KHG DIY or Alternative Reagent

Jposch

Active Member
View Badges
Joined
Sep 17, 2015
Messages
241
Reaction score
196
Rating - 0%
0   0   0
Which firmware are you using and which KHG model do you have?
The one you did (009?) Is the newest wirh the most features and without the authenticating. Now, the older models didn't have the sensor, so while not as precise, you can enjoy the newer features and still use diy.
All this fooling around, and I'm keeping an eye on the Kamoer kh carer, and rhe new announced multi-parameter tester. Alk, ca,mag,N&P. Hopefully it turns out to be good.
 

Jposch

Active Member
View Badges
Joined
Sep 17, 2015
Messages
241
Reaction score
196
Rating - 0%
0   0   0
10ml hcl per 1 gallon, 3785ml/gallon of acid. A gallon lasts me well over a month testing every 90 minutes.
 

Nate Chalk

7500 Club Member
View Badges
Joined
Nov 15, 2018
Messages
9,602
Reaction score
30,471
Location
no
Rating - 0%
0   0   0
I think I'll make this jump with you guys.

Does anyone have a tutorial on how to make the downgrade?

I just re read through and I was on it early 2019 when I got my unit. And when this thread was starting. I never came back :eek:
 

coralbeauties

Valuable Member
View Badges
Joined
May 6, 2014
Messages
1,105
Reaction score
910
Location
Yellow Springs ohio
Rating - 100%
3   0   0
Which firmware are you using and which KHG model do you have?
I actually have two of them. My original one is just a monitor unit running 9.16x and my second one is running 9.3r31. My old one needs repaired now and was planning on sending it to Alex for service but am concerned a firmware update will keep me from using my own reagent.
thanks for any advise
Jeff
 

Nate Chalk

7500 Club Member
View Badges
Joined
Nov 15, 2018
Messages
9,602
Reaction score
30,471
Location
no
Rating - 0%
0   0   0
Rewording my question.

Does someone have a step by step guide for dummies on how to roll back the software version?

I think I understand the reagent recipe.
 

Jposch

Active Member
View Badges
Joined
Sep 17, 2015
Messages
241
Reaction score
196
Rating - 0%
0   0   0
I actually have two of them. My original one is just a monitor unit running 9.16x and my second one is running 9.3r31. My old one needs repaired now and was planning on sending it to Alex for service but am concerned a firmware update will keep me from using my own reagent.
thanks for any advise
Jeff
Why not do service yourself?
 

gbroadbridge

2500 Club Member
View Badges
Joined
Mar 25, 2021
Messages
4,573
Reaction score
4,843
Location
Sydney, Australia
Rating - 0%
0   0   0
Do we have the math on savings by using diy reagent vs just buying from Alex?
Hanna HI70464 1.0N reagent grade HCl costs $US 32.00

It will make 50 litres of KHK reagent.

Is that what you mean?

It can be much cheaper again, if you use a commercial swimming pool muriatic acid.
 

coralbeauties

Valuable Member
View Badges
Joined
May 6, 2014
Messages
1,105
Reaction score
910
Location
Yellow Springs ohio
Rating - 100%
3   0   0
Why not do service yourself?
I have done all the upgrades my self over the years. I contacted Alex and he said he just charges for the parts that were needed so I figured what the heck. I dont know about everyones khg but I test my alk with my red sea kit every other week or so and most of the time I need to reset the reference and I sure would never trust mine to dose alk. I mainly use mine to watch trends for something going wrong.
 

Nate Chalk

7500 Club Member
View Badges
Joined
Nov 15, 2018
Messages
9,602
Reaction score
30,471
Location
no
Rating - 0%
0   0   0
Hanna HI70464 1.0N reagent grade HCl costs $US 32.00

It will make 50 litres of KHK reagent.

Is that what you mean?

It can be much cheaper again, if you use a commercial swimming pool muriatic acid.
Right I have that down. How do I install the previous version without bricking my unit?
 

Randy Holmes-Farley

Reef Chemist
View Badges
Joined
Sep 5, 2014
Messages
72,100
Reaction score
69,741
Location
Massachusetts, United States
Rating - 0%
0   0   0
What is the consensus on how the unit knows if you diy the reagent?

Fixing the diy reagent to match may be a better long term choice than downgrading the unit, although I understand it carries risks testing diy reagents.
 

DanyL

Valuable Member
View Badges
Joined
Jan 13, 2023
Messages
1,477
Reaction score
1,738
Location
Middle East
Rating - 0%
0   0   0
A more proper solution IMO would be to patch this check in firmware and be able to reset the lock itself if it has been set.
This would be a software-only solution.

But with the ability to properly debug the device - we can also reverse the check itself and in turn able to expose the expected values they measure and replicate it by adjusting the reagent itself.
 

Randy Holmes-Farley

Reef Chemist
View Badges
Joined
Sep 5, 2014
Messages
72,100
Reaction score
69,741
Location
Massachusetts, United States
Rating - 0%
0   0   0
A more proper solution IMO would be to patch this check in firmware and be able to reset the lock itself if it has been set.
This would be a software-only solution.

But with the ability to properly debug the device - we can also reverse the check itself and in turn able to expose the expected values they measure and replicate it by adjusting the reagent itself.

Is that a doable thing in this circumstance?
 

