A closeup of the ring, inner electronics including a lit green LED seen through the inner transparent epoxy, next to the official app used to light up the LED for a demo.

New Part Day: A Hackable Smart Ring

June 16, 2024 by Arya Voronova 36 Comments

We’ve seen prolific firmware hacker [Aaron Christophel] tackle smart devices of all sorts, and he never fails to deliver. This time, he’s exploring a device that seems like it could have come from the pages of a Cyberpunk RPG manual — a shiny chrome Bluetooth Low Energy (BLE) smart ring that’s packed with sensors, is reasonably hacker friendly, and is currently selling for as little as $20.

The ring’s structure is simple — the outside is polished anodized metal, with the electronics and battery carefully laid out along the inside surface, complete with a magnetic charging port. It has a BLE-enabled MCU, a heartrate sensor, and an accelerometer. It’s not much, but you can do a lot with it, from the usual exercise and sleep tracking, to a tap-sensitive interface for anything you want to control from the palm of your hand. In the video’s comments, someone noted how a custom firmware for the ring could be used to detect seizures; a perfect example of how hacking such gadgets can bring someone a brighter future.

The ring manufacturer’s website provides firmware update images, and it turns out, you can upload your own firmware onto it over-the-air through BLE. There’s no signing, no encryption — this is a dream device for your purposes. Even better, the MCU is somewhat well-known. There’s an SDK, for a start, and a datasheet which describes all you would want to know, save for perhaps the tastiest features. It’s got 200 K of RAM, 512 K of flash, BLE library already in ROM, this ring gives you a lot to wield for how little space it all takes up. You can even get access to the chip’s Serial Wire Debug (SWD) pads, though you’ve got to scrape away some epoxy first.

As we’ve seen in the past, once [Aaron] starts hacking on these sort of devices, their popularity tends to skyrocket. We’d recommend ordering a couple now before sellers get wise and start raising prices. While we’ve seen hackers build their own smart rings before, it’s tricky business, and the end results usually have very limited capability. The potential for creating our own firmware for such an affordable and capable device is very exciting — watch this space!

Continue reading “New Part Day: A Hackable Smart Ring” →

The 3D-printed adapter shown assembled, with the USB cable's wires going into cable channels on the adapter and magnets slotted into the adapter's openings

Use Your Thinkpad X1 Tablet’s Keyboard Standalone

June 16, 2024 by Arya Voronova 8 Comments

Some hacks are implemented well enough that they can imitate involved and bespoke parts with barely any tools. [CodeName X]’s Thinkpad X1 Tablet Keyboard to USB adapter is one such hack – it let’s one reuse, with nothing more than a 3D printed part and a spare USB cable, a keyboard intended for the Thinkpad X1 Tablet (2016 or 2017).

The issue is, this keyboard connects through pogo pins and holds onto the tablet by magnets, so naturally, you’d expect reusing it to involve a custom PCB. Do not fret – our hacker’s take on this only needs aluminum foil and two small circular magnets, pressing the foil into the pins with the help of the printed part, having the USB cable pins make contact with the foil pads thanks to nicely laid out wire channels in the adapter. If you want to learn more, just watch the video embedded below.

Of course, this kind of adapter will apply to other similar keyboards too — there’s no shortage of tablets from last decade that had snap-on magnetic keyboards. But watch out; some will need 3.3V, and quite a few of them will use I2C-HID, which would require a MCU-equipped adapter like this wonderful Wacom rebuild did. Not to worry, as we’ve shown you the ropes of I2C-HID hacking.

Continue reading “Use Your Thinkpad X1 Tablet’s Keyboard Standalone” →

the Logitech receiver in question next to the mouse it's paired to

Uncovering Secrets Of Logitech M185’s Dongle

June 15, 2024 by Arya Voronova 18 Comments

[endes0] has been hacking with USB HID recently, and a Logitech M185 mouse’s USB receiver has fallen into their hands. Unlike many Logitech mice, this one doesn’t include a Unifying receiver, though it’s capable of pairing to one. Instead, it comes with a pre-paired CU0019 receiver that, it turns out, is based on a fairly obscure TC32 chipset by Telink, the kind we’ve seen in cheap smart wristbands. If you’re dealing with a similarly obscure MCU, how do you even proceed?

In this case, GitHub had a good few tools developed by other hackers earlier — a Ghidra integration, and a tool for working with the MCU using a USB-UART and a single resistor. Unfortunately, dumping memory through the MCU’s interface was unreliable and frustrating. So it was time to celebrate when fuzzing the HID endpoints uncovered a memory dump exploit, with the memory dumper code helpfully shared in the blog post.

From a memory dump, the exploration truly began — [endes0] uncovers a fair bit of dongle’s inner workings, including a guess on which project it was based on, and even a command putting the dongle into a debug mode where a TC32-compatible debugger puts this dongle fully under your control.

Yet another hands-on course on Ghidra, and a wonderful primer on mouse dongle hacking – after all, if you treat your mouse’s dongle as a development platform, you can easily do things like controlling a small quadcopter, or pair the dongle with a SNES gamepad, or build a nifty wearable.

We thank [adistuder] for sharing this with us!

PCB Design Review: A 5V UPS With LTC4040

June 13, 2024 by Arya Voronova 23 Comments

Do you have a 5 V device you want to run 24/7, no matter whether you have electricity? Not to worry – Linear Technology has made a perfect IC for you, the LTC4040; with the perfect assortment of features, except perhaps for the hefty price tag.

