Getting more information about a USB device with rust and rusb (libusb)

In case you missed my previous posts I’m trying to reverse engineer how the Apple USB display service utility sends configuration commands to Apple Studio Display CRT monitors over USB.

I haven’t managed to run the original Apple software on QEMU successfully, but in the meantime I though I could use libusb to get a bit more information about the Apple Studio Display.
libusb is a C library and I’d rather not have to write C code. Luckily for me there is a rust wrapper for libusb called rusb.

Did I mention I’m hopping I’ll be able to use libusb and rust to create an open source command line tool that can change service settings on the Apple Studio Display?

Rust’s documentation is outstanding: I took me less time than I anticipated to go through enough chapters to feel confident to run one of rusb’s list device example and understand what was going on (disclaimer: I’m fluent in C#).

Below is the relevant output of the list device example I got while my computer was connected to the Apple Studio Display via USB.

Last login: Mon Mar 16 15:56:51 on ttys000
~
▶ cargo run
Finished dev [unoptimized + debuginfo] target(s) in 0.04s
Running `target/debug/open-usb-dsu`

Bus 020 Device 002 ID 05ac:9210   12 Mbps
Device Descriptor:
  bcdUSB              1.00
  bDeviceClass        0x00
  bDeviceSubClass     0x00
  bDeviceProtocol     0x00
  bMaxPacketSize0        8
  idVendor          0x05ac
  idProduct         0x9210
  bcdDevice          18.156
  iManufacturer          0 
  iProduct               1 
  iSerialNumber          0 
  bNumConfigurations     1
  Config Descriptor:
    bNumInterfaces         1
    bConfigurationValue    1
    iConfiguration         0 
    bmAttributes:
      Self Powered      true
      Remote Wakeup    false
    bMaxPower              0mW
    no extra data
    Interface Descriptor:
      bInterfaceNumber       0
      bAlternateSetting      0
      bNumEndpoints          1
      bInterfaceClass     0x03
      bInterfaceSubClass  0x00
      bInterfaceProtocol  0x00
      iInterface             0 
    [9, 33, 0, 1, 0, 1, 34, 1, 1]
      Endpoint Descriptor:
        bEndpointAddress    0x81 EP 1 In
        bmAttributes:
          Transfer Type          Interrupt
          Synch Type             NoSync
          Usage Type             Data
        wMaxPacketSize    0x0008
        bInterval            255

Bus 020 Device 001 ID 05ac:9110   12 Mbps
Device Descriptor:
  bcdUSB              1.00
  bDeviceClass        0x09
  bDeviceSubClass     0x00
  bDeviceProtocol     0x00
  bMaxPacketSize0        8
  idVendor          0x05ac
  idProduct         0x9110
  bcdDevice           0.01
  iManufacturer          0 
  iProduct               0 
  iSerialNumber          0 
  bNumConfigurations     1
  Config Descriptor:
    bNumInterfaces         1
    bConfigurationValue    1
    iConfiguration         0 
    bmAttributes:
      Self Powered      true
      Remote Wakeup    false
    bMaxPower              2mW
    no extra data
    Interface Descriptor:
      bInterfaceNumber       0
      bAlternateSetting      0
      bNumEndpoints          1
      bInterfaceClass     0x09
      bInterfaceSubClass  0x01
      bInterfaceProtocol  0x00
      iInterface             0 
    no extra data
      Endpoint Descriptor:
        bEndpointAddress    0x81 EP 1 In
        bmAttributes:
          Transfer Type          Interrupt
          Synch Type             NoSync
          Usage Type             Data
        wMaxPacketSize    0x0001
        bInterval            255

▶

The second device listed has a class of 0x09 which means it is the USB hub built in the display…
The first device however has a device class of 0x00 and interface class of 0x03. This seem to indicate it is a HID device (i.e. it’s telling its host “I’m a keyboard”).
Could it be that the color sync button on the display, acts as a keyboard and sends a special key combination that, when running mac os 9 launches the color sync software?

I’ll update this post with my findings soon.

Running Apple USB Display Service Utility via emulation (updated)

After turning on the Apple Studio Display and connecting it to a VGA output I was pleasantly surprised: I’d forgot how nice high resolution CRT monitors are. The main advantage of a CRT over an LCD display is the CRT will scale different resolution very nicely. On an LCD on the other hand, any resolution which is not the native one looks awful.
On the other side there is that flickering that LCD screens do not suffer from at all. But refresh rates 75 Hz or over, the effect is more than bearable.

