Picture of the dumper board, with a ROM chip and a Pi Pico inserted

A Disposable Dumper For ROM Chips With A Pi Pico

February 2, 2023 by Arya Voronova 26 Comments

ROM dumping is vital for preserving old hardware, and we’ve seen many hacks dedicated to letting someone dump a ROM and send its contents to some hacker stuck with a piece of technology that lost its firmware. However, that requires ROM dumping tools of some kind, and it’s often that the lucky ROM-equipped hacker doesn’t own such tools. Now, you could mail the chip to someone else, but postal services in many countries are known to be UDP-like — lossy and without delivery guarantees. The risk of leaving both hackers without a ROM chip is quite real, so, instead of mailing ROM chips or expensive devices around, [Amen] proposes a cheap and disposable flash dumping tool that you could mail instead.

The ROMs in question are 24-pin 2332 and 2364 chips, which run at 5 V and can easily be read with any microcontroller. Thus, his concept is a very simple board, with a Pi Pico and flash chip socket on it, as well as some resistors. Those are used to provide rudimentary GPIO over-voltage protection, since the RP2040 runs its GPIOs at 3.3 V. All the magic is in the software – the tool can both write the chip contents in the RP2040’s internal memory, as well as dump it over USB to the computer. Everything is open-source – if you ever need to dump a rare chip on the other side of the world, modify the design to your liking, order a few copies and then mail them to the hacker involved – losing such a package is way less significant than losing a ROM chip with last-of-its-kind firmware on it.

Old ROM chips are dying out, causing whole generations of hardware, like synths, to fade away – with tools like this one, you can lend a hand in preserving the legacy of many an industry and hobby, and many hackers do. Looking to learn about the basics of parallel flash dumping? This post from 2012 will be a good start, and then check out a more recent venture to learn how things are done with more recent parts.

Building An All-in-One Desktop Out Of Framework Parts

February 2, 2023 by Arya Voronova 10 Comments

The Framework laptop prides itself on having reusable parts, and hackers all around routinely challenge the claims by building projects reusing them. Yet again, [whatthefilament] puts the Framework hardware to the test, by taking all the laptop internals and building an AiO (All-in-One) desktop computer with it. Hot on the heels of his Framework tablet project we covered a few months ago, this desktop reuses as much as possible – the mainboard, the display and the expansion cards in particular, and even one of the hinges is reused for adjusting the monitor’s angle.

Of course, this build required a custom case – and [whatthefilament]’s design is fully 3D-printed, with STLs and assembly instructions available for anyone interested. Parts of the desktop are held by magnets for ease of assembly and maintenance, with a few parts requiring screws held in by heat-set inserts. Complete with a webcam, speakers and even a WiFi card, all it needs for completeness is an external keyboard&mouse combo, making for a sleek desktop that anyone in possession of a few Framework parts can build.

Laptop-to-desktop builds are nice – take the X-PC project, starting with a pile of school laptops and rebuilding them into colourful and sturdy desktops for classroom use. We’ve seen quite a few fancy Framework projects already, and that’s because they provided motherboards to hackers for specifically project purposes, kickstarting a fair few creations to grace our pages. Other hacker-friendly laptops didn’t lag behind, either – for instance, here’s the hacker favourite, Novena, getting the desktop treatment.

Screenshot of a terminal showing the HELP command in action - outputting descriptions of other commands

Let’s Make SCPI More Helpful

February 2, 2023 by Arya Voronova 9 Comments

The SCPI (Standards Command for Programmable Instruments) protocol is exceptionally popular in lab and workspace tools, letting you configure and fetch data from oscilloscopes and lab scales alike in a standardized way. However, when interfacing with a SCPI device, you need to use a programming guide document if you want to know the commands for any of the inevitably extended features; essentially, SCPI isn’t as human-friendly as you might want. [MisterHW] argues that SCPI could use more discoverability by proposing a HELP? command.

