Electric Bikes – odometer

7th February 2017 – 7631 kilometres

4th November 2016 – 7432 kilometres

18th October 2016 – 7245 kilometres

5th October 2016 – 7080 kilometres

20th September 2016 – 6910 kilometres

7th September 2016 – 6803 kilometres

22nd August 2016 – 6703 kilometres

12th August 2016 – 6610 kilometres

5th August 2016 – 6553 kilometres

22nd July 2016 – 6389 kilometres since June 2014

Posted in Electric Bikes

Ebikes – dual battery managment system more riding.

So day two of a multiday test. Another 21.8 kms, with much hill climbing, used 163.7Wh for the day, bringing the total to 335.5Wh.

Posted in Computer Stuff

Ebikes – dual battery management system – first rides

I have waterproofed both the DBMS and the power meter, so am feeling a bit happier about going out for a ride or two.

I did my first ride just after I finished the basic unit, but it was all a bit short and hilly to get a grip on what was happening. I had a “dead spot” where power to the motor stopped for a few seconds, so wasn’t sure what was happening after that. However, I did 10-12km, and used power from both batteries, so something was working.

Today I went out with both batteries fully charged, the trip reset, and the power meter reset. Unfortunately, at the moment I have no data logging set up, nor do I have anyway of being sure which battery is attached at any instant. On steep hills, the new battery does suffer from more voltage drop, but normally the differences and the change overs are so subtle, I have no idea which battery is in use. Additionally, there is a good chance that at the point the processor decides to test the battery voltages I will be using no power, so the system may well stay on the same battery! Only when the first battery has been used enough to take the voltage below the second battery can we guarantee a battery change.

The power meter is excellent, easily readable even with polarised sunnies on, clear read out of volts, amps and watts, and 2 second scrolling through all the other various highs, lows and AmpHours and WattHours readings. In particular, the “uptime” is quite useful, I can work out when the next battery change might happen.

Start voltage on the 13Ah bottle battery was 40.72V, and on the 15Ah headway battery was about 40.2V.

I did 21.2Km, I was  moving for 62 minutes, and the DBMS was turned on for 69mins.

The whole system used 4.66Ah, or 171.8Wh. Peak amps was 14.97, Peak Watts was 551W. Lowest voltage recorded was 33V. Possible a connection not made properly, or a problem with the switch over algorithm.

At the end, Bottle battery was at 38.71, and Headway was at 39.76.

At the finish, the system was switched onto the headway battery, probably because the bottle battery had dropped below the voltage of the Headway. On a short ride like this one, balancing battery usage is not likely, but double the distance and we may start to see more equal usage of the batteries.

I got a couple of “dead spots” but I still have no idea what is causing it, some serious thinking and analysis required. The low voltage of 33V that was recorded may be some part of the problem.

I am not going to charge the batteries or reset the trip or Powermeter, so the figures may get more meaningful on the next trip.

The watt meter on the King Meter display unit from Lekkie was inaccurate most of the time, reading between 30W and 100W high. Even the battery bars indicator bore little relationship to the actual voltage being recorded.

Eventually, I would like to detect the ampage within the DBMS, and calculate watts and WattHours, and use these to make a more sophisticated battery switch algorithm, and also add a data logger to record volts, amps, time and battery selected, which I could analyse in a spreadsheet. This may help with ironing out the small issues.

Soon, maybe. 🙂



Posted in Arduino, Dual Battery Management System, Electric Bikes, Programming, Yuba Mundo eV4

Ebikes – dual battery management system – build and install


After a few months of designing, prototyping and waiting for all the components to arrive, I finally had enough to build a working, install-able prototype of my Dual Battery Management system.

DBMS installed on yuba

DBMS installed on Yuba

It is still a prototype, and like all prototypes is too big, too heavy and too expensive. I am not an electronic designer, and despite dabbling for over 50 years, I am still incompetent with most aspects. So this device uses pre-made off the shelf components. If I was to have a thousand made in a factory somewhere, it would be a single board in a tiny case.

Even when the components finally arrived, I was still adding ideas and concepts, the most recent being adding a power meter to aid testing and development. More about this in another post. But it did involve a rather large “shunt” – a device which copes with large ampages, has a very low resistance, and allows amps to be translated into millivolts for measurement.



As you can see, it is large, 130mm long, 30mm wide and 38mm high, and heavy (250g?). This spoiled my proposed layout even into the new larger case I am using.

This case is 140mm long, and its internal width is 108mm. It comes in two identical pieces, which slot into each other along the edges, and has two end plates which hold it all together. Not by design waterproof, but I can work on that.

So I spent many hours arranging and rearranging components until I was happy enough with the layout to commit to cutting and drilling stuff.

Basic layout of components

Basic layout of components

First in was the shunt. A fair chunk of the 130mm length was the plastic plinth. The case half comes with a slot for mounting printed circuit boards (PCBs) in. The actual internal width of the case is 110mm, but the “groove” consists of two ridges along the length of the case, about a 1mm high, one at 8mm and the other at 11mm from the bottom approximately. I very carefully cut the plinth to exactly 110mm wide, and then cuts slots in the ends to match the PCB groove. The shunt now slides into the case and is securely held by the PCB groove.

The two relays were fitted next. These have heat sink plates built into them, so are held securely to the base with 4mm countersunk setscrews and nuts, with a smear of thermal paste to make good contact with the case, just in case they get warm. As the are well overrated for the task, this is unlikely.

