Skip to main content

casio watch hack


welcome to cuvoodoo,the sorcery of copper. today we're going to take apart a cash register. it's been lying around here a long time. nobody uses is it, and they want to get rid of it. but before they get rid of it, i wanted to get the parts. this is a samsung ser-6500 ii, ser stands for system electronic cash register. it seems quite new. there is even the foil on the screen. i don't expect it to be too complicated.

a couple of solenoids for the mechanical parts, a thermal printer, some keyboard, and just some king of screen. before we take it apart, let's see if it actually still works. here we have the us plug. go in. it makes noise. and it prints.

"closed", with some weird signs on top. and the printer seems to work. it came also with a bunch of keys. maybe for switching the modes here. there are two serial outputs, and then irc. i don't know if this is for a bar code scanner, or something different. and there is a keyhole in the front. i actually found out what the keys are for. here we have two pair of keys which close or open the box for the printer,

so you can change the paper roll. the other pair of keys just opens or locks the metal box where you can put money in. but actually it doesn't open it, so i have to figure out how to open it. and then we have 5 pair of keys which have different privileges. first we have the reg key, which you can only use to turn to reg, and that's all. then we have the vd key. it probably stands for void. you can go to void or up to x. the the z key.

which probably, as you might have guessed, can go to void and up to z. the p key. from void until p. and then the c key, which is the master key, and can do everything. i think this device is buggy, because independently of the mode i am it gives only weird signs. the difference in the keys is actually

the indents, which you can see here. for example for the reg key you only have two indents, then you have even more indents. and the bar, which is here. in the beginning it's quite large, and then the c key, the most powerful key, has a very short tab, and then the three indents, compared to this one, which is a long tab, and two indents.

i could not find out how to open the tray using the keys and switching to the different modes, and then pressing on the keys. as you can here, the keyboard works. this is where you change the mode. since there is no mode programmed, it's just complaining. i couldn't find any key which opens this tray. there is this button, which feeds paper. this is quite a generic keyboard. it came also with this paper.

i think you just have to put it under the plastic here. let's see. it's actually fixed on this side. here is the keyboard. nice buttons actually. i expected it to be soft metal domes, and not real tactile buttons. i have to find out how to open this tray, to see if there is a bit of money inside. that's the bottom of the machine.

that's probably the serial number. i didn't find any button on the keyboard to open the tray, but here there is a lever. when you press, it just magically opens the tray. as expected, there is nothing inside. when you have a look at the keys, they are not very hard to copy or to get. this lock doesn't look hard to pick.

and this lever doesn't look hard to reach. but when it's in front of the cashier, it's probably not very easy to open this device and to lift the cash register, without having anyone noticing you. so probably it's ok. else they would have put more thoughts and security in it. the tray is quite easy to remove. just slide it, and then ... you can first remove the plastic which is inside. there is no money or secret notes. and then just lift up.

here we have the tray. the inside is quite simple. we just have a spring, to put the tray to the front. here is a micro-switch. and here is some kind of solenoid for releasing the tray, with some cable going to the cashier machine, the cash register. some knobs here. this is probably hold it. i'll try to get the top part of.

on the back there is also a nice display. you can pull it out if you want. even higher probably. and then turn around. nice machine. i think i'll keep this display. it looks nice. removing the top part was quite easy. you just have to remove two screws. one is here, which is connected to this green ground cable.

and one in the back, which is also to connect the ground. once you unscrewed this, you can just take the thing, and get it off. now that we have the top part, we want to remove the cover. that's quite easy too. there is one screw here.

one screw here. and one screw on the back, just right here. and once you removed these three screws, you can just lift the cover. let me do that. and here we have the inside of the machine. a giant transformer. a board, with a giant capacitor. probably for the thermal printer.

the thermal printer. and cables for the displays. and that's it. as expected, very simple. the heat sinks are quit huge actually. and this is the complete board. what's funny is, is that it's actually a mix between a lot for surface mount devices, and then we have through hole devices

a bit everywhere. here and here. but this is normal. and if you look closely at it, the silkscreen is black, and not white. and here we also have the serial number. it's a ser 6500 ii, revision 1.2. it seems they make good work. they don't have a lot of revisions.

