Ethernet From First Principles

For someone programming in a high-level language like Python, or even for people who interact primarily with their operating system and the software running on it, it can seem like the computer hardware is largely divorced from the work. Yes, the computer has to be physically present to do something like write a Hackaday article, but most of us will not understand the Assembly language, machine code, or transistor layout well enough to build up to what makes a browser run. [Francis Stokes] is a different breed, though, continually probing these mysterious low-level regions of our computerized world where he was recently able to send an Ethernet packet from scratch.

Continue reading “Ethernet From First Principles”

This Week In Security: Hardware Attacks, IoT Security, And More

This week starts off with examinations of a couple hardware attacks that you might have considered impractical. Take a Ball Grid Array (BGA) NAND removal attack, for instance. The idea is that a NAND chip might contain useful information in the form of firmware or hard-coded secrets.

The question is whether a BGA desolder job puts this sort of approach out of the reach of most attackers. Now, this is Hackaday. We regularly cover how our readers do BGA solder jobs, so it should come as no surprise to us that less than two-hundred Euro worth of tools, and a little know-how and bravery, was all it took to extract this chip. Plop it onto a pogo-pin equipped reader, use some sketchy Windows software, and boom you’ve got firmware.

What exactly to do with that firmware access is a little less straightforward. If the firmware is unencrypted and there’s not a cryptographic signature, then you can just modify the firmware. Many devices include signature checking at boot, so that limits the attack to finding vulnerabilities and searching for embedded secrets. And then worst case, some platforms use entirely encrypted firmware. That means there’s another challenge, of either recovering the key, or finding a weakness in the encryption scheme. Continue reading “This Week In Security: Hardware Attacks, IoT Security, And More”

3D Printed Hardware Sorter Keeps It Simple

If you’re like us, you’ve got at least one bin dedicated to keeping the random hardware you just can’t bear to part with. In our case it’s mostly populated with the nuts and bolts left over after finishing up a car repair, but however it gets filled, it’s a mess. The degree to which you can tolerate this mess will vary, but for [EmGi], even a moderately untidy pile of bolts was enough to spur this entirely 3D-printed mechanical bolt sorter.

The elements of this machine bear a strong resemblance to a lot of the sorting mechanisms we’ve seen used on automated manufacturing and assembly lines. The process starts with a hopper full of M3 cap head bolts of varying lengths, which are collated by a pair of elevating platforms. These line up the bolts and lift them onto a slotted feed ramp, which lets them dangle by their heads and pushes them into a fixture that moves them through a 90° arc and presents them to a long sorting ramp. The ramp has a series of increasingly longer slots; bolts roll right over the slots until they find the right slot, where they fall into a bin below. Nuts can also feed through the process and get sorted into their own bin.

What we like about [EmGi]’s design is its simplicity. There are no motors, bearings, springs, or other hardware — except for the hardware you’re sorting, of course. The entire machine is manually powered, so you can just grab a handful of hardware and start sorting. True, it can only sort M3 cap head bolts, but we suspect the design could be modified easily for other sizes and styles of fasteners. Check it out in action in the video below.

Just because it’s simple doesn’t mean we don’t like more complicated hardware sorters, like the ones [Christopher Helmke] builds.

Continue reading “3D Printed Hardware Sorter Keeps It Simple”

A Robust Guide To The Xbox 360 Glitch Hack

The Xbox 360 was a difficult console to jailbreak. Microsoft didn’t want anyone running unsigned code, and darn if they didn’t make it difficult to do so. However, some nifty out of the box thinking and tricky techniques cracked it open like a coconut with a crack in it. For the low down, [15432] has a great in-depth article on how it was achieved. The article is in Russian, so you’ll want to be armed with Google Translate for this one.

The article gets right into the juice of how glitch attacks work—in general, and with regards to the Xbox 360. In the specific case of the console, it was all down to the processor’s RESET line. Flicker it quickly enough, and the processor doesn’t actually reset, but nonetheless its behavior changes. If you time the glitch right, you can get the processor to continue running through the bootloader’s instructions even if a hash check instruction failed. Of course, timing it right was hard, so it helps to temporarily slow down the processor.

