Laptop Repair à la Backyard Dentistry

A friend of mine had purchased a nice Alienware laptop a number of years ago (an AW15R3), and it had some serious problems. He wanted help repairing it – and in fact, he had already done a great deal of diligence in tracking down problems and solutions. Here’s how we pulled a bad tooth out of a problematic laptop, so to speak, and restored it to its former glory!

Mikes beast of a laptop was now out of warranty; the laptop would power on to a black screen and get very hot. Mike got his hands on a thermal imaging camera and got to work analyzing the problem:

Well, there was clearly a problem. Unsurprisingly, it was in the power supply circuitry. You can see just how hot this thing was running:


Mike managed to source a schematic for the laptop (I have no idea how, I’ve never been so lucky!) and asked for my help troubleshooting the power section and repairing this unit. I had just received my hot-air rework gun, so this came with good timing!

After some brainstorming, we reasoned that the likeliest cause (And one that would be possible to fix) was that one or more of the circled power MOSFETs had gone bad – and indeed one of them correlates to the hot spot on the motherboard:

Of course, it could be the supporting circuitry that caused the MOSFET(s) to fail in the first place. Nothing else appeared damaged, so we took the chance. We sourced the replacement parts and got to work repairing the unit. Our game-plan was to replace all of the MOSFETs circled. However – we underestimated just how much heat it takes to get the solder flowing on this multi-layer motherboard, undoubtedly with many large copper planes for the power supply:

I couldn’t tell you how long we spent trying to get one of these power MOSFETs to reflow – easily over half an hour. This is normally done with a large oven to bring the whole board up to temperature before rework. We made do with brute force and ignorance.

And so – with inadequate heat and too much force, We managed to get some of the bad parts off of the board – it became apparent that soldering something back on was out of the question. We were getting hopeless – you can see some of the copper pads lifting underneath a MOSFET die… yes, we pried the case off, and the die was still stuck to the board…

Not my proudest work….

But, wait a minute – looking at the schematic, these MOSFETs have parallel counterparts on the other side of the PCB. What’s the current capacity of these things, anyway?

These MOSFETs can each handle 24A pretty handily, and the current calculations printed in the schematic worked out to under 20A total – so, theoretically, this laptop did not need the paralleled capacity, if the calculations are to be trusted. It looks as if they were paralleled to spread out the heat a little bit, and perhaps for some added redundancy. We had removed the thermally challenged MOSFET; could this thing “just work” at this point? I was skeptical about turning the unit on, but Mike was willing to accept the risks. We soldered some of the casualties back in place (diodes) and cleaned up the desoldering mess as best we could. We reassembled the laptop, booted it into a diagnostic mode – and everything worked!

I don’t know that I’ve ever fixed something by removing a part. We effectively pulled a bad tooth out of the laptop, and the problems all disappeared. Go figure. Mike stress tested it with some intensive gaming when he got home, and the thermal issues had entirely disappeared.

So – when your laptop is misbehaving, should you go removing parts? Absolutely not. I will point out that we had an appropriate fire extinguisher present during all of our tests. Power electronics can get very – well, “explodey” – this is why we did all of our testing outside! This was only remotely advisable on account of the research and precautions that Mike and I had done (okay, it was mostly Mike!)

A big thank-you to Mike for the fun project, the hard research, and the photos. You can catch Mike Himbeault on reddit and github.

Building a Magic Mirror; Nifty Opto-Isolator Tricks

After seeing a critical mass of Magic Mirror builds online, I caved and built one as a Christmas gift for my girlfriend – I made a few innovations on top of the other builds I’ve seen, so I’ve documented them here.  I drew much of the inspiration from Dylan Pierce in particular, so be sure to check out his build log as well!  Here’s the finished product, before wall-mounting:



Build Process:

As I did not have the patience to spec out my own LCD panel, I decided to purchase a used victim TV, and worked from there.  The first step was to pop the bezel off and take a few measurements:




With measurements of the LCD panel itself, I was able to mount the LCD panel in a basic 2×4 frame:


The LCD Panel did not have any usable mounting holes that could mate with the 2×4, so I held it in place with some small angle brackets.