DanyL

Valuable Member
View Badges
Joined
Jan 13, 2023
Messages
1,477
Reaction score
1,738
Location
Middle East
Rating - 0%
0   0   0
Is that a doable thing in this circumstance?
Reverse engineering software is time intensive, can be frustrating, but it is doable.

That being said, once the ground work is done and you have a good familiarity with how the firmware was implemented - it is fairly easy to modify the control flow to bypass checks like this, accessing both volatile and persistent memory values (full read/write), and even adding your own additional logic to the code.

This is how most 3rd party software modifications are being done to game consoles, phones, etc.
 

DanyL

Valuable Member
View Badges
Joined
Jan 13, 2023
Messages
1,477
Reaction score
1,738
Location
Middle East
Rating - 0%
0   0   0
Had to dig around my old things to find this,
but here's an example of a payload I injected a while ago into a dosing pump made by Jebao that had a bug where it'd fail to properly load settings after power cycling.

Screen Shot 2024-01-01 at 18.37.45.png


This payload was used mainly to debug the problem itself, and once I figured out what was going on, I was able to develop a patch for it to permanently fix their own bug, which eventually required just a small modification of 2 function calls (marked in red is the actual patch, the code around it is what applies it to the firmware).

Screen Shot 2024-01-01 at 19.00.25.png


It took me about a week (in free time) from start to finish to tinker with and figure it out, however - I had the device on hand, had rich familiarity with its architecture instruction set and their firmware used some open source software that I was able to recognize and thus did not have to fully reverse engineer, which made this process easier for me.

The KHG from the quick glance I had in its firmware, is based on an architecture I have less experience with, and I also have no physical device to facilitate a proper debugging environment to work with.
Having a device on hand (preferably a locked one) would be the biggest road block here IMO.

Anyway - my point is that it is possible and practical to achieve, it'll be fun to work on, useful for many and most importantly - show prove companies that these practices are wrong and will get bypassed.
 

coralbeauties

Valuable Member
View Badges
Joined
May 6, 2014
Messages
1,105
Reaction score
910
Location
Yellow Springs ohio
Rating - 100%
3   0   0
What is the consensus on how the unit knows if you diy the reagent?

Fixing the diy reagent to match may be a better long term choice than downgrading the unit, although I understand it carries risks testing diy reagents.
My khg's are really basic from what I can tell. they have a precise needle for the droplet size and a sensor to count the drops. Adds drops till it reaches its goal ph level then calculates the alk determined my the number of drops. I guess the drop count could be affected by the weight of the reagent which could cause the drops to be smaller or larger but that would seem to be very minuscule. I dont see anything that would be used to tell the reagent composition to know if it is diy or oem reagent. I may be way off in my thinking and stand to be corrected.
 

Nate Chalk

7500 Club Member
View Badges
Joined
Nov 15, 2018
Messages
9,602
Reaction score
30,471
Location
no
Rating - 0%
0   0   0
Had to dig around my old things to find this,
but here's an example of a payload I injected a while ago into a dosing pump made by Jebao that had a bug where it'd fail to properly load settings after power cycling.

Screen Shot 2024-01-01 at 18.37.45.png


This payload was used mainly to debug the problem itself, and once I figured out what was going on, I was able to develop a patch for it to permanently fix their own bug, which eventually required just a small modification of 2 function calls (marked in red is the actual patch, the code around it is what applies it to the firmware).

Screen Shot 2024-01-01 at 19.00.25.png


It took me about a week (in free time) from start to finish to tinker with and figure it out, however - I had the device on hand, had rich familiarity with its architecture instruction set and their firmware used some open source software that I was able to recognize and thus did not have to fully reverse engineer, which made this process easier for me.

The KHG from the quick glance I had in its firmware, is based on an architecture I have less experience with, and I also have no physical device to facilitate a proper debugging environment to work with.
Having a device on hand (preferably a locked one) would be the biggest road block here IMO.

Anyway - my point is that it is possible and practical to achieve, it'll be fun to work on, useful for many and most importantly - show prove companies that these practices are wrong and will get bypassed.
I would love it.
 

Randy Holmes-Farley

Reef Chemist
View Badges
Joined
Sep 5, 2014
Messages
72,100
Reaction score
69,741
Location
Massachusetts, United States
Rating - 0%
0   0   0
My khg's are really basic from what I can tell. they have a precise needle for the droplet size and a sensor to count the drops. Adds drops till it reaches its goal ph level then calculates the alk determined my the number of drops. I guess the drop count could be affected by the weight of the reagent which could cause the drops to be smaller or larger but that would seem to be very minuscule. I dont see anything that would be used to tell the reagent composition to know if it is diy or oem reagent. I may be way off in my thinking and stand to be corrected.

Some folks mentioned an optical sensor early in the thread?
 

gbroadbridge

2500 Club Member
View Badges
Joined
Mar 25, 2021
Messages
4,573
Reaction score
4,843
Location
Sydney, Australia
Rating - 0%
0   0   0
Some folks mentioned an optical sensor early in the thread?
If someone could pop the back off a unit and take a photo of any leds/sensors in the reagent path, and any markings on them, the sensor type could be determined.

From that information a patch to the firmware that removes the test should not be all that difficult.

Or it could simply be a matter of replacing the sensor with components that send psuedo sensor data back to the MCU to make it think the reagent is within spec.

edit:
The second is probably the easiest, as it is super easy to interrogate the data between a sensor and the MCU no matter what type of device it is.
 
Last edited:
Back
Top