CRHLM - User contributions [en]

DIY Watchman Dongles

2025-05-09T11:46:47Z

Cronholm: Created page with "Category:Reverse Engineering right ==Background== If you are using a lighthouse based tracking system, chances are you have encountered watchman dongles, either directly (Vive/Tundra trackers) or indirectly, mounted inside of your HMD. These watchman dongles are USB radio receivers that communicate wirelessly with Lighthouse-compatible devices using Valve’s proprietary protocol. Watchman dongles are typically based on the Nordic NRF..."

[[Category:Reverse Engineering]]
[[File:Spiggot.webp|frameless|right]]
==Background==
If you are using a lighthouse based tracking system, chances are you have encountered watchman dongles, either directly (Vive/Tundra trackers) or indirectly, mounted inside of your HMD.

These watchman dongles are USB radio receivers that communicate wirelessly with Lighthouse-compatible devices using Valve’s proprietary protocol. Watchman dongles are typically based on the Nordic NRF24LU1+ chipset, which is a USB-capable 2.4 GHz transceiver with a embedded microcontroller. In setups involving trackers like Tundra or HTC Vive, each dongle manages communication with a tracker or controller.

Unfortunately, these dongles are quite hard to get ahold of, without modifying steam controller dongles, it is reasonably straight forward to create your own.

In this semi-guide (lol) i will be showing how I was able to modify and flash a off-the-shelf development kit with Valve's own firmware.

==Parts==
When creating your own dongles, you can either choose to get a NRF24LU1+ development board or a board that has a NRF52840, which is a more advanced and newer integrated transciever. This is the one that sits inside of the Valve index and some newer headsets. NRF52840 development kits are more widespread these days since the NRF24LU1+ platform is being phased out.

[[File:Nrf52840dongle.png|thumb|alt=Makerdiary nRF52840 USB MDK, source:wiki.makerdiary.com|Makerdiary nRF52840 USB MDK]]
I opted to go with a Makerdiary MDK52840 USB Dongle. These can be found for anywhere between 20-30€ in the EU.
Whats great with these particular dongles is that they come preloaded with a UF2 Bootloader, which makes the flashing process quite straightforward.

==Modifying the firmware==
I cant share a modified firmware file, as that is Valves own IP. But i can show you how you can get one and modify it yourself. This guide is based HEAVILY on the work of [https://github.com/ugokutennp/watchman-uf2 Ugokutennp] on github but instead of creating a UF2 file, I create a DFU package instead and flash it using Adafruit's modified NRFUtil.

Start by locating your SteamVR install directory. Im on Linux, so i could find it under
'''~/.local/share/Steam/steamapps/common/SteamVR''' but YMMV.

Now go to the '''drivers/indexhmd/resources/firmware/radio''' directory, in here you will find two archives. You will want to copy '''gd_1558748372_dfu.zip''' to a working directory of choice.

File:Nrf52840dongle.png

2025-05-09T11:35:19Z

Cronholm:

File:Spiggot.webp

2025-05-09T11:19:00Z

Cronholm: This is a screenshot of a copyrighted video game graphic. It is believed that screenshots may be exhibited on CRHLM.COM under the fair use provision of copyright law.

== Summary ==
This is a screenshot of a copyrighted video game graphic. It is believed that screenshots may be exhibited on CRHLM.COM under the fair use provision of copyright law.

2024-12-30T19:42:51Z

Cronholm:

[[Category:Reverse Engineering]]
[[File:Openmelon-logo.png|frameless|right]]
==Background==
[[File:Melons-headband-Reprinted-from-Gadgets-to-help-you-relax-in-the-new-year-by-ZDNET.png|thumb|alt=Picture of the Melon EEG Headband, a silicone circular headband, approximately 15mm in height, black smooth silicone with a yellow plastic insert, source:zdnet.com|The Melon EEG Headband (ZDNET.com)]]
The Melon Headband started as a [https://www.kickstarter.com/projects/806146824/melon-a-headband-and-mobile-app-to-measure-your-fo Kickstarter] in May 2013, pitched as a focusing and meditation aid in a all to active world (if only they knew what was coming). The device used EEG (Electroencephalography) to measure the brains activity and deduct a focus metric from the [[#Data Collection|collected data]]. The "focus score" was then used to generate statistics over time and also control the built in origami folding game.

When the project eventually was abandoned in 2016 and the application subsequently discontinued, many customers were left with what was pretty much a silicone paper weight. Attempts were made to repurpose the device as a general EEG data collection device, but nothing compliant with LSL standards was ever made.

I came across one of these devices in a thrift shop, sitting at 49sek (4€-ish). Having never heard of the company, nor the device in question i naturally purchased it, with its complete box with all the accessories and the proprietary USB charger >:|

After finding out that the device was practically useless in its current condition, I became quite upset and decided to take matters into my own (arguably incompetent) hands.

==Reverse Engineering the BLE protocol==
The Melon Headband communicates with the users device using Bluetooth LE. I used the Linux Bluez utilities to connect to the device and read back its properties.
All communication from and to the band is done using Nordic RF:s UART over BLE functionality. This is exposed over one service with two characteristics:

'''SERVICE''': 6e400001-b5a3-f393-e0a9-e50e24dcca9e | ''Nordic UART Service''
*'''CHARACTERISTIC''': 6e400003-b5a3-f393-e0a9-e50e24dcca9e | ''Nordic UART RX''
*'''CHARACTERISTIC''': 6e400002-b5a3-f393-e0a9-e50e24dcca9e | ''Nordic UART TX''

I managed to find a copy of the original Android application, and was able to decompile it using JD-GUI.

The structure of the app is actually quite interesting, and contains some quite dubious programming choices such as storing the AWS S3 Bucket credentials in PLAIN TEXT???? The application also gathers geolocation data, which is sent together with collected EEG data to the mentioned S3 bucket. Sketchy stuff but i digress...

Eventually after much digging i found the class responsible for initializing a connected device.

