Quirky Nimbus Hacking
Update: Part 2 is up! Quirky Nimbus Hacking (part 2)
A bit of history
About two months ago, I became interested in a little device called the Nimbus, by a company called Quirky. Basically, it's a little dashboard that shows different messages or values depending on the configured action. You can also configure it as an alarm with an annoying 'beep'.
On itself, the device was a bit useless for me, as it was oriented for social media (you can show your tweeted messages for example) and some other uses I don't care about (like the time it will take you to arrive at work depending on the traffic. I walk to work :P).
But my inner hacker was very curious, so I did some investigation in order to learn how this device worked and the customization possibilities.
I discovered the Nimbus uses an Electric IMP as its core. This little device is basically an ARM CPU tied with an always online cloud platform in which you code your firmware and gets deployed to all your devices.
The problem was, if I wanted to modify how the Nimbus worked, I had to "unbless" the device to add my code, and to do that you need to be the manufacturer. So I contacted the awesome support guys at Quirky (hey, Domenick!) and after explaining to them that I basically wanted to hack the device, they agreed to unbless it for me! They also warned me that I'd have to write everything from scratch, including fonts and everything else, because understandably I won't have access to their firmware source, but that was part of the fun, so I was happy :).
The specs
With those wonderful news, I ordered one and cracked it open the very first minute it arrived :D. I learned that internally, the device was as follows:
The interactive parts:
- 4 dials
- 4 blue LED matrix displays
- 2 buttons
- 1 speaker
The brains:
- 1 Electric Imp (imp002)
- 1 PIC16F1829
- 1 W25X40 (4MBit serial flash)
The details
After checking the internals, I fired up my logic analyzer and started analyzing signals. This is what I discovered (only on the electric imp side, the one we can actually control)
- Pin 1 & Pin A: Controls the speaker. Pin A enables and disables the sound, where a PWM on pin 1 generates the sound itself. On the original firmware it's used when an alarm sounds with an annoying 'beeeep', but I generated something more nice in my demo (check on the results at the bottom of the post).
- Pin 2, 5, 6 & 7: Connected to the flash memory using an SPI interface (in order, DO, CLK, /CE and DI).
- Pin 8 & 9: I2C between imp and PIC.
- Pin C: Background brightness, using a simple PWM.
- Pin D & E: Left/Right buttons.
I'll left out the I2C protocol details (those used to control the dials and the LEDs) out so this post won't become a monster, but if you want those, check the second part of this post (Quirky Nimbus Hacking (part 2)) :).
All this also left me wonder if there is a way to reprogram the PIC from the electric imp itself (maybe with that unused pin B) but I'm not in the mood of tracing tracks on the PCB, and I cannot revert my Nimbus back to the original firmware, so I'm happy with the results :).
The results
With all those details, I created a simple firmware on my own that controls everything there is to control. I can even create a Quirky Spotter, another of Quirky curious products, as I can read the amount of light the sensor of the imp receives (basically what the Spotter does).
I don't use the buttons here, but you can imagine what those do ;). I'm also currently waiting for the electric imp guys to provide me with a better way of changing the PWM frequency, as the trick I'm using right now produces clicks, and that's why you don't hear a better sound (I want to add some effects like the original speaker version :D)
Anyway, hope you like my little hacking! A lot of thanks to the Quirky guys for opening the device up for me, even if they didn't have to, and specially to Domenick for going through all the process with me and being super helpful in general!.
As usual, comment or tweet if you have any questions or suggestions on what to hack next :)