Next in is the DC-DC converter, from up to 50V to 5v 3a. This is required to power the Arduino microprocessor, yet to be fitted in this photo.

Finally, a rectifying diode (two diodes with a common cathode) was attached to a piece of heatsink, which was attached to the case with a 2.5mm set screw, and a smear of thermal paste, but again this is well over specified for the task, so it is not likely to get warm. Its purpose is to take power from both batteries without allowing the batteries to discharge through each other, but provide a voltage to the power supply regardless of which battery is attached, or if both are attached, whichever has the highest voltage.

At this point it looks quite nice, almost elegant!

However …

High Voltage, high current wiring added

High Voltage, high current wiring added

the next step was to drill the end plate and install the 3 main high voltage, high current wires. These feed the two batteries into the device, and feed power to the motor controller. The bottom two wires are the battery wires. The ground wire from each of these goes to the same end of the shunt, crimped into high current eye connectors, and bolted down very securely to the shunt (M8 bolt!). The live wire from each does to the positive connection of a relay, one to each relay. Again, high current eye connectors under the retaining screw of the relay.

The negative side of the outputs from the relays are both connected to the single live wire of the cable which goes to the motor controller. You can just see the red wire between the two relay terminals. The ground wire from the motor controller goes to the other end of the shunt. The motor controller gets power from whichever relay is turned on at the time, and the relays ensure there is no possibility of one battery discharging through the other (so long as only one relay is on at a time). The power returns from the motor controller, and passes through the shunt back to the batteries. The minuscule resistance in the shunt causes an equally minuscule voltage drop between the two ends of the shunt (50mV at 100A – so 5mV at the usual 10 amp usage while the motor is running).

Still looks pretty good, eh?

Low current wiring added

Low current wiring added

So here we have added most of the low current wiring. First of all wires are run from the positive connections on the output of each relay to the anodes of the rectifier diode. The cathode of the diode is connected to the input of the DC-DC converter. The negative of the DC-DC converter is connected to the battery end of the shunt, which is used as the common ground for the whole device.

The output from the DC -DC is 5V up to 3A, which is connected via a micro USB cable to a SparkFun ProMicro arduino clone (from now on called the arduino). This is tiny (30mm by 17mm) and I am using it without header pins, soldering directly to the board. The arduino and all its connections are shrink wrapped in clear tubing, and mounted to the top of the relay with a piece of double sided foam tape. The ProMicro does not have mounting holes.

There are minimal connections into and out of the Arduino. Firstly there are two inputs, which allow the arduino sense the voltage of each of the two attached batteries. Wires are attached directly to the positive side of the relays again, and are attached eventually to the analog A0 and A1 pins of the arduino. However, the battery voltages are in the rage 33-41V, and cannot be connected directly to the arduino, which operates at 5V maximum. To drop the voltage voltage splitters are used, these are simple a pair of resistors, 390k ohms (r1) and 30k ohms (r2) connected in series between the +ve from the battery and earth. A take off is taken from between the r1 and r2, which is connected to the analog inputs of the arduino. The splitter formula is

Vout = Vin (r2/(r1+r2)

or in this vase Vout = Vin * 30,000 /(30,000+390,000)

which works out to Vin/14,  or 3V maximum with a 42V Vin.

The splitters are the lumpy red shrink wrapped wires running from the arduino up the side of the shunt.

The second set of connections  is the output from the arduino, which is through digital pins D6 and D7.

These are set to high or low depending on the programming of the arduino. In this case, every 150,000 milliseconds, the arduino tests the voltages of the two batteries, and sets one of the two pins to high, and after a 20mS delay, sets the other to low.

D6 and D7 are connected to the positive side of the input end of the relays (the end at the bottom of the pictures, the thin orange and yellow wires). The negative terminals of the relay are connected to the GND pins of the arduino board.

The net result is that the relay for whichever battery has the highest voltage is switched on, and 20mS later the other is switched off. The slight delay allows the relays to do their job, but the time is not enough for the batteries to do any damage.

The last connection is a wire between the negative of one of the relay inputs to the common ground on the shunt, which is just an extra safeguard to make sure the arduino is connected to the common ground directly, not just through the DC-DC converter.

OK, one final connection …

Completed wiring

Completed wiring

In this picture an output cable to the Power meter has been added. This has three connections.

First is a positive connection, which as this provides the voltage for the voltage part of the meter, is connected to the positive wire of the motor controller, where it attaches to the -Ve connection of the relay output!

Second is a connection to the common ground at the bottom end of the shunt. This acts as the GND for the meter, as well as one of the ammeter connections.

Thirdly, a wire is connected to top end of the shunt. This is the other ammeter connection.




Fortunately, the Yuba Mundo has stacks of room, and as many 5mm lugs welded in to the frame as you could possibly want.

I chose to install it in front of the back wheel, behind the bottom bracket. This meant for easy, short cable runs.

The case comes with T slots down the side of the case, you can see them on top of the device above, and in the end view photo at the top of this post.