<pre>
package com.axio.melonplatformkit;

class i implements Runnable {
i(DeviceHandle.Peripheral paramPeripheral) {}

public void run() {
DeviceHandle.Peripheral.b(this.a, "DW0308"); // send start command !! EUREKA
DeviceHandle.Peripheral.a(this.a, DeviceHandle.DeviceState.CONNECTED);
DeviceHandle.Peripheral.n(this.a);
}
}
</pre>

After confirming that <code>DeviceHandle.Peripheral.b();</code> does in fact send commands to a connected device:
(shortened code)
<pre>
private boolean b(String param1String) { // send command to device CONVERTER
byte[] arrayOfByte = param1String.getBytes("UTF-8");
bool = a(arrayOfByte); // send command to device
return bool;
}
// where a() is the send function:
private boolean a(byte[] param1ArrayOfbyte) { // send command to device
BluetoothGattService bluetoothGattService = this.m.getService(UUID.fromString("6e400001-b5a3-f393-e0a9-e50e24dcca9e"));
BluetoothGattCharacteristic bluetoothGattCharacteristic = bluetoothGattService.getCharacteristic(UUID.fromString("6e400002-b5a3-f393-e0a9-e50e24dcca9e"));
bluetoothGattCharacteristic.setValue(param1ArrayOfbyte);
boolean bool = this.m.writeCharacteristic(bluetoothGattCharacteristic)
return bool;
}
</pre>

The conclusion that "DW0308" was the initialization command could be made. I confirmed it once more by using a Bluetooth sniffer app on a test device.
The band is now initialized and ready to receive instructions. No response is sent back to the client. The client now sends the "Start Stream" command "S01".
The code responsible for sending this command was eventually found as well:

<pre>
package com.axio.melonplatformkit;

import android.util.Log;

class j implements Runnable {
j(DeviceHandle.Peripheral paramPeripheral) {}

public void run() {
if (DeviceHandle.Peripheral.b(this.a, "S01")) { // if send start stream command is successful
String str = DeviceHandle.Peripheral.m(this.a);
if (str == null)
str = "???";
Log.i(DeviceHandle.Peripheral.b(this.a), "Device opening stream: " + str);
}
}
}
</pre>

The band immediately starts spitting out the raw data on the RX line.

Now this is where the real pain started. I wrote a whooollee bunch of python test scripts to interact with the device using a variety of different python Bluetooth API:s, all of them with their own project-stopping quirks that on multiple occasions made me question every life choice i made up to this point. But alas, Bleak seemed to work (most of the time) on my Linux install, i just had to make sure that BlueMan did '''NOT''' connect to the device before the scripts did.

[[File:Melon-RawData.png|thumb|Raw packets, organized by receive time]]
I managed to gather a bunch of packets to analyze:
Now, there is a LOT to unpack here, these packets are always 20 bytes long, where the first byte is omitted (as can be found in the decompiled packet handler functions:
<pre>
protected void a(short[] paramArrayOfshort) {
System.arraycopy(paramArrayOfshort, 2, this.e, 0, 18);
</pre>
then we can see quite easily that the data is segmented into six parts (3 samples per 2 channels, each sample is marked as a group of "orange,red,green"). where the two first bytes (orange and red) are simply counting up from some initial value to <code>0xffff</code> and then rolls over. The values (or value rather since it really is a 2 byte value) is incremented every 28-29 values, so 3 times per second, is my best guess. This is most likely done to keep track of the time, since the sample rate may fluctuate a bit. The green values are the actual samples themselves!
I then did a recording of 100 seconds, which gave 8349 packets, so 83.49 packets/sec. 83.49 multiplied by the amounts of samples (3 samples) yields a sample rate of ≈ 250 samples/second or 250 Hz rate! Which means that the maximum frequency that the device can capture is 125 Hz (see [https://en.wikipedia.org/wiki/Nyquist_frequency Nyquist Frequency]), not bad at all.

Now in order to make any sense of this data I needed to look at the code that handles each packet and saves the resulting data to a buffer. The decompilation of this particular class was quite difficult to follow so i used ChatGPT to help me understand what was going on (my coffee-language skills are quite rusty), so that i could re-write the functionality in python.

<pre>
def conversion_method(byte_string):
byte_array = bytes.fromhex(byte_string)
raw_samples = [b & 0xFF for b in byte_array]
raw_samples[:] = raw_samples[2:20]
Sample1 = [0, 0]
Sample2 = [0, 0]
Sample3 = [0, 0]
skip_bit = 0
i = 0
while skip_bit < 18:
for j in range(2):
temp_sample = [0, 0, 0]
for loop in range(3):
temp_sample[loop] = raw_samples[skip_bit + loop + j * 3]
val1 = temp_sample[0] & 0xFF
val2 = temp_sample[1] & 0xFF
val3 = temp_sample[2] & 0xFF
sample_value = (val1 << 16) + (val2 << 8) + val3
if i == 0:
Sample1[j] = sample_value #& 0xFF
elif i == 1:
Sample2[j] = sample_value #& 0xFF
elif i == 2:
Sample3[j] = sample_value #& 0xFF
skip_bit += 6
i += 1
final_sample1 = multiplier(Sample1)
final_sample2 = multiplier(Sample2)
final_sample3 = multiplier(Sample3)
return final_sample1, final_sample2, final_sample3

def multiplier(sample):
final_sample = [0] * len(sample)
for i in range(len(sample)):
final_sample[i] = sample[i] * 0.4 / ((2 ** 23) - 1)
return final_sample
</pre>

Firstly the data is cropped and converted to an array of bytes. Then arrays are initialized for the three samples. The function then loops over the raw data and appends the sample bytes to temporary arrays for processing, which is really just signing the bytes using <code>& 0xFF</code> and then shifting them into a byte array, then adding that to the corresponding sample channel and sample iteration. Real messy but a solution that gets the job done.

