<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>irq5 test</title><link>https://irq5-7854a1fdb9f4.pages.dev/</link><description>Recent content on irq5 test</description><language>en-us</language><lastBuildDate>Mon, 01 Jan 2024 00:00:00 +0000</lastBuildDate><atom:link href="https://irq5-7854a1fdb9f4.pages.dev/feed/" rel="self" type="application/rss+xml"/><item><title>Fixing My Vintage Mirror with 3D Printing</title><link>https://irq5-7854a1fdb9f4.pages.dev/2024/01/fixing-my-vintage-mirror-with-3d-printing/</link><pubDate>Mon, 01 Jan 2024 00:00:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2024/01/fixing-my-vintage-mirror-with-3d-printing/</guid><description>&lt;p>Some painters came over to give my house a new coat of paint for the new year,
and in the process wrecked my vintage bathroom mirror.
We have what&amp;rsquo;s called a &lt;em>tilting mirror&lt;/em> or &lt;em>pivot mirror&lt;/em> in the bathroom area,
which we have been using for at least 50 years in the household.
We adjust the mirror tilt every day for decades and it has never broke.
This style of mirror is quite uncommon these days, perhaps because it has gone out of fashion.&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2024/img/bracket_1304.jpg.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2024/img/bracket_1304.jpg alt="broken mirror bracket, snapped off at the screw portion with the thumbnut still attached" width=1280 height=853>&lt;/picture>&lt;/p>&lt;p>Looking at the damage, it was clear they forcefully tried to remove the nuts securing
the mirror and it just snapped off.
The other bracket on the opposite side broke off too, but at a different location.
I&amp;rsquo;m no metallurgist but it looks like the part was made from cast iron or something, and therefore quite brittle.
For years now I didn&amp;rsquo;t dare to dismantle the mirror for exactly this reason:
the thumbnut loosens up till a certain point then refuse to go further,
which is also why I left it in place.
I have already removed everything I could for them - toothbrush holders,
any hanging towels and racks. Anything else still left on the wall is obviously not removable,
or I would have done so already.
&lt;strong>But these fuckers took it upon themselves to try to remove the mirror when I left them alone for an hour.
To say I was very pissed is an understatement.&lt;/strong>&lt;/p>&lt;p>When they told me they broke the mirror, I thought they had shattered the mirror glass.
I was at least a little hopeful when I saw they had placed the mirror under the sink.
Still, I was at a loss of how to fix the mirror, until the idea of leveraging 3D printing hit me days later.
I&amp;rsquo;ve known about it since the MakerBot days (and it was a hot topic at &lt;a href=https://irq5-7854a1fdb9f4.pages.dev/tag/makerfaire/ rel=noopener>maker faires&lt;/a>) but since I don&amp;rsquo;t have a 3D printer or easy access to one,
it was just something I didn&amp;rsquo;t care too much about.&lt;/p>&lt;p>What is in its place now is a piece of IKEA BLODLÖNN, which I have used 3M Command strips to
temporarily hold in place, while I tried to learn enough FreeCAD to design a replacement bracket.
Buying IKEA was the cheapest option, and I had an inkling that learning FreeCAD from scratch was going to be a steep learning curve, so we needed something to use in the meantime
(we kept looking up but finding ourselves staring at a blank wall).
You can see the metal supports arms for the tilting mirror are left intact on the wall,
but now painted white&lt;sup id=fnref:1>&lt;a href=#fn:1 class=footnote-ref role=doc-noteref>1&lt;/a>&lt;/sup>.&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2024/img/blodlonn_1318.jpg.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2024/img/blodlonn_1318.jpg alt="white wall with a piece of BLODLÖNN mirror, flanked by metal support arms for the old mirror" width=1280 height=853>&lt;/picture>&lt;/p>&lt;p>Follow me as I detail how difficult it is for someone with zero experience like myself
to learn FreeCAD, which hopefully inspires you not to give up, and the final results of my journey.&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2024/01/fixing-my-vintage-mirror-with-3d-printing/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Setting Up a Zigbee Sensor Network</title><link>https://irq5-7854a1fdb9f4.pages.dev/2022/01/setting-up-a-zigbee-sensor-network/</link><pubDate>Tue, 04 Jan 2022 23:52:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2022/01/setting-up-a-zigbee-sensor-network/</guid><description>&lt;p>The advantage of Zigbee devices is that they are very low power, and they communicate in a wireless mesh network.
The sensors are small and can work off a CR2032 coin cell for at least 2 years, maybe more.
Depending on the type of sensor, they cost around US$10 and are readily available from various manufacturers,
such as Xiaomi, Aqara (pictured below) or IKEA under their TRÅDFRI range of products.&lt;/p>&lt;p>You typically pair these sensors with a &lt;em>Zigbee gateway&lt;/em>, which speaks the IEEE 802.15.4 protocol and relays the information (e.g. sensor readings) to either your mobile app or stores it in the cloud (or the gateway itself).
But as you can imagine, a Raspberry Pi with the right adapter can do this job and offer more flexibility.&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2022/img/zigbee-apu4-0888.jpg.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2022/img/zigbee-apu4-0888.jpg alt width=1280 height=853>&lt;/picture>&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2022/01/setting-up-a-zigbee-sensor-network/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Using U2F for Door Access Control Systems</title><link>https://irq5-7854a1fdb9f4.pages.dev/2021/07/using-u2f-for-door-access-control-systems/</link><pubDate>Fri, 02 Jul 2021 00:00:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2021/07/using-u2f-for-door-access-control-systems/</guid><description>&lt;p>I was looking at trying to &lt;em>securely&lt;/em> implement a door access control system.
This usually involves some kind of card that you tap at a reader and the door unlocks.&lt;/p>&lt;p>Because it uses NFC, the NFC reader and electronics can be
located safely on the inside, leaving no exposed DIY electronics on the outside for attackers to fiddle around with.
Here&amp;rsquo;s an example project using a 3D-printed enclosure:&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2021/img/nfc-lock-qtechknow-FFOTW1TI7L6T5HL.jpg.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2021/img/nfc-lock-qtechknow-FFOTW1TI7L6T5HL.jpg alt="photo of a DIY NFC door lock found on Instructables.com, with all the electronics &amp; parts on the interior side of the door" width=1620 height=1080>&lt;/picture>&lt;/p>&lt;p>A lot of those DIY projects &lt;em>work&lt;/em>, but they are just not secure:&lt;/p>&lt;ul>&lt;li>&lt;a href=http://www.instructables.com/NFC-Door-Lock-with-the-Qduino-Mini-under-100/ rel=noopener target=_blank class=external>NFC Door Lock With the Qduino Mini &amp;ndash; Instructables.com&lt;/a>&lt;/li>&lt;li>&lt;a href=http://keyduino.forumsactifs.com/t4-nfc-drawer-lock rel=noopener target=_blank class=external>NFC drawer lock&lt;/a>&lt;/li>&lt;li>&lt;a href=https://www.makeuseof.com/tag/diy-smart-lock-arduino-rfid/ rel=noopener target=_blank class=external>DIY Smart Lock with Arduino and RFID&lt;/a>&lt;/li>&lt;/ul>&lt;p>Just look at the code and you will see what I mean.
