[Sprite_TM] OHM2013 Talk: Hacking hard drive controller chips

hacking-hard-drive-controllers

Even if he hadn’t done any firmware hacking on this hard drive [Sprite_TM's] digital exploration of the controller is fascinating. He gave a talk at this year’s Observe, Hack, Make (OHM2013) — a non-commercial community run event in the Netherlands and we can’t wait for the video. But all the information on how he hacked into the three-core controller chip is included in his write up.

[Sprite_TM] mentions that you’re not going to find datasheets for the controllers on these drives. He got his foot in the door after finding a JTAG pinout mentioned on a forum post. The image above shows his JTAG hardware which he’s controlling with OpenOCD. This led him to discover that there are three cores inside the controller, each used for a different purpose. The difference between [Sprite_TM's] work and that of mere mortals is that he has a knack for drawing surprisingly accurate conclusions from meager clues. To see what we mean check out the memory map for the second core which he posted on page 3 or his article.

Using JTAG he was able to inject a jump into the code (along with a filler word to keep the checksum valid) and run his own code. To begin the firmware hacking portion of the project he pulled the flash ROM off of the board and installed it on that little board sticking out on the left. This made it easy for him to backup and reflash the chip. Eventually this let him pull off the same proof of concept as a firmware-only hack (no JTAG necessary). He goes onto detail how an attacker who has root access could flash hacked firmware which compromises data without any indication to they system admin or user. But we also like his suggestion that you should try this out on your broken hard drives to see if you can reuse the controllers for embedded projects. That idea is a ton a fun!

When we were poking around the OHM2013 website (linked above) we noticed that the tickets are sold out; good for them! But if you were still able to buy them they take Bitcoin as one payment option. Are there any other conferences that allow Bitcoin for registration?

[Sprite_tm] connects an LCD to a tiny Linux board

One of [Sprite_tm]‘s colleagues recently challenged him to connect a small LCD touch screen to a Raspberry Pi. Sadly, [Sprite_tm] has yet to take delivery of a Raspberry Pi, but he did manage to connect an LCD to a Linux board without video capabilities.

Because [Sprite_tm]‘s display has a 16-bit parallel interface, and 16 GPIO pins are hard to come by on the Carambola Linux board, a few shift registers had to be brought into the build to make the LCD work. These shift registers are connected to the Carambola board via an SPI interface; a very simple way to connect all the LCD pins to the Linux board.

Of course, there’s no way for Linux to speak to the LCD without a kernel driver; [Sprite_tm] wrote a framebuffer driver so the LCD can be used as a console, an X session, or used by any other program that can write to a framebuffer device.

Like all good driver authors, [Sprite_tm] is giving away the patch to enable SPI-ified LCD panels on the Carambola along with the shift register schematic. With any luck we’ll also see the Raspi drivers when [Sprite_tm] takes delivery of his Raspberry Pi.

[Sprite_tm]‘s three-component FM transmitter

When the Regency TR-1 transistor radio came out onto the market in the 1950s, it was hailed as a modern marvel of microelectronics. With only four transistors and a handful of other components, the TR-1 was a wonder of modern engineering. [Sprite_tm] may have those old-timers beat, though. He built an FM transmitter with the lowest parts count of any transmitter ever.

Like most of [Sprite_tm]‘s builds, it’s an unimaginably clever piece of work. [Sprite] overclocked the internal RC oscillator of an ATtiny45 to 24 MHz. After realizing the PLL running at four times the frequency of the oscillator was right in the middle of the FM band, he set about designing a tiny FM transmitter.

[Sprite_tm] remembered his work on MONOTONE and made a short song for hit ATtiny. The firmware for the build takes the notes from his song and varies the 96 MHz PLL frequency a tiny bit, thereby serving as a tiny FM transmitter.

Does it work? Well, if you want to compare it to a Mister Microphone, the range is incredibly limited. That being said it works. It’s an FM transmitter built out of a microcontroller and a battery, and that’s very impressive. Check out [Sprite_tm]‘s demo after the break.

[Read more...]

