In this special episode Shahriar presents his collaboration with Mark Rober:

I Stole a Car Using a Baby Monitor
https://www.youtube.com/watch?v=h0EGCnBjTVk

Shahriar helped the engineering team at Mark Rober's studio build an RF repeater that can fool a car's keyless entry & ignition system. Using an old modified baby monitor, Mark's team managed to steal a car! In this video, Shahriar presents the technical theory behind this heist as well as a detailed view of the RF repeater, circuit measurements and a demonstration of bypassing a vehicle's keyless entry system.

This video is organized as follows:

00:00 – Introductions & collaboration with Mark Rober.
01:22 – How does Keyless Entry & Keyless Ignition actually work?
08:50 – A close look inside of a car's key fob.
11:14 – Making & measuring a magnetic loop antenna to capture a car's keyless broadcast.
13:30 – Complete RF & time domain measurements of the key fob & vehicle keyless signals.
16:56 – Why did we use an old baby monitor to steal a car?
18:30 – Detailed teardown & analysis of the baby monitor's transmit/receive modules.
24:51 – Measurements of the baby monitor's transmit/receive modules for fooling a car.
31:27 – Live demonstration of stealing a car using the baby monitor circuits.
33:52 – Conclusions & how to protect yourself against this venerability.

DISCLAIMER: This video is purely for educational purposes. The video purposely omits the design of come critical parts needed to replicate the project in full. The presented system, as shown, cannot bypass a vehicle's keyless entry or ignition at distance. DO NOT ATTEMPT TO REPLICATE THIS PROJECT FOR ANY ILLEGAL ACTIVITIES.

Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath

Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath

In this episode Shahriar takes a look at a new dumpster find! A Photo Research PR-670 SpectraScan has some unique capabilities for measuring light spectrum. In particular, it has an adjustable field of view, as narrow as 0.125 degrees, which allows the spectrometer to ignore the majority of light sources in a scene and only focus on a small visible area. This means it is possible to measure multiple points of a screen or sources of light from far away.

The teardown & theory of operation of the instrument is presented including the spectrometer core which uses a diffraction mirror and linear CCD detector. A few experiments are also conducted which showcase the FOV measurement capability using an array of RGB LEDs. Lastly, the measured spectrum of a mercury discharge lamp is also shown.

Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath

Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath

In this episode Shahriar explores the capability of some frequency counters to measure DC voltage. While this may seem non-intuitive initially, the video shows how the architecture of the HP 5245L Nixie tube frequency counter can be used to realize an integrating ADC. A particular plug-in module, the 5265A, leverages the Start/Stop counter control to implement an ADC and display the equivalent DC voltage at the plug-in input. The theory of operation as well as the teardown of the plug-in in shown.

The plug-in module unit is zeroed & calibrated initially and then using a Fluke 5720A the performance of the entire system is evaluated. Despite being in storage for decades, the unit is incredibly accurate and precise.

Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath

Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath

In this episode Shahriar attempts the repair of a Keithley 2510 TEC Source-Meter. This instrument is capable of delivering up to 60W of power to any TEC in both polarities. Furthermore, the instrument integrates a flexible temperature read-out capability with 4-wire interface. Lastly, combining both capabilities, alongside a fully customizable PID controller, a precise temperature controller can be realized.

This particular unit returns erroneous readouts in all modes: voltage, current, resistance & temperature. The unit is also generating "squeaky" noises which is indicative of a failing DC-DC converter. The block diagram of the unit is examined and the fault is ultimately traced to a damaged opto-isolator in the isolated switching power supply. Several other components are also faulty which are located via thermal camera. The output Class-D / buck converter circuit & block diagram are also examined in details.

Unfortunately, the custom IC at the heart of the multi-slope ADC is also damaged. The IC is de-capped, examined under a microscope, and compared with its predecessor CPLD counterpart. This Keithley component is sourced from an older high-speed power supply. The correct readout is then verified. Several experiments are demonstrated using the PID controller and a custom TEC setup.

Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath

Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath

In this episodes Shahriar repairs a Keithley 2500 Dual Photodiode Meter which does not power up. Teardown of the unit reveals two transformers coupled with two fully independent channels. The unit is able to source voltage in two quadrants as well as measure current down to 1-fA resolution. There is also a separate 5V switching power supply responsible for all digital circuits. This power supply is the reason why the unit does not power up. The fault is quickly traced to a bad switching power supply startup capacitor which is easily corrected.

The unit's voltage source & current measurement performance and operation is verified using a LakeShore M81 SSM system coupled with an SMU-10 module:

https://www.lakeshore.com/products/categories/overview/material-characterization-products/measureready-m81-synchronous-source-measure-system/measureready-m81-synchronous-source-measure-system

The Keithley 2500 is also calibrated using the same LakeShore system. An example of active fiber alignment (primary application for the Keithley 2500) is also demonstrated using a pair of infrared LEDs & detectors.

Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath

Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath