Laser distance meter hack has a description of several pads on the main board.

Description of pads on main board. Origin

The keypads on my device main board are different to the description above.

Keypads on main board. No all keys available.

Debugging pads on the main board backside providing acces to the STM32 SW debug port. I tried with an ST-Link V2 just to find the chip being locked in protection level 1. So one can not read the firmware. However, there are two chips missing on the main boards back side. So I probed the with an oscilloscope. Found three pins with activity on which is an unidirectional SPI bus.

Missing chip pinout for data bus.

Details about the bus that I found so far:

Single 68 bytes frame.

Single frame length 16.6ms.

Frames with 2Hz rate.

2Hz frames with additional frame right after measurement end.

Two consecutive frames after measurement.

Start of frame with first three bytes.

  • Signal level is 0V to 3V.
  • Clock frequency 37KHz.
  • The are 8 long clock pulses and one short pulse for each byte. Data is LOW in first, second and third byte of each sub-frame during this short pulse (byte data is a command). For any other byte in sub-frames DATA is HIGH during this short pulse (byte data are LCD symbols).
  • Data sampling at rising clock edge.
  • Bit order seems to be MSB first.
  • CS signal (D2 in above plots) is high when bus inactive, there is a short strobe pulse at the end of each byte.
  • In continuous measurement mode the main frame is randomly split and the 17 bytes sub-frames are transmitted with a pause in between. Obviously a timing issue when the controller is busy while measuring distance.

First byte of frame.

20 thoughts on “Laser distance meter hack

  1. It’s so lucky when my Laser Rangefinder was almost like yours (mine was SW-M40). Due to the different, can you help me point out where are the 3 SPI pins in my board? Thank you very much!
    This is the picture of the board
    Again, thank you very much! So lucky when I got the laser module same as yours.

    • Looks similar. Can you provide a picture from back side of this board?
      In case you have a oscilloscope probe each pin on the LCD connector to find the SPI signals.

    • Your first picture, the LCD connector pins counting left to right would be:
      5 = Clock CLK
      6 = Data DTA
      8 = Chip Select CS

      I hope the LCD pinout is the same as mine. If it doesn’t work for you than very probably the pinout is different, even when it looks equal.

        • I don’t wonder. There are obviously so many board variants existing of these laser distance meters that very probably the LCD type varies also. All my working units have an LCD that reads DFG0071 and a date on the back side.

          • ok, I’ll study my circuit better.
            Another quick question: you say “Before you connect any hardware to the LCD bus of the laser distance meter make sure it runs at 3V signal levels!” this is true, but a regular 5 V arduino can read properly a 3V digital signal, right? You fry the telemeter only if you send 5V signal to it.
            Thank you

          • 5V Arduino board might be 3V compatible for reading. But why taking a risk?

  2. Hi! After reading your article I bought the same range finder you own (on Amazon). I disassembled it, I did all three soldering (data, cs, clock) but it doesn’t print anything similar to your to my serial port. I noticed a slight different lcd pinout as you can see in my photos. I’m using a 5V (it only read signals) arduino with GND connected to – of batteries. If necessary I also have this 3V board
    This are the pictures
    What’s wrong? Please help me, I need to read measure remotely

    • You already noticed a different LCD pinout. So maybe the LCD is different, so is the internal controller and hence the LCD protocol. My code works with LCD’s marked DFG0071 on the backside. Anything else is probably different and not believed to work. This project and code is a proof of concept. To make it work with other devices requires additional efforts in reverse engineering.

  3. Hello,
    this is Stefan from hackaday. Unfortunately I do not have my old rangefinder any more.
    I bought an SNDWay later, but got the same device as oregon and Khoi Nguyen Phan.
    It seems that there are a handful companys in china building cloned devices, because they look identically.

    The Pins 5 and 6 of the display connector are connected to Pin 30 and 31 of the STM32 µC. This are RX and TX of USART1 of the microcontroller. So it could be that the display is driven by a uart interface.
    @Michael, do you know if the DFG0071 display is connected to a hardware SPI bus?

    • On the first device I made, the LCD is connected to PB6,PB7 and PB8 which seems to be also an USART. But protocol is clearly SPI.

      • Thanks for your reply. I will check the protocol and give feedback as soon as possible.

        PS. Can someone correct my typing errors 😉

  4. Another interesting product could be the LS1- Laser Range finder.
    I bought one for the purpose of utilizing it with arduino.
    I tried to identify the “main ic” but had no luck.
    I guess it’s a STM32 most likely there will be no accessible serial interface on this device too.. 🙁

    So maybe we have to intercept the display signal as well.
    Here are some photos of the disassembly:

Leave a Reply