Skip to content
  • MySensors
  • OpenHardware.io
  • Categories
  • Recent
  • Tags
  • Popular
Skins
  • Light
  • Brite
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Brand Logo
  1. Home
  2. OpenHardware.io
  3. 💬 Ikea Molgan Hack

💬 Ikea Molgan Hack

Scheduled Pinned Locked Moved OpenHardware.io
motionmolganhackpirmysensorsikea
90 Posts 16 Posters 27.4k Views 15 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • YveauxY Yveaux

    @Anticimex the Molgan Hack uses the internal oscillator, not an external crystal like the nano and pro mini.
    The internal oscillator is less accurate, hence the lower baud rate.

    AnticimexA Offline
    AnticimexA Offline
    Anticimex
    Contest Winner
    wrote on last edited by
    #69

    @Yveaux ah, ok. That explains that then. But to my knowledge there is no timing dependency for software signing, except the signing timeout. But I think there is a debug message if that fires. If not, perhaps @LastSamurai could try to increase the timeout (currently at 5000 ms).

    Do you feel secure today? No? Start requiring some signatures and feel better tomorrow ;)

    1 Reply Last reply
    0
    • L Offline
      L Offline
      LastSamurai
      Hardware Contributor
      wrote on last edited by
      #70

      Ok for the molgan sketch the arduino IDE spits this out:

      • list item22.602 Bytes (73%) of memory
      • list itemglobal variables 56% of dynamic memory

      How do you change the timeout? Quick googling only turned up requests to make it configurable...

      AnticimexA 1 Reply Last reply
      0
      • L LastSamurai

        Ok for the molgan sketch the arduino IDE spits this out:

        • list item22.602 Bytes (73%) of memory
        • list itemglobal variables 56% of dynamic memory

        How do you change the timeout? Quick googling only turned up requests to make it configurable...

        AnticimexA Offline
        AnticimexA Offline
        Anticimex
        Contest Winner
        wrote on last edited by
        #71

        @LastSamurai it is configurable, and clearly visible where all signing configuration parameters are located in MyConfig.h. Look for MY_VERIFICATION_TIMEOUT_MS.

        Do you feel secure today? No? Start requiring some signatures and feel better tomorrow ;)

        1 Reply Last reply
        0
        • L Offline
          L Offline
          LastSamurai
          Hardware Contributor
          wrote on last edited by
          #72

          Thanks, haven't really looked in that file since the upgrade to mysensors 2. Doing it all in the sketches now. I'll test it and get back to you.

          AnticimexA 1 Reply Last reply
          0
          • L LastSamurai

            Thanks, haven't really looked in that file since the upgrade to mysensors 2. Doing it all in the sketches now. I'll test it and get back to you.

            AnticimexA Offline
            AnticimexA Offline
            Anticimex
            Contest Winner
            wrote on last edited by
            #73

            @LastSamurai I do not think the timeout is the issue here, but worth a try anyway. The memory usage is in the red zone if over 70% I'd say so I suspect the hmac key gets corrupted by a stack that grows into the heap. You can test that by adding a debug print in the soft signing backend that dumps your hmac key before it is set. Assuming you run the latest stable release you'd want to place the print just before this line. You can copy this line and replace _signing_hmac with _signing_hmac_key. Also change the HMAC text to HMAC KEY to tell them apart (and don't post your printed key here ;))
            This to verify that the key used is the key you personalized and that it has not been corrupted.

            Do you feel secure today? No? Start requiring some signatures and feel better tomorrow ;)

            L 1 Reply Last reply
            0
            • AnticimexA Anticimex

              @LastSamurai I do not think the timeout is the issue here, but worth a try anyway. The memory usage is in the red zone if over 70% I'd say so I suspect the hmac key gets corrupted by a stack that grows into the heap. You can test that by adding a debug print in the soft signing backend that dumps your hmac key before it is set. Assuming you run the latest stable release you'd want to place the print just before this line. You can copy this line and replace _signing_hmac with _signing_hmac_key. Also change the HMAC text to HMAC KEY to tell them apart (and don't post your printed key here ;))
              This to verify that the key used is the key you personalized and that it has not been corrupted.

