A light blue marker with a two-pin header replacing the tip, being pressed against the back of the keypad baord that's removed from the safe

Anyone Can Be The Master Of This Master Lock Safe

June 5, 2022 by Arya Voronova 21 Comments

[Etienne Sellan] got one of these lovely $5 logic analyzers. As with any shiny new tool, he started looking for things to investigate with it, and his gaze fell on a Sentry Safe (produced by Master Lock). On the surface level, this keypad-equipped safe is designed decently when it comes to privilege separation. You can take the keypad board off and access its backside, but the keypad doesn’t make any decisions, it merely sends the digits to a different board embedded behind the safe’s door. The solenoid-connected board receives the PIN, verifies it, and then controls the solenoid that unlocks the safe.

[Etienne] hooked up a logic analyzer to the communication wire, which turned out to be a UART channel, and logged the keypad communication packets — both for password entry and for password change. Then, he wrote some Arduino code to send the same packets manually, which worked wonders. Bruteforcing wasn’t viable, however, due to rate limitation in the solenoid controller. Something drew his attention from there – if you want to change the password, the keypad requires you enter the factory code, unique to each safe and supplied in the instruction manual. That code entry is a separate kind of packet from the “change password” one.

More after the break…

Continue reading “Anyone Can Be The Master Of This Master Lock Safe” →

Photo of the spectrophotometer in question, with a screenshot of the decoding software on the right

Exporting Data From Old Gear Through LCD Sniffing

May 5, 2022 by Arya Voronova 27 Comments

[Jure Spiler] was at a flea market and got himself a spectrophotometer — a device that measures absorbance and transmittance of light at different wavelengths. This particular model seems to be about 25 years old, and it’s controlled by a built-in keyboard and uses a graphical LCD to display collected data. That might have been acceptable when it was made, but it wasn’t enough for [Jure]. Since he wanted to plot the spectrophotometry data and be able to save it into a CSV file, hacking ensued.

He decided to tap into the the display communication lines. This 128×64 graphical display, PC-1206B, uses a 8-bit interface, so with a 16-channel logic analyzer, he could see the data being sent to the display. He even wrote decoder software – taking CSV files from the logic analyzer and using primitive optical recognition on the decoded pixels to determine the digits being shown, and drawing a nice wavelength to absorbance graph. From there, he set out to make a standalone device sniffing the data bus and creating a stream of data he could send to a computer for storage and processing.

[Jure] stumbled into a roadblock, however, when he tried to use an Arduino for this task. Even using a sped-up GPIO library (as opposed to notoriously inefficient digitalRead), he couldn’t get a readout frequency higher than 80 KHz – with the required IO readout rate deemed as 1 MHz, something else would be called for. We do wonder if something like RP2040 with its PIO machinery would be better for making such captures.

At that point, however, he found out that there’s undocumented serial output on one of the pins of the spectrophotometer’s expansion port, and is currently investigating that, having shelved the LCD sniffing direction. Nevertheless, this serves as yet another example for us, for those times when an LCD connection is all that we can make use of.

We’ve seen hackers sniff LCD interfaces to get data from reflow ovens, take screenshots from Game Boys and even equip them with HDMI and VGA ports afterwards. With a skill like this, you can even give a new life to a vintage calculator with a decayed display! Got an LCD-equipped device but unsure about which specific controller it uses? We’ve talked about that!

Continue reading “Exporting Data From Old Gear Through LCD Sniffing” →

Screenshot of Pulseview showing capture and decode of some digital channels

Need A Logic Analyzer? Use Your Pico!

March 2, 2022 by Arya Voronova 25 Comments

There’s a slew of hardware hacker problems that a logic analyzer is in a perfect position to solve. Whether you’re trying to understand why an SPI LCD screen doesn’t initialize, what’s up with your I2C bus, or determine the speed of an UART connection, you’ll really want to have a logic analyzer on hand. People have been using a Pi Pico as a logic analyzer in a pinch, and now [pico-coder] has shared a sigrok driver that adds proper support for a Pico to beloved tools like Pulseview.