They generally look like this:&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-c data-lang=c>&lt;span class=line>&lt;span class=cl>&lt;span class=kt>uint32_t&lt;/span> &lt;span class=n>uid&lt;/span> &lt;span class=o>=&lt;/span> &lt;span class=n>nfc&lt;/span>&lt;span class=p>.&lt;/span>&lt;span class=n>readCardId&lt;/span>&lt;span class=p>();&lt;/span> &lt;span class=c1 translate>// read the card&amp;#39;s unique ID
&lt;/span>&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=c1 translate>&lt;/span>&lt;span class=k>if&lt;/span> &lt;span class=p>(&lt;/span>&lt;span class=n>uid&lt;/span> &lt;span class=o>==&lt;/span> &lt;span class=mh>0xAAAAAAAA&lt;/span> &lt;span class=o>||&lt;/span> &lt;span class=n>uid&lt;/span> &lt;span class=o>==&lt;/span> &lt;span class=mh>0xBBBBBBBB&lt;/span> &lt;span class=o>||&lt;/span> &lt;span class=p>...)&lt;/span> &lt;span class=p>{&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> &lt;span class=n>unlock&lt;/span>&lt;span class=p>();&lt;/span> &lt;span class=c1 translate>// YES!!
&lt;/span>&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=c1 translate>&lt;/span>&lt;span class=p>}&lt;/span>&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>Unfortunately, consumer smart locks like a Yale or Samsung do pretty much the same thing,
without hard-coding UIDs of course.
When you enroll cards, the door lock will simply record the UID and will unlock
when you present a card (or tag) with that UID.
&lt;a href=https://learn.adafruit.com/adafruit-pn532-rfid-nfc/mifare rel=noopener target=_blank class=external>MIFARE Classic cards&lt;/a>
are commonly used for this purpose because they are very inexpensive.
They are factory-programmed with a unique identifier stored in sector 0,
which is read-only.&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2021/07/using-u2f-for-door-access-control-systems/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Custom Firmware for the Xiaomi AX3600 Wireless Router</title><link>https://irq5-7854a1fdb9f4.pages.dev/2020/08/custom-firmware-for-the-xiaomi-ax3600-wireless-router/</link><pubDate>Mon, 10 Aug 2020 23:53:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2020/08/custom-firmware-for-the-xiaomi-ax3600-wireless-router/</guid><description>&lt;p>As I have &lt;a href=https://irq5-7854a1fdb9f4.pages.dev/2020/07/xiaomi-aiot-wireless-router-ax3600-review/ rel=noopener>mentioned in the review&lt;/a>, the stock firmware on the &lt;strong>Xiaomi AX3600 wireless router&lt;/strong> is extremely limiting. On top of that, the firmware is also locked to install only authorized updates from the manufacturer.
If you have been following the blog, you will know that I like &lt;a href=https://irq5-7854a1fdb9f4.pages.dev/tag/asuswrt/ rel=noopener>the flexibility that ASUSWRT provides&lt;/a> for customizing my router.&lt;/p>&lt;p>While there is currently an on-going effort to try and port vanilla OpenWRT for this router,
I suspect that might take some time.
In this post, I describe how to workaround the lousy firmware and configure the router with the advanced features I need.&lt;/p>&lt;h1 id=router-disassembly>Router Disassembly&lt;/h1>&lt;p>It is recommended to have UART access handy, in case something bad happens and you need to recover your router,
or if you want access to U-Boot, the bootloader.
This would require you to crack open your router, so you might only want to do this if necessary.
&lt;strong>Feel free to skip this section if you are not interested in the hardware, or don&amp;rsquo;t need low-level access.&lt;/strong>&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2020/img/50192590117_c462cfd63a_7171.jpg.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2020/img/50192590117_c462cfd63a_7171.jpg alt="router top view, with cover opened" width=1023 height=682>&lt;/picture>&lt;/p>&lt;p>You need to unscrew 5 screws, 4 of which are hidden under the rubber feet, and one under the center sticker label.
In the disassembled top view photo here, you can see the screw holes at the corners, as well as a missing chunk in the center of the heatsink for the mating screw post, directly aligned with the AIoT antenna and indicator LEDs.&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2020/08/custom-firmware-for-the-xiaomi-ax3600-wireless-router/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Xiaomi AIoT Wireless Router AX3600 Review</title><link>https://irq5-7854a1fdb9f4.pages.dev/2020/07/xiaomi-aiot-wireless-router-ax3600-review/</link><pubDate>Mon, 13 Jul 2020 00:00:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2020/07/xiaomi-aiot-wireless-router-ax3600-review/</guid><description>&lt;p>I recently bought the &lt;strong>Xiaomi AIoT AX3600 wireless router&lt;/strong> to experience WiFi 6 (or 802.11ax).
This WiFi 6 router has been touted as having very good hardware specs for under US$100.
After checking out a few reviews, it looked like you could achieve close to Gigabit speeds over a wireless link,
which was pretty exciting. It reminded me of the time I upgraded my home network to Gigabit and could finally copy large files over the network quickly.
I decided to get my hands on one and evaluate it with some speed tests around the house.&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2020/img/ax3600-router.jpg.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2020/img/ax3600-router.jpg alt="the Xiaomi AX3600 wireless router" width=1280 height=853>&lt;/picture>&lt;/p>&lt;p>I don&amp;rsquo;t have any compatible WiFi 6 devices yet, so I ordered an Intel AX200NGW wireless card to replace the one in my laptop. These cards typically go for US$15 on AliExpress or eBay.&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2020/07/xiaomi-aiot-wireless-router-ax3600-review/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Batch Binary Analysis with IDA Pro 7.4 Automation</title><link>https://irq5-7854a1fdb9f4.pages.dev/2020/05/batch-binary-analysis-with-ida-pro-7.4-automation/</link><pubDate>Fri, 22 May 2020 00:00:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2020/05/batch-binary-analysis-with-ida-pro-7.4-automation/</guid><description>&lt;p>It is easy to script analysis steps with IDAPython, but now we want to automate
this analysis over, let&amp;rsquo;s say, 10,000 files.
I did a quick Google and I couldn&amp;rsquo;t find a guide on how to perform batch
binary analysis tasks by automating IDA Pro 7.x.&lt;/p>&lt;p>Unfamiliar with this, I was constantly guessing whether it was the command-line arguments,
the script, or a combination of both that was not working.
I&amp;rsquo;m sharing my experince here so you won&amp;rsquo;t have to be fumbling around like I was.&lt;/p>&lt;p>I will be using IDA Pro for Windows here, but it should be applicable to any of
their supported platforms like Mac or Linux.&lt;/p>&lt;h1 id=simple-binary-analysis>Simple Binary Analysis&lt;/h1>&lt;p>Let&amp;rsquo;s write some simple IDAPython analysis script and run it within the IDA Pro console.