I got some 1/8″ set screws, and filed one side of the head so that the screws slid into the T-Slots, and were held secure when the nuts were tightened on them. 6 of these bolts, three in each side of the case attach the case to a piece of 3mm aluminium plate, 40mm wide, and 200mm long. Mounting holes and brackets to fit lugs on the frame were added, and the whole device is securely and neatly mounted onto the frame of the bike. Wires from the two batteries connect easily to the device, and the wire from the motor controller plugs in to its wire. The power meter wire is threaded around the bike, and connected to the power meter which is on a bracket in the centre of the handlebars.

Power meter

Power meter

At this stage the power meter is not waterproof, so will be taken off when used in rain, and the device itself needs a bit of waterproofing also, which it will need sooner rather than later, as it is not easily removed.

More to come on first rides, development of the software, the worth of the power meter, and plans for a data logger using the spare capacity of the arduino.

Posted in Arduino, Computer Stuff, Dual Battery Management System, Electric Bikes, Programming, Yuba Mundo eV4

Counterfeit Laptop Power Supplies

A few months ago, I supplied a Dell charger and battery for an older laptop. Because I wanted to get them at the same time, with a single postage charge, and the battery was quite difficult to find, when I found a site that had both available, namely adaptershop.co.nz, I ordered them both. I realised this is a Chinese site with an NZ website  address, but I have had no difficulties with these types of suppliers in the past, especially when dealing with hard to get stuff.

All this started to wrong when they contacted me and told me that the battery was not available, would I like a full refund or to just get the charger. Being impatient, I decided to continue with the charger and just pay for it. I ordered the battery elsewhere.

When they both arrived, the customer brought back the loan charger I had supplied, and took the battery and charger away untested. A few weks later I got an email about the charger and battery not working, and another few weeks later, the laptop and charger was dropped off. Simple testing showed that the charger was providing some volts and amps, but was not being recognised as a Dell charger, so it was faulty in some way.

The new charger weighs significantly less than an original charger, but I thought that was down to new technology. A closer inspection of the labels shows that all the Dell trademarks etc look genuine, but the English on the label is terrible – Techogogy instead of Technology, Inddor instead of Indoor and some other spelling mistakes. See the photos above

So Adapter Shop Co,. Ltd as their invoice reads, is selling counterfeit Dell chargers as real ones. I doubt I will get any money back on this one, so a lesson has been learned.

Posted in Computer Stuff, Other Technology

EBikes – Dual Battery Management System

The only commercial developer of dual battery electric bikes I have seen to date is Bosch, who do an optional Dual Battery kit, which one or two manufacturers have taken up. Being proprietary technology, there is not a lot out there about it. The only two things I can glean are:

1. The real technology is in the Bosch controller, which manages use of the battery, charging and showing information about the batteries on the dashboard. This means it cannot be retrofitted to an earlier Bosch system yet.

2. It doesn’t connect the batteries in parallel, it switches to a battery and uses 10% of power, then switches to the other battery and uses 10% and repeats. This is designed to make sure a battery does not get too “tired” and can recover somewhat before being used again. This will extend the short term range of the two batteries, apparently more than doubling the range of a single battery, and presumably will also extend the life of the cells in the batteries.

This is great, but I cannot afford a bike with a Bosch system, especially as I have only just built my latest Bafang based bike.

Why do I want dual batteries? Firstly, the 13Ah battery supplied with the kit, while only 2 Ah less than the self build Headway battery I was using, is getting a bit frustrating, and secondly I have an excellent 36v 12 cell 15Ah LiFePO4 headway cell battery sitting on a bench not doing much. I could re-purpose the cells, but being able to use them to increase my bike from 430Wh to 1008Wh is quite attractive. These two batteries are an interesting combination. The 13aH Lekkie, is made from 18650 (18mm diameter by 65mm long) cells, some sort of LiPo (Lithium Polymer) probably, each cell being about 3.3 to 3.9 volts. 4 or 5 are grouped in parallel to give the 13 Ah and 10 groups connected in series to give the nominal 36v. The other is made of 40152 Headway cells (40mm by 152mm), each 15Ah, with a voltage range of 3.0 to 3.6v. 12 are connected in parallel to give the 36v nominal. The former weighs 3Kg and sits very neatly on the downtube, the latter is 8Kg and sits in a pair of plastic panniers on the rear rack! http://www.signsofsuccess.co.nz/batteries/ and http://www.signsofsuccess.co.nz/electric-bikes-back-again/

So what do I want this dual battery system to do?

1. I want both batteries to be physically attached for the whole ride, no stopping to physically swap cables etc.

2. I want the system to automatically swap the connection from one battery to another on the fly – no loss of power, no stopping to flick a switch etc. This means it will need to “make before break” – connect the next battery, and when connected, disconnect the previous battery so that it can rest. If a batteries voltage is less than the battery currently in use, the system will stay with the current battery.

3. It must cope with only one battery being connected at a time, or both.

4. There must be no connection between the two batteries while in use, other than the momentary “make before break”, so that the batteries do not attempt to equalize their states of charge.

5. The system shall be self powered by one or other of the attached batteries, no extra connection or battery will be necessary. Battery equalization through this power supply is to be avoided.

6. This is a development platform, the battery swap time, the delay between make and break and the swap algorithm should be easily reprogrammed.

7. It should look good on the bike, and be completely weatherproof, using the Lekkie/Bafang weatherproof connectors used to connect the motor and battery on a standard system.

8. Reverting back to a single battery should be easy and free – no damage to existing components.

How do I propose to achieve all this?

