|Published (Last):||2 June 2009|
|PDF File Size:||10.79 Mb|
|ePub File Size:||19.9 Mb|
|Price:||Free* [*Free Regsitration Required]|
We've got blank stares. But I digress. One of the things that has a few people worried is that the clerk at Radio Shack takes down your name and address in their system before giving you a CueCat. However, there doesn't appear to be a way of tying a particular CueCat to a person at the time of purchase although Digital Convergence can most likely trace a CueCat back to a particular Radio Shack.
Although each CueCat has a unique serial identifier, each CueCat package has the exact same bar code on the front which is what the clerk scans in. My goal was to find where that serial identifier lurks inside the CueCat The component that caught my eye was the small 8-pin device U1 on the top side of the board see Figure 4.
For a detailed list of the semiconductor devices see the sidebar. Semiconductor Devices of the CueCat. Unfortunately, ATC doesn't have datasheets for the device available on their page. Not to worry, as other manufacturers, such as Microchip and Holtek, have 93LC46s available.
The datasheet for Holtek's HT93LC46 is located here, and it's a closer match than the Microchip unit, as it implements an ORG pin to control how the memory is accessed in the above picture, the ORG pin is tied to VSS—this would make the unit addressable by 8-bit words if it was actually a Holtek 93LC46, but the ATC unit appears to be set up the opposite way—more on this later.
The first thing I tried was removing the 93LC46 from the board. However, I'm really not equipped to desolder SMT devices, so this was rather futile.
So, I simply soldered some wirewrap wire onto the pins to see what's going on. I hooked my trusty scope up to them and found that the data is read out of the 93LC46 only on power up of the CueCat about ms after power up, to be exact. Oh well, at least I don't have that pesky serial number in there anymore. Unfortunately, hooking up a microcontroller to erase the EEPROM is a little out of range for your average privacy-concerned individual.
For those interested, the 93LC46 is an SPI Serial Peripheral Interface device—it uses a synchronous serial line to transfer data your computer's serial port is asynchronous and doesn't use a separate clock line.
The CS line is used to tell that particular chip that it's being talked to, otherwise it will ignore data being sent to it. The 93LC46 is sent a total of nine commands they are all read commands, but more on this later. Okay, now the first thing to note is that the leading 0 is basically garbage, as the first 1 is really a start bit and not yet the beginning of a command. So what we really have is a command like this:. The first two bits are the command, followed by the address.
In the 93LC46, 10 is the read command. But what's this? We only have six bits to define the address and a lot more than eight clock pulses after the command is sent—the EEPROM must be organized as 64 bit words!
So, the microcontroller reads in a total of 9 bit words from addresses 0x01 through 0x09 I have no idea why they didn't start at 0x Note in this sample scan,.
I wonder if they're hiding anything nifty in the other 55 words? I'm glad they used a 93LC46, though—you can desolder them and use them for other stuff Or, you can slice the line, indicated in Figure 6, by the microcontroller to sever the DO data out line I'd be inclined to try this one myself—the floating voltages could be fun here. Remember—you should need to cut only one line to disable the serial ID—take your pick.
If anyone decides to give it a try, let me know how it turns out—your CueCat should still be able to read bar codes without any problem. I picked up another CueCat last night—this one is the A model supposedly more common rather than the which is shown here.
I'll be tearing apart this one later and posting the innards. How can you tell the difference? The A model has four small screws holding it together, the older one has two larger screws. The A has a small grommet for the wire on the cat's butt and a large black square for the scanning window, rather than the smaller rectangular opening on the Reprint Permissions. He is also hopelessly addicted to playing paintball and squanders vast sums of money on the sport.
Dissecting the CueCat Hardware. Figure 1. Figure 2. Figure 3. Image of the Board with the Shield Removed. Figure 4. A Small 8-Pin Device. Figure 5. Figure 6. Cut Here to Disable the DO data out line. You May Like. Downsides to Raspberry Pi Alternatives.
Kyle Rankin. Handling Complex Memory Situations. Zack Brown. Disk Encryption for Low-End Hardware. Using Linux for Logic. Joey Bernard.
ATC93LC46 datasheet pdf datenblatt
ATC93LC46 Datasheet and ATC93LC46 manual