This script loops through all functions in the executable and prints out its
address and name:&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-python data-lang=python>&lt;span class=line>&lt;span class=cl>&lt;span class=kn>import&lt;/span> &lt;span class=nn>idc&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=kn>import&lt;/span> &lt;span class=nn>idautils&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=nb>print&lt;/span> &lt;span class=s1>&amp;#39;count &lt;/span>&lt;span class=si>%d&lt;/span>&lt;span class=s1>&amp;#39;&lt;/span> &lt;span class=o>%&lt;/span> &lt;span class=nb>len&lt;/span>&lt;span class=p>(&lt;/span>&lt;span class=nb>list&lt;/span>&lt;span class=p>(&lt;/span>&lt;span class=n>idautils&lt;/span>&lt;span class=o>.&lt;/span>&lt;span class=n>Functions&lt;/span>&lt;span class=p>()))&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=k>for&lt;/span> &lt;span class=n>ea&lt;/span> &lt;span class=ow>in&lt;/span> &lt;span class=n>idautils&lt;/span>&lt;span class=o>.&lt;/span>&lt;span class=n>Functions&lt;/span>&lt;span class=p>():&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> &lt;span class=nb>print&lt;/span> &lt;span class=nb>hex&lt;/span>&lt;span class=p>(&lt;/span>&lt;span class=n>ea&lt;/span>&lt;span class=p>),&lt;/span> &lt;span class=n>idc&lt;/span>&lt;span class=o>.&lt;/span>&lt;span class=n>get_func_name&lt;/span>&lt;span class=p>(&lt;/span>&lt;span class=n>ea&lt;/span>&lt;span class=p>)&lt;/span>&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>The &lt;code>idautils&lt;/code> module contains higher-level functionality like getting a list of
functions, or finding code &amp; data references to addresses.
If you are familiar with IDC scripting, most of the functions by the same name
can be found within the &lt;code>idc&lt;/code> module.
This is not really meant to be an IDAPython or IDC scripting tutorial,
so you will need to look elsewhere for that.&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2020/05/batch-binary-analysis-with-ida-pro-7.4-automation/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Generating Small Static Binaries</title><link>https://irq5-7854a1fdb9f4.pages.dev/2019/09/generating-small-static-binaries/</link><pubDate>Mon, 30 Sep 2019 11:59:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2019/09/generating-small-static-binaries/</guid><description>&lt;p>I&amp;rsquo;ve recently seen some shell script that tries to test for your OS architecture
by running executables encoded within.
There&amp;rsquo;s one for i386 (x86 platforms) and a few for ARM variants.&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-bash data-lang=bash>&lt;span class=line>&lt;span class=cl>test_i386&lt;span class=o>()&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=o>{&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>cat &lt;span class=s>&amp;lt;&amp;lt; EOF | $_base64 &amp;gt; /tmp/archtest &amp;amp;&amp;amp; chmod a+x /tmp/archtest
&lt;/span>&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=s>f0VMRgEBAQAAAAAAAAAAAAIAAwABAAAA5oAECDQAAACoEAAAAAAAADQAIAAEAC
&lt;/span>&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=s>AAAAAIAECACABAgUBwAAFAcAAAUAAAAAEAAAAQAAANwPAADcnwQI3J8ECDgAAA
&lt;/span>&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=s> . . .
&lt;/span>&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=s>AAAAAAAgAAAAAAAAAFYAAAABAAAAMAAAAAAAAAAUEAAAMgAAAAAAAAAAAAAAAQ
&lt;/span>&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=s>AwAAAAAAAAAAAAAARhAAAF8AAAAAAAAAAAAAAAEAAAAAAAAA
&lt;/span>&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=s>EOF&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>/tmp/archtest &amp;gt; /dev/null 2&amp;gt;&lt;span class=p>&amp;amp;&lt;/span>&lt;span class=m>1&lt;/span> &lt;span class=o>&amp;amp;&amp;amp;&lt;/span> &lt;span class=nv>arch&lt;/span>&lt;span class=o>=&lt;/span>i386
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=o>}&lt;/span>&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>What is terrible (well, to me at least) is that these executables are huge:&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-fallback data-lang=fallback>&lt;span class=line>&lt;span class=cl>$ ls -l *.bin
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>-rwxrwx--- 1 root root 4832 Jul 17 06:58 archtest-armv6.bin
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>-rwxrwx--- 1 root root 4820 Jul 17 06:59 archtest-armv7.bin
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>-rwxrwx--- 1 root root 4992 Jul 17 06:59 archtest-armv8.bin
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>-rwxrwx--- 1 root root 4824 Jul 17 06:57 archtest-x86.bin&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>For one, I&amp;rsquo;m not sure why inspecting &lt;code>/proc/cpuinfo&lt;/code> or &lt;code>uname -a&lt;/code> is not
really sufficient for their needs.
And also, why such large binaries are required.&lt;/p>&lt;p>After all, what you want to do is just to check that it executes successfully.
Were they trying to test for the presence of a working libc?
Nope, because the binaries are statically-linked:&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-fallback data-lang=fallback>&lt;span class=line>&lt;span class=cl>$ file ./archtest-x86.bin
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>./archtest-x86.bin: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>I think this just adds unnecessary bloat.&lt;/p>&lt;p>&lt;strong>There are ways to make smaller binaries.&lt;/strong>&lt;/p>&lt;p>Now, I am not talking about crazy techniques like using assembly language
instead of C, or &lt;a href=https://www.muppetlabs.com/~breadbox/software/tiny/teensy.html rel=noopener target=_blank class=external>making a weird ELF that might load only on Linux&lt;/a>,
but just using normal C and the standard &lt;code>gcc&lt;/code> and &lt;code>binutils&lt;/code>.&lt;/p>&lt;p>Let&amp;rsquo;s get started.&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2019/09/generating-small-static-binaries/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Detailed Wireless Client Stats with collectd</title><link>https://irq5-7854a1fdb9f4.pages.dev/2019/08/detailed-wireless-client-stats-with-collectd/</link><pubDate>Thu, 01 Aug 2019 11:59:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2019/08/detailed-wireless-client-stats-with-collectd/</guid><description>&lt;p>collectd has always been able to grab interface traffic statistics from Linux.
But what if we want to collect data about individual WiFi clients that connect to it?
How much bandwidth is each of the clients using?&lt;/p>&lt;p>That information is already being recorded by the wireless driver; all we need to do is to query it.
Turns out you can do that with the &lt;code>wl&lt;/code> utility.
This is Broadcom&amp;rsquo;s proprietary tool to control and query the wireless interfaces.&lt;/p>&lt;p>To do this, first use &lt;code>wl&lt;/code> to get associated stations:&lt;/p>&lt;pre>&lt;code>wl -i eth2 assoclist
&lt;/code>&lt;/pre>&lt;p>Given a particular MAC address that is associated to the AP, query its info using &lt;code>sta_info&lt;/code>:&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-fallback data-lang=fallback>&lt;span class=line>&lt;span class=cl># wl -i eth2 sta_info d4:a3:00:aa:bb:cc
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>STA d4:a3:00:aa:bb:cc:
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> aid:2
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> rateset [ 6 9 12 18 24 36 48 54 ]
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> idle 0 seconds
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> in network 16 seconds
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> state: AUTHENTICATED ASSOCIATED AUTHORIZED
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> flags 0x11e03b: BRCM WME N_CAP VHT_CAP AMPDU AMSDU
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> HT caps 0x6f: LDPC 40MHz SGI20 SGI40
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> VHT caps 0x43: LDPC SGI80 SU-BFE
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> tx data pkts: 663916
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> tx data bytes: 68730715
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> tx ucast pkts: 155
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> tx ucast bytes: 42699
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> tx mcast/bcast pkts: 663761
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> tx mcast/bcast bytes: 68688016
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> tx failures: 0
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> rx data pkts: 234
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> rx data bytes: 73557
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> rx ucast pkts: 192
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> rx ucast bytes: 62971
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> rx mcast/bcast pkts: 42
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> rx mcast/bcast bytes: 10586
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> rate of last tx pkt: 866667 kbps
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> rate of last rx pkt: 780000 kbps
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> rx decrypt succeeds: 195
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> rx decrypt failures: 1
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> tx data pkts retried: 19
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> tx data pkts retry exhausted: 0
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> per antenna rssi of last rx data frame: -61 -56 -59 0
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> per antenna average rssi of rx data frames: -61 -56 -57 0
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> per antenna noise floor: -104 -98 -98 0&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>The &amp;ldquo;easy way&amp;rdquo; is probably to write a shell script, invoked via the &lt;a href=https://collectd.org/wiki/index.php/Plugin:Exec rel=noopener target=_blank class=external>Exec plugin&lt;/a> that calls &lt;code>wl&lt;/code> multiple times (once per interface, and once for each WiFi client) and uses &lt;code>grep&lt;/code> or &lt;code>awk&lt;/code> to get the information we need.