The data is then passed to the <code>multiplier()</code> function, which iterates over each byte in the sample and multiplies it by a factor:

<math>sampleFloat=\frac{sampleInt \cdot 0.4}{2^{23}-1}\cdot 1\mathrm{e}{6}</math>

This part caught my eye because i genuinely have no idea what it does! My best guess is that it is a rounding function maybe? It uses the machine epsilon of a single precision float? No clue.

With the above functionality successfully ported to python, i threw together a script and was able to generate actual usable data!

==Making python talk brainwaves==
Jiggling python into working with EEG data is easily done using the [https://mne.tools/stable/ MNE library], which contains some really useful analysis tools such as fourier transforms for the power bands (Delta, Theta, Alpha, Beta and Gamma) and various filters for EOG (Electro-ocularography) in order to remove artifacts from eye movement. I used MNE to create some nice visualizations but that's really where its functionality stopped for me, as I wanted to focus more on creating a LSL stream, so that the data can be analyzed by other software.

===Lab Streaming Layer===
Lab Streaming Layer (LSL) is an Open Source standard used in scientific environments to stream data between devices and software. It currently is supported (officially or unofficially) by over 100 devices, many of which are very similar to the Melon Headband such as the Muse headband.

Once i had established a reliable method for receiving packets of data from the band and was able to process the data, the integration process was very smooth. I simply had to iterate over the 3-sample group and split the 2 channels (Fp1 and Fp2), then push that to a LSL outlet.

===OSC Server===
OSC was very easy to implement (similar structure to LSL in how the data is handled) but in order for an OSC stream to be useful i would like to extract actual focus metrics and maybe even isolate EOG to use for eye tracking? Something similar to [https://www.youtube.com/watch?v=B2f_Epm4epM this.]

==To be continued==
It turns out that analyzing raw brain data is really difficult! Who would have thought ;)

My main goal is as previously mentioned to get a reliable focus metric to pipe to many other pieces of software, and getting this metric has proved to be extremely hard.

Currently I'm trying to take a different approach to focus metrics, using machine learning. That project will get its own page once its done.

Main Page

2024-12-30T19:33:00Z

Cronholm: Changed linkbook to use categories

{| cellspacing=5 cellpadding=5 border=0 width=100%
|- style="background:#e0e0ff; color:black; font-size:24px; -moz-border-radius:8px;"
! width="75%" colspan="2" | Welcome to my wikisite!
|-
|valign=middle|
This is where I share the projects I’ve worked on, both personal projects and professional work. Browse around to see what I’ve been creating and experimenting with.

{| cellspacing=5 cellpadding=5 border=0 width=100%
{{Iconlink|:Category:Software|Software|Media-optical.png|Software that I have made, or worked with.}}
{{Iconlink|:Category:Hardware|Hardware|Jockey.png|Hardware projects. [[Assorted Schematics | Assorted Schematics and CAD models]]}}
|-
{{Iconlink|:Category:Blerbs|Blerbs|gnome-control-center.png|Assorted random posts regarding nothing in particular.}}
{{Iconlink|:Category:Reverse_Engineering|Reverse Engineering|logviewer.png|Sherlock holmes!}}
|-
{{Iconlink|FAQ|FAQ / Meta|dialog-information.png|Mostly meta content surrounding this wikisite.}}

|-
|}

{| cellspacing=5 cellpadding=5 border=0 width=100%
|- style="background:#e0e0ff; color:black; font-size:16px; -moz-border-radius:8px;"
! width="66%" | Wiki Usage !! Recent Updates
|-
|valign=top|

* This wikisite works just like any other wiki, it can be navigated using the search functionality as well as hyperlinks to other pages in posts as well as the sidebar.
* You can consult the [[Special:Allpages | Index of all pages ]]
* You cannot contribute to any of the listed pages, if you have feedback on any of the content, please reach out to me via the methods found in [[Contact]]
* If you want to subscribe to my blog in RSS format, see [[RSS:HowTo]] for a tutorial.
 
Thanks for visiting!
 
|
{{Special:RecentChanges}}
|-
|}

Melon Headband

2024-12-30T19:26:30Z

Cronholm:

Melon Headband

2024-12-30T17:39:46Z

Cronholm: added openmelon logo

[[Category:Reverse Engineering]]
[[File:Openmelon-logo.png|frameless|right]]
==Background==
[[File:Melons-headband-Reprinted-from-Gadgets-to-help-you-relax-in-the-new-year-by-ZDNET.png|thumb|alt=Picture of the Melon EEG Headband, a silicone circular headband, approximately 15mm in height, black smooth silicone with a yellow plastic insert, source:zdnet.com|The Melon EEG Headband (ZDNET.com)]]
The Melon Headband started as a [https://www.kickstarter.com/projects/806146824/melon-a-headband-and-mobile-app-to-measure-your-fo Kickstarter] in May 2013, pitched as a focusing and meditation aid in a all to active world (if only they knew what was coming). The device used EEG (Electroencephalography) to measure the brains activity and deduct a focus metric from the [[#Data Collection|collected data]]. The "focus score" was then used to generate statistics over time and also control the built in origami folding game.

When the project eventually was abandoned in 2016 and the application subsequently discontinued, many customers were left with what was pretty much a silicone paper weight. Attempts were made to repurpose the device as a general EEG data collection device, but nothing compliant with OSC standards was ever made.

I came across one of these devices in a thrift shop, sitting at 49sek (4€-ish). Having never heard of the company, nor the device in question i naturally purchased it, with its complete box with all the accessories and the proprietary USB charger >:|

After finding out that the device was practically useless in its current condition, I became quite upset and decided to take matters into my own (arguably incompetent) hands.

==Reverse Engineering the BLE protocol==
The Melon Headband communicates with the users device using Bluetooth LE. I used the Linux Bluez utilities to connect to the device and read back its properties.
All communication from and to the band is done using Nordic RF:s UART over BLE functionality. This is exposed over one service with two characteristics:

'''SERVICE''': 6e400001-b5a3-f393-e0a9-e50e24dcca9e | ''Nordic UART Service''
*'''CHARACTERISTIC''': 6e400003-b5a3-f393-e0a9-e50e24dcca9e | ''Nordic UART RX''
*'''CHARACTERISTIC''': 6e400002-b5a3-f393-e0a9-e50e24dcca9e | ''Nordic UART TX''

I managed to find a copy of the original Android application, and was able to decompile it using JD-GUI.