After installing the brackets, I realized the single-screw mounting hole would be prone to rotation – some flank screws made for a quick fix.  Also pictured: speed holes


I eventually added small metal mending plates to sandwich the LCD bezel in the frame (not pictured)

The TV I had cannibalised did not support HDMI/CEC control via the raspi, so I patched in to the power button with an opto-isolator (Sharp PC817).  By using an opto-isolator, the raspi only “sees” an LED as the load, allowing for safe coupling between the raspi and the TV circuitry.  The pin spacing on the PC817 was conducive to patching in directly to the tactile switches.  I also replaced the TV’s “off” LED with an opto-isolator connected in the opposite direction – this lets the raspi know if the TV is on or not.  This is important, because the power button is of the on/off toggle type; the raspi wouldn’t be able to know if it was turning it “on” or “off” otherwise, it would only know that it is changing the state.




Originally, I was going to power the TV on and off via cron job, until a coworker suggested putting a sensor in to turn the mirror on when someone is in front of it.  I just happened to have a spare ultrasonic sensor around, so I mounted it into the frame and wired it up via GPIO pins on the rpi:


With all the electronics connected + working, I glued the fancy mirror-glass in place (Actually, it’s acrylic), and added a nice aesthetic touch with some faux-oak molding and iron-on veneer (ran out of veneer, so the bottom got the thin piece).  I measured the mirror piece to have a 0.5″ margin beyond the viewable LCD portion so that I could affix it to the LCD bezel for a tight fit.  Mirror glass was the same used by Dylan Pierce available at TAP Plastics:

The notch is in place to accommodate a power cable while wall-mounted.  Also pictured: speed holes


The ultrasonic sensors were a bit tricky; I drilled holes in the moulding and adjusted them with a dremel.  They are by no means perfect…



And here’s a view of the rear/electronics – the intention is that this will be wall-mounted, so I didn’t bother with a protective cover.  Zip ties were applied liberally.




Note: The optoisolator / ultrasonic sensor circuitry was soldered onto a piece of perfboard that mated with the RPi’s GPIO header


The base software installation uses raspbian jessie and MagicMirror², and raspbian packages python-gpiozero and wiringpi (i.e. install via sudo apt-get install _____).  All GPIO control code is below.

Note: all .sh and .py files live in /home/pi, the .service files live in /etc/systemd/system/, enable via:

  • cd /etc/systemd/system
  • sudo systemctl enable detect_person.service
  • sudo systemctl enable tv.service

This allows for control via, e.g. sudo service tv [start|stop].  The tv.service serves to turn on the tv during the boot process (as well as for general debugging), while the detect_person service performs the ongoing operation for person detection.   Note that the particulars in need to be tuned to the environment that the mirror is installed in!

I also had to play with some settings /boot/config.txt to get the right screen orientation, see the comments in that file for details.




Hacking Dollar-Store Bluetooth Devices (The Kindness of Strangers) part 2

This is a continuation of “Hacking Dollar-Store Bluetooth Devices (The Kindness of Strangers) part 1”

After putting the EEPROM programming document (rda5871_progguide) through google translate, I was able to discern the format of this mysterious binary dump I had created – I created a simple program to parse the Saleae log file (saleae_log) into one contiguous binary image (binary_image – extension is just to get around wordpress, it’s binary) and parse the info header as well as  some of the configuration data (hopefully).

However, the data I got back was pretty trivial:

Parsing info header…
Chip ID: 0x5873
Version: 6.4
PSKey Length: 532
Data Length: 6912
Length: 0
Data: {}

This at least provided a sanity check against the info header format – the Chip ID matches what is laid out in the guide.  But, none of the datasheet’s “PSKey” information located at 0x88 seems to be used – just 532 bytes of “SYS_CONFIG_ID_NULL” and zero-length data blocks.  As well, the ISR code regions described seem to reside well out of the memory range of the binary dump – e.g. 0x80006880 – so it appears I am no further along in the binary image, pending further ingenuity…


But then I noticed some clearly labelled serial connections!

I was able to squeeze in a tiny terminal header to break out the TX/RX solder pads

Pro tip – you can pop the Atmel IC out of an arduino board, and you have a simple USB <-> TTL RS232 bridge



I was able to discern from my ‘scope that the data was transmitting at a line discipline of 115200 Baud 8N1 – however, the data that it spat back at me was indecipherable.  Consistent, but gibberish.  I had some hopes that it was unicode / chinese characters, but this was quickly ruled out (unless this serial prompt also uses arabic…).  If I had to guess, this is some binary debug and/or manufacturing automation output.  Oh well.

I also noticed that the device would pair to my PC as a USB keyboard – it ends up sending a “Volume up” keystroke and a “Enter” keystroke between the two buttons.  I was hopeful that the EEPROM image would contain the keycodes for these, allowing us to change it’s behaviour, but I was unable to find such.

My next step will be to selectively write some of the EEPROM data & (hopefully) change the device’s name – stay tuned!