This won&amp;rsquo;t be performant, of course.&lt;/p>&lt;p>&lt;code>wl&lt;/code> itself does have quite a fair bit of overhead. It does some verification of the provided interface name.
It checks for the Broadcom driver magic to ensure that the interface is a Broadcom device.
It then needs to convert the MAC address from the argument string to binary, and vice-versa.
Sure, that&amp;rsquo;s not really much &amp;ldquo;these days&amp;rdquo;, but we can definitely do better.&lt;/p>&lt;p>Instead, let&amp;rsquo;s short-circuit the process and write a plugin that directly collects the data,
without going through &lt;code>wl&lt;/code>.
This way, we avoid creating several new processes for every query.&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2019/08/detailed-wireless-client-stats-with-collectd/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Data Encryption on Firefox Send</title><link>https://irq5-7854a1fdb9f4.pages.dev/2019/05/data-encryption-on-firefox-send/</link><pubDate>Tue, 14 May 2019 11:59:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2019/05/data-encryption-on-firefox-send/</guid><description>&lt;p>If you haven&amp;rsquo;t heard, &lt;a href=https://send.firefox.com/ rel=noopener target=_blank class=external>Firefox Send&lt;/a> is a service
that solves the problem of sending large attachments without going through email.
It does this in a privacy-preserving manner by encrypting the file in your browser first, before upload.&lt;/p>&lt;p>The concept is simple:&lt;/p>&lt;ol>&lt;li>An encryption key is generated in your browser&lt;/li>&lt;li>Your file is encrypted with that key before being uploaded to the server.&lt;/li>&lt;li>The download URL is returned by the server,
but will only work after the browser appends the secret key to the URL &lt;em>fragment&lt;/em>.&lt;/li>&lt;/ol>&lt;p>Note that URL fragments are never sent to the server.
They are often used for page anchors, and sometimes to keep track of local state in SPA.&lt;/p>&lt;p>This has been made possible through the use of &lt;a href=https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API rel=noopener target=_blank class=external>Web Crypto API&lt;/a> exposed via JavaScript.&lt;/p>&lt;h1 id=technical-details>Technical Details&lt;/h1>&lt;p>The code that powers &lt;a href=https://github.com/mozilla/send rel=noopener target=_blank class=external>Firefox Send is actually open source&lt;/a>,
so you can run your own server, or read the code to figure out exactly how it works.
The encryption details are documented in &lt;a href=https://github.com/mozilla/send/blob/master/docs/encryption.md rel=noopener target=_blank class=external>docs/encryption.md&lt;/a>.&lt;/p>&lt;p>A master key is first generated and from it, a few keys are derived using HKDF SHA-256.
The derived key length depends on its purpose, so for AES-128 encryption, the key will be 128-bit. Oddly though, the Subtle Crypto API returns a a 512-bit key for HMAC SHA-256, which had me stumped for a while.
I wrote some code that you can &lt;a href=https://gist.githack.com/geekman/f9735602f744ebe5fa812f8ba17518c4/raw/webcrypto-hdkf.html rel=noopener target=_blank class=external>try out online&lt;/a>.&lt;/p>&lt;p>Because HKDF is based on a hash algorithm, derived keys are inherently not reversible to obtain the master key from which they were derived (unless the algorithm itself is somehow broken).&lt;/p>&lt;p>3 keys are derived from the master key:&lt;/p>&lt;ol>&lt;li>&lt;strong>Data Encryption key&lt;/strong>. Used to encrypt the actual file contents.&lt;/li>&lt;li>&lt;strong>Authentication key.&lt;/strong> Given to the service and used to authenticate future downloaders.&lt;/li>&lt;li>&lt;strong>Metadata key.&lt;/strong> Used to encrypt the upload manifest (filename and size information) for display.&lt;/li>&lt;/ol>&lt;p>&lt;picture>&lt;source srcset=/posts/2019/img/ffsend-keys.png.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2019/img/ffsend-keys.png alt="keys derived in Firefox Send" width=1574 height=491>&lt;/picture>&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2019/05/data-encryption-on-firefox-send/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>ONV PD3401G PoE Splitter Teardown &amp; Review</title><link>https://irq5-7854a1fdb9f4.pages.dev/2019/04/onv-pd3401g-poe-splitter-teardown-review/</link><pubDate>Tue, 02 Apr 2019 11:59:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2019/04/onv-pd3401g-poe-splitter-teardown-review/</guid><description>&lt;p>Continuing my &lt;a href=https://irq5-7854a1fdb9f4.pages.dev/tag/poe rel=noopener>PoE series&lt;/a>,
I bought the &lt;strong>ONV PD3401G&lt;/strong>, an active PoE splitter that is capable of extracting up to 60W (24V @ 2.5A) from the PSE.
It is housed in a small aluminum extruded case that can be DIN rail mounted.
This splitter is comparatively low-cost, about US$35,
and more importantly, is capable of passing through Gigabit.&lt;/p>&lt;p>ONV seems to be quite a reputable company, so I believe their products shouldn&amp;rsquo;t be too badly designed.
This unit can also be easily purchased on Aliexpress without having to go through some obscure distributor.&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2019/img/47507377741_54f9e66587_2813.jpg.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2019/img/47507377741_54f9e66587_2813.jpg alt="ONV PoE splitter, side view" width=1280 height=853>&lt;/picture>&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2019/img/33630711828_27cb5770a8_2819.jpg.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2019/img/33630711828_27cb5770a8_2819.jpg alt="ONV PoE splitter, front view" width=1280 height=853>&lt;/picture>&lt;/p>&lt;p>Internally it uses the &lt;a href=https://www.analog.com/en/products/lt4275.html rel=noopener target=_blank class=external>LT4275A&lt;/a>
(marking &lt;code>LTGBT&lt;/code>) for PD interfacing.
The &lt;code>A&lt;/code> variant of this chip supports up to 90W of power.
On the power supply side, it uses a &lt;a href="https://www.onsemi.com/PowerSolutions/product.do?id=NCP1034" rel=noopener target=_blank class=external>NCP1034&lt;/a> synchronous buck converter.
The NCP1034 is capable of handling up to 100V, which is more than sufficient for PoE.&lt;/p>&lt;p>Looking inside, the in/out Ethernet ports are connected via a transformer, in order extract power from the center taps of each pair.
We can see that the PCB traces for the input port pairs are thicker to carry the higher currents.
