First-gen Chromecast and Unifi UAP-Pros

Quick and dirty, recently upgraded to the 5.0.6 (now 5.0.7) Unifi controller at home and enabled bandsteering on the Ubiquiti UAP-Pros I have. Immediately dumped the first-generation Chromecast. Disable band steering and the chromecast plays just fine. I have two Chromechast Audios running, which I believe to be similar hardware to the second-gen Chromecast, and they were fine with band steering enabled.

As far as I know the first-gen Chromecast doesn’t do 5GHz so it may have been erroneously being redirected to a band it can’t access. I haven’t seen that behaviour with any other 2.4GHz only clients I have.

I can’t fucking do it anymore

Surface RT, I’m sick of your shit. I’m tired of your split personality. I’m tired of your bullshit limitations. I’m tired of your half-assed-half-broken implementation of fucking everything.

Hooray! You made it so Skydrive is available in windows explorer in the 8.1 update, instead of being relegated to only a metro app. But you couldn’t be fucking bothered to do the same for Skydrive Pro. Oh, and your metro file picker is an exercise in frustration every damn time it pops up.

Hooray! You have a full usb port. But the only thing worth plugging in to it is a flash drive. You’d be a perfect little network admin device if I could use a usb-serial adapter. But there’s no drivers for that anywhere that are compatible. I tried my Bluetooth serial adapter, same pile of shit. It’ll pair, but your Bluetooth stack doesn’t implement serial comms.

Hooray! You have “full blown” IE. Except it’s a pathetically slow pile of shit. It hangs every time I open youtube because of their giant flash-ad header that they’ve been doing lately. And it doesn’t allow for any add-ons. I can’t tie-in a password manager, I have to flip over to a modern-ui app to copy every single username and password I use fifty times a day.

Hooray! In 8.1 you added Outlook. You can barely run it. It hangs every time it refreshes my Office365 account, just like every time IE loads youtube. It also doesn’t support Caldav. So we’ll just ignore all those other calendars I give a shit about. Not like I need to see those appointments on your splashscreen login page thing. Speaking of…

Hooray! You have a fancy dashboard splashscreen thing! But you only support a handful of apps running “in the background” at any given point. You can’t just let apps dynamically feed you notifications as they generate them. So there can only be a few apps at any given point with active modern ui notifications. Your weather app manages to update it’s live tile, but that doesn’t mean that the data in the app is up to date when I launch it. Your appstore selection is mediocre at best, and too many of the apps simply display a website wrapped in someone else’s ads. You taunt me with your desktop, but won’t let me install desktop apps. You were MORE useful running 8.0 as at least there was a jailbreak then which allowed me to run PuTTY and Notepad++. At this point you’d be better off not having the desktop at all as the transition between it and metroland is so jarring, the uselessness of the desktop environment so anger inducing, I’d really just rather not see it at all.

The ONLY thing that has kept you in my bag this long is that you’re not a completely terrible Remote Desktop client. I spend more time RDPed into real computers than I do using you as a computer. But of course there has to be a rub here as well. Your VPN support is pretty fucking mediocre. PPTP in 2014?

My Nexus7 showed up today. It’s on my desk charging alongside a Bluetooth keyboard case. Your days are numbered, Surface. I’m sorry it didn’t work out between us, I really tried but you just couldn’t meet me halfway.

Unifi AP Recovery

I finally got around to manually reloading the firmware on two Unifi UAPs that I’ve had laying on my desk for months. It didn’t go so well last time around.

[PiwigoPress id=71 url=’’ size=’2s’ desc=1 class=’img-shadow’]

Step one was cracking them open and connecting my usb ftdi adapter to the onboard uart. The bootloader talks at 115200 baud, btw.

As the bootloader does its thing, it prompts you to press any key to interrupt the boot process. I found that by the time I saw that message, it was too late. I started spamming the space-bar as soon as it iterated the onboard flash and ram. Based on the recovery guides I’d originally read when at the boot-prompt I ran:


which spawns a tftp server listening at and then tftp over a copy of the firmware.bin from the BZ2 folder on your controller. When I did that I got the following:

Error code 2: Firmware check failed

Of course. I spent some time running that particular message through google this time around and found this thread, which revealed the magic sauce.

mtdparts default

Then launch


and go through the tftp process. All better. Haxxy cat was not so interested in this recovery, unfortunately.

Fixing an Asus Transformer TF101 stuck in recovery boot loop

Sometimes hax go awry.  When we’re lucky they only go slightly awry and things are relatively easy to recover once you get all the tools and ducks lined up. In this case it was an Asus Transformer TF101 that the BIL of a friend had tried to root and rom about a year ago. APPARENTLY about a year ago there was a fairly common bug in the tools available that resulted in devices like the Transformer getting stuck in a boot-loop where they’ll only start in recovery mode but won’t ever boot up android by themselves without user-intervention. That user-intervention for reference is:

  1. Press and hold Power and Vol- until the device reboots and small white text shows up saying press Vol+ within 5seconds for recovery.  Do not press Vol+.
  2. It will then prompt you to cold-boot in to either recovery or android, follow the directions on screen to select android and start.

That seems rather annoying to have to do every time you restart the bloody thing. The permanent fix requires either root access via terminal emulator under the installed version of android, or running a remote shell on it with the Android sdk. I chose the latter.

As with all ASDK tomfoolery, start the adb server

adb start-server

Check to make sure the device shows up

adb devices

Start the required remote shell session

adb shell

Run the follow magic command to make everything happy again

echo boot | dd of=/dev/block/mmcblk0p3 bs=1 seek=0

And then reboot the device.


Once you know it works, take a picture of your haxxing assistant and post to social media.