The controls of the display are simple: brightness and contrast. The image looks the nicest with those controls set quite high.

I was able to set the maximum official resolution of 1600×1200 pixels @ 85 hertz. Annoyingly, at 85 Hz, the image isn’t perfectly centred: some the left of the image is cropped.
I have yet to experiment with custom resolution profiles to see if I can get higher refesh rates…

The display’s service manual mentions a tool named Apple USB Display Service Utility. It requires mac os 8.6 or 9 to run so I looked into emulating mac os 9 using QEMU. Unlike other power PC emulator, QEMU has support for external USB devices via libusb; you must either compile QEMU yourself or find a precompiled version that was compiled with libsub.

The original tool and all the service manual for all the apple displays studios are all on a disk image on macintosh garden. This resource is a gold mine. You’ll need stuff it expander to extract the .sit archive. Then you’ll end up with a .toast CD image. If you try to mount in on macos X it will not work, however, if you mount it to mac os 9, the image will mount on your desktop.

QEMU isn’t very user friendly. In order to connect a USB device to a virtual machine you first need to find out the vendor ID and device ID of the USB device. You can do this by searching in the tree of USB devices listed in macos X’s System Report.
I have stared a wiki page to list all the Vendor and Device IDs for Apple Studio Displays.

Then you can add -device USB to you qemu.command file:

#!/bin/bash
cd “$(dirname “$0″)”

./qemu-system-ppc -L pc-bios -boot c -M mac99,via=pmu -m 512 \
-prom-env ‘auto-boot?=true’ -prom-env ‘boot-args=-v’ -prom-env ‘vga-ndrv?=true’ \
-drive file=Service_Source.toast,format=raw,media=cdrom \
-drive file=MacOS9.2.img,format=raw,media=disk \
-netdev user,id=network01,hostfwd=tcp::5555-:548 -device sungem,netdev=network01 \
-device VGA,edid=on \

To tell QEMU to connect the Studio Display via USB to the virtual machine, add the following line to qemu.command before starting QEMU.

-device usb-mouse -device usb-host,vendorid=0x05ac,productid=0x9210

I was able to install mac os 9.2 and run the apple USB DSU but annoyingly, QEMU fails to connect the USB device to the virtual machine. It looks like it can’t access the USB device because it’s already used by mac os X. When I run the DSU I get an error message because as far as the software goes, there is no display to connect to via USB.

Maybe running QEMU on a linux machine (or VM) will give me more flexibility with regard to connecting the USB device to the virtual machine?

I’ll update this post once I get the utility working…

2020-05-25 Update:

I gave up on running the monitor utility via emulation. It was making my macos qemu instance crash all the time.
I also noticed qemu would output an USB kext error message on launch.

With emulation out of sight, I found myself a second hand Powermac G4 on eBay for £15 (the only catch: I had to collect the item myself).
I’d never seen a computer this dirty. It looked like it was due a decent clean from the picture but in person, yuk. The computer seemed to have been used by a chain smoker, then left in moist basement for years. The result? That musty ashtray smell you don’t want.

The machine has a single CPU 466 MHz G4, a Rage AGP card and I managed to install OS 9.2.2.
I’m using the Apple 21″ Studio Display and it’s really nice experience I have to say. MacOS 9 has its charms but it also sucks. I’d never used a mac properly before OS X and was really surprise to find that there is no terminal in macos 9 (or prior) for example!
The finder is also really good at not being helpful when renaming files by not having an undo function. For example, go to a system folder, click on an icon/file name by mistake, then type something… you then realise you are renaming a file you don’t even know the orignal name of. Press the ESC key… and it did not cancel the operation and your system file is now renamed “fwe)” (for example). At that point you are good for re-installing macos 9.

Back the the subject, the “Monitor” control panel works and I can adjust all the geometry settings of the display, from macos 9. It’s really cool.

In my next post in this series I’ll share my experience using a USB analyser…

Apple Studio Display 21″

A 21″ CRT monitor made by apple in 1999 found me on eBay recently. The beast weighs 35 kgs; and to be honest turned out to be a lot bigger in the flesh than anticipated.

