Lately, I’ve noticed a massive uptick in spam, generally stemming from the larger instances in the fediverse. Nobody seems to be talking too much about this though. This spam is usually commercial or corporate accounts promoting their product, service, website, blog post/SEO marketing bullshit. It’s rather annoying and seems to goes against what Mastodon was supposedly founded on. I tend to browse by hashtags, but this feature is practically unusable on some hashtags, primarily because it has been transformed into infinite feeds of straight-up ads.

On the joinmastodon.org website, they tout, front-and-center:

Your home feed should be filled with what matters to you most, not what a corporation thinks you should see.

and

No […] ads to waste your time

As of today, these claims are essentially false. It seems now, every marketing team thinks I should be reading their AI-generated garbage articles, giving clicks to their products or affiliate links, or otherwise buying their services. And I’m wasting my time sifting through these feeds just to find posts written by actual humans.

Where’s the spam coming from?

If you take a quick glance at the live feed of mastodon.social, it’s clearly littered with ads, moreso than my e-mail’s spam folder. Sure, they’re not ads generating revenue for the instances nor Mastodon itself—but they’re still advertisements by companies wanting in on those fedi users. With a cursory glance of about 25 posts on that live feed, I counted 10-12 obvious ads and 3-4 automated posts (probably also ads). These are companies that are clearly looking to promote their website or service, and even sometimes directly linking to products for sale. There doesn’t seem to be a way to curtail this, aside from muting or blocking each of these seemingly-infinite accounts.

Moderation here is not necessarily the solution here either. Although some instances (like Hachyderm) will prevent companies from creating accounts, other instances do allow this. And sometimes, it’s not so clear-cut whether, for example, an AI-generated SEO-keyword-crammed blog post is truly considered spam. The rules of some instances might strictly define spam as companies selling products, whereas others may not.

Nor is server selection nor defederation a solution. Yes, users can choose which server to use and users can pick an instance that may have stringent spam policies. Yes, your instance can defederate from a spammy instance. Yes, you can simply block the offending instance. But this will also block legitimate, non-corporate users. I still want to view the posts of actual people. I just don’t want Mastodon to devolve into my e-mail’s spam folder.

A possible solution: marking commercial accounts

One possible solution is to mark commercial users as commercial users, similar to how Mastodon currently marks automated accounts. Corporate users would be required to self-identify their accounts as commercial and other users can decide whether or not to see their posts in their feeds. The ActivityPub spec already enables this via the type attribute in Actor objects. Users can be marked as a person, organization, group, or a service (bot). But as of today, this organization type and filters have yet to be implemented in Mastodon.

In 2022, user ocdtrekkie already proposed this change, although it doesn’t seem to have gone anywhere. I recently proposed adding filters for bot accounts but I won’t hold my breath that this will go anywhere.

I’m hoping that sometime soon, Mastodon will have these features to reduce the amount of spam in feeds. But until then, I guess I’ll just have to live with blocking an endless supply of spam and/or blocking some of these larger, spammy instances.

Take action

If you’re also tired of the recent spam on Mastodon, I would encourage you to take action by 👍-ing or showing support for these Github issues:

• https://github.com/mastodon/mastodon/issues/20804
• https://github.com/mastodon/mastodon/issues/36157

And talk about it on Mastodon! These features are currently not yet on the Mastodon roadmap, so attention must be given to these problems before the spam completely consumes the fediverse.

I’ve gotten so tired of GitHub’s and Microsoft’s forced shenanigans—enough so that I’ve migrated over to Codeberg. It was a fairly painless experience switching over and would recommend it to anybody. There’s much less clutter, more privacy (no weird tracking & ads), and its community seems to be much nicer overall.

Here’s how I’ve migrated over my Github Pages to Codeberg Pages, complete with an action to build the static content.

Project structure

The project is organized using its branches:

• main where the source code resides, and where I would do PRs to
• pages the compiled pages generated by Jekyll, i.e. where index.html lives

(Note: there are several ways of doing this. I’m using separate branches because it keeps the main branch clean of generated files.)

Actions

On Github, there was a built-in action for deploying to Github pages. This made it very easy to deploy a static page.

On Codeberg, it required a little setup: namely a Forgejo Action. I based this Forgejo action on the quick start guide and the example Hugo action which does something similar.

The Action works by running a series of steps when we push a commit onto main. The steps are:

1. On the build job: Cloning the repo from main
2. Installing dependencies (Ruby from apt-get, and the Jekyll dependencies)
3. Builds the static files and places them into a temporary directory, _site/
   • This also copies over the .domains file
4. Uploads them as artifacts (I think these steps can be omitted), including hidden files like the .domains file
5. On the deploy job: downloads the artifacts
6. Copies the generated files onto the branch pages

The full workflow is listed in the repo.