This proposal is so intuitive, it makes you wonder why it isn’t in the base spec. It adds a built-in command that provides information on other commands. Internally, the description is just an extra string parameter that you add to your command definition code, and you can use it to describe the parameter types and ranges it takes. The output is both human-readable and machine-parseable, and as it’s stored within your code, it’s way quicker to update the description string than it is to re-release programming guides. Which are themselves prone to being outdated as-is, so decreasing reliance on them is a win-win.

The proposal makes a lot of sense, and [MisterHW] is willing to back it up with a pull request to the most popular SCPI library, libscpi. Whenever the pull request finally goes through, you will have the option to easily add the HELP? command support to whatever SCPI-connected device you might have brewing.

While the old devices will eventually fade, SCPI is not about to die out – hackers keep building devices with SCPI as the communication protocol, as the spec is quite powerful. For instance, here’s this fancy temperature logger, or this Source Measurement Unit – both of them use SCPI for hacker-to-device data transfer, and it’s likely to be libscpi under the hood. Ever wondered what SCPI is all about? Check out our overview!

The Chipwhisperer adapter plugged into a ChipWhisperer, with the STM chip mentiuoned soldered on

ChipWhisperer Adapter Helps Reverse-Engineer A Controversial Game Cartridge

February 1, 2023 by Arya Voronova 7 Comments

The ChipWhisperer has been a breakthrough in hobbyist use of power analysis and glitching attacks on embedded hardware. If you own one, you surely have seen the IDC and SMA sockets on it – usable for connecting custom breakouts housing a chip you’re currently probing. Today, [MAVProxyUser] brings us a ChipWhisperer adapter for STM32F446ZEJx, which comes in a UFBGA144 package – and the adapter has quite a backstory to it.

In retro gaming world, a crowdfunding campaign for a game called PAPRIUM has seen a huge success getting funded in 2017. However, the campaign has grossly underdelivered throughout the last five years, and out of those rare cartridges delivered to backers, quite a few have faulty hardware. Getting replacements isn’t realistic at this point, so the repair attempts and game preservation efforts have been ongoing. Trouble is – there are protection mechanisms against dumping the cartridges, and one of the protection mechanisms is the built-in flash read protection of the aforementioned STM32 found on the cartridge. This board adapts the chip to a ChipWhisperer interface for protection bypass exploration, and has quite a few configuration jumpers anyone facing a similar chip is able to use – Eagle files are out there as well, in case your chip needs a slightly different approach.

With reverse-engineering underway, are we likely to see this cartridge’s defenses fall? Our assessment is ‘yes’ – it’s not like there’s a shortage of mechanisms for bypassing security ; from modchips to EMP attacks to blasting the die with a laser, hardware-reliant security is, still, quite bypassable. All in all, despite the drama around the project, this is one more reference design for the ChipWhisperer, and a fun journey to look forward to.

A graphic showing the suggested footprint dimensions for 0402 parts

Want Better 0402 Reflow? Consider These Footprints!

February 1, 2023 by Arya Voronova 13 Comments

Assembling with a stencil is just that much more convenient – it’s a huge timesaver, and your components no longer need to be individually touched with a soldering iron for as many times as they have pads. Plus, it usually goes silky smooth, the process is a joy to witness, and the PCB looks fantastic afterwards! However, sometimes components won’t magically snap into place, and each mis-aligned resistor on a freshly assembled board means extra time spent reflowing the component manually, as well as potential for silent failures later on. In an effort to get the overall failure rate down, you will find yourself tweaking seemingly insignificant parameters, and [Worthington Assembly] proposes that you reconsider your 0402 and 0201 footprints.

Over the years, they noticed a difference in failure rates between resistor&capacitor footprints on various boards coming in for assembly – the size and positioning of the footprint pads turned out to be quite significant in reducing failure rate, even on a tenth of millimeter scale. Eagle CAD default footprints in particular were a problem, while a particular kind of footprint never gave them grief – and that’s the one they recommend we use. Seeing the blog post become popular, they decided to share their observations on 0201 as well, and a footprint recommendation too. Are your 0402 resistors giving you grief? Perhaps, checking the footprints you’re using is a good first step.