[Lukilukeskywalker] has shared a PCB for us to review – a LTC4040-based stamp you can drop onto your PCB whenever you want a LTC4040 design. It’s a really nice module to see designed – things like LiFePO4 support make this IC a perfect solution for many hacker usecases. For instance, are you designing a custom Pi HAT? Drop this module to give your HAT the UPS capability for barely any PCB effort. if your Pi or any other single-board computer needs just a little bit of custom sauce, this module spices it up alright!

Continue reading “PCB Design Review: A 5V UPS With LTC4040” →

Displays We Love Hacking: DSI

June 12, 2024 by Arya Voronova 10 Comments

We would not be surprised if DSI screens made up the majority of screens on our planet at this moment in time. If you own a smartphone, there’s a 99.9% chance its screen is DSI. Tablets are likely to use DSI too, unless it’s eDP instead, and a smartwatch of yours definitely will. In a way, DSI displays are inescapable.

This is for a good reason. The DSI interface is a mainstay in SoCs and mobile CPUs worth their salt, it allows for higher speeds and thus higher resolutions than SPI ever could achieve, comparably few pins, an ability to send commands to the display’s controller unlike LVDS or eDP, and staying low power while doing all of it.

There’s money and power in hacking on DSI – an ability to equip your devices with screens that can’t be reused otherwise, building cooler and cooler stuff, tapping into sources of cheap phone displays. What’s more, it’s a comparably underexplored field, too. Let’s waste no time, then!

Decently Similar Internals

DSI is an interface defined by the MIPI Alliance, a group whose standards are not entirely open. Still, nothing is truly new under the sun, and DSI shares a lot of concepts with interfaces we’re used to. For a start, if you remember DisplayPort internals, there are similarities. When it comes to data lanes, DSI can have one, two or four lanes of a high-speed data stream; smaller displays can subsist with a single-lane, while very high resolution displays will want all four. This is where the similarities end. There’s no AUX to talk to the display controller, though – instead, the data lanes switch between two modes.

Continue reading “Displays We Love Hacking: DSI” →

Switching Regulator Layout For Dummies

June 10, 2024 by Arya Voronova 43 Comments

Last time, we went over switching regulator basics – why they’re wonderful, how do you find a switching regulator chip for your purpose, and how to easily pick an inductor for one. Your datasheet should also tell you about layout requirements. However, it might not, or you might want to deviate from them – let’s go more in-depth on what those requirements are about.

Appreciate The Feedback

The two resistors on the right decide what your output voltage will be, and their output is noise-sensitive

There’s a few different switching regulator topologies. Depending on your regulator’s topology and how many components your chip contains, you might need some external components – maybe a Schottky diode, maybe a FET, or maybe even a FET pair. It’s often that the FET is built-in, and same goes for diodes, but with higher-current regulator (2 A to 3 A and above), it’s not uncommon to require an external one. For sizing up those, you’ll want to refer to the datasheet or existing boards.

Another thing is input and output capacitors – don’t skimp on those, because some regulators are seriously sensitive to the amount of capacitance they’re operating with. Furthermore, if you fail to consider things like capacitance dropping with voltage, you might make your regulator very unhappy – not that a linear regulator would be happy either, to be clear. We’ve covered an explainer on this recently – do check it out!

One thing you will likely need, is a feedback resistor divider – unless your switching regulator is pre-set for a certain voltage or is digitally controlled, you need to somehow point it to the right voltage, in an analog way. Quite a few switching regulators are set for a certain voltage output, but most of them aren’t, and they will want you to add a resistor divider to know what to output. There’s usually a formula for resistor divider calculation, so, pick a common resistor value, put it in as one of the resistors into the formula, get the other resistor value out of that formula, and see what’s the closest value you can actually buy. Don’t go below about 10 kΩ so that you don’t have unnecessary idle power consumption, but also don’t go too far above 100 kΩ to ensure good stability of the circuit. Continue reading “Switching Regulator Layout For Dummies” →

A screenshot of the website, showing various parts from Western manufacturers

How Many Western ICs Are There In Russia’s Weapons?

June 8, 2024 by Arya Voronova 60 Comments

Recently, the Ukrainian government has published a database of Western components being used in recently produced Russian armaments, and it’s a fascinating scroll. Just how much does Russia rely on Western manufacturers’ parts? It turns out, a surprising amount. For instance, if you are wondering which ICs are used to build Iran-produced Shahed drones, it seems that it’s a whole bunch of Texas Instruments parts, as well as some Maxim, Intel, and Xilinx ones. Many of the parts in the lists are MCUs and FPGAs, but it’s also surprising how many of the components are jelly bean parts with multiple suppliers.

There appear to be thousands of parts listings, compiled from a good few dozen pieces of equipment that volunteers appear to have taken apart and scrupulously documented – just take a look at the dropdowns at the top of the page. The Ukrainian government is advocating for parts restrictions to be implemented based upon this data – as we all remember, it’s way harder to produce hardware when you can’t buy crucial ICs.

Even for a regular hacker, this database is worth a scroll, if only to marvel at all the regular parts we wouldn’t quite associate with military use. Now, all that’s left is to see whether any of the specific chips pictured have been sold to washing machine manufacturers.