DNS

I followed the instructions and use A/AAAA/TXT records to point the domain to the Codeberg page. For the TXT record, I had to use the branch.repo.username scheme (pages.pages.kevinhikaruevans.codeberg.page in this case).

I’m using Cloudflare for this and although the docs recommend not using the Cloudflare caching, I enabled it anyway and it seems to be alright. There’s some slowness in Codeberg pages, probably caused by me living across the world from the servers, and using Cloudflare’s caching helps speed things up. I presume it would be fine to use Cloudflare’s caching here, since I’m only using a single domain.

A part of Kagi’s mission is to make the web more ethical. But I feel that some of their actions go against this mission and I ultimately cannot continue supporting Kagi in good conscience.

Support of Russian services

A portion of your fee goes towards Yandex, indirectly funding Russia’s invasion of Ukraine. Vlad, the CEO, has stated that 2% of their total costs in 2024 goes towards Yandex. He has also stated that there is no intent of changing this.

Is it ethical to continue funding a large Russian-based company knowing full well it goes towards killing innocent lives?

At least other search engines like DuckDuckGo have halted their partnerships with Yandex. Kagi’s refusal to do so and Vlad’s firm support of Yandex is quite telling. If others have ceased partnering with Yandex, why can’t Vlad?

It’s worth mentioning that Kagi previously listed the sources they used in their search. It seems that they’ve now hidden that information on that page, seemingly contradictory to their “commitment to transparency.”

Inclusion of xAI’s Grok

A portion of your fee goes towards Elon Musk’s xAI, of X/Twitter, to support Grok in their AI assistant. Indeed, you can simply not use this assistant, however all paying users are effectively subsidizing the cost of the Grok API calls. There is no way to opt-out of this.

Is it ethical to help finance a company which consistently promotes division among the population, the spread of disinformation, and hate speech? Is it ethical to give money to a company that continually platforms white supremacists?

Kagi currently recommends eight LLMs, including Grok. There are plenty of LLMs to choose from, yet Kagi continues to include Grok despite pushback from the community. Why is that?

* * *

I don’t believe Kagi is upholding their mission of making the web more ethical. No matter the ethical framework here, the firm financial support of Russian services and X/Twitter is ultimately harming society as a whole and creating a more-fractured, divided world. It’s odd that Kagi dismisses these valid concerns, noting that they’re more focused on providing a better search, etc. But if they strive to be an ethical company, would that not take precedence over search result quality?

It goes without saying that none of us are perfect. No company is perfect. But, much like how Kagi can choose which heinous companies to partner with—you and I too can choose which companies to support. The ethical choice is simply cancelling my Kagi membership.

As an aside, I do wonder when, not if, the larger, less obvious cracks will show in the company. When will Kagi change their mission and remove their own “don’t be evil?”

PS: There are some other posts that I would recommend:

• Why I Lost Faith in Kagi
• PSA: part of your Kagi subscription fee goes to a Russian company (Yandex)
• Reconsider [Kagi’s] partnership with Brave

I recently received a Zojirushi coffee maker as a gift, after doing pour-overs for years. While I love the ritual of doing a pour over, it can get fairly monotonous after a few years.

The internals of the Zojirushi coffee maker are very simple and I’m sure it’s the same design as most budget-friendly coffee makers. It consists of a single heater element for both the water and the hotplate, controlled by a single normally-on thermostat. During the brew cycle, the water cools the thermostat and boils up, then re-condenses over the coffee grounds. Once the heater runs dry, the specific heat decreases and the thermostat quickly warms up, tripping the thermostat. Once relatively cool, the thermostat trips on and resumes its hot plate heating cycle, indefinitely keeping the coffee warm. It’s a simple system that works great.

I wanted to create an alarm that can let me know if the coffee maker was left on for too long. Also given that this is a Zojirushi product, I wanted it to play a little jingle when turned on and when complete. I decided to modify the coffee maker by including a simple board to:

• play a song during start-up
• detect the current of the heater and detect the heater’s falling edge
  • when the water heater is tripped off, it should play a song indicating the coffee’s done
• when left on for too long, I want it to sound an alarm

I also wanted to do this completely non-destructively and keep the coffee maker relatively stock and revertable to its original form.

Prototyping

Since I want this to be revertable, using a non-contact current sense would be the best choice. I have a couple current transformers (CTs) that I’ve salvaged and they will work for measuring whether the thermostat is switched on or off, since it’s non-invasive and relatively safe.

I initially just stuck the CT inline with a 10k resistor and probed it, just to see what the wave looked like (it was as-expected for a resistive heater, but skewed a little from stray effects).

Design

The system can be divided into a few parts:

• power supply (120 VAC to 5VDC and 3V3)
• current sense (the CT) to DC-ish
• microcontroller with piezo buzzer

Board outline

I borrowed a flatbed scanner to get the board outline (surprisingly, it was 1:1), then used a set of dividers and a ruler to get the precise measurements. Then I imported the image into Inkscape and created an SVG of the outline using bezier curves, which I could then bring into KiCAD. Then, I printed out a 1:1 copy, cut it out, and confirmed it fit in there.