The structure of the app is actually quite interesting, and contains some quite dubious programming choices such as storing the AWS S3 Bucket credentials in PLAIN TEXT???? The application also gathers geolocation data, which is sent together with collected EEG data to the mentioned S3 bucket. Sketchy stuff but i digress...

Eventually after much digging i found the class responsible for initializing a connected device.

<pre>
package com.axio.melonplatformkit;

class i implements Runnable {
i(DeviceHandle.Peripheral paramPeripheral) {}

public void run() {
DeviceHandle.Peripheral.b(this.a, "DW0308"); // send start command !! EUREKA
DeviceHandle.Peripheral.a(this.a, DeviceHandle.DeviceState.CONNECTED);
DeviceHandle.Peripheral.n(this.a);
}
}
</pre>

After confirming that <code>DeviceHandle.Peripheral.b();</code> does in fact send commands to a connected device:
(shortened code)
<pre>
private boolean b(String param1String) { // send command to device CONVERTER
byte[] arrayOfByte = param1String.getBytes("UTF-8");
bool = a(arrayOfByte); // send command to device
return bool;
}
// where a() is the send function:
private boolean a(byte[] param1ArrayOfbyte) { // send command to device
BluetoothGattService bluetoothGattService = this.m.getService(UUID.fromString("6e400001-b5a3-f393-e0a9-e50e24dcca9e"));
BluetoothGattCharacteristic bluetoothGattCharacteristic = bluetoothGattService.getCharacteristic(UUID.fromString("6e400002-b5a3-f393-e0a9-e50e24dcca9e"));
bluetoothGattCharacteristic.setValue(param1ArrayOfbyte);
boolean bool = this.m.writeCharacteristic(bluetoothGattCharacteristic)
return bool;
}
</pre>

The conclusion that "DW0308" was the initialization command could be made. I confirmed it once more by using a bluetooth sniffer app on a test device:
<pre>
SamsungE_xx:xx:xx (Samsung Galaxy S5) | xx:xx:xx:xx:xx:xx (Melon_XXXXXXXX) ATT 15 Sent Write Command, Handle: 0x0011 (Nordic UART Service: Nordic UART Tx)
0000 02 40 00 0d 00 09 00 04 00 52 11 00 44 57 30 33 .@.......R..DW03
0010 30 38 08
</pre>

The band is now initialized and ready to receive instructions. No response is sent back to the client. The client now sends the "Start Stream" command "S01":

<pre>
SamsungE_xx:xx:xx (Samsung Galaxy S5) | xx:xx:xx:xx:xx:xx (Melon_XXXXXXXX) ATT 15 Sent Write Command, Handle: 0x0011 (Nordic UART Service: Nordic UART Tx)
0000 02 40 00 0a 00 06 00 04 00 52 11 00 53 30 31 .@.......R..S01
</pre>

The code responsible for sending this command was eventually found aswell:

<pre>
package com.axio.melonplatformkit;

import android.util.Log;

class j implements Runnable {
j(DeviceHandle.Peripheral paramPeripheral) {}

public void run() {
if (DeviceHandle.Peripheral.b(this.a, "S01")) { // if send start stream command is successful
String str = DeviceHandle.Peripheral.m(this.a);
if (str == null)
str = "???";
Log.i(DeviceHandle.Peripheral.b(this.a), "Device opening stream: " + str);
}
}
}
</pre>

The band immediately starts spitting out the raw data on the RX line.

Example packet:

<pre>
xx:xx:xx:xx:xx:xx (Melon_XXXXXXXX) SamsungE_xx:xx:xx (Samsung Galaxy S5) ATT 32 Rcvd Handle Value Notification, Handle: 0x000e (Nordic UART Service: Nordic UART Rx)
0000 02 40 20 1b 00 17 00 04 00 1b 0e 00 a0 f8 c9 07 .@ .............
0010 45 d2 7f 46 c9 08 51 d2 7e a6 c9 05 11 d2 7f 2a E..F..Q.~......*
</pre>

Now this is where the real pain started. I wrote a whooollee bunch of python test scripts to interact with the device using a variety of different python Bluetooth API:s, all of them with their own project-stopping quirks that on multiple occasions made me question every life choice i made up to this point. But alas, Bleak seemed to work (most of the time) on my Linux install, i just had to make sure that blueman did '''NOT''' connect to the device before the scripts did.

[[File:Melon-RawData.png|thumb|Raw packets, organized by recieve time]]
I managed to gather a bunch of packets to analyze:
Now, there is a LOT to unpack here, these packets are always 20 bytes long, where the first byte is omitted (as can be found in the decompiled packet handler functions:
<pre>
protected void a(short[] paramArrayOfshort) {
System.arraycopy(paramArrayOfshort, 2, this.e, 0, 18);
</pre>
then we can see quite easily that the data is segmented into six parts (3 samples per 2 channels, each sample is marked as a group of "orange,red,green"). where the two first bytes (orange and red) are simply counting up from some initial value to <code>0xffff</code> and then rolls over. The values (or value rather since it really is a 2 byte value) is incremented every 28-29 values, so 3 times per second, is my best guess. This is most likely done to keep track of the time, since the sample rate may fluctuate a bit. The green values are the actual samples themselves!
I then did a recording of 100 seconds, which gave 8349 packets, so 83.49 packets/sec. 83.49 multiplied by the amounts of samples (3 samples) yields a sample rate of ≈ 250 samples/second or 250 Hz rate! Which means that the maximum frequency that the device can capture is 125 Hz (see [https://en.wikipedia.org/wiki/Nyquist_frequency Nyquist Frequency]), not bad at all.

