Welcome

Getting it to work

So, now all that remained was putting it together and booting the system, to see if I could get some LEDs to light up. Let's first see if the system survived transport and will still boot:

Aaah, look at these specs; a blazingly fast 486DX4 at 100MHz with 8 megabytes of RAM! It seems to boot into QNX, an Unix-like RTOS, from the attached 16MB SSD. Unfortunately, the screen blanks after the startup process is done, maybe trying to start up something graphical that fails because of lack of network access.

With the screen blank, the only way to get info in and out of the machine is the network. I didn't have any idea what the network it used to be connected to looked like, however. The easiest way to find that out was to connect my laptop to the Ethernet-port of the device and start tcpdump to hope the 486 would output some packets indicating what IP it has.

jeroen@laptop:~$ sudo tcpdump -i eth0 -n -v
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
22:43:16.098455 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.28.0.171 tell 10.28.0.171, length 46
22:43:16.520952 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.28.0.4 tell 10.28.0.171, length 46
22:43:21.531265 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.28.0.4 tell 10.28.0.171, length 46

Ah, it seems like the machine lives at 10.28.0.171. Now I could configure my laptops IP to be in the same subnet. Using nmap, an advanced portscanner, I should be able to find out what services the machine offers:

jeroen@laptop:~$ sudo ifconfig eth0 10.28.0.1
jeroen@laptop:~$ nmap 10.28.0.171

Starting Nmap 5.51.6 ( http://nmap.org ) at 2013-04-05 22:45 CEST
Nmap scan report for 10.28.0.171
Host is up (0.020s latency).
Not shown: 993 closed ports
PORT     STATE SERVICE
21/tcp   open  ftp
23/tcp   open  telnet
79/tcp   open  finger
512/tcp  open  exec
513/tcp  open  login
514/tcp  open  shell
3050/tcp open  gds_db

Nmap done: 1 IP address (1 host up) scanned in 3.39 seconds
jeroen@laptop:~$

Telnet, exec, login, shell... all unencrypted services. Seems the signs really were meant to live on a secured LAN, inaccessible from the outside. Maybe, if I was really lucky...

jeroen@laptop:~$ telnet 10.28.0.171
Trying 10.28.0.171...
Connected to 10.28.0.171.
Escape character is '^]'.
termdef: Warning - terminal type previously set (TERM=xterm) is unknown.
Enter terminal type : vt100
login: root
No directory!  Logging in with home=/

# ls
.             .bitmap       LASTUPDATE    bin           peer
..            .boot         MYSELF        dev           ram
.altboot      .inodes       NETMSK        etc           usr
# 

Awesome, a root login with no password needed: I was in!
Next, I browsed around on the filesystem a bit to see how the software was structured. It seems like QNX is built around 'servers' that provide some kind of service to the operating system, in a microkernel-like way. It seems the software that controls the LEDs is written in the same way... but how could I talk to the service? It seems it listens on a TCP-port, but it needed some kind of format I couldn't decipher... and without that format, it just closed the connection. Luckily, I struck gold when I looked in the /etc/config/sysinit startup file and saw the line 'solact led lumen 5 5'. Seems that's a command that does something with the LEDs! Maybe we can do something with it...

# solact led
SOLACT version [2.0]  April 24, 1997
Connected with server "led" (QUEUE mode)
? help
//c 0  COMMAND LIST :
BACKTEST       activates back read test: checks led power row by row
BACKSTAT       gives back test result
COPYRECT       <sourcepage> <targetpage> <X1> <Y1> <X2> <Y2>
LUMEN          <RED 0�10> <GREEN 0�10>    *** SET LUMEN - LED only ***
PAGE           DISPLAY, RESET
PLAY           <storyname> [xoffset (def=0)] [yoffset (0)]
RD             (logical) ROWS DEFINE
ROWDEFINE      (logical) ROWS DEFINE
RECTANGLE      <X1> <Y1> <WIDTH> <HEIGHT> <colornum|name> [PAGE n]
READAP         RETURNS THE ANALOG PORT VALUE FROM SENSORS
READTUTA       READ TUNE TABLE (TO SET LED INTENSITY ACCORDING TO SENSORS INPUT
SETLIGHT       SET LED INTENSITY ACCORDING TO SENSORS INPUT VIA TUNE TABLE
STOP           Stops immediately the story playing, no parameters
TEST           ENABLE|DISABLE [n1-n2] [PAGE=n] [COLORS] (PIXEL ALTERNANCE TEST)
VA             [pagnum]          (VIEW ALTERNATING REGIONS)
VB                               (VIEW BLINKING REGIONS)
VF                               (VIEW FONTS)
VP             [pagnum]          (VIEW PAGES)
VR             [n1-n2] [PAGE=n]  (VIEW ROWS DEFINITION)
VS             [pagnum]          (VIEW SCROLLING REGIONS)
VT             VIEW TUNE TABLE (FOR LED INTENSITY TUNING)
VIEWCMD        <storyname>  prints story commands - DONT'CALL DURING PLAYING
WRITEROW       [options] "text between quotes" ... [opt] "text"
ASSIGN         <varname>=<value>
EXIT            
HELP            
QUERY           
? help writerow
//c 0 
WRITEROW       [options] "text between quotes" ... [opt] "text"
options : X=<num | CENTER> def=cur pos
          Y=<num | CENTER> def=cur pos
          ROW=<num> (def=cur Y pos)
          WIDTH=<n> (def=automatic) [+|-]SCROLL [+|-]UNDERLINE [+|-]REVERSE
          [+|-]ALTERN {PUSH}[UP|DOWN|RIGHT|LEFT|NORMAL(def)] "txt1"..."txtn"
          HEIGHT=<n> (def=automatic)
          YOFFSET=<n> (def=0)
          JUSTIFY=<?> C=Center | R=Right | L=Left (default)
          ENDX=<num> : calculate X as ENDX-WIDTH (arabic write)
          <foreground> ON <background> (white on black)
          FONT <fontname> (def=current font)
          [+|-]BLINK   [+|-]LINEFEED
          XMAX=<n>  YMIN=<n>  WMAX=<n>
          +IMAGE : interpret text as image file name
? 

Jackpot! With the writerow command I should be able to put text on the display and verify it still works:

Yay, we have text! I soon found out the reason the second part of the display didn't work was because I missed a power cable somewhere; it worked just fine after I installed that.

« Prev 2 Next »


© 2006-2016 Sprite_tm - Contact