This was by far the easiest solution of getting the outline. I initially tried to sketch it by transferring measurements between the coffee maker into CAD, but that was painstakingly slow and I couldn’t replicate the curves easily enough.

Power supply

I’m just using a 120 VAC to 5VDC module from Meanwell with more than enough current to supply the microcontroller (max of like 100 mA). For protection, I added a fuse and MOV on the 120 VAC side, then added a thermal fuse on the 5V side. Then used a 5V to 3V3 LDO to supply the microcontroller.

Current sense

The current sense is a current transformer, going across an AC coupling cap. This is fed into a full bridge rectifier, then dropped across a small resistor, then fed into the ADC with a diode in reverse for overvoltage protection. I originally had an RC filter here to read the DC voltage (i.e. rectifying to dc), but the ADC is fast enough to sample at 60/120Hz—so instead, I’m reading the half waves.

I simulated the CT using an AC current source with a series resistor in SPICE, and while this worked, it wasn’t simulated very well. There were several major differences in simulation vs reality, probably attributed to the nonlinearlity of the CT and diodes. Although it wasn’t super accurate, it helped me get ballpark estimates of components without having to do some of the math.

…but wtf?

After rectifying, the frequency should’ve been 120 Hz, since the negative side should’ve been flipped upward. But for whatever reason (bad solder joint? did I solder the wrong component?), it’s still reading 60 Hz.

MCU and buzzer

The MCU is laid out just like the application example from the TRM.

The piezoelectric buzzer is fed by the 5V power divided by a variable resistor, controlled by a BJT on a PWM pin. While this works, I found it still to be too quiet. This was also simulated in SPICE at several audible frequencies.

Software

There are two main components of the software:

• the firmware that runs on the esp32s2
• the user application, a webapp exposed by the esp32’s softAP

Firmware

The firmware is pretty simple and consists of mostly timers:

• on startup, the startup song is enqueued and played
• on the falling edge of the current sense (i.e. when the heater is first turned off), it plays the `done’ song and begins the alarm timer
  • there’s some debounce happening w/ timers
  • this can only get trig’d after 5 seconds after boot
• the alarm timer plays after 15 minutes of being started
  • this timer auto-reloads, so it plays every 15 minutes after the coffee is finished brewing

Protobuffers

I finally had a fun use for protobuffers! I’m using them to hold the track data:

syntax = "proto3";

message AudioEvent {
  // the frequency (Hz) or rest if 0
  int32 frequency = 1;

  // the duration of the note/rest in ms
  int32 duration = 2;
}

message AudioSequence {
  // track name
  string name = 1;

  repeated AudioEvent events = 2;
}

It was honestly easier than expected to use protobuffers. I used protoc to generate both the C and TS code and it worked well for this purpose. It lets me easily transfer the tracks between the frontend and the fw code, as well as giving a convenient format for storing the tracks in NVS.

Misc./ESP-IDF bugs

I noticed there were several bugs in ESP-IDF, although these might just be HW limitations or problems on my part:

• the digi adc calibration is off by a factor of 1/2
  • when in continuous mode, it’s using the digi adc (unlike oneshot which uses a different realm)
  • the digi adc is limited to 12 bits, but the one shot uses 13 bits - but the calibration routine only seems to use 13?
  • bug report
• the adc’s threshold interrupts do not work on the esp32s2
  • supposedly, you can set a min/max threshold on the adc to interrupt the cpu
• when doing an ota update where the partitions are not properly defined, calling esp_ota_write on a nonnull handle provided by esp_ota_begin will hard crash and trigger the wdt
  • I don’t feel like diving into this since I don’t intend to use the ota functionality much
  • I think this has to do with aligning the ota0 partition but I don’t feel like diving into this one
  • I regret getting the 4MB version, since I like to use 2MB factory/ota sizes. Should’ve gotten the 8MB version ;_;
• not a bug, but there’s no simd instructions on the s2 series, unfortunately. I was hoping to read the continuous adc via dma, then use the vector instructions to find the half-wave rms voltage. But alas, I had to just use for-loops

Putting it all together

Here’s what the board looks like in the enclosure:

For the power pins, I’m using the same-sized spades as the original. The wire-to-board connectors I’m using have two spades on them, so none of the heater load is going across a trace.

Other modifications

I’m tempted to put in a ground but I don’t want to have to change out the cable or strain relief yet. Both the hotplate and enclosure cover are aluminum, and I can see a potential hazard if the spades disconnect, and either the live/neutral can short to these. I also would like to put a conformal coating on the board, but I might save that for the next revision (if ever).