and it seems to be from august 2001. a pretty old board, but apparently the machine has never been used. let's start to analyze the board. here the have the main transformer. there is a fuse right there. two smaller capacitors. a huge 50v 6800î¼f capacitor. and here probably a diode to rectify the ac into dc. there is the smaller transistor,

and a huge darlington transistor which is externally controlled by even one more transistor. so you could say it's a three stage transistor. on the this here you have two inputs. two times serial. and the is actually an ethernet port. you can see from this protection. and this is an ethernet controller. this micro-chip is only an ethernet controller. this is flash for the main cpu.

here we have the debugging port. what funny is that this cpu is an integrated multi-core cpu (here is the clock) which also integrates an ethernet controller by itself. so i don't know why they need two ethernet controllers. or maybe it's just a peripheral? i don't really know. this one has its own clock. the main cpu has its own clock.

and here we have several options. either you use eeprom. but they seem to use flash. this is ram. and then we have three other slots of ram. the two connections here are: this connection is for the mode switch, where you turn the key, and this connection controls the two displays which we have.

and on this side we have: the backup battery to probably keep the memory safe, but also to provide this real time clock (rtc). this is the rtc. here we have a 32.768khz clock. quite typical for rtc. and here we come at the bottom. here we have the flex cables for the keyboard itself. these are multiplexers for the keyboard obviously.

here we have drivers, like here. here there are a lot of drivers which control these mosfets. and these mosfets then in turn control the thermal printer. i thought i wanted to keep the thermal printer, but when i see the number of connections you have to drive, and the huge number of mosfets, i don't think that only for this thermal printer i'll keep it. but we'll also have a look at the thermal printer. and funnily, i removed the sticker, but here we have a uv resetable rom, in a dip package.

and this is also again an 8-bit micro-controller. and this 8-bit micro-controller is just used to handle the keyboard here. that's why you need the drivers, the multiplexers, and a dedicated uv prom. this is also ram. for this micro-controller probably. and here on the side we have even more connections, which are unpopulated. that seems to be for another surface mount micro-controller, with a lot of pins. but i'm not sure what it's used for. maybe an additional option.

but we have quite few jumpers. here we have some jumpers here. this is the mode. we have two jumpers here. and that's all. on/off jumpers. i don't really know what they do. so quite a simple board. and there is not a lot to harvest in it. we'll have a look at the printer and the displays. and i have to correct myself.

this diode is obviously not to rectify ac to dc. for that you need a bridge rectifier. and it seems to be just behind ... here. you can not see it that well, but just behind this huge heat sink. that seems to be the bridge rectifier. as i expected. i was also wondering where it was. i just removed the cover, and as you can see we have ...

two printer sides actually. one for the customer, and one for the merchant, which keeps it inside. so they can have a copy of whatever they sell. then two huge rolls. a small motor which turns this wheel, which gets this paper off. but i'm interested to look in the inside, to see how this printer works. i've just removed this sort of band from here.

i thought thermal printers only need to warm up thermal paper. but to me this looks kind of, like you used to have for old fax machines: band which you could use the ink from. but this seems to be, maybe to get the heat better transferred? it seem to be just some textile of some sort, or some fabric. but if you put the power on, you'll see how the head is moving. let me get the power. not working now?

it works. the printer head just works, just moves and prints along the two paper trails. let's take it apart. i didn't pay attention, but here is an interesting message. probably when i first booted the machine. here is the id of the machine. ser 6540 actually.

number ii. the version of the software. the date code. boot version 1.05. default keyboard. and some kind of serial number. here is the printer disassembled. and it's actually a lot easier than i thought. two huge resistors.

10î©. 10î© resistors. just next to it, two transistors. probably these are for the motors, or for the head. i don't know. two other transistors, where you can even see which pin is the emitter, collector, and the base. the connector for the printer head. on the back you have this bar to make the head travel.

if i just turn, you see the head travel. and then you have light barriers. there is one here. and the other one is here. so you can figure out when it's at the end. and the printing head is quite boring actually. you can see everything from here. here on the top are the dots which activate. i don't know if it's an electrical shock, or an electric barrier, or it it's warm.

but this is what makes the dots on the paper, it's actually pretty simple. here is the motor to make the head move from left to right. a bit disappointed. but it's cheap, and it's reliable it seems. and here i assembled back the printer, the keyboard. and it seems to work. if i switch it on.