The specs offered are impressive. Compared to the $10 “Saleae” clone analyzers we are so used to, this thing boasts 21 digital channels with up to 120 MHz capture speed, 3 ADC channels at up to 500 KHz, and hardware-based triggers. The GitHub repository linked above stores the driver files out-of-tree, but provides build instructions together with an easily flash-able uf2 firmware. It’s likely that you’ll soon see this driver in a stock Pulseview installation, however, given the submitter-friendly attitude we’ve witnessed on the sigrok mailing list. However, if you need a logic analyzer ASAP, you should follow the caringly offered quickstart guide.

We’ve covered Pulseview being used in combination with cheap accessible analyzers before — a must-watch if you need to get yourself up to speed on the value they provide to a hobbyist. If an oscilloscope is what you need and a smartphone is what you have, perhaps you’ll enjoy the Scoppy firmware for the Pico.

We thank [mip] for sharing this with us!

Logic Meter Aims To Make Hobby Electronics Troubleshooting Easier

January 28, 2021 by Dan Maloney 28 Comments

The basic test instrument suite — a bench power supply, a good multimeter and perhaps an oscilloscope — is extremely flexible, but not exactly “plug and play” when it comes to diagnosing problems with some common hardware setups. A problem with a servo driver, for example, might be easy enough to sort of with a scope, but setting everything up to see what’s going on with the PWM signal takes some time.

There’s got to be a better way to diagnose hobby electronics woes, and if [Bob Alexander] has his way, his “Logic Meter”, or something very close to it, will be the next must-have bench tool. The Logic Meter combines some of the functionality of an oscilloscope and a logic analyzer into a handy instrument that’s as easy to use as a multimeter. The Logic Meter’s probes connect to logic-level signals in a circuit and can be set up to capture or send serial data, either directly to or from a UART or via an SPI bus connection. There are also functions for testing servos and similar devices with a configurable PWM output. [Bob] rounds out the functionality with a GPS simulator and a simple logic analyzer, plus some utility functions.

The beauty part of the Logic Meter is that [Bob] has left where it goes next largely up to the community. He’s got a GitHub repo with details on the PIC32-based hardware, and the video below makes it clear that this is just a jumping-off point to further work that he hopes results in a commercial version of the Logic Meter. That’s a refreshing attitude, and we hope it pays off; from the look of a few of [Bob]’s retrocomputing makeovers, something like the Logic Meter could come in pretty handy.

Continue reading “Logic Meter Aims To Make Hobby Electronics Troubleshooting Easier” →

Teaching A Pocket Logic Analyzer (Many) New Tricks

October 1, 2020 by Tom Nardi 8 Comments

A few years ago, low-cost pocket digital oscilloscopes aimed at the hacker and maker crowd started hitting the market and gained quite a following. While few would consider them to be a replacement for a proper bench scope, they’re cheap and convenient enough that it’s hard to complain. Manufacturers are apparently looking to expand on the concept, as we’re now seeing similarly priced and sized logic analyzers pop up from the usual sources.

[Gabriel Valky] got his hands on a sub-$100 USD model known as the LA104, and decided that the stock software didn’t quite deliver. So he started a project to create a new open source firmware for the affordable gadget that greatly expands its core functionalities. The code has even been ported to a few of those digital oscilloscopes, as it turns out (perhaps unsurprisingly) that they aren’t too far removed internally.

Controlling addressable LEDs with the LA104.

In the video after the break, [Gabriel] shows off some impressive radio tricks by adding a small CC1101 transceiver to the mix. This allows his modified LA104 to scan for and decode popular RF protocols in the 300 – 900 MHz range. His software even allows for the received packets to be modified and re-transmitted, which he demonstrates by pushing a fake temperature signal into a wireless weather station.

