I hacked my filament dryer - Hackware Sept 2026

Okay. Uh, hacker August yada yada dry box hacking. Um, >> that doesn't work. I'll use space. Okay. So, 3D printer. You guys know what that is. Um, I have a cheapo ender. It's fine. Um, worked great in Shanghai. And then I moved to Singapore and then I had a problem and that is that suddenly my prints came out like crap. And it turns out that Singapore is a tropical country. Um, and that means that your filament just gets wet in like 3 milliseconds total. >> Um, which is which is not great, but you know, you have dry boxes, which is great because it gets wet in three milliseconds and then you have to put it in a dry box and you have to wait like six hours before the thing is dry again. >> [snorts] >> Um >> um so which is not great because I I don't I don't really plan my 3D prints very well. So I'm like I want a 3D print and then it turns out like crap because the stupid >> Okay. So there's there's some frustration there. Let's let's let's keep it at that. So what I would like to do is just something that keeps it dry maybe or something that um I at least can can decide at any random moment. Okay. six six hours for now. I want to 3D print something. So, I want to have this automated. I want to have this connected to a network. I want to I want to do stuff with it so I don't have to Yeah. Um the the the other thing is I don't have a picture, but this thing stands next to my 3D printer in a corner. That that LCD like the the the the contrast that's there is a lie. It's [laughter] it's it's a lot harder to read in real life. Uh the button is also kind of janky. So like I I I want to I want to automate the ever loving crap out of this. So luckily that's doable. This is the main PCB. Um main PCB consists of a few parts. Power goes in here. That's like straight 230 volt. >> Oh wow. Okay. >> Um here is uh here is the heater. Heater is just a big old old resistive coil. I have a picture at the end of the presentation. You can uh you can see it. That thing runs off at 220. Okay. Um, so not everything runs off 220 volt obviously. So there's a little 12vt power supply here. Um, isolated luckily. Um, uh, the relay for the, uh, for the heater is here. It's a solid state relay, so it doesn't go kick click. And that's actually important for something later on. Um, here is the fan. There's a fan that blows the hot air through the the thing. 12vt fan. That's probably why the the power supply is 12 volt because uh as far as I can tell that this is the only thing actually taking 12 volt display is connected here. Um it's just a a display without a controller, seven segments. Um so there's a display controller here. Um this little chip is the main main CPU of the thing. Um CPUs has a few inputs as well. There's a humidity sensor here and an NT an NTC for like the temperature. Uh this bit is actually on the other side. So that's a big rotary button where you can set set the temperature etc. And then you've got these fancy interesting test points and and headers. >> Um this >> so uh CPU itself is a GD32 whatever. Um, it's a 72 MHz 32-bit processor, which feels like overkill. Um, it's actually a little bit less overkill than you would think. Um, but still it is it is pretty pretty weird. Uh, 16K of flash. Uh, I think 4K of RAM. I'm not sure anymore. Uh, pretty pretty powerful. Um, aside from that, it's got >> um, aside from that, it's got your old scattering, all the URS, SPI, whatever. Nothing special, the things that you find in any CPU. Um, so traced out the important bits of the PCB, mainly the header. Uh, header goes to 3.3 volt and ground and a bunch of pins here. Uh, one of them is the reset pin. So, maybe interesting. A bunch of test points as well. Uh, they go here to a bunch of GPIOs uh one to a wakeup pin. So I guess they had some idea to make it sleep or something. I don't know. But it's just test pin that doesn't do anything. Uh so tracing it out a little bit more that header has uh the SW clock and SWIO there. So that is a debug port. That is the the the the wire equivalent of a J-tech port. So you can use this in order to debug and program the um main CPU which is pretty useful. >> Yes. >> So obviously I took out my my general do everything debug port thing that also has an S SWD port. Um this is just a FD2232 uh based thing. Um it's got a it's got a mini USB. That's how old it is. Um but it still works great. and I actually got a binary out of it. And unfortunately, no strings, but you can see that there's a random crap out there. That is positive because that means that the chip is not protected. I can just read out the firmware. I can mess with the firmware. I can write it back. No problem. No big ones. Um, so obviously you do what you do. Yeah. You take out your old NSA sponsored reverse engineering tool and you throw it in there. Decided to make my life a little bit easier. um uh modern CPUs have something called a CMS SVD file which is an XML file which describes all the registers in the processor. So if you if you use an extension to throw that into Gedra then suddenly you actually see what it's writing to rather than just random addresses. Pretty useful. And the other thing is I heard that modern clankers are pretty good at at reverse engineering. So inside just throw that at it. >> Um uh bit of work to set up, but aside from that, yeah, uh worked. So you tell your clanker, please figure out what the hell this is. Uh gave it a few input outputs and um yeah, happily just figured out what all the what all the what all the functions were. Um great, that's worked for me. Um so um ask