Now in order to make any sense of this data I needed to look at the code that handles each packet and saves the resulting data to a buffer. The decompilation of this particular class was quite difficult to follow so i used ChatGPT to help me understand what was going on (my coffee-language skills are quite rusty), so that i could re-write the functionality in python.

<pre>
def conversion_method(byte_string):
byte_array = bytes.fromhex(byte_string)
raw_samples = [b & 0xFF for b in byte_array]
raw_samples[:] = raw_samples[2:20]
Sample1 = [0, 0]
Sample2 = [0, 0]
Sample3 = [0, 0]
skip_bit = 0
i = 0
while skip_bit < 18:
for j in range(2):
temp_sample = [0, 0, 0]
for loop in range(3):
temp_sample[loop] = raw_samples[skip_bit + loop + j * 3]
val1 = temp_sample[0] & 0xFF
val2 = temp_sample[1] & 0xFF
val3 = temp_sample[2] & 0xFF
sample_value = (val1 << 16) + (val2 << 8) + val3
if i == 0:
Sample1[j] = sample_value #& 0xFF
elif i == 1:
Sample2[j] = sample_value #& 0xFF
elif i == 2:
Sample3[j] = sample_value #& 0xFF
skip_bit += 6
i += 1
final_sample1 = multiplier(Sample1)
final_sample2 = multiplier(Sample2)
final_sample3 = multiplier(Sample3)
return final_sample1, final_sample2, final_sample3

def multiplier(sample):
final_sample = [0] * len(sample)
for i in range(len(sample)):
final_sample[i] = sample[i] * 0.4 / ((2 ** 23) - 1)
return final_sample
</pre>

Firstly the data is cropped and converted to an array of bytes. Then arrays are initialized for the three samples. The function then loops over the raw data and appends the sample bytes to temporary arrays for processing, which is really just signing the bytes using <code>& 0xFF</code> and then shifting them into a byte array, then adding that to the corresponding sample channel and sample iteration. Real messy but a solution that gets the job done.

The data is then passed to the <code>multiplier()</code> function, which iterates over each byte in the sample and multiplies it by a factor:

<math>sampleFloat=\frac{sampleInt \cdot 0.4}{2^{23}-1}\cdot 1\mathrm{e}{6}</math>

This part caught my eye because i genuinely have no idea what it does! My best guess is that it is a rounding function maybe? It uses the machine epsilon of a single precision float? No clue.

==Making python talk brainwaves==

===Collected Data===

File:Openmelon-logo.png

2024-12-30T17:38:22Z

Cronholm: Openmelon Logo

== Summary ==
Openmelon Logo

Melon Headband

2024-12-30T17:15:53Z

Cronholm: Did some writing, just a little bit

[[Category:Reverse Engineering]]
==Background==
[[File:Melons-headband-Reprinted-from-Gadgets-to-help-you-relax-in-the-new-year-by-ZDNET.png|thumb|alt=Picture of the Melon EEG Headband, a silicone circular headband, approximately 15mm in height, black smooth silicone with a yellow plastic insert, source:zdnet.com|The Melon EEG Headband (ZDNET.com)]]
The Melon Headband started as a [https://www.kickstarter.com/projects/806146824/melon-a-headband-and-mobile-app-to-measure-your-fo Kickstarter] in May 2013, pitched as a focusing and meditation aid in a all to active world (if only they knew what was coming). The device used EEG (Electroencephalography) to measure the brains activity and deduct a focus metric from the [[#Data Collection|collected data]]. The "focus score" was then used to generate statistics over time and also control the built in origami folding game.

When the project eventually was abandoned in 2016 and the application subsequently discontinued, many customers were left with what was pretty much a silicone paper weight. Attempts were made to repurpose the device as a general EEG data collection device, but nothing compliant with OSC standards was ever made.

I came across one of these devices in a thrift shop, sitting at 49sek (4€-ish). Having never heard of the company, nor the device in question i naturally purchased it, with its complete box with all the accessories and the proprietary USB charger >:|

After finding out that the device was practically useless in its current condition, I became quite upset and decided to take matters into my own (arguably incompetent) hands.

==Reverse Engineering the BLE protocol==
The Melon Headband communicates with the users device using Bluetooth LE. I used the Linux Bluez utilities to connect to the device and read back its properties.
All communication from and to the band is done using Nordic RF:s UART over BLE functionality. This is exposed over one service with two characteristics:

'''SERVICE''': 6e400001-b5a3-f393-e0a9-e50e24dcca9e | ''Nordic UART Service''
*'''CHARACTERISTIC''': 6e400003-b5a3-f393-e0a9-e50e24dcca9e | ''Nordic UART RX''
*'''CHARACTERISTIC''': 6e400002-b5a3-f393-e0a9-e50e24dcca9e | ''Nordic UART TX''

I managed to find a copy of the original Android application, and was able to decompile it using JD-GUI.

The structure of the app is actually quite interesting, and contains some quite dubious programming choices such as storing the AWS S3 Bucket credentials in PLAIN TEXT???? The application also gathers geolocation data, which is sent together with collected EEG data to the mentioned S3 bucket. Sketchy stuff but i digress...

Eventually after much digging i found the class responsible for initializing a connected device.