It doesn’t do much, but it’s something that has been bugging me for a while. I often include Pydantic models in SQLAlchemy-created databases. Normally, I just use JSONB and use the regular ol’ model_validate functions. While this works, I’d prefer it to be automatic. Here’s where pydantic-sqlalchemy-deco comes in.

It’s a simple TypeDecorator class that automatically converts between Pydantic and SQLAlchemy JSONB types.

Installation

Since it’s pip installable, you can use pip install pydantic_sqlalchemy_deco.

Usage

All you need to do is set the Mapped[] type and include PydanticJSON in the mapped_column(), like such:

from pydantic_sqlalchemy_deco.decorator import PydanticJSON

...

# Define Pydantic model somewhere:
class MyCustomModel(BaseModel):
    custom_id: int = 0


# Define your SQLAlchemy model:
class MyEntry(Base):

    custom_data: Mapped[MyCustomModel] = mapped_column(PydanticJSON(MyCustomModel))

Then it’s easy as doing

entry = MyEntry(
    custom_data=MyCustomModel(custom_id=1234)
)

...

print(entry.custom_data.custom_id)

Pretty simple, eh?

Further remarks

I never realized how easy it is to build Python packages. It’s basically:

1. write your code
2. define your pyproject.toml file
3. then setup the default Github action to push releases to pypi.

That’s it! I was expecting a whole mess of generating and keeping track of tokens, writing and rewriting Github actions, and some CLI work to get it published.

I’ll eventually need to do tests, but I can hold off on those til later.

Links

• pydantic_sqlalchemy_deco on pypi
• pydantic-sqlalchemy-type-decorator on Github

When I got home, I cracked it open and noticed it seems to use a regular USB C-to-C cable to connect the laptop to the dock. When I tried using several cables, I noticed that none of them worked! It seems that the cable did not abide by the USB spec. I used some USB-C breakout boards to trace out the schematic. It seems that Dell (or Bizlink or whatever OE they use) chose to use a non-compliant, custom and propietary USB cable. What kind of monster does that? Is it for greater power delivery? Planned obsolescence? I cannot find a reasonable explanation for this.

Finding the pinout

As stated, I just used some breakout boards to find the pinout: literally probing each pin on the breakout board and seeing where it goes. It turns out the entire cable is mangled as fuck and somebody, somewhere, chose to fuck the thing up. The RX pins go to RX again, instead of TX, the CC pins are weird, and the data pins are reversed. I’m assuming the dock’s PCB “corrects” the pinout, so that a proprietary pinout can be used.

Bringing it into KiCAD

I brought the design into KiCAD, for a much cleaner diagram. This schematic is slightly different than what’s above, since a USB cable is meant to be plugged into the receptacle on one side (so the RX/TX pins are somewhat “corrected”).

Note that this adapter is unidirectional, at least on the dock side. This is discussed here.

Testing

Initially, I ignored the impedance requirement for the adapter and only matched differential lengths. I think it ended up being around 50 ohms (ish), but when I tested the maximum speed, I couldn’t achieve anywhere near GbE speeds despite a GbE connection. I’m guessing this has to do with the impedance matching.

I created a separate PCB design, hoping to get this printed on a long flex PCB strip. But unfortunately, when I estimated the impedance using openEMS, I was nowhere in the realm of 90 ohms. I might just be doing the simulation wrong, but I’m wondering if this is even remotely possible on a non-impedance controlled (read: cheap) flex PCB. Bleh.

Next steps

I built an adapter that works but it’s pricey af and time-consuming to iterate on the design. I’m hoping that someone with more time and motivation can finish up the project.

The next steps are:

• lay this out on a long flex pcb strip
• create a 3d printed part for the receptacle
• create an assembly containing the part above and the pcb
• get a handful manufactured
• ????

Links

• Github project
• Relevant issue on the Github project

While getting my degree, I had several electrical engineering courses with labs. During one of the early labs, we were using curve tracers to characterize diodes. Many of y’all know the drill: plug in a diode or transitor into a curve tracer, it sweeps the voltage and displays the output. Our curve tracers are… antiquated. We’re using some dusty Tek 571s, which were due for calibration about thirty years ago. I am surprised that our lab equipment is so outdated, but this might be related to the fact that our university’s presidents and coaches are some of the state’s top paid employees.

Anyway, a requirement of this specific lab was to take pictures of the curve tracer CRT display and embed them in our report. I think we were to put tangents over the curves (in post) and grab some fitment params, or something along those lines. This isn’t the most accurate method, considering the CRTs are convex and have a rolling shutter effect, so it’s actually quite hard to get a good image of the curves. But hey, it’s for an undergrad class, so it truly doesn’t matter.