it how it how it works, how it ties together. Uh turns out that there's a main routine that does both the user interface as well as the uh as well as handles the sensors and that just writes to a certain structure in the RAM and there's two interrupts that do the actual work. Um there's one timer that handles the fan and does the LCD countdown. So uh what you do is you set a temperature and you set a time and that time it just counts down until that zero and turns off. Uh so that that handles that and the other thing handles the heater PWM. Um seemingly that relay has to be a solid state relay because it's actually doing a slow PWM. Uh the uh thermal inertia of that heater is just such that they can just use a solid state relay to kind of sort that VWM in. And what they do is they use that like number um uh in order to uh well they take a P controller and they use that as the output uh which is um it feels like a hack but it gives a way better result than just using a bang bang temperature controller. So yeah um but it actually takes a a fair amount of logic. So I I I suddenly blame them a lot less for throwing like 72 mehz at this problem. Um, kind of makes sense. Uh, so, um, the nice thing is though, oh yeah, so the clanker also told me exactly where those things were in in RAM. Great. So that actually means that I can just add myself. Uh, as long as I can read and write to RAM, I can figure out what the sensor values are and I can I can just poke the values in there as if uh I did it on the user interface. Um, and I can do more than that because I can also change them on the fly. Um yeah. So great question obviously is how do I poke around? Um so first thought is this is an SWD port. Um I can also just take an ESP32 of course an ESP32. Um and um tell it how to speak SWD. Um we actually do have existing solutions for that but like it's probably easiest to to just hand roll something if you just want to poke into RAM because SWD is actually a pretty simple protocol. uh you can just do it using a few GPIOs and there's a few layers to it. So you got to write to registers in order to write to registers in order to write to registers and like that's not >> that's that's that's like conceptually hard to get your head around but as soon as you get it it's like yeah sure no worries. Um so great I just going to control it to the SWD port and and I'm done right. So, it turns out that the people who designed the the the the thing used the SWDIO port to control the fan. >> So, as soon as the thing starts up, this the [laughter] the S SWD port does not work anymore. [sighs and gasps] >> Great. Um, so I thought one of the solutions would be to rewrite the entire firmware to maybe move the fan to another pin. But um, but there actually was another thing that the clanker discovered and that was that there um, seemingly used to be a UART interface in this thing. Um, you could still see an interrupt handler wasn't hooked up to anything um, and it didn't really do that much. just received something finished by an enter and then dumped it into a buffer and it sent that as well. So, um I couldn't even figure out what protocol it was and wasn't set up, the UR wasn't configured, etc. Hey, maybe if you know the UART was used, then um yeah, turns out that that is on two of the two test pins that are not used for anything else. like you could have also just connected the fan to that. [laughter] Um you know you you got to do what you got to do. So um uh I decided to just reimplement a UR control protocol and I did that by writing some C code and the way it works is uh you first need to tell your C compiler or actually your linker where everything is. Uh so I just told it here's a little bit of flash that you can you can you can live in. at the end of the flash there's a region of like 4K give or take. Uh if you want to put your variable somewhere there's like 2K free of RAM. So knock yourself out. Um >> so this is because you wanted to confine this without re like on its own without any reference to the rest of the firmware. >> So um well like I can't I can't compile this as standalone firmware because there already is a whole bunch of firmware that I just want to keep in place. So I want to have my own routines, but they need to live in flash somewhere. >> So exactly. So what I'm saying is like this little bit of flash you can happily use. There's also an associated bit of RAM. I know that the firmware doesn't use that. So you can happily use that. Um so I can also tell it, hey, some of the existing routines live here. So I can just declare those as externals and I can just call them as if I had the source code to them and as if I were to just link to them. uh which is great. Uh same thing with the buffers that are in use both uh to store things like time etc as well as the uh existing UR buffers that are poked by the interrupt routine but are not used. Um I can just feed them the address and it's just like they live in other C files. Uh so Ccode itself I just have an initialization routine um that that does a bunch of things and I also have another routine or I used to have another routine that got called in a timer. I reworked that later. Um but the issue is now I I just have code that is sitting somewhere in flash but that's not connected to something. Uh so I just added my code. So how do you hook that up? Well for that you need to patch the existing code. So in the top there you see some assembly uh branch to some sub function. The sub function does some things and then return. So what you can do is you can hack the firmware so that branch actually