Hacking Dollar-Store Bluetooth Devices (The Kindness of Strangers) part 1

Ah, the dollar store – risky condoms, something labelled as mustard, and every permutation of pastey-looking, thin-plastic discharge courtesy of third-world prisons factories all line the utilitarian wire-shelves; How do our capitalist overlords tolerate such thrift?  Just how much nausea-ketchup must one purchase to turn a profit at $1/bottle?  I don’t even care to know, because I’m too busy ogling the most modern dollar store trinket yet(?); this Bluetooth camera shutter!




This things works right out of the box – but that’s boring, because that’s what we expected it to do (actually, I didn’t even expect it to do that.)  I decided to take this thing to SkullSpace (my local hackerspace) to see what makes this zany device tick –  this three-dollar chunk of plastic that wirelessly talks to my cell phone!?

20160904_183253See those two lines coming from the large chip to the small chip?  Yup, thats an I2C bus!  Googling the part number (RDA5871 ) reveals that the larger chip is a bluetooth IC with an integrated ARM core, and the smaller one is ostensibly a configuration ROM.  After connecting our handy logic analyser and twiddling with the I2C settings, I was able to get a log of all the data being read from the smaller chip:


saleae_log (text file, output from Saelae logic)


Lo and behold, searching through the text file for the Bluetooth name – “AB Shutter”, we find it:



1.363374400000000,7,’161′,’ ‘,Read,ACK
1.363564800000000,7,’161′,’ ‘,Read,ACK


Looks like we are reading the chip correctly!  I noticed the above block is one giant read (about 6.8kB) starting from ROM address 0x0228 – We see two writes to address 160, the data of which is 0x0228.  This is a typical I2C EEPROM “Start reading data from here” command.   The device then spits out consecutive bytes, starting from the supplied address, on every read.   I carved out the relevant 6.8k read manually, and used awk to extract the “read” column.  Then, I used this simple python script to convert the decimal “read data” output into a binary file (note – I had to change the csv data from ASCII to decimal in Saleae Logic):

test_out (Arbitrary extension, just binary data)

But what is this file?  Is it an ARM binary? I have no idea!  I was hopeful that the device was reading a full firmware image directly from the I2C ROM, but I cannot find any indication of such (yet).  I have tried looking at earlier reads in the I2C transactions to discern any kind of header information, but nothing was obvious – I’ve tried pointing the file command at it to determine it’s type via magic bytes, and I’ve also tried running it through various ARM dissemblers with no luck.

I did manage to find this defunct google code page regarding the RDA5871, and I am happy to report that the previous maintainer has replied to my random emails with some documentation on how to configure the device via ROM!  I am hopeful to get this pointed at the mystery file dump that I have.   The only hurdle is that the document is primarily in chinese, so stay tuned for when I wrangle together a translation –  for any of you willing to take a gander, here it is: rda5871_progguide




Halloween 2014 – a functioning gameboy

For Halloween this year, I decided to step up my costume game and make a fully functioning gameboy costume:


A ton of people who saw the costume wouldn’t believe it worked until they pushed a button….. but the reaction was always priceless


Click ‘Continue Reading’ to see how the magic works!

Read more “Halloween 2014 – a functioning gameboy”

Rejuvinating an old laptop… with electrical tape

What do you do with a busted laptop?  Many people are quick to throw them away.  Others turn them into FreeNAS boxes, or other useful servers.  For the machine I inherited today, I decided to turn it into an all-in-one style desktop PC.  The screen still worked, it was able to boot windows – the only trouble being that it was in physically rough shape.



Basically, the screen had become detached from the rest of the machine – but all the cables were still in place for it to function.  After some light tweaking, I was able to get the screen to flip around the body of the laptop and sit flat on the reverse side:


But how to keep it in place?  Being impatient and lazy (usually a dangerous combination), I tried my lucking using an entire roll of electrical tape to keep it all together.  Because why not?

Partway through the taping

Being that this thing is going to mount against something on the reverse, I removed the keyboard as well.  So it’s not bumping its keys into stuff all the time.

As luck would have it, I had an old monitor stand kicking around – works as a nice little kickstand. Not perfectly stable, but still more solid than I was expecting:

Starting to take form…

Now all that’s left is to wipe the old Vista install and put on a fresh OS…

Tape starting to lift in the top-right corner, this was later fixed. The answer, of course, was more tape.

A few hours of tinkering, an old laptop, some electrical tape, and a fresh Xubuntu install made for a perfectly good bedroom workstation.  Not bad for one night!