Since I’m putting in the effort into typesetting my reports in TeX, I wondered if there was a better way of grabbing the image. I noticed that there’s a print feature on the curve tracers with parallel ports in the rear. I drafted a quick email to the lab director asking if they would mind if I grabbed the print outputs using a microcontroller:

In the EE352 lab the other day, we were using the Tek 571 curve tracers and were taking snapshots of the CRTs on our phones. There were a couple of students that weren’t able to take photos because of the screen flicker and mismatched refresh rates between the camera/CRTs. [My instructor’s name] mentioned there were dot matrix printers setup previously, but [the department] had switched away from those because of their incredibly slow printing speed.

I was wondering, since there are parallel ports available, would it be possible to setup a microcontroller to act as an printer client (basically bitbanging the IBM or Epson FX80 protocol) and dump the printer data as a file on a USB drive? I’m thinking it would only need a couple 5v to a 3.3v logic level converters (and maybe a parallel to serial register) and a microcontroller. Is there someone I could talk to about getting the permission to try implementing this?

It seems the lab director thought it wasn’t a good idea, as he responded with telling me:

I am not in favor of adding additional custom-made hardware to the lab at this time.

Then he CC’d other folks in the department, some of whom I’d never met prior. I can partly understand why he said this, given that our budget is limited enough to still use 30-plus-year-old equipment—there’s only a few of these in the department’s arsenal. But to me, this narrow-minded attitude stifles creativity and innovation in students. Students should accept the equipment we’re given without questioning if we could do this better. Now, that’s the engineering mindset!

This could’ve been a cool learning and mentorship experience. Plus, it could’ve helped other engineering students who had trouble capturing the displays. But instead, we’re continuing to take these pictures of CRTs and doing fits with rulers. Instead, we’re not engineering anything but strictly following the course guidelines. Can’t go beyond those guidelines, eh. Well, hey, I thought it would’ve been a cool project.

Their API

To retrieve your user data, it’s a simple GET call,

curl https://log.concept2.com/api/users/$USER_ID --header "Authorization: Bearer $API_KEY" | jq

This retrieves a lovely JSON-formatted response,

{
  "data": {
    "id": 123456789,
    "username": "myusername",
    "first_name": "Kevin",
    "last_name": "Evans",
    "gender": "M",
    "dob": "1800-01-01",
    "email": "my-email@some-domain.com",
    "country": "USA",
    "profile_image": null,
    "age_restricted": false,
    "email_permission": false,
    "max_heart_rate": null,
    "weight": null,
    "roles": [],
    "logbook_privacy": "partners"
  }
}

I was curious to see what would result if I weren’t authorized, so I ran

curl https://log.concept2.com/api/users/$((USER_ID+1)) --header "Authorization: Bearer $API_KEY" | jq

To my surprise, this gave me the same data fields for other users! I could retrieve the username, first and last names, gender, DOB, email, weight, max HR, and profile images of ANY user on Concept2, including children!

Report and response

After seeing this, I promptly emailed the Concept2 Logbook team, noting that this is a pretty serious issue. They responsed quickly with,

Hi Keith,

Thanks for bringing this to our attention. It should not be possible to return this level of information. It looks like a very recent change affected this by putting a bug into the permission logic. The API is set to return a small level of information about the user, no different from visiting their profile page. The bug has been fixed now and we will reconsider whether the information we return in still appropriate. I’ve quickly checked out logs, and it does not appear that anyone has taken advanatge of this bug, but I will check them in more detail.

Thanks again for letting us know.

Best,

Well, first off, my name is Kevin and not Keith.

But I’m really wondering how the hell was this missed and how long was this vulnerability in place for? Were there no unit tests before deployments? I wonder how thoroughly they checked the logs to see if anybody has exploited this.

Can I trust Concept2 to store my data in the future? (No.)

To begin, the master initiates the sequence by sending several 10-bit frames and slaves respond by driving the line low and responding with their own packets. On my logic analyzer, it looks something like this:

Unfortunately, I don’t own anything that natively supports 10-bit serial. All of my chips only support up to 8-bit and one even supports 9-bit (addressed) serial.

Ideally, I would like to use an ESP32-S3, mostly because I’ve been working with ESP-IDF lately and find it good enough for a project like this.

Attempt 1: Bitbanging serial

I attempted to just bitbang serial using several timers on the ESP32. I initially tried the high-resolution timer, but it is unable to reach a 10 us resolution and silently fails (d’oh). This is documented on their docs, but I must’ve missed it.

Then I tried the general purpose (GP) timer and while it’s able to reach 10 us periods, it sometime skewed more than a microsecond or two! This is not acceptable for this application since there is no external clock.

Attempt 2: ✨ RMT peripheral ✨

After consulting the ESP32 forum, I tried the remote control transceiver (RMT) peripheral. To my surprise, this worked wonderfully. It is made for controlling remote control signals, but has numerous applications outside of that realm.

It’s a pain to set this up, as it requires you to manually encode and decode pulses at a fixed period. But, this peripheral is fairly precise and accurate and can hit 10 us right on the money.

