Getting it to work
So, now all that remained was putting it together and booting the system, to see if
I could get some LEDs to light up. Let's first see if the system survived transport
and will still boot:
Aaah, look at these specs; a blazingly fast 486DX4 at 100MHz with 8 megabytes of RAM!
It seems to boot into QNX, an Unix-like RTOS, from the attached 16MB SSD.
Unfortunately, the screen blanks after the startup process is done, maybe trying to
start up something graphical that fails because of lack of network access.
With the screen blank, the only way to get info in and out of the machine is the network. I didn't have any idea what the network it used to be connected to looked like, however. The easiest way to find that out was to connect my laptop to the Ethernet-port of the device and start tcpdump to hope the 486 would output some packets indicating what IP it has.
jeroen@laptop:~$ sudo tcpdump -i eth0 -n -v tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 22:43:16.098455 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.28.0.171 tell 10.28.0.171, length 46 22:43:16.520952 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.28.0.4 tell 10.28.0.171, length 46 22:43:21.531265 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.28.0.4 tell 10.28.0.171, length 46
Ah, it seems like the machine lives at 10.28.0.171. Now I could configure my laptops IP to be in the same subnet. Using nmap, an advanced portscanner, I should be able to find out what services the machine offers:
jeroen@laptop:~$ sudo ifconfig eth0 10.28.0.1 jeroen@laptop:~$ nmap 10.28.0.171 Starting Nmap 5.51.6 ( http://nmap.org ) at 2013-04-05 22:45 CEST Nmap scan report for 10.28.0.171 Host is up (0.020s latency). Not shown: 993 closed ports PORT STATE SERVICE 21/tcp open ftp 23/tcp open telnet 79/tcp open finger 512/tcp open exec 513/tcp open login 514/tcp open shell 3050/tcp open gds_db Nmap done: 1 IP address (1 host up) scanned in 3.39 seconds jeroen@laptop:~$
Telnet, exec, login, shell... all unencrypted services. Seems the signs really were meant to live on a secured LAN, inaccessible from the outside. Maybe, if I was really lucky...
jeroen@laptop:~$ telnet 10.28.0.171 Trying 10.28.0.171... Connected to 10.28.0.171. Escape character is '^]'. termdef: Warning - terminal type previously set (TERM=xterm) is unknown. Enter terminal type : vt100 login: root No directory! Logging in with home=/ # ls . .bitmap LASTUPDATE bin peer .. .boot MYSELF dev ram .altboot .inodes NETMSK etc usr #
Awesome, a root login with no password needed: I was in!
Next, I browsed around on the filesystem a bit to see how the software was structured.
It seems like QNX is built around 'servers' that provide some kind of service to
the operating system, in a microkernel-like way. It seems the software that controls
the LEDs is written in the same way... but how could I talk to the service? It seems
it listens on a TCP-port, but it needed some kind of format I couldn't decipher...
and without that format, it just closed the connection. Luckily, I struck gold when
I looked in the /etc/config/sysinit startup file and saw the line 'solact led lumen 5 5'.
Seems that's a command that does something with the LEDs! Maybe we can do something
with it...
# solact led
SOLACT version [2.0] April 24, 1997
Connected with server "led" (QUEUE mode)
? help
//c 0 COMMAND LIST :
BACKTEST activates back read test: checks led power row by row
BACKSTAT gives back test result
COPYRECT <sourcepage> <targetpage> <X1> <Y1> <X2> <Y2>
LUMEN <RED 0�10> <GREEN 0�10> *** SET LUMEN - LED only ***
PAGE DISPLAY, RESET
PLAY <storyname> [xoffset (def=0)] [yoffset (0)]
RD (logical) ROWS DEFINE
ROWDEFINE (logical) ROWS DEFINE
RECTANGLE <X1> <Y1> <WIDTH> <HEIGHT> <colornum|name> [PAGE n]
READAP RETURNS THE ANALOG PORT VALUE FROM SENSORS
READTUTA READ TUNE TABLE (TO SET LED INTENSITY ACCORDING TO SENSORS INPUT
SETLIGHT SET LED INTENSITY ACCORDING TO SENSORS INPUT VIA TUNE TABLE
STOP Stops immediately the story playing, no parameters
TEST ENABLE|DISABLE [n1-n2] [PAGE=n] [COLORS] (PIXEL ALTERNANCE TEST)
VA [pagnum] (VIEW ALTERNATING REGIONS)
VB (VIEW BLINKING REGIONS)
VF (VIEW FONTS)
VP [pagnum] (VIEW PAGES)
VR [n1-n2] [PAGE=n] (VIEW ROWS DEFINITION)
VS [pagnum] (VIEW SCROLLING REGIONS)
VT VIEW TUNE TABLE (FOR LED INTENSITY TUNING)
VIEWCMD <storyname> prints story commands - DONT'CALL DURING PLAYING
WRITEROW [options] "text between quotes" ... [opt] "text"
ASSIGN <varname>=<value>
EXIT
HELP
QUERY
? help writerow
//c 0
WRITEROW [options] "text between quotes" ... [opt] "text"
options : X=<num | CENTER> def=cur pos
Y=<num | CENTER> def=cur pos
ROW=<num> (def=cur Y pos)
WIDTH=<n> (def=automatic) [+|-]SCROLL [+|-]UNDERLINE [+|-]REVERSE
[+|-]ALTERN {PUSH}[UP|DOWN|RIGHT|LEFT|NORMAL(def)] "txt1"..."txtn"
HEIGHT=<n> (def=automatic)
YOFFSET=<n> (def=0)
JUSTIFY=<?> C=Center | R=Right | L=Left (default)
ENDX=<num> : calculate X as ENDX-WIDTH (arabic write)
<foreground> ON <background> (white on black)
FONT <fontname> (def=current font)
[+|-]BLINK [+|-]LINEFEED
XMAX=<n> YMIN=<n> WMAX=<n>
+IMAGE : interpret text as image file name
?
Jackpot! With the writerow command I should be able to put text on the display and
verify it still works:
Yay, we have text! I soon found out the reason the second part of the display didn't
work was because I missed a power cable somewhere; it worked just fine after I installed
that.