For the working prototype I have the following ideas.

  1. Obviously some reasonably simple control is required, I will use an Arduino micro processor to run a simple C program. I have experience of C on the Arduino, I have two development platforms I can develop and test the components on, and tiny versions are available which take up very little room, yet do everything I need them to do.
  2. Arduino devices run on 5v (or 3.3v) power, and this can be supplied directly to the board via the headers, or can be supplied via a micro USB  plug. To run this off the bike batteries I will need two things. The first is a DC-DC voltage converter, with an input voltage that can cope with a variety of batteries in various states of charge (12s – 41v to  33v, other batteries up to 60v). These converters are readily available. The second is a pair of diodes (or a single diode with two cathodes) so that both batteries can be connected to the input of the voltage converter, without the higher voltage battery trying to charge the lower voltage battery. I have a diode rated at up to 100v (60v RMS) and runs at 20A, with a 150A surge, which should cover all bases!
  3. The Arduino program will use two digital output pins to control two solid state relays (SSR). These SSRs optically isolate the high voltage circuit from the low voltage circuit allowing the relays to be used on the battery positives. They also stop any back flow from one battery to another. Other solutions using MOSFETs have issues with common grounds etc. In addition, the SSRs come ready built, just plug and play. I am using 100v 40 amp relays, to give a bit of leeway (maximum voltage should be about 42V, maximum current should be about 18A).
  4. In order for the Arduino to measure the state of charge of each battery, analog pins on the Arduino will be connected to the positives of each battery. Arduino analog pins have a maximum voltage of 5V, so voltage splitters will be added to reduce the voltage to under 5v, I will be using an 11 to 1 ratio between input and output, so 44v will be reduced to 4v for the Arduino.
  5. The program on the Arduino is quite simple (at the moment). Every 5 or 10 minutes (to be decided) the program will read the voltage of both inputs, and whichever has the highest value will be connected as the next battery, and after a short pause for the relay to do its work (10ms) the previous battery will be disconnected. If a battery is faulty or not connected, the voltage test will ensure that only the working or attached battery will be selected. 10% of usage on my batteries is between 7 and 9 minutes, so a simple timer will have a similar effect to using power meters to decide when to swap. Because the unit will have no switch, it will activate as soon a the first battery is attached, and that battery will be the selected battery. An initial pause of 30 seconds before the first automatic switch will allow both batteries to be connected, and the highest voltage battery to be used.
    // global variables
    //debug variable
    //#define debug 1
    //relay output pins
    const int r1Pin = 7 ;
    const int r2Pin = 6 ;
    //battery analog voltage pins
    const int b1Input = 0;
    const int b2Input = 1;
    //duration between switches
    const int duration = 450000;
    const int waitforbattery = 30000;
    //overlap for make before break
    const int overlap = 20;
    //constant to convert sensor to voltage
    // ((max voltage) / (resolution of analogread) ) * (voltage splitter factor)
    // (5.0/1024.0) * 11.0
    const float voltConv = 0.053711;
    //float variables
    float voltageB1;
    float voltageB2;

    void setup() {
    #ifdef debug
    //set relap pins to output
    pinMode(r1Pin, OUTPUT);
    pinMode(r2Pin, OUTPUT);
    //switch on a battery temporarily until both batteries are plugged in
    //wait 30 seconds for second battery to switched on or plugged in
    delay (waitforbattery);
    void loop() {
    //switch to better battery
    //wait a while before switching again
    delay (duration);

    void togglebattery() {
    // read analog battery sensor values and convert to voltage
    voltageB1 = analogRead(b1Input) * voltConv;
    voltageB2 = analogRead(b2Input) * voltConv;
    #ifdef debug
    // if battery one voltage higher than battery two
    // switch battery one on and switch two off after small delay
    if (voltageB1 > voltageB2) {
    digitalWrite (r1Pin, 1);
    delay (overlap);
    digitalWrite (r2Pin, 0);
    //else switch battery two on and battery one off
    else {
    digitalWrite (r2Pin, 1);
    delay (overlap);
    digitalWrite (r1Pin, 0);

  6. For a weatherproof case, I have a few spare controllers for use with Bafang rear or front wheel motors, one or two of which are not particularly useful. They do have excellent silicon gaskets to provide full weatherproofing, and are also aluminium extrusion which is designed to act as a heat sink for any hot components attached inside. As both relays and the rectifier diode being used on the power converted are designed to be attached to heat sinks, this saves me having to make anything else up. Matching up sizes of components and the case, all components should just fit into the case. The case has mounting points for easy attachment to the bike.
  7. The power converter will be plugged into the Arduino board via a USB plug. This will be easily reached just inside one of the end plates of the aluminium case. If I want to reprogram the Arduino, I can attach a programming cable to the same port, and update the code as required.
  8. I have purchased two Lekkie battery extension cables. This gives me two of each type of connector. The input to the DBMS will be two battery sockets, as found on the Lekkie/Bafang motor, the batteries will plug into these sockets. The output will be a single battery plug, as found on the Lekkie battery that came with the kit, this will plug into the Bafang motor instead of the single battery. This leaves me with a single battery plug, which I will attach via an adapter to the XT90 connector currently on my self built headway battery. At $16 for each cable, these provide a standard connection method, so adding or changing batteries later is easy, and the connections are waterproof.