The RMT also allows you to transmit bidirectionally on the same line, using is_loop_back=true.

Here’s my tester code that I used. It’s ugly and definitely not ready for production, but the bones are all there. It’s roughly based on the RMT NEC example on the Espressif website.

It initializes the RMT with:

• a transmitter
• an encoder to convert the lower 10-bits of ushorts into pulse structures for the underlying RMT
• a loopback receiver
• an ugly decoder that performs some rounding (e.g. rounding 8 us to 10 us)

#include "freertos/FreeRTOS.h"
#include "freertos/task.h" 
#include "freertos/queue.h"
#include "driver/rmt_tx.h"
#include "driver/rmt_rx.h"
#include "driver/rmt_encoder.h"

#include "esp_check.h"
#include "esp_log.h"
#include "driver/gpio.h"
#include <stdint.h>

#define SERIAL_FREQ_HZ 1000000
#define SERIAL_TX_GPIO_NUM 6
#define SERIAL_RX_GPIO_NUM 7

static const char TAG[] = "main";

static rmt_channel_handle_t tx_channel_handle = NULL;
static rmt_channel_handle_t rx_channel_handle = NULL;
static const rmt_transmit_config_t tx_config = {
  .loop_count = 0,
  .flags.eot_level = 0, // stop bit: note inverted
};
static rmt_encoder_handle_t encoder = NULL;

const static rmt_symbol_word_t bits[2] = {
  // inverted!

  /* 0 */ {
    .level0 = 1,
    .duration0 = 5,
    .level1 = 1,
    .duration1 = 5,
  },
  /* 1 */ {
    .level0 = 0,
    .duration0 = 5,
    .level1 = 0,
    .duration1 = 5
  },
};


// #define RMT_ENCODING_RESET 0

typedef struct {
  rmt_encoder_t base;
  rmt_encoder_t *copy_encoder;
  rmt_symbol_word_t start_bit;
  int state;
  rmt_symbol_word_t end_bit;
} rmt_curtis_encoder_t;


static size_t rmt_encode_curtis(rmt_encoder_t *encoder, rmt_channel_handle_t channel, const void *primary_data, size_t data_size, rmt_encode_state_t *out_state) {
  rmt_curtis_encoder_t *curtis_encoder = __containerof(encoder, rmt_curtis_encoder_t, base);
  rmt_encode_state_t session_state = RMT_ENCODING_RESET;
  rmt_encode_state_t state = RMT_ENCODING_RESET;
  size_t encoded_symbols = 0;

  uint16_t raw = *((uint16_t *)primary_data);
  rmt_encoder_t *copy_encoder = curtis_encoder->copy_encoder;

  switch(curtis_encoder->state) {
    case 0: // send start bit
      encoded_symbols += copy_encoder->encode(copy_encoder, channel, &curtis_encoder->start_bit, sizeof(rmt_symbol_word_t), &session_state);
      if (session_state & RMT_ENCODING_COMPLETE) {
        curtis_encoder->state = 1; // go to next state
      }
      if (session_state & RMT_ENCODING_MEM_FULL) {
        state |= RMT_ENCODING_MEM_FULL;
        goto out;
      }
    
    // fall-through
    case 1: // send data symbols
      for(int i = 0; i < 10; i++) {
        // iterate through bits in data
        bool bit = (raw >> i) & 0b1;
        rmt_symbol_word_t symbol = bits[bit];
        encoded_symbols += copy_encoder->encode(copy_encoder, channel, &symbol, sizeof(rmt_symbol_word_t), &session_state);

        if (session_state & RMT_ENCODING_MEM_FULL) {
          state |= RMT_ENCODING_MEM_FULL;
          goto out;
        }
      }
      // data is encoded :)
      curtis_encoder->state = 2;
      state |= RMT_ENCODING_COMPLETE;

    // fall through
    case 2: // end end bit
      encoded_symbols += copy_encoder->encode(copy_encoder, channel, &curtis_encoder->end_bit, sizeof(rmt_symbol_word_t), &session_state);
      if (session_state & RMT_ENCODING_COMPLETE) {
        curtis_encoder->state = RMT_ENCODING_RESET; // go to next state
        state |= RMT_ENCODING_COMPLETE;
      }
      if (session_state & RMT_ENCODING_MEM_FULL) {
        state |= RMT_ENCODING_MEM_FULL;
        goto out;
      }
      // all done!
  }

out:
  *out_state = state;
  return encoded_symbols;
}

static esp_err_t rmt_del_curtis_encoder(rmt_encoder_t *encoder) {
  rmt_curtis_encoder_t *curtis_encoder = __containerof(encoder, rmt_curtis_encoder_t, base);
  rmt_del_encoder(curtis_encoder->copy_encoder);
  free(curtis_encoder);
  return ESP_OK;
}