Large beefy diodes form rectifier bridges for the data pairs.&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2019/img/46783600124_a981bb08b6_2807.jpg.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2019/img/46783600124_a981bb08b6_2807.jpg loading=lazy alt="PCB, top side" width=1280 height=853>&lt;/picture>&lt;/p>&lt;p>Surrounding the input port on the underside, there are a lot of unpopulated components; those were supposed to offer input protection,
probably using some TVS of some kind.
these are marked &lt;code>RD1&lt;/code> ~ &lt;code>RD8&lt;/code>, one for each Ethernet wire.&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2019/04/onv-pd3401g-poe-splitter-teardown-review/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>35C3 CTF Write-up: php</title><link>https://irq5-7854a1fdb9f4.pages.dev/2019/01/35c3-ctf-write-up-php/</link><pubDate>Mon, 07 Jan 2019 23:40:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2019/01/35c3-ctf-write-up-php/</guid><description>&lt;h1 id=php-web>php (web)&lt;/h1>&lt;blockquote>&lt;p>PHP&amp;rsquo;s unserialization mechanism can be exceptional. Guest challenge by jvoisin.&lt;/p>&lt;p>Files at &lt;a href=https://35c3ctf.ccc.ac/uploads/php-ff2d1f97076ff25c5d0858616c26fac7.tar rel=noopener target=_blank class="external rawurl">https://35c3ctf.ccc.ac/uploads/php-ff2d1f97076ff25c5d0858616c26fac7.tar&lt;/a>.
Challenge running at: &lt;code>nc 35.242.207.13 1&lt;/code>&lt;/p>&lt;/blockquote>&lt;p>This challenge exposes a service written in PHP,
and as you can guess, it has something to do with &lt;em>unserialization&lt;/em>.&lt;/p>&lt;p>The single source file is straightforward to understand:&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-fallback data-lang=fallback>&lt;span class=line>&lt;span class=cl>&amp;lt;?php
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>$line = trim(fgets(STDIN));
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>$flag = file_get_contents(&amp;#39;/flag&amp;#39;);
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>class B {
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> function __destruct() {
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> global $flag;
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> echo $flag;
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> }
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>}
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>$a = @unserialize($line);
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>throw new Exception(&amp;#39;Well that was unexpected…&amp;#39;);
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>echo $a;&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>Your goal is to get the flag printed by somehow getting the destructor of class B to execute.&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2019/01/35c3-ctf-write-up-php/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Extending ASUSWRT Functionality, Part 2</title><link>https://irq5-7854a1fdb9f4.pages.dev/2018/12/extending-asuswrt-functionality-part-2/</link><pubDate>Fri, 28 Dec 2018 00:11:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2018/12/extending-asuswrt-functionality-part-2/</guid><description>&lt;p>Following up from &lt;a href=https://irq5-7854a1fdb9f4.pages.dev/2012/12/hacking-functionality-into-asuswrt-routers/ rel=noopener>my earlier post&lt;/a>, Asus has released faster and beefier routers.
But perhaps the more important change here is that they have moved from MIPS in the RT-N56U to ARM in newer routers.
I have also upgraded to the &lt;strong>RT-AC68U&lt;/strong> for better reception and hopefully to fix the poor battery life experienced by my Android tablet.&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2018/img/asus-routers.jpg.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2018/img/asus-routers.jpg alt="the Asus N56U and AC68U routers, side by side" width=1023 height=682>&lt;/picture>&lt;/p>&lt;p>After upgrading, I noticed that the method I described back then no longer works.
Someone also noticed this, as they
&lt;a href=http://koolshare.cn/thread-105955-1-1.html rel=noopener target=_blank class=external>translated key portions of my post&lt;/a> into Chinese,
while pointing out some of the steps that didn’t work.&lt;/p>&lt;p>In this post, I&amp;rsquo;ll summarize the key changes required to get it working again.&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2018/12/extending-asuswrt-functionality-part-2/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Boot-time Device Tree Overlays with U-Boot</title><link>https://irq5-7854a1fdb9f4.pages.dev/2018/07/boot-time-device-tree-overlays-with-u-boot/</link><pubDate>Sun, 22 Jul 2018 22:12:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2018/07/boot-time-device-tree-overlays-with-u-boot/</guid><description>&lt;p>I bought a &lt;em>Banana Pi&lt;/em> some time ago and have been using it as my go-to ARM box.
Among the single-board computers I have,
this Allwinner A20-based platform has the fastest CPU.&lt;/p>&lt;p>Similar to the (old) Raspberry Pi, it has a 26-pin GPIO header on one side that sports the same layout.
This means that the 5V, 3V3 and I2C pins are the same as where they would be on the Raspberry Pi.&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2018/img/banana-pi-a20.jpg.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2018/img/banana-pi-a20.jpg alt width=1280 height=853>&lt;/picture>&lt;/p>&lt;h1 id=device-tree--overlays>Device Tree &amp; Overlays&lt;/h1>&lt;p>On embedded systems, the &lt;a href=https://elinux.org/Device_Tree_What_It_Is rel=noopener target=_blank class=external>Device Tree&lt;/a>
helps the kernel understand various peripherals that are connected to the board
and how to initialize them.
These hardware might be things like LDO regulators,
various controllers, GPIO, etc which are generic,
but yet needs certain configuration that should not be
hard-coded into the kernel.
To understand more about device trees I recommend you start with the Raspberry Pi
&lt;a href=https://www.raspberrypi.org/documentation/configuration/device-tree.md rel=noopener target=_blank class=external>documentation on this topic&lt;/a>.
There are more links at the end of this article.&lt;/p>&lt;p>To support &lt;a href=https://www.raspberrypi.org/blog/introducing-raspberry-pi-hats/ rel=noopener target=_blank class=external>Pi HATs&lt;/a> and other non-HAT accessories,
the Pi added a &lt;a href=https://github.com/raspberrypi/firmware/blob/master/boot/overlays/README rel=noopener target=_blank class=external>&lt;code>dtoverlay&lt;/code> configuration parameter&lt;/a> in the &lt;code>config.txt&lt;/code> file.
This allows you to specify, at boot time,
&lt;a href=https://www.kernel.org/doc/Documentation/devicetree/overlay-notes.txt rel=noopener target=_blank class=external>&lt;em>Device Tree Overlays&lt;/em>&lt;/a>,
which modify the board&amp;rsquo;s base device tree to specify additional peripherals
like I2C devices, or to configure GPIO pins for certain purposes.
The BeagleBone also has a similar mechanism to support its add-on boards via
&lt;a href=https://elinux.org/Capemgr rel=noopener target=_blank class=external>Capemgr&lt;/a>.
These mechanisms enable non-technical users to easily modify the device tree
by simply editing a text file or running a command.
Neither of these have been adopted into mainline Linux,
so there is no provisions for doing quick overlays on other boards yet.&lt;/p>&lt;p>Fortunately for us, &lt;a href=https://bootlin.com/blog/dt-overlay-uboot-libfdt/ rel=noopener target=_blank class=external>device tree overlay support has been merged&lt;/a>
into &lt;a href=https://www.denx.de/wiki/U-Boot rel=noopener target=_blank class=external>U-Boot&lt;/a>,
and the Banana Pi uses U-Boot for booting Linux.