Early days yet, most parts are ordered, a small circuit board for the power supply diodes and the voltage splitters has been built.


Posted in Arduino, Dual Battery Management System, Electric Bikes, Programming, Yuba Mundo eV4

Anatomy of a scam

This post may take a few days, so keep coming back!

Some background first. I repair computers, and a few customers (3 or 4) have been hit by the “Windows Corporation” scam, where someone thief rings up with a very Indian accent, but with a very English name, claiming to be from the Windows Corporation, or Microsoft, and tells the victim that their PC has been infected with malware and is busy infecting others and other bad things. Most people are not taken in by this but some customers get confused, maybe they have just seen an adware or malware message on their PC, or have just changed email addresses, or are not well at the time, and they are taken in to some extent. Most don’t actually pay these thieves any money, claiming to not have a credit card and are housebound etc. But by the time they get to this stage, the damage has been done. Next time they log on, the system asks for a Startup Password, which they of course don’t know. Soon after they get the second call from the thieves telling them what has happened and how much they have to pay. Fortunately for some, they call me rather than pay the thieves. I have a couple of effective solutions to unlocking the ransomed PCs in this case, and it normally takes just 30 minutes to undo the damage.

Strangely, I am also on every single list there is for these people, and I get several phone calls a week from similar callers. Because my home phone is forwarded to my cellphone, I can ignore them most of the time, but occasionally I get to the home phone in time and field the call. At first I called them names, or led them on and then told them they were stupid and hung up, but more recently I have decided to find out more about the scam and have been actively using the calls to get more information. It takes a good 30 minutes of my time, but some days I can spare it! To this end I have a “disposable” PC set up with nothing on it, which has no access to the rest of my network.

So, how do these calls go?

The opening blurb is much the same, introduces themselves with an English name (Jack Dawson was the latest, and the technician was Will Harris or something similar). They tell me that my PC has been monitored and has malware infections and has been doing all sorts of things, all of which  are bad. This is designed to scare and confuse.

I am told to get to a PC and switch it on, and pestered until I say it is on. In the meantime, they are asking questions about who uses the computer, how old it is, and whether I use it for secure applications, such as banking, shopping etc.

When the computer is going, they ask which key is at the bottom left of the keyboard, and then which key is next to it. They are obviously finding out if the keyboard has a windows key, but depending on the answers could be gauging the level of knowledge of the victim.

When answering these questions I have been a bit silly in the past, if I want to trap these people better, I need to pretend I know nothing about computers, but that I do internet banking with three banks, manage my stock portfolio and keep my bitcoin wallet on there!

Any way, once they know the keyboard layout, the fear and confusion continues. I am told to press the Windows key and hold it, then press the “r” key, and am asked what I see on the screen now. What you see of course is the run dialog box, and I am then asked whether the box on it is empty.

The thief then asks you to type in, one letter at a time (e for elephant, v for victor, e for elephant again etc) the word “eventvrw’, and as with all steps below, I am asked what I see now.

From here I am told to click on Custom Views in the left pane, then Administrative Events in the middle pane, and am asked what I see, which of course is red exclamation marks and yellow warning triangles with hundreds of errors. When I admit I don’t know what these are, they are described in gory detail as errors caused by all the bad software on my PC, and how only they can fix it. This spiel can take many minutes!

So having agreed that this is very bad and should be fixed, the thief offers to fix them for me. OK says I, let’s do it!

So, Windows R again, and www.1234computer.com in the white box. I have complained to the powers that be about this website, so it may be something different when you get your call! Of course this starts up a web browser with a quite sophisticated web page on it, very little of which actually works. At the bottom of the page are four flashing buttons labelled Server One, Two, Three and Four. Clicking on Server One starts a download of Teamviewer. All this is done while comforting words about how normal all this is and how it will help get rid of the malware.

Teamviewer is a legitimate application, which is used to give people you trust access to your computer, so that they can fix errors on it etc. Some computer technicians use this a lot rather than travel to customers sites. Personally, I like the personal interaction occasionally. However, when thieves and scoundrels get access to it, they can do so much bad stuff to your PC.

The other three buttons are links to alternatives to Teamviewer, like Supremo, ShowMyPc and AnyDesk. Other web pages such as AMMY.COM carry the same links.

So OK and download are clicked as requested, and TeamViewer downloads, installs and runs for the first time all with no further intervention. After describing what I see, it is explained that I am going to give their technician access to my computer.

This is the clever bit, I thought they would ask for the partner ID and password that is shown on the left of the TeamViewer screen, but what they actually do is give the victim the Partner ID and password generated on their technicians PC by team viewer. Now this would normally give me control of their computer, but a menu appears at the top of the screen, and I have to select/click the “Switch sides” button, which then gives them access to my desktop. At this point I am handed over to a technician on the phone.

The technician starts by repeating the eventvrw demonstration, adding the technical confusion to what the first guy said. He then uses Windows R and types in “inf”. This displays the contents of the /windows/system32/inf directory, which I never seen before. He then asks if I recognize any of these folders and files, to which I answer, honestly for the first time, “No”. Finally, he gets up a list of services, and explains that some of these services are stopped. Yes, I agreed. He then asks me to scroll down and see how many there are. I declined, saying I believed him, but then he came over all “school teacher”ish, and insisted I scroll down through the list and counted them one by one out loud! I gave him a not so small piece of my mind about what I thought he could do with that idea, which he accepted and moved on from.