This model follows the Powermac G3 / original iMac design language with a translucent and green outer polycarbonate shell.
It supports resolutions up to 1600×1200 @ 85 Hz and has Sony Trinitron tube.
The monitor has a VGA connector and can be used with PCs and Macs (that have a VGA output). It also has a built in “Full Speed” USB 1.0 hub, which is of course very slow by today’s standard but just fine to connect a keyboard or mouse.
The controls on the monitor – in true apple fashion – are very simple: ON/OFF, brightness, contrast and a color-sync button. The latter is a shortcut that launch the display settings on macos (8 or 9) where you can tweak the color-sync parameters.
Needless to say, the color-sync button does nothing on a modern mac or when the monitor is connected to a PC.

According to service manual I found on the internet archive, if you need to adjust the geometry or horizontal/vertical offset of the picture you have to use a piece of software made by Apple called “USB Display Service Utility”. Annoyingly, this utility only runs on macos 8 or 9 (possibly mac os classic?).
To adjust the display settings you also need to connect the monitor to your mac via USB.

I’m assuming there is more to the monitor than a 4 port USB hub. It must also act as USB  device so that the USB DSU can send commands to adjust the picture settings (and also for the monitor’s color-sync button to launch the display settings on the computer).

I searched in vain for an macos x compatible version of the Apple USB DSU… and I’m thinking this is perfect pet-project to learn more about USB and logic analysers, and further down the line how to write a program that would let me change the monitor’s display settings from a modern OS.

I created a public repository on github where I’ll put my findings as I go along and where I’m planning on saving saving my USB software experiments.
My plan is as follows:

1. Find a copy of the Apple USB Display Service Utility and run it on macos 9 inside a virtual machine (probably QEMU) while the apple display USB device is connected to the virtual machine. Run the utility to see it it works. I might experiment with the power pc version of macos x and its classic mode.
2. Get a logic analyser and learn how to use sigrok and learn about the USB protocol.
3. Write a (hopefully cross platform) utility that can change the display settings via USB.

PS: If anyone knows more about this monitor or know a modern driver for it please get in touch on github.

 

 

DIY Hardware Stereo LED VU and Peak Program Meter

I’ve always loved VU meters (favouring the LED types over the needle ones). When it comes to mixing (live performances or recording project) they prove to be a must have metering tool in my opinion.
Having dedicated hardware VU meter shows you your audio levels, even when you’re focusing on something else on your computer display. It also allows you to monitor any source of audio, even when your computer is off. For example, I find it quite really interesting to compare the level at which different albums are mastered to.

If you don’t know what Volume Unit represents, I would suggest reading this article on sound on sound as well as this article about audio levelling on wikipedia.

Of course you could buy an off the shelf VU meter, but why would you when you can build your own?

JLM audio sells a variety of audio products, including DIY kits that are definitely worth having a look at.

One of their kit is a 40 LED PPM/VU/GR Meter kit that can be stacked with another one to make it a stereo meter (I imagine you can stack more that two kits to build a multi-channel VU meter!).

Build

Component list (sourced from JLM Audio)

• VUPPMGR40v3 (with +5V into +/-12V SMPS PCB module option)
• VUPPMGR40v3 without any option
• VUPPM Stereo Scale for Hammond 1598B Case
• VUPPM HAMMOND CASE 1598BBK

The first LED kit has the +5V to +/- 12V SPMS option and powers the second kit.

The two boards are then stacked together using the provided spacers and female IDC 10 way connector.

You’ll also need the a few extra components:

• Panel mount USB Connector NAUSB-W
• Neutrik XLR + TRS Jack Combo NCJ6FI-S (x 2)
• Slim-line rocker switch
• ON-OFF-(ON) switch (type C)

The USB connector lets you power the device using USB (from a computer or a mobile phone charger).

The two XLR + Jack TRS combo sockets lets you connect any XLR or jack source. Using cinch to jack adapters you can even connect the VU meter to consumer audio products (CD player, hifi amp, etc).

The slim line rocker switch is the power on/off switch and finally, the ON-OFF-(ON) switch lets your select the peak mode for the meter (jumper 7 on the 10 way connector).

• Always ON position: peak hold with decay drop back. The maximum peak is hold for a few seconds before it starts decaying.
• OFF position: peak hold. The maximum peak of your signal is hold and never forgotten.
• Momentary ON position: peak reset. Lets you reset the peak when in peak hold mode.