This means that U-Boot can perform the merging of device tree overlays with
the base device tree, and pass the entire Flattened Device Tree (FDT) structure
to the kernel during boot-up.&lt;/p>&lt;p>Before we get started, you will need the &lt;code>i2c-tools&lt;/code> and &lt;code>dtc-overlay&lt;/code> package,
and the U-Boot source code for the &lt;code>mkimage&lt;/code> tool
(you &lt;em>did&lt;/em> have to compile U-Boot for your Banana Pi right?)&lt;/p>&lt;h1 id=creating-the-overlay>Creating the Overlay&lt;/h1>&lt;p>For this example, we will be attaching an &lt;a href=http://www.ti.com/lit/ds/symlink/ina219.pdf rel=noopener target=_blank class=external>INA219 current sensor&lt;/a>
to the Banana Pi over I2C.
The kernel has drivers for this sensor in its hwmon subsystem
and provides an easy way of reading values for us.&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2018/img/ina219-breakout.jpg.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2018/img/ina219-breakout.jpg alt="INA219 current sensor breakout board" width=1280 height=853>&lt;/picture>&lt;/p>&lt;p>The default I2C address on most INA219 breakout boards is with the address lines &lt;code>A0&lt;/code> and &lt;code>A1&lt;/code> grounded, giving it an address of &lt;code>0x40&lt;/code>.
Also note that the shunt resistor is marked with &lt;code>R100&lt;/code>,
which denotes 0.1 mΩ or 100,000 µΩ.&lt;/p>&lt;p>My Banana Pi has 3 I2C buses:&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-fallback data-lang=fallback>&lt;span class=line>&lt;span class=cl>$ i2cdetect -l
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>i2c-1 unknown mv64xxx_i2c adapter N/A
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>i2c-2 unknown sun4i_hdmi_i2c adapter N/A
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>i2c-0 unknown mv64xxx_i2c adapter N/A&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>We will try scanning each of the buses, and the one with device &lt;code>0x40&lt;/code> will
&lt;em>likely&lt;/em> be the bus that is exposed via the GPIO headers.
We can do this using &lt;code>i2cdetect&lt;/code>:&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-fallback data-lang=fallback>&lt;span class=line>&lt;span class=cl># i2cdetect -y 1
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> 0 1 2 3 4 5 6 7 8 9 a b c d e f
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>00: -- -- -- -- -- -- -- -- -- -- -- -- --
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>40: 40 -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>70: -- -- -- -- -- -- -- --&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>The last parameter to &lt;code>i2cdetect&lt;/code> specifies the bus number,
which is &lt;code>1&lt;/code> in this case.
We can see here that the INA219 has been correctly wired and detected,
as it shows up in the I2C bus scan.&lt;/p>&lt;p>We now need to find out which device tree node this bus corresponds to:&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-fallback data-lang=fallback>&lt;span class=line>&lt;span class=cl>$ readlink /sys/class/i2c-adapter/i2c-1/of_node
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>../../../../../firmware/devicetree/base/soc@1c00000/i2c@1c2b400&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>In order to figure out the symbolic name for this I2C bus,
we can &lt;code>grep&lt;/code> from the kernel&amp;rsquo;s live device tree,
parsed with the help of the &lt;code>dtc&lt;/code> utility:&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-fallback data-lang=fallback>&lt;span class=line>&lt;span class=cl># dtc -I fs /proc/device-tree | grep 1c2b400
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>...
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> i2c2 = &amp;#34;/soc@1c00000/i2c@1c2b400&amp;#34;;&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2018/07/boot-time-device-tree-overlays-with-u-boot/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>PoE: Quick Guide &amp; Cheap Hardware</title><link>https://irq5-7854a1fdb9f4.pages.dev/2018/06/poe-quick-guide-cheap-hardware/</link><pubDate>Wed, 06 Jun 2018 12:45:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2018/06/poe-quick-guide-cheap-hardware/</guid><description>&lt;p>I have been looking around for Power over Ethernet (PoE) devices to supply power to some networking hardware that will be located in a remote location, without a convenient power outlet.
These networking hardware do not have built-in PoE support,
so I have to find both an &lt;em>injector&lt;/em> and a &lt;em>splitter&lt;/em> device.&lt;/p>&lt;p>PoE is typically found on enterprise networking equipment,
which usually means a higher price tag.
Not wanting to spend a ton on PoE hardware, I did some research to understand what was required to make it work.&lt;/p>&lt;p>Hopefully this will help you understand PoE,
how it works, and what to look out for when shopping for PoE hardware that are suitable for your needs.&lt;/p>&lt;h1 id=poe-quick-guide>PoE Quick Guide&lt;/h1>&lt;h2 id=active-vs-passive>Active vs Passive&lt;/h2>&lt;p>Passive adapters are very simple, and you will see them mostly as an RJ45 socket with pigtails for power and Ethernet.
These adapters do not contain or require any circuitry,
which also explains why they are the more inexpensive option between the two.&lt;/p>&lt;p>&lt;picture>&lt;img src=https://c2.staticflickr.com/2/1756/41507595985_0a4a94cca6_o.jpg alt="Photo of a passive PoE injector &amp; splitter pair, sold on Adafruit">&lt;/picture>&lt;/p>&lt;p>&lt;strong>Active PoE&lt;/strong> (the &lt;em>real&lt;/em> Power over Ethernet) on the other hand requires some negotiation between the two devices, called the PSE (power sourcing equipment) and the PD (powered device).&lt;/p>&lt;p>There are several PoE standards. 802.3af, 802.3at and the newer 802.3bt.
The difference is mainly in the maximum power is made available to PDs:&lt;/p>&lt;ul>&lt;li>802.3af - 15.4W&lt;/li>&lt;li>802.3at - 30W&lt;/li>&lt;li>802.3bt - 60W to 100W&lt;/li>&lt;/ul>&lt;p>802.3bt was just ratified in the last year (2017).
In the time span before the 802.3bt standards was ratified (~8 years!),
some companies like Linear Technolgy &amp; Cisco Systems took it upon themselves
to find other means of carrying up to 60W.
The result was
&lt;a href=http://www.analog.com/media/en/technical-documentation/technical-articles/ltc_nov11_psde.pdf rel=noopener target=_blank class=external>&lt;em>LTPoE++&lt;/em>&lt;/a>
and &lt;a href=https://www.cisco.com/go/upoe rel=noopener target=_blank class=external>&lt;em>UPOE&lt;/em>&lt;/a>,
an evolution of the existing 802.3af/at standards,
but may not be compatible with the final standard arrived at by committee.&lt;/p>&lt;h2 id=mode-a-or-b>Mode A or B&lt;/h2>&lt;p>The Cat5 cable has 8 wires, forming 4 twisted pairs.
For 10/100Mbps, only 2 pairs are used:
pair 1/2 for Tx and pair 3/6 for Rx.&lt;/p>&lt;p>The modes refer to how power is delivered to the device:&lt;/p>&lt;ul>&lt;li>Mode A: pairs 1/2, 3/6&lt;/li>&lt;li>Mode B: pairs 4/5, 7/8&lt;/li>&lt;/ul>&lt;p>&lt;picture>&lt;source srcset=/posts/2018/img/poe-modeAB.png.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2018/img/poe-modeAB.png alt="PoE mode A &amp; B wiring diagram" width=1305 height=494>&lt;/picture>&lt;/p>&lt;p>Mode A uses the data pairs for power.