static esp_err_t rmt_curtis_encoder_reset(rmt_encoder_t *encoder) {
  rmt_curtis_encoder_t *curtis_encoder = __containerof(encoder, rmt_curtis_encoder_t, base);
  rmt_encoder_reset(curtis_encoder->copy_encoder);
  curtis_encoder->state = RMT_ENCODING_RESET;
  return ESP_OK;
}

esp_err_t rmt_new_curtis_encoder(rmt_encoder_handle_t *out_encoder) {
  rmt_curtis_encoder_t *curtis_encoder = calloc(1, sizeof(rmt_curtis_encoder_t));
  // TODO: error check
  curtis_encoder->state = 0;
  curtis_encoder->base.encode = rmt_encode_curtis;
  curtis_encoder->base.del = rmt_del_curtis_encoder;
  curtis_encoder->base.reset = rmt_curtis_encoder_reset;

  rmt_copy_encoder_config_t copy_encoder_config = {};
  rmt_new_copy_encoder(&copy_encoder_config, &curtis_encoder->copy_encoder);

  // construct start, end bit
  curtis_encoder->start_bit = bits[0];
  curtis_encoder->end_bit = bits[1];

  *out_encoder = &curtis_encoder->base;

  return ESP_OK;

}

static bool rmt_rx_done_callback(rmt_channel_handle_t channel, const rmt_rx_done_event_data_t *edata, void *user_data)
{
    BaseType_t high_task_wakeup = pdFALSE;
    QueueHandle_t receive_queue = (QueueHandle_t)user_data;
    // send the received RMT symbols to the parser task
    xQueueSendFromISR(receive_queue, edata, &high_task_wakeup);
    return high_task_wakeup == pdTRUE;
}

static unsigned int round_duration(unsigned int duration) {
  int mod = duration % 10;
  
  if (mod == 0) {
    return duration;
  }

  if (mod >= 5) {
    return duration + (10 - mod);
  }
  return duration - mod;
}
static int extract_level(uint16_t *data, int index, const unsigned int level, const unsigned int duration) {
  if (level == 1) {
    // this is inverted, so this is a zero. we can just increase index
    return index + duration / 10;
  }

  for(int i = 0; i < duration / 10; i++) {
    *data |= 1 << index;
    index++;
  }

  return index;
}

static void round_symbol_word(rmt_symbol_word_t *word) {
  word->duration0 = round_duration(word->duration0);
  word->duration1 = round_duration(word->duration1);
}

uint16_t sequence[] = {
  0x3BA,
  0x2,
  0x2,
  0x3E2,
  0x2,
  0x102,
  0x15A
};

uint16_t master_seq[] = {
  0x2E8,
  0x202,
  0x002,
  0x3E2,
  0x002,
  0x002,
  0x05A
};

static void parse_frame(rmt_symbol_word_t *rmt_symbols, size_t symbol_num)
{
    // printf("frame start---\r\n");
    uint16_t data = 0;
    int data_idx = 0;

    for (size_t i = 0; i < symbol_num; i++) {
      rmt_symbol_word_t symbol = rmt_symbols[i];
      // round_symbol_word(&symbol);

      data_idx = extract_level(&data, data_idx, symbol.level0, symbol.duration0);
      data_idx = extract_level(&data, data_idx, symbol.level1, symbol.duration1);

      
      // printf("{%d:%d},{%d:%d}\r\n", symbol.level0, symbol.duration0,
      //         symbol.level1, symbol.duration1);

    }

    while(data_idx < 14) {
      // stick in remaining bits
      data |= 1 << data_idx;
      data_idx++;
    }

    data = (data >> 1) & 0b1111111111;

    if (data == 0x5A) {
      for(uint16_t i = 0; i < 7; i++) {
        rmt_transmit(tx_channel_handle, encoder, (void *)&sequence[i], sizeof(uint16_t), &tx_config);
      }
      // rmt_tx_wait_all_done(tx_channel_handle, 5);
      
    }
    // ESP_LOGI(TAG, ">> data = %x", (data >> 1) & 0b1111111111);
    // // printf("---frame end: ");
}


static void parse_all_frames(rmt_symbol_word_t *rmt_symbols, size_t symbol_num) {
  // breaks up frames into smaller ones

  int current_duration = 0;
  size_t current_size = 0;

  rmt_symbol_word_t *start = NULL;

  for(size_t i = 0; i < symbol_num; i++) {
    rmt_symbol_word_t *word = &rmt_symbols[i];

    if (start == NULL) {
      start = word;
    }

    round_symbol_word(word);
    current_duration += word->duration0 + word->duration1;
    current_size++;

    if (current_duration / 10 >= 12) {
      // ship it
      parse_frame(start, current_size);

      current_duration = 0;
      current_size = 0;
      start = NULL;
    }
  }

  if (start != NULL) {
    parse_frame(start, current_size);
  }
}

void app_main() {
  ESP_LOGI(TAG, "create rmt tx channel");

