Topic: Interfacing to the Davis console without the Weatherlink Datalogger

[DeKay]

Good news.

I have discovered that the expansion port at the back of the Davis console has a logic level serial port that allows easy interfacing to a PC without requiring the datalogger that comes with the Davis Weatherlink software.  An adapter to convert USB to these serial levels can be bought for $15 or less.  More details can be found in my blog, specifically this post].

Anything that can provide a logic level serial interface at 3.3V would work with this technique, such as a 3.3V Arduino or PIC.  Or maybe a 5V Arduino with four resistors to make a couple voltage dividers.  One of these little microcontroller boards with a flash interface could give you gigabytes of long term data storage.  Or just use a PC.  There are lots of possibilities here.

The good news is that the Davis dongle would seem to work just as a pass-through of the commands from the host.  I have used a terminal program on my laptop and manually sent commands directly to the console that are exactly as described in the datalogger protocol document.  I would think that any software that talks to the datalogger should work with my technique, with the exception of retrieving data stored within the non-volatile memory of the datalogger itself.

More good news is that my method's USB connection should be rock solid.  There shouldn't be the hang-up issues with this approach that some others have seen with USB.

By the way, I don't own the Weatherlink software or the datalogger.  What I've done is completely arms length to Davis' design.  Any forum admin hovering their finger above the delete button should have no cause for concern.  All I have done is basically used a continuity tester to determine the expansion port pinout at the back of the console to the internal processor.  There is no "hacked software", no circumvention of any encryption, and no misuse of any copyrighted or patented Davis material.  If you want to call what I've done "reverse-engineering" (a stretch given how simple this actually was), then what I've done is still completely legal (Wikipedia link).

Enjoy!

[ocala]

Interesting.
Not hip to the technical aspect of how you did it but more that you did do it.

[Garth Bock]

 

I read your blog. Friggin' fantastic. This could open it up for alot of new uses ! Great job !!! If they claim infringement...I will be one to keep a candle burning in the window for you....just kidding.

YOU DA MAN !!!!

[Bushman]

SOAB!  Friggin' awesome find!!!  That is the coolest hack I've seen in a long time.  Now to interface to my Redhill/CAI Webcontrol box.  Bwa-ha-ha....

[W3DRM]

Wow, that is fantastic! GREAT JOB!!! 

I can just imagine having some means of capturing months or years worth of data on a single dongle on a remote VP2 or Vue and then being able to download it all to a PC later.

Keep us posted on your progress on this endeavor.

BTW, your blog is great reading...

[DeKay]

Thanks for the kind words, guys.  I'll tell you, I was pretty psyched the first time I typed "TEST" in a terminal and it said "TEST" back to me.  There were a number of educated guesses that I made that I mention in my blog, so I actually got a bit lucky getting something working as quickly as I did.

Have fun with this.

[Downlinerz2]

   Great job!!!  You may get a Nobel Prize for that one!!
       Mark

[xykotik]

Thanks for sharing, DeKay.  Cracking the Davis DNA makes you the Francis Crick of WX hacking.

[xykotik]

I followed some of the links in your blog, DeKay.  It looks like Davis themselves are publishing their datacom specifications (where did you get the FW dump?) probably for wx software developers.  And if the protocols come from a common chip available on the open market, then you are violating nothing (except for warranty, obviously) by exploitation of these pseudo-open specs.  Just remember to disclaim yourself, and recognize/acknowledge tradmarks when you use them.  Then file your OWN patents before you go into overseas production of your third-party dataloggers.  (Just be sure to keep the price low enough that someone NEW doesn't develop a desire to try to hack it.)

*Oh, my own disclaimer...  Free advice is worth what you pay for it.  I am not an attorney.  Don't listen to a word I say.  That would be foolish.  (Just ask my wife.)

[SlowModem]

Thanks for sharing, DeKay.  Cracking the Davis DNA makes you the Francis Crick of WX hacking.

Or maybe Fargo North, Decoder.   