This mode is well suited for very old cabling which didn&amp;rsquo;t connect all 4 pairs end-to-end.
You might see some manufacturers calling this mode &lt;em>End-span&lt;/em> wiring.
To carry power over the same data cables,
&lt;em>phantom power delivery&lt;/em> is used (more on this later).&lt;/p>&lt;p>Mode B uses the unused (or spare) pairs for power.
You might see this being referred to as &lt;em>Mid-span&lt;/em>.
This type of wiring is easier because it knows the pair is not carrying any data and thus can be wired directly.&lt;/p>&lt;p>Unlike mode A, mode B in this form cannot be used to carry power for Gigabit networks,
because a Gigabit connection will require all 4 pairs for data transmission.
Power must therefore be delivered via centre-tapped transformers,
or what is known as &lt;em>phantom power&lt;/em>.
How this works is explained in a 1944 US Army &lt;a href="https://www.youtube.com/watch?v=H4NDVkjT9mg" rel=noopener target=_blank class=external>video on telephone electronics&lt;/a>.&lt;/p>&lt;h2 id=power-capacity>Power Capacity&lt;/h2>&lt;p>The committee decided that two pairs of Cat5 wire should only carry up to 30W of power;
which two pairs will depend on whether mode A or B wiring is used.&lt;/p>&lt;p>For higher power capacity like 802.3bt (PoE++)
or the non-standards-based &lt;em>UPOE&lt;/em> and &lt;em>LTPoE++&lt;/em>,
the other 2 pairs will be paralleled up,
making use of all 4 pairs to carry higher currents.&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2018/img/poe-4wire.png.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2018/img/poe-4wire.png loading=lazy alt="PoE wiring diagram for 4-pair based PoE" width=638 height=488 class=half>&lt;/picture>&lt;/p>&lt;p>For Gigabit Ethernet (1000Mbps), because all 4 pairs are used to carry data,
power (regardless of which pairs used) must be delivered
via phantom power delivery.&lt;/p>&lt;h2 id=why-use-active-poe>Why use Active PoE?&lt;/h2>&lt;p>In short, because it is safer.&lt;/p>&lt;p>It was designed with the consideration that not all network equipment can accept power, whether via the data pairs or spare pairs.&lt;/p>&lt;p>During the detection phase, the PSE
will apply 2.7V to 10V to check for a known resistance.
This voltage is low enogh and also for a brief period such that it wouldn&amp;rsquo;t matter if the device on the other end is shorted.
A device that was not designed for PoE would thus never see any higher voltage beyond the detection phase.&lt;/p>&lt;p>&lt;picture>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2018/img/poe-phases.png loading=lazy alt="Graph depicting voltage vs time during various PoE phases" width=902 height=683 class=half>&lt;/picture>&lt;/p>&lt;p>In contrast, passive PoE makes the full voltage and current available on the data/spare pairs.
If the remote end is using a &lt;em>magnetics&lt;/em> configuration that shorts out the centre taps,
the 30W of power would just melt the port (one would assume).&lt;/p>&lt;p>Integrated PSE controller chipsets will also contain features like overcurrent protection, thermal cut-offs and surge protection, etc.
which all contribute towards keeping your PDs safe from harm.&lt;/p>&lt;h1 id=finding-low-cost-poe-hardware>Finding Low-Cost PoE Hardware&lt;/h1>&lt;p>It was quite a daunting task, trawling AliExpress for PoE injectors &amp; splitters.
The description or specifications for items are also not accurate;
it&amp;rsquo;s like finding a USB cable listed as capable of carrying 2A
when in fact it does not.&lt;/p>&lt;p>While passive injectors are the cheapest option,
most of them are not meant for Gigabit Ethernet.
Recall that &lt;em>Mode B&lt;/em> wiring is the easiest and most low-cost method for building a passive device,
and that is what you will mostly find.
This wiring configuration does not pass through all 4 pairs and thus cannot be used for Gigabit.&lt;/p>&lt;p>Most active PoE splitters output 12V, or 5V via USB.
This is largely due to the fact that these devices were meant for IP cameras, which operate at that voltage.
If your target device uses a non-standard voltage,
you will have difficulty finding a suitable (and yet low-cost) splitter.&lt;/p>&lt;p>Here&amp;rsquo;s a list of hardware I&amp;rsquo;ve found;
which one is suitable for you depends on your requirements:&lt;/p>&lt;ul>&lt;li>Do you need 1000Mbps, or just 10/100Mbps would suffice?&lt;/li>&lt;li>What voltage does your target device require?&lt;/li>&lt;li>How much power does it require? 13W, 30W?&lt;/li>&lt;/ul>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2018/06/poe-quick-guide-cheap-hardware/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Crypto-Erasing BitLocker Drives</title><link>https://irq5-7854a1fdb9f4.pages.dev/2018/05/crypto-erasing-bitlocker-drives/</link><pubDate>Thu, 10 May 2018 12:45:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2018/05/crypto-erasing-bitlocker-drives/</guid><description>&lt;p>These days with larger and larger drive capacities, erasing stored data takes longer and longer.
Another problem is also the inability to do so when the time comes, due to bad sectors or hardware failures.
Just because the data is not accessible by you does not mean that
it is also inaccessible to someone else with the know-how.&lt;/p>&lt;p>&lt;strong>&lt;em>Cryptographic erasure&lt;/em> to the rescue!&lt;/strong>&lt;/p>&lt;p>Crypto erase simply erases the encryption key that is used to encrypt the data on your drive.
This is the &lt;a href=https://irq5-7854a1fdb9f4.pages.dev/2014/04/encrypt-all-the-drives/ rel=noopener>primary reason why&lt;/a> I encrypt my drives.&lt;/p>&lt;p>Oddly, I have not found anyone talking about BitLocker crypto erasure or doing it.
The closest I have seen is &lt;a href=https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde-forcerecovery rel=noopener target=_blank class=external>&lt;code>manage-bde -forcerecovery&lt;/code>&lt;/a>, which removes all TPM-related key protectors.
This is briefly described in a TechNet article titled &lt;a href=https://technet.microsoft.com/en-us/library/cc512654.aspx rel=noopener target=_blank class=external>BitLocker™ Drive Encryption and Disk Sanitation&lt;/a>.&lt;/p>&lt;p>But what if we are not running Windows?
What if the disk is not a Windows boot drive that is protected by a TPM key protector?&lt;/p>&lt;p>In order to erase the (key) data, we first need to know how the data is stored on disk.
For open-source FDE implementations,
this is easy because the disk format is well-documented,
but BitLocker is not exactly open.&lt;/p>&lt;h1 id=bitlocker-disk-format>BitLocker Disk Format&lt;/h1>&lt;p>BitLocker was first introduced in Windows Vista and has gone through changes since then.
Some changes were made to the format in Windows 7, but has largely remained unchanged through Windows 8 till 10.&lt;/p>&lt;p>For LUKS, it is simple - there is a LUKS header at the start of the disk, followed by the encrypted volume data.
For BitLocker, it is slightly more involved, probably due to backward-compatible design considerations.&lt;/p>&lt;p>The header at the start of the partition is a valid boot sector (or boot block), so not all BitLocker information can be stored within.
Instead, this volume header points to the FVE metadata block where most of the data is kept.
In fact, there are 3 of these for redundancy.
