Ice40 Runs DOOM

February 7, 2021 by Lewin Day 22 Comments

Spec sheets are an important tool in determining the performance of a given part or system, but they’re not the be all and end all when it comes to engineering. However, specs alone don’t prove whether a given system can complete a given task. Sometimes, you need to actually do the work to prove it instead – as [Sylvain] has done, running DOOM on the iCE40 FPGA.

DOOM’s minimum specifications demand a 386 with 4MB RAM minimum, but it’s commonly agreed that a 486 DX2 running at 66MHz with 8MB of RAM is required to play the game smoothly. With an iCEBreaker v1.0b running a RISC V softcore at 25MHz, it may seem like a difficult task, but the RISC V core has the benefit that many instructions run in a single clock cycle that take many on the 486. While the iCEBreaker doesn’t have much RAM onboard, it’s a simple job to piggyback an 8MB SPI device on top of the existing flash storage. Control of the game is via keystrokes sent to the iCEBreaker over serial, while video is handled over a PMOD video interface with an HDMI connector.

[Sylvain] does a great job of explaining all the minute details of the work that was required to get things working, and has provided files on Github for those keen to replicate the feat or expand upon the code. Music is notably absent but MIDI output could likely be achieved without much hassle. “Does it run DOOM?” is still a question asked of many platforms, even the new Nintendo Game & Watch. Video after the break.

Continue reading “Ice40 Runs DOOM” →

Hacking Hardware Bitcoin Wallets: Extracting The Cryptographic Seed From A Trezor

February 4, 2021 by Adam Zeloof 30 Comments

It’s long been common wisdom that one of the safest places to keep your cryptocurrency holdings is in a hardware wallet. These are small, portable devices that encrypt your keys and offer a bit more peace of mind than holding your coins in a soft or web wallet.

But of course, as we know, nothing is totally secure.

And we were reminded of this fact by Kraken Security Labs, when they showed us how they bypassed all of the safeguards in a popular wallet, the Trezor, to dump and decrypt it’s seed.

It’s worth noting that the hack does require physical access to the wallet — albeit only about fifteen minutes worth. And by “physical access” we mean that the hack leaves the device thoroughly mutilated. The Kraken team started by desoldering the heart of the wallet, a STM32 processor. They then dropped it into a socket on an interface board, and got to glitching.

The hack relies on an attack known as voltage glitching. Essentially, at a precisely-timed moment during the device’s boot sequence, the supply voltage is fluctuated. This enables the chip’s factory bootloader, which can read out the contents of it’s onboard flash memory. The memory is read-protected, but can be accessed 256 bytes at a time through a second voltage glitch. Neither of these attacks work 100% of the time, so if the device fails to boot or the memory remains locked, the FPGA performing the attacks simply tries again. After enough iterations, the Kraken team was able to fully dump the chip’s flash memory.

Continue reading “Hacking Hardware Bitcoin Wallets: Extracting The Cryptographic Seed From A Trezor” →

The Bus That’s Not A Bus: The Joys Of Hacking PCI Express

February 3, 2021 by Maya Posch 55 Comments

PCI Express (PCIe) has been around since 2003, and in that time it has managed to become the primary data interconnect for not only expansion cards, but also high-speed external devices. What also makes PCIe interesting is that it replaces the widespread use of parallel buses with serial links. Instead of having a bus with a common medium (traces) to which multiple devices connect, PCIe uses a root complex that directly connects to PCIe end points.

This is similar to how Ethernet originally used a bus configuration, with a common backbone (coax cable), but modern Ethernet (starting in the 90s) moved to a point-to-point configuration, assisted by switches to allow for dynamic switching between which points (devices) are connected. PCIe also offers the ability to add switches which allows more than one PCIe end point (a device or part of a device) to share a PCIe link (called a ‘lane’).

This change from a parallel bus to serial links simplifies the topology a lot compared to ISA or PCI where communication time had to be shared with other PCI devices on the bus and only half-duplex operation was possible. The ability to bundle multiple lanes to provide less or more bandwidth to specific ports or devices has meant that there was no need for a specialized graphics card slot, using e.g. an x16 PCIe slot with 16 lanes. It does however mean we’re using serial links that run at many GHz and must be implemented as differential pairs to protect signal integrity.

This all may seem a bit beyond the means of the average hobbyist, but there are still ways to have fun with PCIe hacking even if they do not involve breadboarding 7400-logic chips and debugging with a 100 MHz budget oscilloscope, like with ISA buses.

Continue reading “The Bus That’s Not A Bus: The Joys Of Hacking PCI Express” →

Make Room For A New Arduino Competitor – With Native Brainf*ck!

January 12, 2021 by Jenny List 70 Comments

With so many smaller and more capable microcontroller boards on the market it’s now fairly safe to say that the classic Arduino footprint and form factor is rather outdated. That’s not to say that there’s no fight left in the old contender though, and to prove it here’s a new platform in the familiar style set by the venerable Atmel-based board. [Eduardo Corpeño]’s Brainfuino is an Arduino competitor that runs everyone’s favourite esoteric programming language, Brainf*ck. (Keeping it SFW, folks.)