The 0402 and 0201 components are in a weird spot, where soldering iron assembly is no longer really viable, but the stencil+reflow approach might not be unilaterally successful when you start off – fortunately, that’s where writeups like these come in. Interested in learning stenciling? Get some solder paste, and read up on all the different ways you can put it onto your boards.

A modchip described in the article - a small PCB with an epoxy blob on it, soldered to the Cisco switch PCB using four thin wires

Counterfeit Cisco Hardware Bypasses Security Checks With Modchips

February 1, 2023 by Arya Voronova 32 Comments

Some pictures recently surfaced on social media, showing a small PCB tapped into four points on Cisco-branded boards. What is this about? A NSA backdoor so data can be exfiltrated to some third party? Well, that’s theoretically possible, but it’s actually used for bypassing hardware authenticity checks in Cisco hardware being cloned — a sizable industry. Of course, “can’t believe it’s not Cisco” hardware is only valuable insofar that it’s able to run the Cisco software, and that’s where the bodge boards play a major role.

A 2020 report by F-Secure details an investigation, comparing three switches marked as Cisco 2960X – one known genuine and two known counterfeits. The counterfeits had the aforementioned implants either soldered to the bottom of the PCB or added to the board as a separate component, and the paper goes into why they’re important for successful counterfeiting.

Apparently, these chips emulate or bypass an I2C EEPROM containing part of the code executed during the boot sequence, and Cisco depends on this EEPROM’s contents for authenticity verification. Cisco software reads the EEPROM twice — once for verification, and once again for actually running it. The microcontroller included on the mod board can return a genuine binary with a valid signature on the first read, and a binary with hardware checks patched out for subsequent reads.

The paper will tell you about way more than this — it’s thorough yet captivating. As you’d expect, it devotes quite a bit of time to comparing genuine and counterfeit boards, showing that the cloning process is pretty to-the-T, save for some part substitutions. For instance, check out the PDF page 12 to see how via locations are exactly copied between PCBs in a bizarre way, or the Cisco file format and authenticity check analysis closer to the end of the report. All in all, the 38 pages of the document make for a fun foray into what makes Cisco authentication mechanisms tick, and what helps clone hardware makers bypass them.

Are such chips ever used for adding backdoors and data exfiltration? There’s no evidence of that, as much as that’s not to be excluded — bypassing anti-cloning protections would make other hijinks more viable no doubt, that said, only hardware authentication bypass measures were found so far. This mechanism also breaks during software updates, and absolutely, leaves some to be desired when it comes to its stated functionality. That said, such fun insights can help us, say, enforce right-to-repair, enable hardware reuse, and thwart many predatory business practices in areas where laws fail us.

SteamDeck connected to a laptop with a USB cable, showing the 'printed-out' document on its screen inside a PDF reader

SteamDeck: Become Printer

January 31, 2023 by Arya Voronova 9 Comments

Wonderful things happen when we read the documentation. For instance, we’ve all seen a Raspberry Pi work as an Ethernet adapter over USB, or a ESP32-S2 presenting as a storage device. Well, [parkerlreed] has made his Steam Deck work as a USB printer after reading the Linux kernel docs on the USB gadget configuration, and all it took was some C code and a BIOS setting change.

“Wouldn’t it be cool if our USB tablets exposed a fake printer interface and saved the received documents as PDF?” With a SteamDeck, you can do just that – thanks to the g_printer kernel module. The C code is fairly straightforward, and even lets you configure some aspects of the printer device.

Of course, there’s gotta be a cherry on the cake, and [parkerlreed]’s shell script hides an addition that makes your PDF printing experience all that more realistic! Not to spoil it too much – you should watch the video of the script in action, showcasing both the ease of use and the added realism.

Jokes aside, the usefulness of this script is undeniable, and owners of USB-device-capable portable Linux devices will find this script a must-have. It’s seriously cool when someone dives into documentation and pulls out a clever solution to a “wouldn’t it be cool” idea – fundamentally, it is the same mindset that gave us the venerable RTL-SDR. What’s your favourite ‘dig into docs and figure out a clever feature’ hack?

We thank [Myself] for sharing this with us on the Hackaday Discord!

Continue reading “SteamDeck: Become Printer” →