[dalecoy]

Thanks for the kind words, guys.  I'll tell you, I was pretty psyched the first time I typed "TEST" in a terminal and it said "TEST" back to me.  There were a number of educated guesses that I made that I mention in my blog, so I actually got a bit lucky getting something working as quickly as I did.

Have fun with this.

Nice work - and you made your own luck, I think. 

In particular, thanks for the extensive documentation of the hardware interface, and of your efforts.

[xykotik]

Or maybe Fargo North, Decoder.   

Now all I can think about is Morgan Freeman dressed like a vampire, singing...
..."a peck on the neck..."

Good 'ol Electric Company (wasn't it?)

[DeKay]

It looks like Davis themselves are publishing their datacom specifications (where did you get the FW dump?)

Well, I guess I could say that I de-capped the processor and used a laser to clear the protection fuse on the Atmel micro (which Davis almost certainly would have set when they flashed the chip), and then used a JTAG board to read the firmware out bit by bit.  But the truth of the matter is, I just downloaded it from the Davis website.

So let's say you click that link and go to their website.  Davis says

Our Firmware is downloadable at no charge, but requires use of our Vantage Pro Updater for Vantage Pro2 or Vantage Pro Updater for Original Vantage Pro, which are available for purchase through our secure e-commerce system.

This isn't true anymore.  With the firmware, a free program called avrdude, and a hacked up parallel printer cable or other inexpensive programmer, you could do it yourself.  Note that the signals that avrdude needs to reprogram the processor are available on the expansion port pinout shown on my blog.  This only makes sense, right?  Davis would want to make any process requiring a firmware update simple to do.  Not that there is much point in doing this as the latest firmware is dated Nov 2005.  But you could have fun with this, and use a hex editor to change the "It's raining cats and dogs" message to something more... colorful.  Or you could screw up the process and totally brick your console.

Edit: Looks like avrdude and a custom cable would not be required.  See this post.

Then file your OWN patents before you go into overseas production of your third-party dataloggers.  (Just be sure to keep the price low enough that someone NEW doesn't develop a desire to try to hack it.)

This is left as an exercise for the reader.

Thanks for sharing, DeKay.  Cracking the Davis DNA makes you the Francis Crick of WX hacking.

I'm more a Tyler Durden kind of guy.

[Bushman]

So let's say you click that link and go to their website.  Davis says

Our Firmware is downloadable at no charge, but requires use of our Vantage Pro Updater for Vantage Pro2 or Vantage Pro Updater for Original Vantage Pro, which are available for purchase through our secure e-commerce system.

This isn't true anymore.  With the firmware, a free program called avrdude, and a hacked up parallel printer cable or other inexpensive programmer, you could do it yourself.  Note that the signals that avrdude needs to reprogram the processor are available on the expansion port pinout shown on my blog.  This only makes sense, right?  Davis would want to make any process requiring a firmware update simple to do.  Not that there is much point in doing this as the latest firmware is dated Nov 2005.  But you could have fun with this, and use a hex editor to change the "It's raining cats and dogs" message to something more... colorful.  Or you could screw up the process and totally brick your console.

For the last several years Davis had a direct from PC install; no avrdude device required.  Davis' website sucks.  I like the idea of changing the warnings.  "It is warmer on Mars"; "Quick Dorothy, grab Toto" etc.

[xykotik]

I'm more a Tyler Durden kind of guy.

I'll take that to mean you fancy yourself more of an anarchist rather than a Brad Pitt wannabe  

Nah, I dig what you are doing.  I got all of my Tivo's hacked to the point they are doing what I want them to do, so now I have to try and break my NEW toy (wx station).

I like the idea of changing the warnings.  "It is warmer on Mars"; "Quick Dorothy, grab Toto" etc.

We were discussing on another thread today the possibility of adding "SNOWMAGEDDON" to the Davis forecasts, so your timing is right on.

[SLOweather]

Well, this is great news! Now to figure out how I wanna exploit it... Smile

Thanks the for post and the blog entries.

[SLOweather]

I like the idea of changing the warnings.  "It is warmer on Mars"; "Quick Dorothy, grab Toto" etc.