              L Offline
              L Offline
              LastSamurai
              Hardware Contributor
              wrote on last edited by LastSamurai
              #74

              @Anticimex So adding this around the line 325 should do the trick, right?

              // Feed "message" to HMAC calculator
              	DEBUG_SIGNING_PRINTBUF(F("HMAC key debug: "), _signing_hmac_key, 32);
              	_signing_sha256.initHmac(_signing_hmac_key,32); // Set the key to use
              

              The output of that is

              HMAC key debug: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
              

              which is definitly not my HMAC key!

              PS Changing the timeout did not change this.

              AnticimexA 1 Reply Last reply
              0
              • L LastSamurai

                @Anticimex So adding this around the line 325 should do the trick, right?

                // Feed "message" to HMAC calculator
                	DEBUG_SIGNING_PRINTBUF(F("HMAC key debug: "), _signing_hmac_key, 32);
                	_signing_sha256.initHmac(_signing_hmac_key,32); // Set the key to use
                

                The output of that is

                HMAC key debug: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
                

                which is definitly not my HMAC key!

                PS Changing the timeout did not change this.

                AnticimexA Offline
                AnticimexA Offline
                Anticimex
                Contest Winner
                wrote on last edited by
                #75

                @LastSamurai alright, so there are now three options:

                1. Your device is not properly personalized
                2. Your key has been overwritten in eeprom by some other part of your sketch during runtime
                3. Your key has been erased by stack growth (unlikely since it very much look like eeprom reset value)

                You can test the various scenarios by moving your newly added print to various places in the backend. For instance, adding it just after the value is fetched from eeprom in the init function of the backend would tell you if the value is bad in eeprom or is erased in ram at a later stage.

                Do you feel secure today? No? Start requiring some signatures and feel better tomorrow ;)

                1 Reply Last reply
                1
                • L Offline
                  L Offline
                  LastSamurai
                  Hardware Contributor
                  wrote on last edited by
                  #76

                  The HMAC key seems to already have been FFFFF.... when read from EPROM. While testing some more I somehow seem to have bricked the atmega328 though :( I just soldered a new board and will to some more testing tomorrow.

                  AnticimexA 1 Reply Last reply
                  0
                  • L LastSamurai

                    The HMAC key seems to already have been FFFFF.... when read from EPROM. While testing some more I somehow seem to have bricked the atmega328 though :( I just soldered a new board and will to some more testing tomorrow.

                    AnticimexA Offline
                    AnticimexA Offline
                    Anticimex
                    Contest Winner
                    wrote on last edited by
                    #77

                    @LastSamurai alright. Perhaps the molgan sketch does some eeprom operations which inadvertently erases the key. You could try to read the key from eeprom early in the sketch after it was personalized just to confirm it had the key at some point at least.

                    Do you feel secure today? No? Start requiring some signatures and feel better tomorrow ;)

                    1 Reply Last reply
                    0
                    • L Offline
                      L Offline
                      LastSamurai
                      Hardware Contributor
                      wrote on last edited by
                      #78

                      Hah success! Until now I was programming the chip directly via an USBasp (ignoring any bootloaders). I guess thats how I "bricked" the other chip (accidentally burning fuses that indicate an external clock...).

                      Today I burned a bootloader (with the right fuses) to the new board and uploaded the securityPersonalizer and the molgan sketch via serial... and everything is working! It takes some (re)tries to get the signing up and running but after ~2 seconds the molgan board showed up in the gateway log. Now I'll only have to connect the new board to the molgan pcb and hope that everything still works.

                      I still don't know why it wasn't working before though. I have some other chips that I programmed via ISP and they work well with signing too...

                      AnticimexA J 2 Replies Last reply
                      0
                      • L LastSamurai

                        Hah success! Until now I was programming the chip directly via an USBasp (ignoring any bootloaders). I guess thats how I "bricked" the other chip (accidentally burning fuses that indicate an external clock...).

                        Today I burned a bootloader (with the right fuses) to the new board and uploaded the securityPersonalizer and the molgan sketch via serial... and everything is working! It takes some (re)tries to get the signing up and running but after ~2 seconds the molgan board showed up in the gateway log. Now I'll only have to connect the new board to the molgan pcb and hope that everything still works.

