K-Line but it sells at $50 which isn’t really convincing me at the moment. Although an economical K-Line shield isn’t available for the arduino, making one using a L9637D is quite simple. The only issue is the software side which I suspect will require quite a bit of time getting the DME and the arduino to communicate with one another if library’s for the L9637D don’t exist yet.
Continue reading

SIEMENS 7508145 GS20

Siemens GS20 and the MS43 have very close similarities. The biggest is the processor and the EEPROM. Traditionally on the MS43 to read and write we use JMFlasher. Since both have the same processor and the same EEPROM, booting the GS20 into boot mode is just like the MS43, by shorting pin 104 as shown below.
Continue reading

BMW E36 Z3 Cluster EEPROMs

Recently I’ve been interested in converting my analog dash board on my 2001 BMW Z3 into a digital dashboard using an arduino. So I bought a used cluster off of eBay for ~$47 The only part I was originally planning to use was the front half of the dash board to take the dials out and put 5″ LCD screen while keeping the cutouts for the odometer, turn signals, warning lights, etc. That way I would be able to still use the original second half of the cluster to keep the original odometer rolling and VIN number. Curiously I was interested in what was inside the two EEPROMs. The E36 cluster has two EEPROMs, one which is detachable and is believed to store the mileage, and car-specific info such as the size of the gas tank, size of differential gearbox, transmission type, etc. According to realoem.com this EEPROM is described as the “CODING PLUG” and is shown below.
Continue reading