Tuesday, March 9, 2010

IM ME GoodFET Wiring Tutorial

by Travis Goodspeed <travis at radiantmachines.com>
concerning the Girltech IM ME,
with a million thanks to Dave.

WARNING: Reflashing the CC1110 while batteries are low will permanently lock the chip. Either be damned sure to use fresh batteries or leave the batteries out and power the IMME from your GoodFET.

Howdy y'all,

This brief tutorial describes the process of reflashing the Girltech IM ME with custom firmware, so that it may be used as a development platform for the Chipcon CC1110 sub-GHz ISM System-on-Chip. I assume the reader to have an assembled GoodFET with recent firmware, but other programmers may of course be substituted.

You should also read Dave's first article on IM ME hacking, as it describes his method for reprogramming the device. All the pinouts below were taken from his articles, as well as the keyboard and LCD information that he was so neighborly as to publish.


First, you'll need to purchase an IM ME, which can be had for $20 USD on a few toy sites while it remains in stock. You'll also need an assembled GoodFET and basic electronics tools.

The testpoints used for programming the IM ME are located behind the batteries in the rear compartment of the device. Ideally, a bed of nails should be used to clip into it, but failing that, just solder on to the Debug Data (DD), Debug Clock (DC), Reset (!RST), and GND pins. Run these to the GoodFET's 14-pin header as shown below.

Exposed Testpoints

From left to right on the IM ME, the pins are !RST, DD, DC, +2.5V, and Ground. Because the GoodFET is a low-voltage device, there's no need for the resistor dividers in Dave's article. Use EITHER the GoodFET OR the batteries for VCC, but not both.





Once you have the IM ME wired up, you can check its model number and status by running `goodfet.cc status'. This will tell you that the chip is locked, so making a backup of its firmware is non-trivial. If you continue from here, the IM ME will no longer function as an instant messenger.

Erase the chip by 'goodfet.cc erase' then dump an image of RAM as 'goodfet.cc dumpdata immeram.hex' to see if anything neighborly can be found inside.

You now have a blank IM ME, with the LCD most likely showing the last gasping breaths of its firmware. To flash a new firmware image, just grab its ihex file and run 'goodfet.cc flash foo.hex'.

I've placed a few example binaries in the repository of an operating system that I've started for the IM ME called GoodME. To flash Dave's LCD Test, run the following commands.
svn co https://goodfet.svn.sourceforge.net/svnroot/goodme
goodfet.cc flash goodme/bins/dave-lcdtest.hex

For a more functional demo, try bins/term-morse824mhz.hex, an ugly hack of an operating system for the IM ME with a Morse code transmitter and random number generator demo. In the Radio demo, holding any of the letter buttons broadcasts on 824MHz. The PRNG demo, shown below, demonstrates the repetition of strings withing the psuedo-random number generator and counts the number of bytes between them. This is sometimes used for key material.

Custom Development

The SDCC compiler is in the package repositories of most civilized operating systems. You might need a more recent version for the cc1110.h header, though building this compiler is a thousand times simpler than GCC. Compiling an example is as simple as sdcc foo.c; packihx <foo.ihx >foo.hex, which will produce a suitable Intel Hex file for flashing. The 8051 memory model makes specifying a chip model unnecessary, a handy deviation from those of us with a thousand MSP430 linking scripts.

Within the GoodME repository, you'll find my bastard child of an operating system at /branches/rough/. It was used to make the term-morse824mhz.hex, and its keyboard, font, and LCD drivers are ripe for organ transplants. /trunk/ ought to someday contain a proper operating system for the device, but for now, I haven't the time to complete it.

Have fun, and build something neighborly,


tvdbon said...

Care to tell us where we can still get this device? I'm very interested in buying some and trying this. I'm from South Africa so they need to be able to ship internationally

lorenzen said...

I am really enjoying your postings, you are taking recyling to another level - thank you very much for sharing - looking forward to the next im-me bulletin, I have got a few which needs a real life

adric22 said...

Maybe we could get Tetris on this thing? have to turn it sideways, I'd guess. Will the screen do bit-mapped graphics?

Penguin Dude said...

tvdbon: Amazon.com could probably supply one (or some) to you...

Travis Goodspeed said...

Howdy y'all,

Feel free to copy any of the hardware interface code from my IMME software in order to write your own. There's no sense re-inventing the wheel.


Travis Goodspeed said...