doesn't branch to that sub function but branches to your own code and your own code does some things in this case handle the UI protocol and then calls the original sub function. Um it's actually not the exact way I ended up finishing it. I ended up finishing it like the main routine initializes a whole bunch of stuff and then goes into the main loop and that calls two functions and what I actually do is um I hijack a jump into that main loop and I just reimplement that main main loop myself. Um so I don't have to branch back to like sub function because I just handle the main loop myself. slightly different thing but like so uh make a simple UR protocol um you can send it this you set the temperature you set the time and you set if it needs to be active or not and every two seconds it returns this uh same thing asky string uh tells you if it's currently active the the amount of time that it still has remaining the temperature that sets uh the current heater power that that that is outputed by the PWM thing current temperature and current humidity Right. That's all you need in order to control it. Um, so got a little PCB. This is actually originally a PCB that I used to automate my air conditioners. Um, this kind of was great for it because air conditioners also use a UART. So, uh, you know, just have to can just reuse it or so I thought. Turns out turns out that the switch mode power supply that I selected for this little chip um, actually only ran to six volt. I happen to have one in my in my parts bin that ran to 12vt, but it it it required it had a little bit of a different pin out. So, um yeah, required a little bit of of hacking. Uh but in in the end, it works. It's happy. Um so, this is how it's connected to the main PCB. Uh some some strain relief by um by by zip tying the cable to an unfortunate capacitor. I mean, eh, and on the ESP32 side, I have a library that happily talks to Home Assistant. You can use ESP home, but my library sort of predates that and I never made it to ESP Home, so whatever. And now I can just control it using Home Assistant, which is great. Um, so conclusion, this works great, right? Well, um, it turns out that, um, the clanker was a little bit too optimistic in what it told me. The clanker is being too optimistic. I'm sure you never heard about that story before. >> Um, so I happily wrote my code and I tested my data. I'm like, awesome, this works. And I just checked everything back in the dryer box and cool. And then I figured out there were bugs. Um, so it's a little bit flaky. Um, a few things that I can't entirely pin down because I haven't used that that much, but where I went like, hm. Um, uh, there's at least one issue, uh, with the heater either being 0% or 99%. So, uh, the heater is like a 32-bit value, and the clanker said, "Yeah, that's that's a percentage that runs from 0 to 100%." So, uh, great. Um, yeah, turns out it's not that simple. Um and and there's probably more hiding around in there that I in my optimism of just believing whatever the clanker said is entirely ignored. Um but like everything is like inside that brier box now and and and and I don't want to reconnect to the SWT thing. So how am I going to solve this? Like and the thing is every time I find a bug I need to open the damn thing again. >> So I decided to solve it a little bit better way. like I can't I can't just have this presentation without like you know yes I made a thing and it sucks. [laughter] >> I mean to be fair it would still be a good presentation but it's a bit you know um so I decided to run a second cable um >> that actually runs to the S uh SWD uh connector and also the reset connector. And the way this works is actually uh it's connected to the ESP32 and the ESP32 is obviously connected in Wi-Fi to my laptop and that runs open OCD and open OCD knows uh a certain protocol that is called a remote bitbang. Um uh it's it's a really nice protocol. It works over TCP. It's just a bunch of strings. Um the protocol is trivial. Like the actual core of my implementation is maybe like 30 lines of code or something. It's it's like next to nothing. downside is that slow as Um, like reprogramming the GD32, which is like 16K using my my original thing. I I I don't even know how much it is because I I never noticed it. It's like a fraction of a second. Um, with remote Bitbank, five minutes. >> Um, >> but it works. >> And it's remote. >> And it's remote. So, uh, yeah, I'm decently happy with it. This is this is how it this is how the inside of the the thing looks like. Um maybe I should have put this before but then we could have seen the conclusion already. Um so the heater is there. There's a fan there. The original thing is there. You see the two wires running to the to the SP32 module. And this is actually looking at it from from the top. There is a like a plateau in there that is pushed in and then screwed in which is a pain and you have to get out because of the isolation that is that is on all sides. that kind of sort of pushes it in and and then it gets screwed in. Roll of filament goes on top of that, etc. Um, but yeah, there's not really an easy way to get a debug port to the outside. So, I'm really happy with my current Wi-Fi solution. Um, uh, this thing at the moment still sucks, but it sucks at least a little bit less because if anything, I I figured out what the heater problem is, and if I run into another problem, I can now debug it and fix it without having to spend like half a day of taking this in and out. So, yay, success. Um, yeah, thanks for listening. Hope you enjoyed. Um, that's my story.