                        I still don't know why it wasn't working before though. I have some other chips that I programmed via ISP and they work well with signing too...

                        AnticimexA Offline
                        AnticimexA Offline
                        Anticimex
                        Contest Winner
                        wrote on last edited by
                        #79

                        @LastSamurai nice. My best bet is that you somehow erased your eeprom after personalizing it. But anyway, nice that you are fully up and running now :)

                        Do you feel secure today? No? Start requiring some signatures and feel better tomorrow ;)

                        1 Reply Last reply
                        0
                        • L LastSamurai

                          Hah success! Until now I was programming the chip directly via an USBasp (ignoring any bootloaders). I guess thats how I "bricked" the other chip (accidentally burning fuses that indicate an external clock...).

                          Today I burned a bootloader (with the right fuses) to the new board and uploaded the securityPersonalizer and the molgan sketch via serial... and everything is working! It takes some (re)tries to get the signing up and running but after ~2 seconds the molgan board showed up in the gateway log. Now I'll only have to connect the new board to the molgan pcb and hope that everything still works.

                          I still don't know why it wasn't working before though. I have some other chips that I programmed via ISP and they work well with signing too...

                          J Offline
                          J Offline
                          Jan Gatzke
                          wrote on last edited by
                          #80

                          @LastSamurai How exactly did you flash it? I am using an USBasp, too. As it seems I have bricked 2 atmega328p and one Arduino Pro mini already. :dancer:
                          This is what I did:
                          "C:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avrdude.exe" -C "C:\Program Files (x86)\Arduino\hardware\tools\avr\etc\avrdude.conf" -B 40 -c usbasp -p m328p -b 11520 -P usb -V -v -U efuse:w:0xFE:m -U hfuse:w:0xDA:m -U lfuse:w:0xE2:m

                          "C:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avrdude.exe" -C "C:\Program Files (x86)\Arduino\hardware\tools\avr\etc\avrdude.conf" -c usbasp -p m328p -b 115200 -P usb -V -U flash:w:ATmegaBOOT_168_atmega328_pro_8MHz.hex

                          After this I am not able to flash sketches via the Arduino IDE. Any ideas?

                          J 1 Reply Last reply
                          0
                          • J Jan Gatzke

                            @LastSamurai How exactly did you flash it? I am using an USBasp, too. As it seems I have bricked 2 atmega328p and one Arduino Pro mini already. :dancer:
                            This is what I did:
                            "C:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avrdude.exe" -C "C:\Program Files (x86)\Arduino\hardware\tools\avr\etc\avrdude.conf" -B 40 -c usbasp -p m328p -b 11520 -P usb -V -v -U efuse:w:0xFE:m -U hfuse:w:0xDA:m -U lfuse:w:0xE2:m

                            "C:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avrdude.exe" -C "C:\Program Files (x86)\Arduino\hardware\tools\avr\etc\avrdude.conf" -c usbasp -p m328p -b 115200 -P usb -V -U flash:w:ATmegaBOOT_168_atmega328_pro_8MHz.hex

                            After this I am not able to flash sketches via the Arduino IDE. Any ideas?

                            J Offline
                            J Offline
                            Jan Gatzke
                            wrote on last edited by Jan Gatzke
                            #81

                            Never mind, it's working now. I soldered a completely new pcb and this time it runs without problems. I still have no idea, why it did now work on first try. But I guess it has something to do with the fact, that I used hot air and solder paste for the first time. :)

                            Edit: I have assembled all the stuff and the node is kind of working. It presents itself to the gateway perfectly. What does not work is the motion sensor. The pin is always high. When I pull it down manually and release it again, the node sends its message.
                            I have removed the light sensor and R17. I have replaced R11 with a 1k resistor because that was the smallest one I had. Could this be a problem?