See Mike Ossmann's article, A $16 Pocket Spectrum Analyzer. It is by far the useful application released for the IM ME.

Ferdinand said...

Today I got my im-me and disassembled both the terminal and the usb receiver. It seems that the kind folks over at Mattel also brought out the debug connections on the usb stick. They are accessible through 5 vias - you just have to remove the clipped on cover from the stick.
I have no access to a programmer for the CC1110 right now, so I can't verify my findings. If someone is interested in trying this out please contact me.

Travis Goodspeed said...

Howdy Ferdinand,
You can find the dongle pinouts in this photo. Email me your address and I'll send some GoodFET boards your way.

Anonymous said...
This comment has been removed by a blog administrator.
Chris said...

All this is pretty cool! My daughters each have an IM-ME and they love playing with them. But my house is all Macs, so whenever they want to play I have to drag out an old PC laptop just so they can chat (Yes, they are in the same house. Why do they need an IM-ME to chat? I don't know, ask them :-)

It occurs to me that these devices should be able to talk directly to each other, right?

I'm interested in 3 things:

1) Getting the units to talk to each other

2) Getting other kid-stuff running on them (simple games, homework list, etc.)

3) Getting the devices to talk to a Mac

Is there a forum or mailing list for IM-ME hacking? I'd like to have a way to discuss these sorts of things with other.

Ali said...

=[ I hooked up my goodfet but can't get it to erase. Maybe I'm getting my wiring mixed up.

Travis Goodspeed said...

Howdy Ali,

I just patched a bug that prevented Chipcon debugging from working on the GoodFET3x boards. GF2x was unaffected.

Run 'goodfet.bsl --fromweb' to upgrade.


Ali said...

Hey Travis,
The new firmware works a treat.


gerryk said...

Hi Travis... are you still providing the GoodFET boards? How do I get a couple here in Ireland?

Travis Goodspeed said...

Howdy Gerryk,

Plenty of GoodFET31 boards remain. See the GoodFET Ordering Page for boards, $5/unit for professionals and free for students.


Peter Loron said...

Has anybody done this programming with an Arduino or BusPirate? Building up a GoodFET wouldn't be a huge problem, but I've got some other programmer-capable hardware already sitting here...

Killdaggy said...
This comment has been removed by a blog administrator.
GirlTech (OG/OP) said...

I posted this to hackaday, but should have posted it here.


So, I just read section 4.4 of P25 .pdf (Why Special Agent Johnny Still Can't Encrypt) and I thought. I have to build something like this, but how.

And it looks like I found the precious source.

What a cool use for a purple and pink kids toy. GirlTech’s design and marketing has really annoyed me throughout the years — I put up my brand about the same time they started theirs. I’ve always felt that green+pink on black and lockpicking was a better way to subvert the other girls out there into the computer and hack scene, but I am totally enamored by the hacks that ya’ll have done on this purple quote unquote girly device. And next time I am required to babysit (doesnt happen very often, muahaha.) I think it's going to be mandatory that I have one of these to bring along.

Guess I'm going to get started. . . .

(I'm emailing you about GoodFet now, cheers.)

Mad Props and Mad Love for feeding the fire!

Ivy aka GirlTech$ (The Original Gangster/Original Princess :P )

EvilEE said...

Greetings Travis and Fellow GoodFET-teers.

I am using GoodFET31 w/ IM-ME. When I run goodfet.cc status I receive the following:

SmartRF not found for this chip.
Status: erase_busy cpu_halted pm0 locked oscstable

Is this message abnormal, please advice. Thank you.


EvilEE said...

Same message was received when attempting goodfet.cc erase

#goodfet.cc erase
SmartRF not found for this chip.
Status: erase_busy cpu_halted pm0 locked oscstable
Status: cpu_halted pm0 locked oscstable

Mike said...

I am really enjoying your postings, you are taking recycling to another level. That's great. I am looking forward for more good post from your side. Keep posting. Cheers!
medical card scanner

Jerry Gene said...

Very informative post. Keep up the good work. I would really look forward to your other posts

Lenovo - 15.6" IdeaPad Notebook - 6 GB Memory - 750 GB Hard Drive

Lenovo - 15.6" ThinkPad Notebook - 4 GB Memory - 500 GB Hard Drive - Black

Arduino Projects said...

Cheers, that's pretty cool. I'm going to use it in one of my next Arduino projects

Arduino Projects said...