Now, while continuing to talk about malware, stopped services etc. once again I saw the run dialog appear, and the word syskey typed in. Syskey would normally allow him to encrypt a very important part of the file system, and add a password to the encryption so that the computer will not start without the password. Unfortunately for him, I recently upgraded this PC to the very latest version of Windows 10 – the Fall Creators update, aka 1709. 1709 has many improvements, but an interesting one is that SYSKEY no longer works on this version of windows! I watched him try a few more times in obvious confusion.

In the meantime, the voice changed again, and I started to get the hard sell, that they would repair and maintain my PC for a payment of just $400 odd dollars, and how would I like to pay. I was going to go through the process and pull out at the last minute of give false credit card details when I realised I would be wasting my time, because they had no leverage over me (they could not hold my computer to ransom) they would just give up and not ring back. So I switched off the router and hung up before they got malicious and started deleting files etc.

So the anatomy of a scam is not complete, I need to take it to the point where they think they can ransom my PC, i.e where SYSKEY was successful.

I have two options, firstly I just finished building a Windows 7 Pro pc up from a cast off by a local business, and I could sacrifice that, allowing them to really use SYSKEY and lock it up. I would have no problems unlocking it.

Secondly and much more fun, I have developed a Windows application that exactly mimics the windows and navigation flow of the SYSKEY application. This took a few hours of development, it is just two screens and a couple of message dialogs, with radio buttons and buttons to navigate by. The main difference is that instead of encrypting the SAM hive file and adding a start up password, it just records the password on a text file. There is no real indication that it is not the real thing.

This program has been compiled into an .exe file, and it is just placed into the c:/windows/system32 folder, and it will run just like the real thing. Download a copy of the fake syskey in zip format here. Of course you could use this to replace the real syskey on any computer, just back up the original and replace it with the fake. You will need a folder c:\secret to store the password file in, otherwise the program will fail with a suspicious error message. Test it before you use it for real, to make sure it is allowed to run by windows, but set the password to spaces before letting a scammer loose on your PC.

This program displays the password if you need to demonstrate it to a scammer, all in the spirit of good fun of course. I leave it on the desktop, if no password exists it doesn’t do much, if one does exist it shows it.

So now I am just waiting for the next call!

I watched a video recently about scam baiting (one of thousands out there), and I am pretty certain it was the same guy as I dealt with, same script delivered in the same way, same web site, and the same method of using Teamviewer. The scambaiter didn’t click on the switch sides button, instead he clicked on actions/disable remote input, then attempted a syskey on the scammer. The scammer was immediately suspicious and disconnected the connection to his computer pretty quickly (I would switch the router off – by far the quickest option). I just tried it on my workshop machines, and if you worked really quickly you might just get away with it, the trick is to say the right things while you are doing it, the scammer can’t see what you are doing, but neither can he move his mouse or use his keyboard. Maybe something along the lines of “Hey, my Teamviewer has locked up, how about yours?”. Maybe I will try that in subsequent calls, or maybe after they have attempted a syskey on me!

Posted in Computer Stuff, Windows 10

Onion Omega – next steps

I have made some serious changes to the PHP web page which servers up the door controls and web cam images, so I decided to finally get FTP access to the files on the Omega. The arrival of my second Omega made this even more relevant!

Wirelessly access and edit the files on your Omega using the SFTP protocol

1. setup the Omega to accept incoming SFTP connection requests. To start, edit /etc/opkg/distfeeds.conf, and find the line below:

## src/gz reboot_packages http://downloads.lede-project.org/snapshots/packages/mipsel_24kc/packages

Remove the two # signs and the whitespace at the beginning so it looks like this:

src/gz reboot_packages http://downloads.lede-project.org/snapshots/packages/mipsel_24kc/packages

2. Ensure your Omega is connected to your WiFi network, then connect to the command line and run the following commands:

opkg update
opkg install openssh-sftp-server

3. Reboot the Onion Omega just to make sure.

4. Start your chosen FTP client (since FireFTP stopped working, I have moved back to FileZilla), and set up the IP address (either Omega-xxxx.local, or your permanent IP address on your network, set up the user name and pssword, and the port 22.

With this set up properly, I am now able to keep backups of my php and python files on my PC, and edit them using Notepad++. The console on the Omega is a bit too flakey to use reliably, and nano on the putty terminal was starting to get tiring!

I also received another Omega2+ and a Mini Dock a couple of days ago, and I am using it to replace a Raspberry Pi I am using to run a second web cam which I use to view the driveway outside my new solid garage doors!

You would thing a simple thing like this, which is just a subset of the previous Omega setup would be relatively easy by now, but it seems that nothing is easy with an Omega. I thought I must have done something pretty serious to my last one during set up, as eventually I had to restore to factory settings using a USB stick with the latest Mega operating system on it. But no, I carefully went through my setup as detailed below, and when I set up the fixed IP address my modifying the network config file, suddenlt I lsot my wifi connection through the internet, and no amount of reverting, copying from other devices etc could get it working again. I tried many times and methods to revert to factory settings, pressing the reset button for 10 seconds, logging on and using command line stuff, connecting serially. I eventually got to the point where I was trying to reset to factory using the USB stick, but this failed repeatedly also, despite working fine on the last Omega.