<pre>
package com.axio.melonplatformkit;

class i implements Runnable {
i(DeviceHandle.Peripheral paramPeripheral) {}

public void run() {
DeviceHandle.Peripheral.b(this.a, "DW0308"); // send start command !! EUREKA
DeviceHandle.Peripheral.a(this.a, DeviceHandle.DeviceState.CONNECTED);
DeviceHandle.Peripheral.n(this.a);
}
}
</pre>

After confirming that <code>DeviceHandle.Peripheral.b();</code> does in fact send commands to a connected device:
(shortened code)
<pre>
private boolean b(String param1String) { // send command to device CONVERTER
byte[] arrayOfByte = param1String.getBytes("UTF-8");
bool = a(arrayOfByte); // send command to device
return bool;
}
// where a() is the send function:
private boolean a(byte[] param1ArrayOfbyte) { // send command to device
BluetoothGattService bluetoothGattService = this.m.getService(UUID.fromString("6e400001-b5a3-f393-e0a9-e50e24dcca9e"));
BluetoothGattCharacteristic bluetoothGattCharacteristic = bluetoothGattService.getCharacteristic(UUID.fromString("6e400002-b5a3-f393-e0a9-e50e24dcca9e"));
bluetoothGattCharacteristic.setValue(param1ArrayOfbyte);
boolean bool = this.m.writeCharacteristic(bluetoothGattCharacteristic)
return bool;
}
</pre>

The conclusion that "DW0308" was the initialization command could be made. I confirmed it once more by using a bluetooth sniffer app on a test device:
<pre>
SamsungE_xx:xx:xx (Samsung Galaxy S5) | xx:xx:xx:xx:xx:xx (Melon_XXXXXXXX) ATT 15 Sent Write Command, Handle: 0x0011 (Nordic UART Service: Nordic UART Tx)
0000 02 40 00 0d 00 09 00 04 00 52 11 00 44 57 30 33 .@.......R..DW03
0010 30 38 08
</pre>

The band is now initialized and ready to receive instructions. No response is sent back to the client. The client now sends the "Start Stream" command "S01":

<pre>
SamsungE_xx:xx:xx (Samsung Galaxy S5) | xx:xx:xx:xx:xx:xx (Melon_XXXXXXXX) ATT 15 Sent Write Command, Handle: 0x0011 (Nordic UART Service: Nordic UART Tx)
0000 02 40 00 0a 00 06 00 04 00 52 11 00 53 30 31 .@.......R..S01
</pre>

The code responsible for sending this command was eventually found aswell:

<pre>
package com.axio.melonplatformkit;

import android.util.Log;

class j implements Runnable {
j(DeviceHandle.Peripheral paramPeripheral) {}

public void run() {
if (DeviceHandle.Peripheral.b(this.a, "S01")) { // if send start stream command is successful
String str = DeviceHandle.Peripheral.m(this.a);
if (str == null)
str = "???";
Log.i(DeviceHandle.Peripheral.b(this.a), "Device opening stream: " + str);
}
}
}
</pre>

The band immediately starts spitting out the raw data on the RX line.

Example packet:

<pre>
xx:xx:xx:xx:xx:xx (Melon_XXXXXXXX) SamsungE_xx:xx:xx (Samsung Galaxy S5) ATT 32 Rcvd Handle Value Notification, Handle: 0x000e (Nordic UART Service: Nordic UART Rx)
0000 02 40 20 1b 00 17 00 04 00 1b 0e 00 a0 f8 c9 07 .@ .............
0010 45 d2 7f 46 c9 08 51 d2 7e a6 c9 05 11 d2 7f 2a E..F..Q.~......*
</pre>

Now this is where the real pain started. I wrote a whooollee bunch of python test scripts to interact with the device using a variety of different python Bluetooth API:s, all of them with their own project-stopping quirks that on multiple occasions made me question every life choice i made up to this point. But alas, Bleak seemed to work (most of the time) on my Linux install, i just had to make sure that blueman did '''NOT''' connect to the device before the scripts did.

[[File:Melon-RawData.png|thumb|Raw packets, organized by recieve time]]
I managed to gather a bunch of packets to analyze:
Now, there is a LOT to unpack here, these packets are always 20 bytes long, where the first byte is omitted (as can be found in the decompiled packet handler functions:
<pre>
protected void a(short[] paramArrayOfshort) {
System.arraycopy(paramArrayOfshort, 2, this.e, 0, 18);
</pre>
then we can see quite easily that the data is segmented into six parts (3 samples per 2 channels, each sample is marked as a group of "orange,red,green"). where the two first bytes (orange and red) are simply counting up from some initial value to <code>0xffff</code> and then rolls over. The values (or value rather since it really is a 2 byte value) is incremented every 28-29 values, so 3 times per second, is my best guess. This is most likely done to keep track of the time, since the sample rate may fluctuate a bit. The green values are the actual samples themselves!
I then did a recording of 100 seconds, which gave 8349 packets, so 83.49 packets/sec. 83.49 multiplied by the amounts of samples (3 samples) yields a sample rate of ≈ 250 samples/second or 250 Hz rate! Which means that the maximum frequency that the device can capture is 125 Hz (see [https://en.wikipedia.org/wiki/Nyquist_frequency Nyquist Frequency]), not bad at all.

Now in order to make any sense of this data I needed to look at the code that handles each packet and saves the resulting data to a buffer. The decompilation of this particular class was quite difficult to follow so i used ChatGPT to help me understand what was going on (my coffee-language skills are quite rusty), so that i could re-write the functionality in python.

<pre>
def conversion_method(byte_string):
byte_array = bytes.fromhex(byte_string)
raw_samples = [b & 0xFF for b in byte_array]
raw_samples[:] = raw_samples[2:20]
Sample1 = [0, 0]
Sample2 = [0, 0]
Sample3 = [0, 0]
skip_bit = 0
i = 0
while skip_bit < 18:
for j in range(2):
temp_sample = [0, 0, 0]
for loop in range(3):
temp_sample[loop] = raw_samples[skip_bit + loop + j * 3]
val1 = temp_sample[0] & 0xFF
val2 = temp_sample[1] & 0xFF
val3 = temp_sample[2] & 0xFF
sample_value = (val1 << 16) + (val2 << 8) + val3
if i == 0:
Sample1[j] = sample_value #& 0xFF
elif i == 1:
Sample2[j] = sample_value #& 0xFF
elif i == 2:
Sample3[j] = sample_value #& 0xFF
skip_bit += 6
i += 1
final_sample1 = multiplier(Sample1)
final_sample2 = multiplier(Sample2)
final_sample3 = multiplier(Sample3)
return final_sample1, final_sample2, final_sample3

def multiplier(sample):
final_sample = [0] * len(sample)
for i in range(len(sample)):
final_sample[i] = sample[i] * 0.4 / ((2 ** 23) - 1)
return final_sample
</pre>

Firstly the data is cropped and converted to an array of bytes. Then arrays are initialized for the three samples. The function then loops over the raw data and appends the sample bytes to temporary arrays for processing, which is really just signing the bytes using <code>& 0xFF</code> and then shifting them into a byte array, then adding that to the corresponding sample channel and sample iteration. Real messy but a solution that gets the job done.