  // init rx channel
  rmt_rx_channel_config_t rx_channel_config = {
    .clk_src=RMT_CLK_SRC_DEFAULT,
    .gpio_num=SERIAL_TX_GPIO_NUM,
    .mem_block_symbols=64,
    .resolution_hz=SERIAL_FREQ_HZ,
    .flags.invert_in=true,
    .flags.with_dma=false,
    .flags.io_loop_back=true,
  };
  ESP_ERROR_CHECK(rmt_new_rx_channel(&rx_channel_config, &rx_channel_handle));

  // init tx channel
  rmt_tx_channel_config_t tx_channel_config = {
    .clk_src=RMT_CLK_SRC_DEFAULT,
    .gpio_num = SERIAL_TX_GPIO_NUM,
    .mem_block_symbols=64,
    .resolution_hz=SERIAL_FREQ_HZ,
    .trans_queue_depth=3,
    .flags.invert_out=true,
    .flags.with_dma=false,
    .flags.io_loop_back=true,
    .flags.io_od_mode=true
  };
  
  ESP_ERROR_CHECK(rmt_new_tx_channel(&tx_channel_config, &tx_channel_handle));
  
  // set gpio modes
  // gpio_set_pull_mode(SERIAL_TX_GPIO_NUM, GPIO_FLOATING);
  // gpio_set_pull_mode(SERIAL_TX_GPIO_NUM, GPIO_MODE_INPUT);
  // gpio_set_drive_capability(SERIAL_TX_GPIO_NUM, GPIO_DRIVE_CAP_0);

  // init rx queue and callbacks
  QueueHandle_t receive_queue = xQueueCreate(10, sizeof(rmt_rx_done_event_data_t));

  rmt_rx_event_callbacks_t cbs = {
    .on_recv_done=rmt_rx_done_callback
  };
  ESP_ERROR_CHECK(rmt_rx_register_event_callbacks(rx_channel_handle, &cbs, receive_queue));

  rmt_receive_config_t receive_config = {
    .signal_range_min_ns=7*1000, // start bit only
    .signal_range_max_ns=12*10*1000 + 7*1000
  };

  // create tx encoder
  
  rmt_new_curtis_encoder(&encoder);
  
  ESP_ERROR_CHECK(rmt_enable(tx_channel_handle));
  ESP_ERROR_CHECK(rmt_enable(rx_channel_handle));
  
  rmt_symbol_word_t raw_symbols[64] = {0}; // more than enough
  rmt_rx_done_event_data_t rx_data;

  ESP_ERROR_CHECK(rmt_receive(rx_channel_handle, raw_symbols, sizeof(raw_symbols), &receive_config ));


  
  for(;;) {
    if (xQueueReceive(receive_queue, &rx_data, pdMS_TO_TICKS(10)) == pdPASS) {
        // ESP_LOGI(TAG, "received data");
        parse_all_frames(rx_data.received_symbols, rx_data.num_symbols);
          // start receive again
        ESP_ERROR_CHECK(rmt_receive(rx_channel_handle, raw_symbols, sizeof(raw_symbols), &receive_config));
        

        // vTaskDelay(5);
    } else {
      // for(uint16_t i = 0; i < 7; i++) {
      //   rmt_transmit(tx_channel_handle, encoder, (void *)&master_seq[i], sizeof(uint16_t), &tx_config);
      // }
    }
  }
}

Attaching it to my computer and using lsusb shows it has a Rockchip in it. I feel like Rockchips will either be running some slim Linux distro or something Android-based. I ran adb devices and sure enough, it’s just a slimmed-down Android-based tablet,

$ adb devices
List of devices attached
3431A0008409	device

Opening a shell, we can see it has a Rockchip RK3128, a fairly high-performance chip for something so innocuous. I’m presuming the designers chose this for its FPU/GPU, since this picture frame supports video playback.

Packages

Running pm list packages, we can see there’s a handful of apps installed. Mainly, it looks like the company installs com.skylight and a watchdog skylight.watchdog. It looks like the apps listen for the android.intent.action.BOOT_COMPLETED to launch the app. Interestingly, looking at the dump, the MainActivity is com.skylight/odesk.johnlife.skylight.activity.MainActivity, maybe based on this repo or the parent repo. (As an aside, what’s with these plaintext creds?).

Since the Android browser is still installed, we can launch it using monkey -p com.android.browser 1:

Launching the settings, monkey -p com.android.settings -c android.intent.category.LAUNCHER 1, we can see it’s running Android 5.1.1. It has a few GB of storage. It’s a bit outdated, so I think I’ll be keeping this on an isolated network.

Summary

The Skylight is a cute little picture frame and I’m glad the ADB interface is still not locked down. It looks like somebody could easily create their own app to take place of the default Skylight app, which could be a fun little project.