this works. but i don't know how to make it print. i couldn't find any mode which makes it reboot and print the current status. none of the buttons work. and the modes still look as crappy. the cash register really seems to be broken because i found the programming manual and the operator manual. they're quite easy to find on the internet. there is actually some diagnostic tool.

it tells to insert the key, go into the s mode with the c key. s stands for service mode, and the c key is the most powerful, which allows you to go in service mode. then press 1, 0, subtotal (sbtl). here you can seem 1 0 subtotal. then one of the codes for the service programming, we'll try the printer test: 4,

(forgot x/time) and then cash. but as you can see, it doesn't do anything. (even with x/time) and the same for the other service programming modes. we'll try the display test. so it's 1 0 sbtl display text is 6. 6 x/time cash

as you can see, the display doesn't test at all. there seems to be something broken inside. i don't know it it's the rom, or if the rom has been erased, it was there. but it's not really important. that's an old machine which is not used anymore, and we just wanted to look what's inside. and here we have the two vacuum fluorescent displays (vfd). with an hv518p,

from a brand i've never heard of, supertex inc. but the data sheet is available. probably that's the only thing you can keep, and reuse in other projects, because although they are quite bulky, these devices (vfd) are quite nice. i played a bit more with it, and as you can see, i could print quite a lot. so what i did is, i shorted this battery.

just but using two probes, (plugged in the current ports of the dmm) for a very short amount of time, until it resets everything. put back the keyboard in. put power. and as you can see, there is an "init clear". and it printed the beginning. and from there on i was able to access the service menu.

you just put the key into the service mode, which is the furthest away. it uses the c key. and then you can take from the programming manual, or operation manual ... programming manual ... in the programmer manual you can look at the diagnostic capabilities. we just you to press 1 0 subtotal and then one of the diagnostic modes we want to do, which a listed here.

so we'll try 1 0 let's try the display test, which is number 6. i did something wrong. clear. 1 0 service code service code 6 x/time

and now you can see, the display works quite well. it's just crappy data after the initialization. i don't know if it's in the ram. after some time it gets stuck. after one or two days you can not go to the service mode again, then you can not type a service code again, and whenever you press a button, it will make a loud beep. so there is definitely something wrong with this machine. another thing i was wondering about,

is that this vfd has a lot of segments. and as you see, this hv518p from supertex is a display driver but only for 32 channels. only this one has already more than 32 channels. you can see it from the pins in the back. what you can see here also is that in the middle there are some pins. so these are from the screen. in the middle there are some pins. and if you look at the side,

you see one chip here and one chip on the other side. if you count the pins and you can briefly look, it looks the same. my guess is that you had multiple of these display drivers. and this is also why you have also multiple entries. you have the voltage, the ground, the vpp for the vfd, and then several data in,

so you can talk to the three of them. how to verify it is just by looking at the pins, simply look at the data sheet. pin 20 is ground. pin 40 is vdd. and if it's the same at all chips on this board the probability is quite high that it's the same chip. let's go in the continuity tester. and if we try ...

this is pin 20. just with one hand is quite hard! beep as you can here, it's also the ground pin. you can see it from the color traces. it's the same for here, same for here. and you have to believe me that pin 40, which is this one, it's also the same on the two other chips.

it beeps. still, 3x32=96. because of this dot matrix display, there could be more than 96 channels. another thing you can see is that put it on, no matter in which mode you are, no matter what you type, whatever is displayed on this 7-segments part, is also displayed on the back end 7-segments part. if you look at the back of the screen,

you can see some of the traces going from this compartment go up here, and then from here they go to this connector, and from this connector they just go to the ... here, this is the connector they just go to the other screen. this screen uses the same pins as this 7-segments screen, which is quite a clever trick. and in addition, the cashier can see the dot-matrix for more information,

while the customer only sees the prices displaying on this screen. i'll keep this display, and the rest is just garbage. and i'll get rid of it. but it was fun to take apart. video blog: https://www.cuvoodoo.infodocumentation wiki: https://wiki.cuvoodoo.infosource files: https:/git.cuvoodoo.infocreative commons attributions-share alike 4.0 international

Comments