Eventually something happened (sorry can’t be more specific – I don’t think I did anything, except possibly leaving it alone for a couple of hours) and it went back to factory and allowed me to set it up from scratch. As per the first time through, and the previous Omega, things like the Editor did not work properly, and still doesn’t. The only thing I am getting is an error message about corrupted Time Zone databases when I try to use the date functions in PHP.

Anyway the steps I took are:-

  1. Set up out of the box, connecting to my home network.
  2. Change passwords for root and AP wifi access. Set up timezone.
  3. Logon using Putty to omega-xxxx.local.
  4. Install Nano
  5. Edit the /etc/config/network file to set up a fixed IP address
  6. Install PHP
  7. Install MJPG-Streamer and set up new camera by editing /etc/config/mjpg-streamer
  8. Set up access for SFTP client (see top of this post) and set up Filezilla.
  9. Modify and upload an index.php file that allows me to view the attached web cam, and also the webcam attached to the first omega.
  10. set up JuiceSSH on my phone to allow me to edit files etc from my armchair!
  11. Finally, in order to get the camera out of the way and out of the sun, I mounted it at the top of the window rather than the bottom, which meant it was mounted upside down. Unfortunately MJPG-Streamerdoes not appear to have the option to rotate the image, so I had to modify the pages that stream this webcam to rotate the image.  This page has a good write up and CSS code to do it.

The secondhand Logitech VUCR45 webcam I picked up from our local cash converters for $12 is great, it has exposure control, so it doesn’t burn out the image at midday, and in the evening the street lamp allows some visibility on the road and driveway. Much better than the old DSE camera I was using before.

Both omegas are a little slow when either or both webcams are in use, sometimes they are prettty much in sync, other times they can lag by seconds. More work is needed in this area.


Posted in Computer Stuff, Onion Omega - Internet of Things

Business Directories – unsolicited entries

I seem to be getting a number of requests by phone and email to confirm details for an entry on yet another internet business directory.

I fell for this as the start, adding myself to a couple of directories, at the time they were respectable and small business advisers advised “claiming” your listing. Since then, they have continued to nag me to upgrade, pay for better listings, look at my viewing figures (which are usually zero). I feel sorry for the people who work for these organisations, so I quietly ignore them.

However it is now getting ridiculous, every man and his extraterrestrial alien (the last one I dealt with was called Kang – I kid you not) thinks that they can set up a business search directory by stealing entries from other directories, asking you to claim you entry, and then asking you to buy a better entry the colour of some precious metal, with a similar cost!

These entries are inevitably wrong, having been filched from another incorrect, out of date directory. In order to correct them you have to claim them and then change the details. What you end up with is a mass of incorrect entries on little used business directories, or with dozens of directory entries to remember logins and passwords for, to maintain details for, and pay for if you are daft enough to be taken in. Fortunately, I have never, ever received any enquiries from customers through any of these directories, so I don’t worry too much either way.

Then there are the cold callers claiming to be from some directory or other asking “can we just confirm your email address/postal address”. When I have clarified who they are, I mention that I don’t remember requesting and entry in their directory, and they ring off pretty quick. I suspect some other sort of scam, but I would have to confirm the details to get any further into the conversation, which I am not prepared to do.

With the latest email attempt, I have decided to see if I can get the entry removed, as I didn’t request it. So I used the Help button, which brought up a page where I could ask a question of the company. The form was prepopulated with my email address and name, so I assumed they would know who I was  when I asked how I could get the entry removed. I then received an email, asking me for my email address and my company name! I have just received another email telling me the entry has been removed. I shall check later.

Posted in Computer Stuff, Uncategorized

Yuba – display woes

After just a couple of hundred kilometres, the main display unit described below stopped working correctly. It bega with it occasionally not switching on first time, needing a repeat try, and this gradually got worse until it was taking 6 or 7 tries to get it switched on. Eventually it reached the point where it would just not start most of the time. In amongst this, occasionally it would start with psychedelic patterns on the screen multi coloured bars and stripes flickering, and only a full power down would fix it.
I checked the switch unit (which is just that inside – no electronics). I used a multimeter across the contacts, all was good.
Contacted the supplier, PSPower, who wanted me to pay postage back to china, lie about the worth of the device, pay any tax they were changed by customs, and pay a US$20 postage and packaging to have it returned. For this they would send it to the factory to have it repaired. I have never been really happy with PSPower’s service, even when they were E-Life Bikes, so may not be using them again.
Fortunately the display that came with the Leckie kit still works fine, so am going with slightly less bling and features for now!
Shame, I really liked that display!

Posted in Electric Bikes, Yuba Mundo eV4

Garage Door Opener – a tinier computer project

Despite the issues with bricking the device and it recovering itself in a random state, I decided to go with what I had rather than risk bricking it again. This caused a few issues, but I can live with them. Below are the steps and some notes about how things went.In the picture below is the complete Raspberry Pi installation, below it the compete Omega installation.