From there, the article continues to explore the many and varied ways this hack played out against Microsoft’s copy protection across multiple models and revisions of the Xbox 360. The bit with the BGA ball connections is particularly inspired. [15432] also goes even deeper into a look at how the battle around the Xb0x 360’s DVD-ROM drive got heated.

We seldom talk about the Xbox 360 these days, but they used to grace these pages on the regular. Video after the break.

Continue reading “A Robust Guide To The Xbox 360 Glitch Hack”

Teardowns Show Off Serious Satellite Hardware

As hackers, we’re always pulling stuff apart—sometimes just to see what it’s like inside. Most of us have seen the inside of a computer, television, and phone. These are all common items that we come into contact with every day. Fewer of us have dived inside real spacey satellite hardware, if only for the lack of opportunity. Some good gear has landed on [Don]’s desk over the years though, so he got to pulling it apart and peering inside.

[Don] starts us off with a gorgeous… box… of some sort from Hughes Aircraft. He believes it to be from their Space & Communications group, and it seems to have something to do with satellite communications work. Externally, he gleans that it takes power and data hookups and outputs RF to, something… but he’s not entirely sure. Inside, we get a look at the old 90s electronics — lots of through hole, lots of big chunky components, and plenty of gold plating. [Don] breaks down the circuitry into various chunks and tries to make sense of it, determining that it’s got some high frequency RF generators in the 20 to 40 GHz range.

Scroll through the rest of [Don]’s thread and you’ll find more gems. He pulls apart a microwave transmitter from Space Micro — a much newer unit built somewhere around 2008-2011. Then he dives into a mysterious I/O board from Broad Reach, and a very old Hughes travelling wave tube from the 1970s. The latter even has a loose link to the Ford Motor Company, believe it or not.

Even if you don’t know precisely what you’re looking at, it’s still supremely interesting stuff—and all very satellite-y. We’ve seen some other neat satellite gear pulled apart before, too. Meanwhile, if you’ve been doing your own neat teardowns, don’t hesitate to let us know!

Real Time Hacking Of A Supermarket Toy

Sometimes those moments arise when a new device comes on the market and hardware hackers immediately take to it. Over a few days, an observer can watch them reverse engineer it and have all sorts of fun making it do things it wasn’t intended to by the original manufacturer. We’re watching this happen in real time from afar this morning, as Dutch hackers are snapping up a promotional kids’ game from a supermarket (mixed Dutch/English, the site rejects Google Translate).

The Albert Heijn soundbox is a small handheld device with a barcode reader and a speaker, and as far as we can see it forms part of an animal identification card game. The cards have a barcode on the back, and sliding them through a reader causes a sample of that animal’s sound to be played. They’re attractively cheap, so of course someone had to take a look inside. So far the parts including the microcontroller have been identified, the ROM has been dumped and the audio reverse-engineered, and the barcode format has been cracked. Still to come are the insertion of custom audio or codes and arbitrary code execution, but knowing these hackers that won’t take long. If you’re Dutch, we suggest you head over to your local Albert Heijn with a few euros, and join in the fun.

European supermarkets can be fruitful places for the hardware hacker, as we’ve shown you before.

Putting A Pi In A Container

Docker and other containerization applications have changed a lot about the way that developers create new software as well as how they maintain virtual machines. Not only does containerization reduce the system resources needed for something that might otherwise be done in a virtual machine, but it standardizes the development environment for software and dramatically reduces the complexity of deploying on different computers. There are some other tricks up the sleeves as well, and this project called PI-CI uses Docker to containerize an entire Raspberry Pi.

The Pi container emulates an entire Raspberry Pi from the ground up, allowing anyone that wants to deploy software on one to test it out without needing to do so on actual hardware. All of the configuration can be done from inside the container. When all the setup is completed and the desired software installed in the container, the container can be converted to an .img file that can be put on a microSD card and installed on real hardware, with support for the Pi models 3, 4, and 5. There’s also support for using Ansible, a Docker automation system that makes administering a cluster or array of computers easier.

Docker can be an incredibly powerful tool for developing and deploying software, and tools like this can make the process as straightforward as possible. It does have a bit of a learning curve, though, since sharing operating system tools instead of virtualizing hardware can take a bit of time to wrap one’s mind around. If you’re new to the game take a look at this guide to setting up your first Docker container.