[PiwigoPress id=67 url=’’ size=’me’ desc=1 class=’img-shadow’]

Kobo Mini Haxxing

Last weekend a buddy of mine picked up a Kobo Mini on sale for $40 while we were out and about. Smoking deal for the baby brother of the ereader I use (Kobo Glo). After sharing the sale info with friends it was pointed out to me that the kobo is readily hackable. At $40 it was really hard to turn down the opportunity. So I bought two of them.

Foolishly I went through the setup/registration/autoupdate on them before doing much reading into it. After finding out that the first app (Kobo Weather App) I wanted to try out required a python library that didn’t like the latest firmwares (2.6.x) project number one became revert back to an older firmware.

After some trial and error the process worked out as such:

  1. Reset the device to factory defaults. Settings -> Device Information -> Factory Reset
  2. The device will reboot after it restores to the factory image. Select Computer Setup.
  3. Plug the Kobo in and copy the desired firmware (from here) to the .Kobo folder on the SD card
  4. Umount the kobo and unplug it, it will reboot again.
  5. Select Computer Setup a second time, plug in via USB.
  6. Using sqlite open .kobo/KoboReader.sqlite I found instructions for this here, however when I attempted the sql insert it failed saying that the user table now has 7 columns and I was only giving it 5 columns of data.  I ran:
    PRAGMA table_info(user);
    to display the current table schema. It seems like at some point they added a column for Facebook Login and whether or not you’ve purchased anything from the store. I added the extra two columns of data to the insert statement:
    INSERT INTO "user" VALUES('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa','aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa','xxxx@xxxx.xx','xxxx@xxxx.xx','2aaaa aaaaaaaaaaaaa==','','0');
  7. Exited sqlite, ejected the mounted volume, unplugged the Kobo Mini, and it jumped from the setup screen to the main screen of the Kobo software. My mini was now running 2.5.2

After that I copied over the update package to enable telnet, shut down the device, disassembled it, took out the sd card and used ddrescue to create an image of the card. Now I can install apps and muck around and have a good point to revert back to should I break the install too horribly in my playing.

When in doubt read the manual

I think I’m so used to working with ancient hardware that runs on cryptic incantations and relies on knowledge that was lost to the ages before I was born that I sometimes forget that it doesn’t always have to be like this.

DST change today, realised the new Cisco SPA525g2 phones don’t have a proper DST rule in place. After googling unsucessfully for a few minutes I remembered that these are relatively new phones. The manual might actually be useful. And it was.

So the proper DST code for Mountain Time is:


Learning through doing

I have a cheap Chinese made adjustable bench power supply at home that I bought during a group by at my local hackerspace. It does 0-18V up to 3A and came in at $60, as a budding electronics tinkerer it was pretty hard to say no to that.

One of the things I’ve learned about cheap Chinese powersupplies during my research (read: watching youtube videos) is that they usually have a fair amount of overshoot when you turn them on. In the case of mine I can turn it off when set to +12V, and when I turn it back on it’ll hit +16V before settling down.

I set out today to fix that and about half-way though adding a new power switch to the back of the unit and repurposing the original switch as a load-switch I noticed a 3-wire cable that goes from the board that has the adjustment controls to the board that houses the output jacks. I had a hunch that the controller board may be using that 3-wire cable to read the actual output voltage of the unit. I then realised my clever plan would need ammending. I realised that I’m going to need to tie in the +V sense line before my new load-switch instead of after the switch where it is now. Well, I figured that’s what it meant. I decided to close up the patient according to the original plan, partially because I wanted to see if I was correct and mostly because I was really tired of using my ancient ratshack soldering station. I was especially tired of using it as I know my new rework station will be here either Monday or Tuesday.

After putting everything back together I verified the new power switch works properly. Lights on. Lights off. Lights on. Lights off.

Lights on. Now we test the load switch. Load off. Aaaaand the voltage display disappears and the powersupply drops into constant current mode. We’re going to need to move that voltage sense line. Good to know. It’ll be easy to do. I’m not going to bother until the radioshack soldering iron is in the garbage.

I didn’t accomplish what I set out to, but at least I learned something along the way.

re-Hello World

This is a test of the re-install of wordpress as well as the new piwigo plugin. Also a picture of tasty tasty booze.
[PiwigoPress id=1 url=’’ size=’xs’ desc=1 class=’img-shadow’]

Quick shot


I picked up a tube of 10 ATMega328 microcontrollers for an embedded project I’m working on. I’d wired everything up Wednesday on a breadboard according to this guide with the intent of then connecting my original Arduino Duemillanove and burning the Arduino bootloader to the blank ATMegas using the ArduinoISP sketch. Attempt after attempt, rewire after rewire resulted in the following error:

avrdude: Expected signature for ATMEGA328P is 1E 95 0F

I spent a few hours searching around trying to find a solution and the forum posts involving that error really didn’t seem to apply to my situation. I eventually noticed that the uC that shipped on my Duemillanove was the ATMega328P-PU and the chips I had ordered/received were the ATMega328-PU, signifying that is not in the pico-power series. Armed with that little tid-bit I found this post containing the piece of information I needed to move forward.


I now have signatures in /etc/avrdude.conf (excerpt below) for both the 328 and the 328p, and I now uncomment the appropriate signature for the chip I will be interfacing with. With that sorted I was able to finish burning bootloaders on all the ATMegas, breadboard my test bed, and get to learning bi-direcitonal half-duplex RS485 comms between microcontrollers using TI sn75176bp differential bus tranceivers.

id                  = "m328p";
desc                = "ATMEGA328P";
##      m328p signature
signature           = 0x1e 0x95 0x0F;
##      m328 signature
##   signature         = 0x1e 0x95 0x14;