• https://git.hannover.ccc.de/c3h/UnJimuUnicorns
• https://git.hannover.ccc.de/c3h/unicorn-scratch

# updating your debian first seems to help :D
cd unicorn-scratch
npm install husky
npm install
#HUSKY=0 npm install # < or this? not sure. fck'n javascript
cd packages/scratch-vm/ # maybe ?
npm run build # maybe ?
cd packages/scratch-gui/
npm install # maybe ?
npm run build
npm start

• https://git.hannover.ccc.de/c3h/unicorn-gateway
  • see README.md

Ansätze:

• App zerlegen

  • jimu app
  • Bluetooth protokoll anschauen ?

Software zerlegen

• Android/App debugging setup

App zerlegen

• Zum decompilen eignet sich jadx

Interessante packages

• com.ubt.jimu.* UI etc
• com.ubtrobot.jimu.* Bluetooth

Hardware

• "ID-01": -> Lenkung -> Antrieb

• "ID-02" -> Hals -> Horn

• main PCB

• Komponenten

  • vmtlt main Controller inkl. bluetooth (direkt neben der Antenne)
    • N52810 QFAAB0 1816BS
    • info page: https://www.nordicsemi.com/Products/nRF52810
    • product specification: https://docs.nordicsemi.com/bundle/nRF52810_PS_v1.5/resource/nRF52810_PS_v1.5.pdf
    • NRF52x series documentation: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/device_guides/nrf52/index.html

• Horn Licht

  • nuvoTon N76E003AT20 830HDFA
  • 4 Pin RGB LED (R,G,B,GND/VCC)
  • Info page > https://direct.nuvoton.com/de/n76e003at20
  • possible datasheet? > https://www.nuvoton.com/export/resource-files/DS_N76E003_EN_Rev1.10.pdf

• Wheel motor kommt in C D raus

SWD debugging

• clk und dio sind verbunden, nochmal neu loeten?

Serial

• 3-Pin Bus
• [1](2)(3)
  • 1: Signal
    • 3.3V Logic-Level
    • normally-high
  • 2: 7.5V
  • 3: GND (0V)
  • RS232; 115,2 kbaud; normally high (3,3V)

Captured frames

• stearing
  • straight: FA AF 01 01 78 32 00 00 AC ED AB
  • right: FA AF 01 01 8C 14 00 00 AZ ED AB
  • left: FA AF 01 01 64 14 00 00 7A ED AB
• drive
  • stop: FB 03 0C 06 01 00 04 00 03 00 00 FF FF 00 01 31
  • forward1: FB 03 OC 06 01 00 04 00 03 FF B0 02 8F 00 01 C5
  • forward2: FB 03 OC 06 01 00 04 00 03 FF B0 00 0A 00 01 22
  • backward: FB 03 0C 06 01 00 04 00 03 00 50 02 8F 00 01 51
• unknown
  • unknown1: AC 03 03 06 01 00 A1
    • CRC8/I-432-1 (from 1 to 5)
  • unknown2: AC 11 03 06 01 00 57
    • Data is second message of "blau0.csv"
    • CRC8/I-432-1 (from 1 to 5)
  • unknown3: FB 03 0C 06 01 00 04 00 01 00 00 B9

Guesses from the Bluetooth snoop

• stearing
  • straight: FB BF 0D 09 00 00 00 01 78 32 03 E8 AC ED
  • right: FB BF 0D 09 00 00 00 01 8C 14 01 90 48 ED
  • left: FB BF 0D 09 00 00 00 01 64 14 01 90 20 ED

Observed sequences

• forward-unknown1-straight
• backward-unknown1-straight
• forward-unknown1-right
• forward-unknown1-left
• stop-unknown1

Decoded frames

• stearing

0: FA
1: AF
2: 01
3: 01
4: angle (small=left, straight~=78, right=big)
5: time (32=slow-ish,2=very fast)
6: 00
7: 00
8: checksum (sum 2...7, mod 256)
9: ED
10: AB

• drive

0: FB
1-14: data bytes
15: checksum (CRC-8/DARC over bytes 1..14)
     - Polynomial: 0x07
     - Init: 0x00
     - XorOut: 0x55
     - RefIn: false
     - RefOut: false

(maybe not DARC but I-432-1; Parameters stay the same)

Helper tools

Parser

make parser
stty -F /dev/ttyUSB1 115200 raw
cat /dev/ttyUSB1 | ./parser
#or
./parser < buslogs/captured_frames.bin

PulseView

PulseView software for analyzing oscilloscope ouput

• can use sigrok capable logic analyzer as input, which includes (some) rigol devices (https://sigrok.org/wiki/Rigol_DS1000Z_series)
• use the conversion feature with to logic via threshold to convert analog into digital
• use the UART decoder module on the digital signal to decode the packets

Scratch stuff

{ opcode: 'rotateBackServo', text: "rotate back servo to [ANGLE] degrees", blockType: BlockType.COMMAND, arguments: { ANGLE: { type: ArgumentType.ANGLE, defaultValue: 20 } }

 rotateBackServo(args) {
    return this.socket.send(args.ANGLE);
}

• https://github.com/scratchfoundation/scratch-editor
• https://github.com/scratchfoundation/scratch-editor/blob/develop/packages/scratch-vm/docs/extensions.md
• https://github.com/scratchfoundation/scratch-editor/blob/develop/packages/scratch-gui/src/examples/extensions/example-extension.js
• https://www.instructables.com/Making-Scratch-30-Extensions/
• https://pruss.mobi/js/rjm.js

Which commands are supposed to be sent?

• Motor front:
• Motor back:
• Motor wheel:
• LED Horn: (- Farbsensor)