We were discussing on another thread today the possibility of adding "SNOWMAGEDDON" to the Davis forecasts, so your timing is right on.

In this thread: http://www.wxforum.net/index.php?topic=532.0, I mentioned that I opened a VP2 firmware upload in Notepad and searched it for a couple of words to get the entire list of forecasts, and status line messages.

It should be easy to open the file with an appropriate hex editor or something, and carefully edit the messages you want to change, and the reflash your console so it would show those messages appropriately.

NOTE: Don't blame me if it doesn't work or hoses your console, but please let us know if you try it. I dunno if the firmware does any CRC checking or whatever, so it might not even load.

[dalecoy]

In this thread: http://www.wxforum.net/index.php?topic=532.0, I mentioned that I opened a VP2 firmware upload in Notepad and searched it for a couple of words to get the entire list of forecasts, and status line messages.

It should be easy to open the file with an appropriate hex editor or something, and carefully edit the messages you want to change, and the reflash your console so it would show those messages appropriately.

The file that you need to edit is flash.bin

What gyrations are necessary to obtain the most recent flash.bin file?

[SLOweather]

What gyrations are necessary to obtain the most recent flash.bin file?

Gyrate over to http://davisnet.com/support/weather/software_frmwr.asp and pick your poison...

[C5250]

It should be easy to open the file with an appropriate hex editor or something, and carefully edit the messages you want to change, and the reflash your console so it would show those messages appropriately.

NOTE: Don't blame me if it doesn't work or hoses your console, but please let us know if you try it. I dunno if the firmware does any CRC checking or whatever, so it might not even load.

Very easy if you are editing flash.bin, the direct PC version may do a crc check (I have an updater, so I haven't felt like trying to edit the exe). A couple tips if editing the messages, the string has to end with 0x00. So you would be limited to a string of the same length or shorter, unless you also edit multiple messages and the table with the message addresses.

[dalecoy]

What gyrations are necessary to obtain the most recent flash.bin file?

Gyrate over to http://davisnet.com/support/weather/software_frmwr.asp and pick your poison...

I gyrated there, and couldn't find anything but .exe files.  (In fact, I had already gyrated there, and that's why I asked how to gyrate the flash.bin files)

[Yes, I know that several years ago, there were .zip files that contained the updater plus the flash.bin file.  The latest one of those that I have seems to be from 2007]

So, a bit more helpful explanation would be appreciated.

[C5250]

Interesting, now all they have is exe that if double clicked wants to upload to an updater...

If you open the exe with winzip or winrar (and probably many other extraction programs) you can extract the files though.

[dalecoy]

Interesting, now all they have is exe that if double clicked wants to upload to an updater...

If you open the exe with winzip or winrar (and probably many other extraction programs) you can extract the files though.

That requires downloading the "for use with updater" .exe - doesn't work with the "direct from PC" .exe, as far as I could determine.

So, unless someone has the Updater (Part #: 06311VP2), or (as mentioned above) "program called avrdude, and a hacked up parallel printer cable or other inexpensive programmer" - modifying the text in the firmware won't help.

But then - building that cable/interface/program is exactly the point of this topic.  Thanks for the pointer to the method.

[DeKay]

I thought I'd bump this thread with some new information from one of the readers (СаД) on my blog:

- WeatherView32 software is "superb" with this interface
- Cumulus software is "perfect"

Since СаД was also able to flash a firmware update to his Vue with this interface (gutsy move!), it is starting to look like pretty much any software that works with the Davis logger will work with this method as well.  You just don't get the archiving if the connection to the PC collecting the data is lost.  I'm dying to know if the Davis Weatherlink software would work or not.  Maybe someone fighting with a balky USB datalogger could give this approach a shot.

СаД's work also points out the error in this post of mine where I thought a separate setup was needed to re-flash the console firmware.  It seems that one $15 adapter can do it all.  Sweet.

[dalecoy]

I haven't chased all of the details of your postings, so perhaps this is answered elsewhere. 

What do you use for the physical connection to the console connector (normally used for the logger)?