                            Edit: Ok, found the problem. Seems like I have accidentally unsoldered R2 when I removed the light sensor. From your pictures I found out, that there has to be a 470k resistor. Now it works. :)

                            1 Reply Last reply
                            0
                            • L Offline
                              L Offline
                              LastSamurai
                              Hardware Contributor
                              wrote on last edited by
                              #82

                              @Yveaux Short question: the zener diode only caps the voltage of the trigger so that the atmega328 can read it safely, right? Wouldn't a 3.3V zener diode work just as well then? Only asking because I am currently having a hard time finding a matching zener diode on aliexpress.

                              AWIA 1 Reply Last reply
                              0
                              • L LastSamurai

                                @Yveaux Short question: the zener diode only caps the voltage of the trigger so that the atmega328 can read it safely, right? Wouldn't a 3.3V zener diode work just as well then? Only asking because I am currently having a hard time finding a matching zener diode on aliexpress.

                                AWIA Offline
                                AWIA Offline
                                AWI
                                Hero Member
                                wrote on last edited by
                                #83

                                @LastSamurai As long as you can be sure the Vcc of the Arduino stays around 3.3v you can use a 3.3v zener. If you power as indicated (2 AA cells) voltage can drop below 2V and that cannot be considered safe. As an alternative to the zener you can have a resistor voltage divider (or stack a few normal diodes).

                                1 Reply Last reply
                                1
                                • M Offline
                                  M Offline
                                  Marek
                                  wrote on last edited by
                                  #84

                                  Works like a charm!

                                  YveauxY 1 Reply Last reply
                                  0
                                  • M Marek

                                    Works like a charm!

                                    YveauxY Offline
                                    YveauxY Offline
                                    Yveaux
                                    Mod
                                    wrote on last edited by
                                    #85

                                    @marek great to hear! :+1:

                                    http://yveaux.blogspot.nl

                                    1 Reply Last reply
                                    0
                                    • P Offline
                                      P Offline
                                      p359
                                      wrote on last edited by
                                      #86

                                      Here's a random question, has anyone made or considered if possible even, an RFM69 radio version? I'm considering moving to RFM69 from NRF24 due to some range issues.. maybe.. Will need two gateways or something along those lines to keep using these fantastic nodes, have 3. Any thoughts back would be terrific, is there for example some show stopper I'm missing or just a matter of space and creative wiring!?

                                      1 Reply Last reply
                                      0
                                      • A Offline
                                        A Offline
                                        aramko aramko
                                        Banned
                                        wrote on last edited by aramko aramko
                                        #87
                                        This post is deleted!
                                        1 Reply Last reply
                                        0
                                        • magpernM Offline
                                          magpernM Offline
                                          magpern
                                          wrote on last edited by magpern
                                          #88

                                          I have finally finished the PCB of two Molgans (withou the actual Molgan). I spent several hours trying to figure out why the sensor did not register with Domoticz.
                                          I had it plugged in to the FTDI which powered it, but nothing... device talked, gateway listened, but device ignored responses from gateway.
                                          I just dealt with with problem on some other nodes, and it was the channel id that was inappropriate. But now I had the correct channel id, and still the same problem.
                                          I checked for shorts, but nothing.
                                          Measured the voltage. It says 3v3 on the FTDI but was actually 3v5. But that should be ok.
                                          Finally I figured, power it through the + and - pads instead of FTDI. So, I set up a 3v3 power supply.. and voila.. it registered with the gateway.

                                          I don't understand why, power is power... but apparently power is different.
                                          So, for future builders, if you run this, you know what I did.

                                          Need to head to IKEA and get some more Molgans!!

                                          YveauxY 1 Reply Last reply
                                          0
                                          Reply
                                          • Reply as topic
                                          Log in to reply
                                          • Oldest to Newest
                                          • Newest to Oldest
                                          • Most Votes


                                          16

                                          Online

                                          11.7k

                                          Users

                                          11.2k

                                          Topics

                                          113.1k

                                          Posts


                                          Copyright 2025 TBD   |   Forum Guidelines   |   Privacy Policy   |   Terms of Service
                                          • Login

                                          • Don't have an account? Register

                                          • Login or register to search.
                                          • First post
                                            Last post
                                          0
                                          • MySensors
                                          • OpenHardware.io
                                          • Categories
                                          • Recent
                                          • Tags
                                          • Popular