The code of the Infrared led of the HP28S. Since the infrared led is also used by companies other than Hewlett Packard, I want to make its code (as far as me and some friends of mine have cracked it) public. First of all, I want to thank Jurjen Bos, Niels Ferguson, and Toin Bloo, for doing this research (I am no good with hardware). Please note that this information might not be correct, it is found by our- selves, and we didn't get it from HP. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% The signal consists of three parts: - Syncpulses: To synchronise the hardware with incoming information - Checksum: To detect and reconstruct bad bits - Data: The actual information The data and checksum are frequence modulated, and every mark is modulated with 6 pulses. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% Schematical representation of a byte: ~0.8 msec ~3.2 msec |<-Sync>|<-----------Checksum---------->| | | | | | | Bitcel: | 0 | 1 2 3 4 | v v v _ _ _ _ _ _ _ _ _ _ |1| |1| |1| | | | | | | | | | | | | | | .... | |_| |_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_ ~6.4 msec |<-----------------------------Data-------------------------->| |Bit: 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | | | | | | | | | | | 5 6 7 8 9 10 11 12 | v v _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .... | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d| where: s = startpulse (clockpulse) d = datapulse - If the preceeding databit was 1, the startbit will be 0. - If the preceeding databit was 0, the startbit will be 1. - The first startbit of bitcel 1 (checksum) is always 1. - Gaps between S and D are maximum 1 msec; it is up to the hardware, to resynchronise with every byte. Example: Bitcel: | 6 | 7 | 8 | 9 | ... s d s d s d s d ... 1 1 0 0 1 0 1 1 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% Schematical representation of a bitcel: (of which a byte has 12) /| /| /| /| /| /| /| /| /| /| /| /| / |/ |/ |/ |/ |/ | / |/ |/ |/ |/ |/ | / | | | | | _| |___________________| |___________________| ^ ^ ^ ^ ^ | |--| ~0.03 msec | | | | | |<----------------------------------->| ~0.4 msec | | ~0.8 msec | |<------------------------------------------------------------------------->| %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% The checksums: Data: I.R.: (filtered from sync- Checksum: and start-bits) #00h 0 0 0 0 0 0 0 0 0 0 0 0 #0h #01h 0 0 1 1 0 0 0 0 0 0 0 1 #3h #02h 0 1 0 1 0 0 0 0 0 0 1 0 #5h #04h 0 1 1 0 0 0 0 0 0 1 0 0 #6h #08h 1 0 0 1 0 0 0 0 1 0 0 0 #9h #10h 1 0 1 0 0 0 0 1 0 0 0 0 #Ah #20h 1 1 0 0 0 0 1 0 0 0 0 0 #Ch #40h 1 1 1 0 0 1 0 0 0 0 0 0 #Eh #80h 0 1 1 1 1 0 0 0 0 0 0 0 #7h The checksum is calculated as follows: Start with 0, and for every position that is 1, take the corresponding value in the table above, and XOR it with the previous result. Example: ,---last result | ,---hex digit #27h 1 1 0 0 0 0 1 0 0 1 1 1 | | (as in table) | | ,---new result Because: ------- | | | | v v v | | | | '-> #0h XOR #3h = #3h | V V '---> #3h XOR #5h = #6h ^ | '-----> #6h XOR #6h = #0h | '->---------> #0h XOR #Ch = #Ch = #1100b | ---- '------<----------------<---------------<------' %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% We hope someone can use this information to create a device to translate the code to RS232C, and make its schemes freely available to the public (as we did with this information). If you do, please send the schematics to: Eric Toonen Djept-Zuid 6 5502 RP Veldhoven The Netherlands You people are not too lazy to send a normal letter, are you? I don't have an E-mail account. We will post the results of this quest to Comp.Sys.Handhelds, Some additional notes: Please do not mail or post any replies about "Hook-uP" or "hp28com", I know of both, but their schemes are not publicly available; I want to accomplish that the schemes and documentation of such a (even if it is output only) device are free, combining our knowledges. You probably will have noticed that I want to have the same, concerning the source-listing of the 2BB ROM. If people at Hewlett-Packard, Corvallis Division, are reading this: I want to ask you to please make the code and hardware-schemes available of the infrared led. Also, I want to ask you to make the source of the 2BB ROM available. Any information sent to me confidential shall be treated as such. Be reading from you, Eric ----------------------------------------------------------------------------- Eric Toonen Snailmail: Djept-Zuid 6 | Hogeschool-Eindhoven: s89406143@hsepm3.hse.nl 5502 RP Veldhoven | (Not an uucp-address) The Netherlands | (Might work on SURFNET (?)) -----------------------------------------------------------------------------