When you receive your kit, you’ll receive all the components you need to assemble the boards, but you won’t find a user manual in the box (except solder and a soldering iron). It’s OK: all you need to know is available on the JLM Audio’s forum threads. There a forum thread for the current version of the kit which contains all you need to know to assemble one board.
To assemble two boards, also have a look at page two of the build thread for version 1&2 of the kit. There is a close up on how to solder the female IDC connector at the back of your master board so that you can stack two boards together! Very clever design!

The diagram below summarises how I wired the two boards into the Hammond 1598BBK case.

 

Depending on how you install the stacked board in the hammond case you might have to install the jumper 4 (on the master board’s 10 way IDC connector) to reverse the direction of the metering on the LED bars.

Calibration

Calibration is easy given you have a signal generator (also called function generator), hardware or software like the Test Oscilator plugin that comes with Logic.

1. In logic, start an empty project with one audio track. On your track, insert a Test Oscilator plugin. All the tracks should already be set to 0dB, in the plugin make sure it outputs a 1kHz sine signal at 0dB.
   If you have a function generator, use the 600 ohms output and generate a 1kHz sine at 1.228 VRMS (this is the 0VU or +4dBm reference level).
2. Connect your JLM audio VU meter to your sound interface or function generator.
   • Peak calibration: turn up RV1 (input trim) until the 40’s LED (red) just turns on.
   • VU calibration: Then adjust RV2 (VU trim) until the 40’s LED (green) just turns on.

Repeat the calibration process on the second channel and you can start using the 40 LED stereo VU/PPM.

iMac mat bezel mod – glass is history

At work I have an core i3 iMac 21.5″ from Mid-2010.

Unibody iMac computers are great machines but I cannot stand the glass panel: It looks great but it’s a nightmare to have a piece of highly reflective glass between your screen and yourself.
I don’t really understand why apple did not offer the option to have the computer’s glass panel replaced with a black mat plastic bezel. I’m not talking about the LCD screen, but just the glass panel that can easily be removed with suction pads to get inside the computer.

I asked my boss if he would mind if I removed the glass panel altogether and left the computer’s LCD screen and edges exposed. He reply he would mind adding he wouldn’t really like the look of it and also so that the computer would gather dust and that maybe water would eventually find it’s way inside the computer…

A couple of weeks later had a brainwave: I should be able to use diamond cutting discs and my dremel to cut out a window into the glass panel thus eliminating the annoying reflections.

I did so and… it was a bit a disaster.

It’s virtually impossible to cut a piece of glass with a dremel and cutting discs without breaking the glass. By the way, cutting glass with a rotating tool is dirty and dangerous business:

• Wear a breathing mask unless you want glass dust in your lungs.
• Wear protection glasses (I felt on several occasions small shards of glass hit my hands and face!).

The good news is behind the black bezel of the iMac’s glass panel is a thin metal frame that sticks to the glass and holds it together even when the glass is broken.

Once the window cut out of the panel I used a large sheet of black vinyl to cover the sharp edges of the panel and render it mat.

Check out the end result bellow. I am really thrilled with the results: No more headaches and annoying reflections between the LCD screen and my eyes!

There are still reflections from the glossy LCD screen but these are not a problem at all as the surface of the screen is treated just like macbook air screens’ are.

USB Powered Magic Trackpad

Batteries on the Magic Trackpad last an amazingly long time. I would say about 6 months for my usage (on alkaline cells).
Nevertheless, eventually running out of batteries is always annoying so the other day I decided to power the Magic Trackpad using an USB cable.

This mod has already been documented on macrumors.com’s forum. My twist on it was to drill a hole in the stainless steel battery compartment cover instead of leaving wires exposed or drilling through the trackpad’s body.

Be warned that drilling stainless steel requires a lot of patience. You also need a drill that can rotate a slow speed and Cobalt drill bits. It is really important to take your time and not to drill for too long otherwise the heat will turn the stainless steel into super hard steel you will not be able to drill through.
In the case of that battery cover, being small it will get hot very quickly so I drilled for 30 seconds at a time, waiting a minute or two in between to allow for the piece to cool down.
It took me a whole afternoon to drill through the cover!