The data is then passed to the <code>multiplier()</code> function, which iterates over each byte in the sample and multiplies it by a factor:

<math>sampleFloat=\frac{sampleInt \cdot 0.4}{2^{23}-1}\cdot 1\mathrm{e}{6}</math>

This part caught my eye because i genuinely have no idea what it does! My best guess is that it is a rounding function maybe? It uses the machine epsilon of a single precision float? No clue.

==Making python talk brainwaves==

===Collected Data===

File:Melon-RawData.png

2024-12-30T16:24:16Z

Cronholm: Raw packets accessed from the melon headband

== Summary ==
Raw packets accessed from the melon headband

File:Melons-headband-Reprinted-from-Gadgets-to-help-you-relax-in-the-new-year-by-ZDNET.png

2024-12-30T15:00:21Z

Cronholm: Melons-headband-Reprinted-from-Gadgets-to-help-you-relax-in-the-new-year-by-ZDNET.png zdnet.com

== Summary ==
Melons-headband-Reprinted-from-Gadgets-to-help-you-relax-in-the-new-year-by-ZDNET.png
zdnet.com

Software

2024-12-30T14:26:16Z

Cronholm: Temporary page content so that i can actually do some real edits

==Software==
===Magisim===
The field of radio engineering, particularly within the amateur radio sphere, necessitates a deep understanding of electromagnetic (EM) theory and its practical applications. Traditionally, this domain has been supported by a variety of simulation
tools, aiming to provide insights into the complex interactions of electromagnetic
fields with their surrounding environments. However, a significant challenge has
emerged from the existing landscape of these simulation tools, marked by their prohibitive cost and steep learning curves. This divide presents a substantial barrier to
entry for amateur radio enthusiasts and learners, who often seek both affordability
and simplicity in educational resources.
Magisim is introduced as a solution to the current market, based around a modular interface with node-graph dataflow programming functionality.

===Lisabet===
An intuitive stenography trainer application, built using Python and TKInter.

===Slapp===
A RSS based Pebble application for checking Stockholm Local Transportation times.

Main Page

2024-12-30T14:14:55Z

Cronholm: Added some more icons

{| cellspacing=5 cellpadding=5 border=0 width=100%
|- style="background:#e0e0ff; color:black; font-size:24px; -moz-border-radius:8px;"
! width="75%" colspan="2" | Welcome to my wikisite!
|-
|valign=middle|
This is where I share the projects I’ve worked on, both personal projects and professional work. Browse around to see what I’ve been creating and experimenting with.

{| cellspacing=5 cellpadding=5 border=0 width=100%
{{Iconlink|Software|Software|Media-optical.png|Software that I have made, or worked with.}}
{{Iconlink|Hardware|Hardware|Jockey.png|Hardware projects. [[Assorted Schematics | Assorted Schematics and CAD models]]}}
|-
{{Iconlink|Blerbs|Blerbs|gnome-control-center.png|Assorted random posts regarding nothing in particular.}}
{{Iconlink|Reverse Engineering|Reverse Engineering|logviewer.png|Sherlock holmes!}}
|-
{{Iconlink|FAQ|FAQ / Meta|dialog-information.png|Mostly meta content surrounding this wikisite.}}

|-
|}

{| cellspacing=5 cellpadding=5 border=0 width=100%
|- style="background:#e0e0ff; color:black; font-size:16px; -moz-border-radius:8px;"
! width="66%" | Wiki Usage !! Recent Updates
|-
|valign=top|

* This wikisite works just like any other wiki, it can be navigated using the search functionality as well as hyperlinks to other pages in posts as well as the sidebar.
* You can consult the [[Special:Allpages | Index of all pages ]]
* You cannot contribute to any of the listed pages, if you have feedback on any of the content, please reach out to me via the methods found in [[Contact]]
* If you want to subscribe to my blog in RSS format, see [[RSS:HowTo]] for a tutorial.
 
Thanks for visiting!
 
|
{{Special:RecentChanges}}
|-
|}

File:Dialog-information.png

2024-12-30T14:09:40Z

Cronholm: Dialog-information.png - Faenza Icon theme https://code.google.com/archive/p/faenza-icon-theme/downloads

== Summary ==
Dialog-information.png - Faenza Icon theme
https://code.google.com/archive/p/faenza-icon-theme/downloads

File:Tvtime.png

2024-12-30T14:07:50Z

Cronholm: Tvtime.png - Faenza Icon theme https://code.google.com/archive/p/faenza-icon-theme/downloads

== Summary ==
Tvtime.png - Faenza Icon theme
https://code.google.com/archive/p/faenza-icon-theme/downloads

File:Logviewer.png

2024-12-30T14:07:23Z

Cronholm: Logviewer.png - Faenza Icon theme https://code.google.com/archive/p/faenza-icon-theme/downloads

== Summary ==
Logviewer.png - Faenza Icon theme
https://code.google.com/archive/p/faenza-icon-theme/downloads

File:Gnome-control-center.png

2024-12-30T14:03:43Z

Cronholm: Gnome-control-center.png - Faenza Icon theme https://code.google.com/archive/p/faenza-icon-theme/downloads

== Summary ==
Gnome-control-center.png - Faenza Icon theme
https://code.google.com/archive/p/faenza-icon-theme/downloads

Main Page

2024-12-30T13:35:56Z

Cronholm: Added main page content, using foss icons for now

{| cellspacing=5 cellpadding=5 border=0 width=100%
|- style="background:#e0e0ff; color:black; font-size:24px; -moz-border-radius:8px;"
! width="75%" colspan="2" | Welcome to my wikisite!
|-
|valign=middle|
This is where I share the projects I’ve worked on, both personal projects and professional work. Browse around to see what I’ve been creating and experimenting with.

