The code of the Infrared led of the HP28S
By Eric Toonen.
Since the infrared led is also used by companies other than Hewlett Packard, I
want to make its code (as far as me and some friends of mine have cracked it)
public.
First of all, I want to thank Jurjen Bos, Niels Ferguson, and Toin Bloo, for
doing this research (I am no good with hardware).
Please note that this information might not be correct, it is found by our-
selves, and we didn't get it from HP.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
The signal consists of three parts:
- Syncpulses: To synchronise the hardware with incoming information
- Checksum: To detect and reconstruct bad bits
- Data: The actual information
The data and checksum are frequence modulated, and every mark is modulated with
6 pulses.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Schematical representation of a byte:
~0.8 msec ~3.2 msec
|<-Sync>|<-----------Checksum---------->|
| | |
| | |
Bitcel: | 0 | 1 2 3 4 |
v v v
_ _ _ _ _ _ _ _ _ _
|1| |1| |1| | | | | | | | | | | | | | | ....
| |_| |_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_
~6.4 msec
|<-----------------------------Data-------------------------->|
|Bit: 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
| | | | | | | | |
| 5 6 7 8 9 10 11 12 |
v v
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
.... | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|
where: s = startpulse (clockpulse)
d = datapulse
- If the preceeding databit was 1, the startbit will be 0.
- If the preceeding databit was 0, the startbit will be 1.
- The first startbit of bitcel 1 (checksum) is always 1.
- Gaps between S and D are maximum 1 msec; it is up to the hardware,
to resynchronise with every byte.
Example:
Bitcel: | 6 | 7 | 8 | 9 |
... s d s d s d s d ...
1 1 0 0 1 0 1 1
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Schematical representation of a bitcel:
(of which a byte has 12)
/| /| /| /| /| /| /| /| /| /| /| /|
/ |/ |/ |/ |/ |/ | / |/ |/ |/ |/ |/ | /
| | | | |
_| |___________________| |___________________|
^ ^ ^ ^ ^
| |--| ~0.03 msec | |
| | |
|<----------------------------------->| ~0.4 msec |
| ~0.8 msec |
|<------------------------------------------------------------------------->|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
The checksums:
Data: I.R.: (filtered from sync- Checksum:
and start-bits)
#00h 0 0 0 0 0 0 0 0 0 0 0 0 #0h
#01h 0 0 1 1 0 0 0 0 0 0 0 1 #3h
#02h 0 1 0 1 0 0 0 0 0 0 1 0 #5h
#04h 0 1 1 0 0 0 0 0 0 1 0 0 #6h
#08h 1 0 0 1 0 0 0 0 1 0 0 0 #9h
#10h 1 0 1 0 0 0 0 1 0 0 0 0 #Ah
#20h 1 1 0 0 0 0 1 0 0 0 0 0 #Ch
#40h 1 1 1 0 0 1 0 0 0 0 0 0 #Eh
#80h 0 1 1 1 1 0 0 0 0 0 0 0 #7h
The checksum is calculated as follows:
Start with 0, and for every position that is 1, take the
corresponding value in the table above, and XOR it with the
previous result.
Example: ,---last result
| ,---hex digit
#27h 1 1 0 0 0 0 1 0 0 1 1 1 | | (as in table)
| | ,---new result
Because: ------- | | | | v v v
| | | | '-> #0h XOR #3h = #3h
| V V '---> #3h XOR #5h = #6h
^ | '-----> #6h XOR #6h = #0h
| '->---------> #0h XOR #Ch = #Ch = #1100b
| ----
'------<----------------<---------------<------'
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
We hope someone can use this information to create a device to translate the
code to RS232C, and make its schemes freely available to the public (as we
did with this information). If you do, please send the schematics to:
Eric Toonen
Djept-Zuid 6
5502 RP Veldhoven
The Netherlands
You people are not too lazy to send a normal letter, are you?
I don't have an E-mail account.
We will post the results of this quest to Comp.Sys.Handhelds,
Some additional notes:
Please do not mail or post any replies about "Hook-uP" or "hp28com", I know of
both, but their schemes are not publicly available;
I want to accomplish that the schemes and documentation of such a (even if it
is output only) device are free, combining our knowledges. You probably will
have noticed that I want to have the same, concerning the source-listing of
the 2BB ROM.
If people at Hewlett-Packard, Corvallis Division, are reading this:
I want to ask you to please make the code and hardware-schemes available of the
infrared led. Also, I want to ask you to make the source of the 2BB ROM
available. Any information sent to me confidential shall be treated as such.
Be reading from you,
Eric
-----------------------------------------------------------------------------
Eric Toonen
Snailmail: Djept-Zuid 6 | Hogeschool-Eindhoven: s89406143@hsepm1.hse.nl
5502 RP Veldhoven | (Not an uucp-address)
The Netherlands | (Might work on SURFNET (?))
-----------------------------------------------------------------------------