~~META:
title=Parkwächter disassembly and investigation
description=Disassembly and investigate Parkwächter electronic Parkscheibe parking disc
keywords=disassembly, Parkwaechter, Parkwächter, elektonische Parkscheibe, electronic, parking, disc, disk, clock disc, investigation
~~

====== ⚠️UNDER CONSTRUCTION!⚠️⚠ ====== 

====== Parkwächter disassembly and investigation ======

In Germany it is allowed to use electronic parking discs if it has an E24 number. \\ 
As the plastic casing has melted in summer (they use thermoplastics, d'oh!), I did not even have to open it, it literally opened itself. I assumed there would be an ASIC inside, but be astonished and read on! \\
Althogh it is a parking disc for the German market, I still like to do my write-ups in english. Use [[https://translate.google.com/translate?hl=en&sl=auto&tl=de&u=https://super-se.de/dokuwiki/disassembled_devices:parkwaechter|Google Translate]] if you want.


===== Info =====

⚠⚠️WARNING: messing with certified electronics is prohibited! Do not alter hard- or software - it is illegal. Just don't do it. \\
This is for educational purposes only! \\


===== Pictures =====


===== Hardware =====

The device consists of two LCDs (one big in the front, another in the back), controlled by a TI **MSP430** MCU. Motion is detected by an accelerometer (labeled XXX). \\
There is a switch for changing from 15mins interval to 30mins and some buttons on the back to set the time on the rear LCD. Additionally, there is a LED . \\
Everything is powered by CR24 battery, which has already lasted for 1 year and is still going (I admit, I don't go much by car. Better ride your bicycle too!:). \\

Surprisingly there is also a pin header socket with silkscreen labeling (nice!). \\ 
What's ugly is the soldering tin junk splattered on the PCB next to the front LCD joints. \\
It is really ignorant to use thermoplastics for the case which sits right behind the windshield frizzling in the sun. The four magnets are there to hold a blue plastic plate which is stuck to the windshield - you cannot see it in the pictures as it is still inside the car. \\

==== Pinout ====
The silkscreen labels of pin header read: \\

<insert table>\\

=== MSP430 Pinout ===

The GPIO-Pins of MSP430 are the following: \\
<insert table>\\

LCD front and back pinout \\

#TODO. Pinout part is still missing. \\
===== Lauchpad programmer =====
We want to connect a debugger to connect to the pin header of MSP430. I used a Lauchpad programmer dev-board collecting dust. \\

<insert picture> \\


==== Output ====

When connecting, we get the following initial output: \\
<hidden Show ouput>
<code>
output
</code>
</hidden>

==== Dumping ====
The lock bits are set to:\\
<code>
output
</code>

Glitching?\\
Dump\\

==== Accelerometer ====
The Accelerometer comes in IC package -16. \\


<insert picture>
Its markings are:\\
<insert marking text> \\

When sending I2C "WHO_AM_I" request, we get: \\
<code>
ID
</code>