{| cellspacing=5 cellpadding=5 border=0 width=100%
{{Iconlink|Software|Software|Media-optical.png|Software that I have made, or worked with.}}
{{Iconlink|Hardware|Hardware|Jockey.png|Hardware projects. [[Assorted Schematics | Assorted Schematics and CAD models]]}}
|-
{{Iconlink|Blerbs|Blerbs|blerb.png|Assorted random posts regarding nothing in particular.}}
{{Iconlink|Reverse Engineering|Reverse Engineering|revengs.png|Sherlock holmes!}}
|-
{{Iconlink|FAQ|FAQ / Meta|faq.png|Mostly meta content surrounding this wikisite.}}

|-
|}

{| cellspacing=5 cellpadding=5 border=0 width=100%
|- style="background:#e0e0ff; color:black; font-size:16px; -moz-border-radius:8px;"
! width="66%" | Wiki Usage !! Recent Updates
|-
|valign=top|

* This wikisite works just like any other wiki, it can be navigated using the search functionality as well as hyperlinks to other pages in posts as well as the sidebar.
* You can consult the [[Special:Allpages | Index of all pages ]]
* You cannot contribute to any of the listed pages, if you have feedback on any of the content, please reach out to me via the methods found in [[Contact]]
* If you want to subscribe to my blog in RSS format, see [[RSS:HowTo]] for a tutorial.
 
Thanks for visiting!
 
|
{{Special:RecentChanges}}
|-
|}

File:Jockey.png

2024-12-30T13:34:41Z

Cronholm: Jockey.png - Faenza Icon theme https://code.google.com/archive/p/faenza-icon-theme/downloads

== Summary ==
Jockey.png - Faenza Icon theme
https://code.google.com/archive/p/faenza-icon-theme/downloads

File:Media-optical.png

2024-12-30T13:28:07Z

Cronholm: Media-optical.png - Humanity Icon theme https://github.com/mk-pmb/ubuntu-icon-theme-humanity/tree/gh-pages/Humanity

== Summary ==
Media-optical.png - Humanity Icon theme
https://github.com/mk-pmb/ubuntu-icon-theme-humanity/tree/gh-pages/Humanity

File:Internet-feed-reader.png

2024-12-30T13:27:41Z

Cronholm: Internet-feed-reader.png - Humanity Icon theme https://github.com/mk-pmb/ubuntu-icon-theme-humanity/tree/gh-pages/Humanity

== Summary ==
Internet-feed-reader.png - Humanity Icon theme
https://github.com/mk-pmb/ubuntu-icon-theme-humanity/tree/gh-pages/Humanity

File:Addressbook.png

2024-12-30T13:26:55Z

Cronholm: Adressbook - Humanity Icon Theme https://github.com/mk-pmb/ubuntu-icon-theme-humanity/tree/gh-pages/Humanity

== Summary ==
Adressbook - Humanity Icon Theme
https://github.com/mk-pmb/ubuntu-icon-theme-humanity/tree/gh-pages/Humanity

Template:Iconlink

2024-12-30T12:46:40Z

Cronholm: Created page with " |width=48|<div style="position: relative; width:48px; height:48px; overflow: hidden"> <div style="..."

|width=48|<div style="position: relative; width:48px; height:48px; overflow: hidden">
<div style="position: absolute; top: 0px; left: 0px; font-size: 100px; overflow: hidden; line-height: 100px; z-index: 3">[[{{{1}}}|   ]]</div>
<div style="position: absolute; top: 0px; left: 0px; z-index: 2">[[Image:{{{3}}}|48px|{{{1}}}]]</div>
</div>
|width=50%| <div style="background:{{{5}}}; -moz-border-radius:8px;"> '''[[{{{1}}}|{{{2}}}]]''' {{{4}}}</div>

Projects

2024-11-15T22:57:11Z

Cronholm:

Most of my software work can be found on my '''[https://github.com/devbrones GitHub profile]'''. I’ve highlighted some of my more notable projects below.
==Software==
===Magisim===
The field of radio engineering, particularly within the amateur radio sphere, necessitates a deep understanding of electromagnetic (EM) theory and its practical applications. Traditionally, this domain has been supported by a variety of simulation
tools, aiming to provide insights into the complex interactions of electromagnetic
fields with their surrounding environments. However, a significant challenge has
emerged from the existing landscape of these simulation tools, marked by their prohibitive cost and steep learning curves. This divide presents a substantial barrier to
entry for amateur radio enthusiasts and learners, who often seek both affordability
and simplicity in educational resources.
Magisim is introduced as a solution to the current market, based around a modular interface with node-graph dataflow programming functionality.

===Lisabet===
An intuitive stenography trainer application, built using Python and TKInter.

===Slapp===
A RSS based Pebble application for checking Stockholm Local Transportation times.

==Electronics==

==Tinkering==

===ICSDR===
See [[ICSDR]]

===OpenMelon===
See [[OpenMelon]]

==Chemistry, Physics et.c.==
===Ecological alternatives to polymerization catalysts in Stereolithography printing===

==Arts==

===Photography===

CRHLM:About

2024-11-14T01:25:50Z

Cronholm: Created page with "My personal website runs MediaWiki, much like WikiPedia."

My personal website runs MediaWiki, much like WikiPedia.

Projects

2024-11-14T01:16:38Z

Cronholm: Created page with "Most of my software work can be found on my '''[https://github.com/devbrones GitHub profile]'''. I’ve highlighted some of my more notable projects below. ==Software== ===Magisim=== The field of radio engineering, particularly within the amateur radio sphere, necessitates a deep understanding of electromagnetic (EM) theory and its practical applications. Traditionally, this domain has been supported by a variety of simulation tools, aiming to provide insights into the c..."

Main Page

2024-11-14T00:47:23Z

Cronholm: Replaced content with "Jonas Cronholm"

Jonas Cronholm