Omega v Pi

Omega v Pi

Set up steps

  1. Unbox and plug in. Lovely packaging, shame to take it out really! I used a stanndard Micro USB cable plugged in to an office PC with a wifi connection. You have to use another computer with a wifi connection,
  2. Connect the computer you are using to the new wifi network that has appeared in your list, in my case it was called Omega-48CD. The 48CD part is the last 4 characters of the MAC address. The default password is 12345678. The Omega is acting as an access point (AP).
  3. Use a browser to log on to http://omega-48cd.local. The Omega set up wizard will start, and you can go through the set up process – login, wifi, update software, install console and latest firwmare updates.
  4. When Omega is rebooted, use a browser to go to http://omega-48cd.local again and log in to  console using “root” and “onioneer”. In general settings, change the password for “root”, change access point password, check for firmware upgrade again.
  5. In order to install all the software I required to create the Garage Door opener, I was probably going to need more than 32MB of storage. I bought the Omega 2+ because it had a built in Micro SD card slot, which can be used to extend the onboard storage.
    I have a 4GB Micro SD card which seemed ideal, so I put it into the Omega 2+, and changed system to boot from it. Full details can be found here on the Onion Omega 2 Documentation pages Make sure you follow the instructions exactly, especially when changing the config file, a mistake in the overlay line just stops it working.
  6. I am a PHP programmer, not a python programmer, so I want to use PHP to process my web pages. In fact, I intended to use exactly the same code as I used on the PI wherever I could. I needed to install PHP as detailed in the documentation pages. I don’t need to install a web server, as the Omega comes with its own light weght one installed.
  7. I like to use Nano (OK I dislike using Vi or Vim – I haven’t had a pony tail for many years now) so I installed the Nano text editor using
    opkg update
    opkg install nano
  8. Much as I want to use PHP, somethings have to be done in Python or C. I dislike C more than Python, so I used this page to install python light. No need for the full version, the sole use is for the relay expansion.
  9. In order to control the relays on the relay board, I needed to install the relay expansion python module. This is a Python script which may use a C program, and it delivers functions to initiate the relays, and to set them on and off. These can be called in small python scripts I have to write, which in turn will be called from my PHP code.
  10. change ip address to static by editing /etc/config/network with (my settings  – use your own based on your router). The last line seems quite important, I didn’t need it on the PI changes, but the Omega won’t work without it.
    config interface 'wwan'
    option proto 'static'
    option hostname 'Omega-48CD'
    option ipaddr ''
    option netmask ''
    option gateway ''
    option dns ''

    And maybe restart the network using /etc/init.d/network restart and the DNS thingy using /etc/init.d/dnsmasq restart
  11. The Omega is set up to use webcams virtually out of the box using the MJPG Streamer package. This a little basic, but seems to work very well. Just plug in the camera and set up config file. I used a Logitech C525 or similar (looks a lot like one) that a customer recycled through my business. The Omega can handle really high quality video, so I set it to its proper resolution (1280 by 720) with a frame rate of 30 and quality of 80%. This is done in /etc/config/mjpg-streamer. The camera can be tested in the console, and from that test you can get the code needed to stream the camera in the web page. In my case it was
    <img src= ""/>

    where is the fixed IP address set up above, and 8080 is the port allocated in the /etc/config/mjpg-streamer.
    I had an issue with starting the streamer, this code automatically starts the streamer at start up. /etc/init.d/mjpg-streamer enable
    Full details of streaming over wifi are here
    The camera and the Omega work really well together, and seem to cope with low light a lot better.
  12. Set up python scripts to flick relays on and off. These are based on the routines I set up for use on the PI, but the functions called are a little different. The lines in red check to see if the relays are initialised, and if they aren’t, initialises them The code in blue sets the channel zero relay on, then 0.2 seconds later, sets it off.
    The addr value of 7 is the hardware address of the relay board. If I added more relay boards, each would need a different address. A similar script does the same for the channel one relay.

    '''**************************************************************************** $
    Pulse relay number 1 for 0.2 seconds
    By dave Glover
    ******************************************************************************* $
    from OmegaExpansion import relayExp
    import sys
    import time
    addr = 7
    ret = relayExp.checkInit(addr)
    if (ret != 1):

    ret = relayExp.driverInit(addr)

    print "checking if initialized: ", ret
    ret = relayExp.setChannel(addr, 0, 1)

    ret = relayExp.setChannel(addr, 0, 0)
  13. As mentioned above, I used the PHP script to generate the web page that I created for the Raspberry Pi version, This needed very little modification. Below is the PHP portion of the code, with the changed lines highlighted. Executing the Python scripts in PHP is much easier, no need to use Sudo, and no need to give the PHP program god rights to use Sudo without a password! The video live stream is discussed above.
     exec('python /www/omegarelay/relay_flick_1.py');
     echo '<div class="notification">North door activated</div>';
     else if(isset($_GET['s'])){
     exec('python /www/omegarelay/relay_flick_2.py');
     echo '<div class="notification">South door activated</div>';
     echo '<div class="notification">Waiting for input</div>';
     else {
     echo '<div class="notification">Live video stream</div>';
     echo '<img src= ""/>';
  14. With it all set and tested on the bench, the Omega was attached to a 4 pin socket for the relay connection, a wifi antenna was attached just to make sure, and the camera on the ceiling was changed to the new Logitech camera, and connected to the Omega. Power was applied, and the new Omega garage door opener was up and running.A step by step, feature by feature comparison with the Raspberry PI will follow. First impressions are that they are fairly evenly matched, with specific difficulties and features in each device.

Screen shot with new camera on Omega 2+

Posted in Computer Stuff, Onion Omega - Internet of Things, Programming, Raspberry Pi