But that’s just the beginning. A perusal of the GitHub page for his replacement firmware shows just how many features have already been packed into this project. For example it can be used to control WS2812 LED strips, generate arbitrary PWM signals, log data from temperature sensors, interface with MIDI devices, and scan for I2C devices. Many of these functions can be controlled on the computer by utilizing a modern browser and WebUSB.

The replacement firmware that [Gabriel] has come up with for the LA104 is really an incredible accomplishment, and elevates an already intriguing piece of kit. Being able to pack all of these functions into something small and cheap enough you can toss into a bag is a very compelling prospect for hackers on the go.

Continue reading “Teaching A Pocket Logic Analyzer (Many) New Tricks” →

Bus Sniffing Leads To New Display For Vintage Casio

March 8, 2020 by Tom Nardi 12 Comments

Despite his best efforts to repair the LCD on his Casio FX-702P, it soon became clear to [Andrew Menadue] that it was a dead-end. Rather than toss this relatively valuable device in the trash, he wondered if would be possible to replace the LCD with a more modern display. Knowing that reverse engineering the LCD panel itself would be quite a challenge, he decided instead to focus his efforts on decoding the communications between the calculator’s processor and display controller.

With his logic analyzer connected to the Casio’s four bit bus [Andrew] was able to capture a sequence of bytes during startup that looked promising, although it didn’t quite make sense at first. He had to reverse the order of each nibble, pair them back up into bytes, and then consult the FX-702P’s character map as the device doesn’t use ASCII. This allowed him to decode the message “READY”, and proved the concept was viable.

Of course a calculator with a logic analyzer permanently attached to it isn’t exactly ideal, so he started work on something a bit more compact. Armed with plenty of display controller data dumps, [Andrew] wrote some code for a STM32 “Blue Pill” ARM Cortex M3 microcontroller that would sniff and decode the data in near real-time. In the video after the break you can see there’s a slight delay between when he pushes a button and when the corresponding character comes up on the LCD below, but it’s certainly usable.

Unfortunately, the hardware he’s created for this hack is just slightly too large to fit inside the calculator proper. The new LCD is also nowhere near the size and shape that would be required to replace the original one. But none of that really matters. While [Andrew] says he could certainly make the electronics smaller, the goal was never to restore the calculator to like-new condition. Sometimes it’s more about the journey than the destination.

Continue reading “Bus Sniffing Leads To New Display For Vintage Casio” →

Unlocking SIM Cards With A Logic Analyzer

January 2, 2020 by Tom Nardi 20 Comments

[Jason Gin] wanted to reuse the SIM card that came with a ZTE WF721 wireless terminal he got from AT&T, but as he expected, it was locked to the device. Unfortunately, the terminal has no function to change the PIN and none of the defaults he tried seemed to work. The only thing left to do was crack it open and sniff the PIN with a logic analyzer.

This project is a fantastic example of the kind of reverse engineering you can pull off with even a cheap logic analyzer and a keen eye, but also perfectly illustrates the fact that having physical access to a device largely negates any security measures the manufacturer tries to implement. [Jason] already knew what the SIM unlock command would look like; he just needed to capture the exchange between the WF721 and SIM card, find the correct byte sequence, and look at the bytes directly after it.

Finding the test pads on the rear of the SIM slot, he wired his DSLogic Plus logic analyzer up to the VCC, CLK, RST, and I/O pins, then found a convenient place to attach his ground wire. After a bit of fiddling, he determined the SIM card was being run at 4 MHz, so he needed to configure a baud rate of 250 kbit/s to read the UART messages passing between the devices.

Once he found the bytes that signified successful unlocking, he was able to work his way backwards and determine the unlock command and its PIN code. It turns out the PIN was even being sent over the wire in plain text, though with the way security is often handled these days, we can’t say it surprises us. All [Jason] had to do then was put the SIM in his phone and punch in the sniffed PIN when prompted.

Could [Jason] have just run out to the store and picked up a prepaid SIM instead of cracking open this wireless terminal and sniffing its communications with a logic analyzer? Of course. But where’s the fun in that?