And in case you mistake it for a Brainf*ck emulator on a PCB then stand ready to be corrected, for this board runs the language natively in a Brainf*ck softcore on a Lattice MachXO2 FPGA. This is the real deal, on which only a true genius or masochist would dare to code.

The board itself is very neatly executed with a graphical style that presents more than a nod to the original Arduino. On this board is the FPGA, 256 kB ROM and 138 kB RAM, an STM32 to provide a USB serial port and an analogue input, and a level shifter to provide Arduino-style 5 V logic on the pins. We can see it’ll provide hours of fun to anyone interested in learning Brainf*ck, but besides that it has potential as an Arduino-shaped FPGA board. We like the joke, we like the graphical and engineering design, but underneath that lies quite the technical achievement.

Brainf*ck has made it to Hackaday before, not least in this jaw-dropping relay computer.

Edge-Mounted LEDs Make This Spherical POV Look Fantastic

December 18, 2020 by Dan Maloney 19 Comments

For as many of them as we’ve seen, we still love a good persistence of vision display project. There’s something fascinating about the combination of movement and light creating the illusion of solid surfaces, and there’s always fun to be had in electromechanical aspects of a POV build. This high-resolution spherical POV display pushes all those buttons, and more.

Called “Flicker” for obvious reasons by its creator [Dan Foisy], this POV display started with a pretty clear set of goals in terms of resolution and image quality, plus the need to support animated images, all in a spherical form factor. These goals dictated the final form of the display — a PCB disc spinning vertically. The shaft has the usual slip rings for power distribution and encoders for position feedback. The PCB, though, is where the interesting stuff is.

[Dan] chose to use an FPGA to slice and dice the images, which are fed from a Raspberry Pi’s HDMI port, to the LED drivers. And the LEDs themselves are pretty slick — he found parts with 1.6 mm lead spacing, making them a perfect fit for mounting on the rim of the PCB rather than on either side. A KiCAD script automated the process of laying out the 256 LEDs and their supporting components as evenly as possible, to avoid imbalance issues.

The video below shows Flicker in action — there are a few problem pixels, but on the whole, the display is pretty stunning. We’ve seen a few other spherical POV displays before, but none that look as good as this one does.

Continue reading “Edge-Mounted LEDs Make This Spherical POV Look Fantastic” →

A Xilinx Zynq Linux FPGA Board For Under $20? The Windfall Of Decommissioned Crypto Mining

December 10, 2020 by Jenny List 80 Comments

One of the exciting trends in hardware availability is the inexorable move of FPGA boards and modules towards affordability. What was once an eye-watering price is now merely an expensive one, and no doubt in years to come will become a commodity. There’s still an affordability gap at the bottom of the market though, so spotting sub-$20 Xilinx Zynq boards on AliExpress that combine a Linux-capable ARM core and an FPGA on the same silicon is definitely something of great interest. A hackerspace community friend of mine ordered one, and yesterday it arrived in the usual anonymous package from China.

There’s a Catch, But It’s Only A Small One

The heftier of the two boards, in all its glory.

There are two boards to be found for sale, one featuring the Zynq 7000 and the other the 7010, which the Xilinx product selector tells us both have the same ARM Cortex A9 cores and Artix-7 FPGA tech on board. The 7000 includes a single core with 23k logic cells, and there’s a dual-core with 28k on the 7010. It was the latter that my friend had ordered.

So there’s the good news, but there has to be a catch, right? True, but it’s not an insurmountable one. These aren’t new products, instead they’re the controller boards for an older generation of AntMiner cryptocurrency mining rigs. The components have 2017 date codes, so they’ve spent the last three years hooked up to a brace of ASIC or GPU boards in a mining data centre somewhere. The ever-changing pace of cryptocurrency tech means that they’re now redundant, and we’re the lucky beneficiaries via the surplus market.

Continue reading “A Xilinx Zynq Linux FPGA Board For Under $20? The Windfall Of Decommissioned Crypto Mining” →

Pushing The FPGA Video Player Further

November 30, 2020 by Matthew Carlson 4 Comments

A fact universally known among the Hackaday community is that projects are never truly done. You can always spin another board release to fix a silkscreen mistake, get that extra little boost of performance, or finally spend the time to track down that weird transient bug. Or in [ultraembedded’s] case, take a custom FPGA player from 800 x 600 to 1280 x 720. The hardware used is a Digilent Arty A7 and PMOD boards for I2S2, VGA, and MicroSD. We previously covered this project back when it was first getting started.

Getting from 800 x 600 to 1280 x 720 — 31% more pixels — required implementing a higher performance JPEG decoder that can read in the MPJEG frames, pushing out a pixel every 2.1 clock cycles. The improvements also include a few convenience features such as an IR remote. The number of submodules inside the system is just incredible, with most of them being implemented or tweaked by [ultraembedded] himself.

For the FPGA Verilog, there’s the SD/MMC interface, the JPEG decoder, the audio controller, the DVI framebuffer, a peripheral core, and a custom RISC-V CPU. For the firmware loaded off the SD card, it uses a custom RTOS running an MP3 decoder, a FAT32 interface, an IR decoder, and a UI based on LVGL.

We think this project represents a wonderful culmination of all the different IP cores that [ultraembedded] has produced over the years. All the code for the FPGA media player is available on GitHub.

Continue reading “Pushing The FPGA Video Player Further” →