I used three 1N4001 diodes in series to step the voltage down a bit (from 5V to about 4.2V). You could use an extra two to bring the voltage closer to 3V, but the trackpad doesn’t seem to mind being powered by tensions over 3V (don’t try with more that 5V though) (I’m pretty sure Apple’s engineers used regulators to protect the trackpad’s internals).

In the process, I discovered that the positive end of the battery ersatz have to reproduce the shape of the + side of an AA battery. If the + end is flat it will not work. There is clever mechanism that doesn’t close the electrical circuit to prevent from damaging the trackpad if you insert the AA batteries in the wrong orientation.

Ingredients:

• A small piece of soft wood, cut down to the dimension of two AA batteries in series
• Electrical tape
• A beer cap (for the negative pole)
• The positive tip of an AA battery
• A couple of 1N4001 diodes to step down the USB voltage

Bellow are a few pictures of my mod. Enjoy!

Miller 597 – Vintage Rear Dynamo Light / LED modification

Recently, I found a gorgeous looking bicycle rear light on eBay.

It was a bit rusty but after cleaning it the following markings on it became readable:

• Miller
• 597

Unfortunately, I couldn’t find much about on Miller as a bicycle light manufacturer and the different models they used to make… If anyone knows about it feel free to leave a reply at the bottom of this post.

597 rear lights are bottle dynamo lights so there is only one piece of wire coming out of the back them, but I converted this one to work of my hub dynamo!

With a  bottle dynamo fitted on your bike, the frame is the return path of the electrical circuit and you only need one piece of wire that runs form the dynamo to the lights to bring the current to the light bulbs.
With dynamo hubs, the frame is not part of the electrical circuit and you need to lay a 2-core wire from the front hub to the lights (usually the front light has a switch that the front and the rear light on & off).

It was quite easy to remove the original one core piece of wire to replace it with a  2-core one: I drilled into the rear of the light through the 1-core wire and also removed all the tar that was used to seal the unit and make the lightbulb holder stay in place.

Next step was looking into how to replace the lightbulb with an LED. LEDs on a bike are advantageous over incandescent lightbulbs because they are absolutely immune to vibrations (there is no filament to break). Incidentally they consume a lot less current but that’s not something you worry much unless you power them out of batteries.

Generators (dynamo) are AC generators. Their output tension is not regulated (the faster you cycle the more energy they produce) so I had to think about voltage and current regulation before using LEDs.

Here is a diagram of the circuit I built and managed to fit inside the 597 (these lights are small!).

The circuit can be broken down in to the following elements

1. The hub AC generator
2. The diode bridge that turn AC into DC.
3. The zener diode that limits the tension to 5.5V
4. The 0.47F (yes half a Farad) memory backup capacitor that smoothes the DC tension.
5. The 150mA / 3.3V positive voltage regulator that drop the tension and limits the current in order not to fry the LED
6. A miniature 1uF capacitor to prevent the regulator from oscillating
7. A 30 Ohms resistor to lower the tension down a bit before feeding the LED

The design above has the advantage to give a “stand light” facility. That is to say, when you stop cycling (at a red light for instance), the 0.47F capacitor is charged an keeps powering the circuit. Depending on how much current is draw by your LED the light should stay on few minutes after you have stopped.

Design considerations if you if you want more that one LED:

• Make sure you don’t exceed 150mA of current draw (or use regulators in parallel or a bigger one)
• Make sure there is always a resistor before each LED if you use LEDs in parallel

List of components:

• 4 x silicon rectifier diodes (more or less any type will do)
• 1 x 5W 5.5 Volts Zener Diode
• 1 x 5.5v 0.47F memory backup capacitor
• 1 x 3.3V / 150mA positive voltage regulator (TS2950CT or equivalent)
• 1 x 1 uF electrolytic capacitor
• 1 x 30 ohms 1/4 watt resistor
• 1 x red LED

It should cost you less than £10 to source the parts above. If you are based in London, the people at Cricklewood Electronics should have the components needed in stock!

Bellow are two pictures of the modified Miller 597 installed on my road bike.

DIY pro (+4dBu) to consumer (-10dBv) audio level transformer

Pro audio equipement such as mixers and sound interfaces work with signal levels referenced up to +4 dBu whereas consumer audio equipement (such as hi-fi amplifiers or cd players) works with signals refereced up to -10 dBu.