Controlling Ten Thousand RGB LEDs

LEDsRGB LEDs are awesome – especially the new, fancy ones with the WS2812 RGB LED driver. These LEDs can be individually controlled to display red, green, and blue, but interfacing them with a microcontroller or computer presents a problem: microcontrollers generally don’t have a whole lot of RAM to store an image, and devices with enough memory to do something really cool with these LEDs don’t have a real-time operating system or the ability to do the very precise timing these LEDs require.  [Sprite_tm] thought about this problem and came up with a great solution for controlling a whole lot of these WS2812 LEDs.

[Sprite] figured there was one device on the current lot of ARM/Linux boards that provides the extremely precise timing required to drive a large array of WS2812 LEDs: the video interface. Even though the video interface on these boards is digital, it’s possible to turn the 16-bit LCD interface on an oLinuXino Nano into something that simply spits out digital values very fast with a consistent timing. Just what a huge array of RGB pixels needs.

Using a Linux board to drive RGB pixels using the video output meant [Sprite_tm] needed video output. He’s running the latest Linux kernel, so he didn’t have the drivers to enable the video hardware. Not a problem for [Sprite], as he can just add a few files to define the 16-bit LCD interface and add the proper display mode.

[Sprite_tm] already taken an oscilloscope to his board while simulating 16 strips of 600 LEDs, and was able to get a frame rate of 30 fps. That’s nearly 10,000 LEDs controlled by a single €22/$30USD board.

Now the only obstacle for building a huge LED display is actually buying the RGB LED strips. A little back-of-the-envelope math tells us a 640×480 display would be about $50,000 in LEDs alone. Anyone know where we can get these LED strips cheap?

[Read more...]

Jello Shot Printer

IMG_5931
While inspecting some jello shots for a friend’s upcoming 25th birthday, [Sprite_tm] had an epiphany. What if you could print designs inside the jello shots? He quickly grabbed a syringe and proceeded to inject food dye into one of the jello shots — it worked. Unfortunately, his friend pointed out that it would take far too long to do each jello shot by hand, to which [Sprite] responded:

Never mind that, I’ll just whip up  a 3D printer that can make nice figures in the jelly for you.

Classic. The great thing about the hacker-mindset is that you never say no when confronted with a problem!

To achieve this printer, [Sprite_tm] has taken a handful of old CD-ROM drives to create a three axis moving platform. He’s using a forth drive’s ejector assembly to depress a syringe which pushes a concoction of banana liquor, green food colouring and cornstarch through medical tubing to the ink-head. To control it, he’s just using an ATTiny2313 with a mere 2K of memory. It took a bit of fiddling with to find the right flow, but works surprisingly well. Stick around after the break to see its printing capabilities.

[Read more...]

Super Simple FM Transmitter

title_001

Making your own FM radio is practically a rite of passage for hackers. How about making a small FM transmitter?

Originally designed by the Japanese multimedia artist [Tetsuo Kogawa], this simple FM transmitter can be built with only 10 components and about an hour of your time. The method shown here is one of the easiest to build, and it’s called the Manhattan Style — the same method used when [Bill Meara] built his BITX radio. It’s unique in that instead of using traces it uses one copper PCB which is used for all ground connections, and then small islands of the same PCB glued on top to form nodes for the circuit to connect to. Besides being an extremely easy way to make a PCB without any fancy tools, it also makes you think about circuits in a different light. In fact, it gives “floating ground” a whole new meaning!

While its 10 component count is impressive, it can’t beat this 3 component FM transmitter we shared a year ago! Stick around after the break to see how to make your very own.

[Read more...]

Old LED marquee turned embedded video player

driving-led-marquee-with-rpi

[Sprite_TM] is was sent an old LED Marquee by an anonymous fan of his hacking projects. The display isn’t full color, but it’s large — 224 by 48 pixels — and he figured he could render some okay images with the bi-color diodes. In the end, he replaced the controller and turned it into a video player.

The original system work well enough, but the 100 MHz 486 industrial style PC that drove the display seems a little comical these days. After giving it a spin and testing out how it drives the display [Sprite] hooked up an FTDI chip and managed to get it playing video from his computer. Above you can see part of the opening sequence of The Simpsons.

Now that he had learned its secrets he set out to give it an embedded controller. His first attempt was with a Carambola board which he’s worked with before. That proved to be a little slow for all the pixel data he was pushing so he upgraded to a Raspberry Pi and never looked back. You can see the demo video after the jump.

[Read more...]