Cheers, that's pretty cool. I'm going to use it in one of my next Arduino projects

John Dudley said...

Acetech have many years of experience in custom software development. Find out more about custom software development at http://www.acetechindia.com

Greyway said...

has anyone got an I'm-me for sale? or know where i can find one?

Ferdinand said...

@Greyway: I do have one for sale. Contact me at gandalf-net@web.de

Gregorio Silliman said...

Thank you for providing me a informative blog. I enjoyed it thoroughly, it helped me a lot for what i was searching for. Keep it up. You do very good. For more details about building materials Visit: Gi binding wire

Bunda Cantika said...

Standard Demo-Text seit 1500, als ein unbekannter Schriftsteller eine Hand voll W├Ârter nahm und diese durcheinander warf um ein Musterbuch zu erstellen.
mesin pembuat kopi Elektrolux and artikel harga mesin kopi Illy terbaru dan artikel harga mesin kopi merk Kenwood and article harga mesin kopi Nescafe dan ulasan harga mesin cuci 1 tabung dan artikel harga mesin cuci 2 tabung serta artikel harga mesin cuci front loading dan harga mesin cuci top loading juga harga kompor gas merk Quantum dan info harga kompor gas merk Rinnai

Software Development Company in Delhi said...

Choose the Best Software Development Services Company in Delhi is also made best designing and CMS web application.

Blogger said...

If you want your ex-girlfriend or ex-boyfriend to come crawling back to you on their knees (even if they're dating somebody else now) you have to watch this video
right away...

(VIDEO) Why your ex will NEVER come back...

Hammad khan said...

Hello !Thank you so much for this article and please keep sharing like this amazing post.
Digital Marketing In Delhi
E-Commerce Solution in delhi


hola mi nombre es byron hill pinnock compre la im-me en ebay por 77 dolares y me gustaria que alquien me ayudara paso a paso lo que debo hacer para programar la im-me para el porton de los garajes alquien que me pueda ayudar gracias

Catabatic Technology said...

I enjoyed reading your post. Please continue publishing helpful information like this. I like this type of information and share my opinion with you.

Brand Development Company | Travel Portal Development | Software Development Solutions | Web Design Company in India | Mobile App Development Company

gunmetal jeans said...

I have to admit that those faces look pretty grim. How anyone could go under the knife, knowing they may come out looking even worse, I don’t know.

Construction Documentation
Construction Documentation in USA

Entertaining Game Channel said...

This is Very very nice article. Everyone should read. Thanks for sharing. Don't miss WORLD'S BEST TrainDrivingSimulatorFreeGames

SRDV Technologies | Web Development | Mobile App Development said...

what is fantastic post? this is so chock full of useful information I cannot wait to dig deep and start utilizing the resource give me.your exuberance is refreshing.
Software Development Travel portal development Travel white label Travel Portal Solution B2C Travel Portal B2B Travel Portal Flight Booking API System Flight api integration

MindtechAffiliates said...

Thanks for sharing informative information

Cpa offers

Unknown said...

I really enjoyed your blog Thanks for sharing such an informative post.
Indian Bookmarking list
Indian Bookmarking list
India Classified Submission List
Indian Classified List
Indian Bookmarking list
Indian Bookmarking list
India Classified Submission List
Indian Classified List

Vipin said...

Thanks for provide great informatic and looking beautiful blog, really nice required information & the things i never imagined and i would request, wright more blog and blog post like that for us. Thanks you once agianMarriage certificate in delhi
Marriage certificate in ghaziabad
Marriage registration in gurgaon
Marriage registration in noida
special marriage act
Marriage certificate online
Marriage certificate in mumbai
Marriage certificate in faridabad
Marriage certificate in bangalore
Marriage certificate in hyderabad thanks once again to all.

Vipin said...

Thanks for Fantasctic blog and its to much informatic which i never think ..Keep writing and grwoing your self

birth certificate in bangalore
name add in birth certificate
birth certificate in mumbai
birth certificate in faridabad
birth certificate in gurgaon
birth certificate in hyderabad
birth certificate online
birth certificate in noida
birth certificate in ghaziabad
birth certificate in delhi

Pankaj Singh said...

The part I find interesting is the more or less complete separation of comments here, keep it up for more updates about this related blog. Visit OGEN Infosystem for creative and responsive Website Designing and also for SEO and PPC Services.
Website Designing Company