The following diagram represent a very easy to build transformer that will let you connect the output of a ‘pro’ mix-table to an ‘consumer’ amplifier for instance. Please note that I deliberately left the output to be balanced. You need to make sure the the input of the ‘consumer’ equipment you are connecting the output of this circuit to has a balanced input. If it hasn’t simply connect pins 3 and 1 of the output together to make the line out unbalanced.

Notes: 1 dBu is the voltage level which delivers 1 mW of power in a 600 ohm resistor. dBu and dBv mean exactly the same; dBv came up first but it was confusing people with dBV so dBu is now in use.

I used the following schematics from Jensen Transformers to make the diagram above:

• Jensen pro to consumer interfaces
• Jensen Line input transformer 4:1 stepdown for balanced bridging inputs

I found it very difficult to buy Jensen transformers from UK but luckily I found an alternative with OEP audio transformers (I used an OEP A262A2E wired in 4:1).

Intrinsically, a transformer will not introduce ground loops and other undesirables to your sound path! And it won’t make your sound sound weak like resistor attenuators tend to do.

It would also be very easy to rewire the transformer into a 1:1 configuration if all you need is to de-couple two systems together without introducing ground loops (like in a sound stage to front PA scenario for instance)…

End result with the circuit above (x 2) housed in an aluminium box

Mac Mini inside a Powermac G4: Wiring

Following my previous Powermac-mini post, I would like to should you how I wired and coupled the mini to the powermac.

The challenge here was to have the ATX power-supply put inside the powermac to start at the same time the mini is started (and to stop when the mini stops) and also to get the front LED and buttons of the powermac to work with the mini. Grincheux’s dedicated blog powermacmini.wordpress.com gives all the info you need to do all that so I won’t go too much into details about it.

Bellow are pictures showing how I modified the original powermac quicksilver’s front buttons board in order to be able to wire it to the mini. The idea is to wire the power-button in parallel with the reset switch so that it’s easy to wire the reset wires to the on/off momentary connector on the mini’s main-board.
Then on the other side I wired the two unused wires on the 10 pin IDC connector straight to the LED.

Powermac-mini quicksilver front board 1

Conclusion

I am thrilled with this mod. The powermac quicksilver case looks stunning under my desk, I’ve got plenty of room for hard drives, the mini runs cooler and I can’t hear it any more (if you’ve got a mini sitting on your desk you know what I’m talking about)!

Best of all is arguably the increased expandability the PCI-express 1X expansion slot gives.

Mac Mini inside a Powermac G4: Body work

After having swapped my mac mini’s internal SATA hard-drive for an external 3.5″ one I got really pleased with the performance boost but also progressively more and more annoyed with the noise produced by the bigger hard-drive, sitting right next to me on the desk.

A few month later I happen to browse Grincheux’s powermacmini blog and got instantly seduced by the concept: Replacing the guts of Powermac G4 with a mac mini! Why not any other PC case for this mod? Well, it’s mostly a question of aesthetics: I really like look of powermac computers.

I chose to experiment on a Powermac G4 quicksilver and it didn’t took me long to get one from eBay. You will find bellow a few pictures of the body work and installation of the mac mini inside the case. For more detailed information please jump to powermacmini.wordpress.com.

Hole cutting

The first thing that had to be done was digging out a hole at the back of the G4’s case in order to be able to connect things to the mini when it is positioned inside.

Internal support

Then, I started converting an old aluminium plaque into a support that would maintain the mini in place inside the G4 case. The left picture bellow shows one of my first satisfying attempts. The one the right shows the final version of the plate (with the paint totally removed so that the plate can act as a passive heatsink for the mini by dissipating the heat that builds up on the mini’s rubber pad). I also cut a section out the aluminium plate to make room for a PCI express 1x female socket…

Powermac optical drive issue

I didn’t foresee something quite frustrating: with the mini mounted like illustrated on the pictures above, it’s impossible to close back the Powermac’s case since the end of the optical drive conflicts with the mini. In the end I was forced to cut a small portion of the mini out. This is the only irreversible modification I performed on the mini, but although irreversible, it doesn’t interfere with the mini’s operation at all, and in fact you can even put the mini’s case back on it and you can’t see a thing (unless you look at the mini upside down).