This metadata block is what holds all the key material.&lt;/p>&lt;p>The metadata blocks are spaced (almost) evenly apart,
located near the start of the volume.&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-fallback data-lang=fallback>&lt;span class=line>&lt;span class=cl># blwipe -offset 0x2010000 bitlocker-2gb.vhd
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>metadata offset 0: 0x02100000
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>metadata offset 1: 0x100c8000
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>metadata offset 2: 0x1e08f000
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>metadata block 0 (size 65536): parsed OK
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>metadata block 1 (size 65536): parsed OK
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>metadata block 2 (size 65536): parsed OK&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>The first metadata block &lt;em>usually&lt;/em> begins at &lt;code>0x02100000&lt;/code>.
This illustration depicts the locations for a 2 GB volume:&lt;/p>&lt;p>&lt;picture>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2018/img/fve-md-disk-layout.png alt="Diagram of disk layout with FVE metadata blocks marked out" width=1145 height=279>&lt;/picture>&lt;/p>&lt;p>If there are 3 of these blocks, how do we know know which ones contain valid data?&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2018/05/crypto-erasing-bitlocker-drives/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>PCBWay PCB Review</title><link>https://irq5-7854a1fdb9f4.pages.dev/2018/04/pcbway-pcb-review/</link><pubDate>Sat, 07 Apr 2018 12:47:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2018/04/pcbway-pcb-review/</guid><description>&lt;p>&lt;a href=https://www.pcbway.com/ rel=noopener target=_blank class=external>PCBWay&lt;/a> is a PCB manufacturer that prides itself on quick turnaround.
You can learn about &lt;a href="https://www.youtube.com/watch?v=NfeDs5ce1PA" rel=noopener target=_blank class=external>CNLohr&amp;rsquo;s sucess story here&lt;/a>.
They also offer detailed tracking of your order&amp;rsquo;s progress on their website.&lt;/p>&lt;p>They have reached out to me and kindly offered to sponsor the boards for this particular project,
which I will be talking about in the coming weeks.
As the cost of these boards were more expensive
(compared to their &amp;ldquo;normal&amp;rdquo; orders),
I had to pay for shipping myself.&lt;/p>&lt;p>With each PCB project, I find more and more methods of testing PCB manufacturers.
This time, it&amp;rsquo;s with a PCB that is inserted directly into your USB socket.&lt;/p>&lt;p>&lt;picture>&lt;img src=https://c1.staticflickr.com/5/4724/25588137367_dff247a8d1_b.jpg alt="project PCBs">&lt;/picture>&lt;/p>&lt;p>The requirement for such a board is 2 mm thickness.
The USB connector size is standard, so the usual 1.6 mm PCB thickness isn&amp;rsquo;t going to work unless you pad the connector area.&lt;/p>&lt;p>Also, I opted for gold fingers on the USB connector contacts.
This is usually done for contacts on the board edge that will be inserted into some mating connector
(like PCI cards and USB connectors such as this).&lt;/p>&lt;p>&lt;strong>They also offer matte black &amp; matte green colors.&lt;/strong>
I haven&amp;rsquo;t seen matte colours being offered at other board houses so far.
I would have loved to try them out, but that would have bloated the cost beyond my comfort level.&lt;/p>&lt;h1 id=order-process>Order Process&lt;/h1>&lt;p>The order flow for PCBWay is a bit different because you submit your gerbers without making payment first.
This allows their engineers to take a look at the design before you actually pay.&lt;/p>&lt;p>Most other systems I&amp;rsquo;ve used are largely automated.
After you submit your gerbers, they typically don&amp;rsquo;t expect any problems and so they collect payment from you first.&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2018/img/pcbway-order-process.png.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2018/img/pcbway-order-process.png alt="PCBWay order flow" width=905 height=185>&lt;/picture>&lt;/p>&lt;p>I uploaded the gerbers on the 8th Aug
and I tracked my order progress online.
Their website allows you to track the detailed progress of your board as it moves along the manufacturing process.
For small runs like this one, it is not crucial but if you were doing a
large project with panels of many boards,
this would definitely be handy.&lt;/p>&lt;p>&lt;picture>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2018/img/pcbway-progress.png loading=lazy alt="table of PCB production processes and their completion times" width=650 height=530>&lt;/picture>&lt;/p>&lt;p>They started manufacture 2 days later (on the 10th)
and completed everything by 12th.
It was not until the 14th that they actually shipped the boards out and provided me with a tracking number.&lt;/p>&lt;p>Here&amp;rsquo;s a summary of the timeline:&lt;/p>&lt;ul>&lt;li>08: Gerber files submission&lt;/li>&lt;li>10: start of PCB manufacture&lt;/li>&lt;li>12: boards completed&lt;/li>&lt;li>14: boards shipped (via registered post)&lt;/li>&lt;li>24: boards received&lt;/li>&lt;/ul>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2018/04/pcbway-pcb-review/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Flare-On 2017 Write-up: "pewpewboat.exe"</title><link>https://irq5-7854a1fdb9f4.pages.dev/2017/10/flare-on-2017-write-up-pewpewboat.exe/</link><pubDate>Sat, 14 Oct 2017 23:30:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2017/10/flare-on-2017-write-up-pewpewboat.exe/</guid><description>&lt;h3 id=flare-on-2017-challenge-5----pewpewboatexe>Flare-On 2017 Challenge #5 &amp;ndash; pewpewboat.exe&lt;/h3>&lt;p>As usual, the first thing to do when tackling the challenge is to run the binary first, to see what it does.
You will soon learn that it&amp;rsquo;s not actually a Windows executable,
but rather a 64-bit Linux ELF.&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-fallback data-lang=fallback>&lt;span class=line>&lt;span class=cl>$ ./pewpewboat.exe
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>Loading first pew pew map...
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> 1 2 3 4 5 6 7 8
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> _________________
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>A |_|_|_|_|_|_|_|_|
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>B |_|_|_|_|_|_|_|_|
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>C |_|_|_|_|_|_|_|_|
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>D |_|_|_|_|_|_|_|_|
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>E |_|_|_|_|_|_|_|_|
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>F |_|_|_|_|_|_|_|_|
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>G |_|_|_|_|_|_|_|_|
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>H |_|_|_|_|_|_|_|_|
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>Rank: Seaman Recruit
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>Welcome to pewpewboat! We just loaded a pew pew map, start shootin&amp;#39;!
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>Enter a coordinate:&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>So this is a &lt;a href=https://en.wikipedia.org/wiki/Battleship_%28game%29 rel=noopener target=_blank class=external>Battleship game&lt;/a>.
Playing manually for a bit, I see the &amp;ldquo;ships&amp;rdquo; form up in the shape what looked like a letter.
Hmm could this be the flag?&lt;/p>&lt;p>It&amp;rsquo;s now time to read the code.&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2017/10/flare-on-2017-write-up-pewpewboat.exe/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Writing Code for the ATtiny10</title><link>https://irq5-7854a1fdb9f4.pages.dev/2017/09/writing-code-for-the-attiny10/</link><pubDate>Sat, 09 Sep 2017 12:47:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2017/09/writing-code-for-the-attiny10/</guid><description>&lt;p>I previously wrote about the hardware aspects of
&lt;a href=https://irq5-7854a1fdb9f4.pages.dev/2010/07/programming-the-attiny10/ rel=noopener>getting your code into an ATtiny10&lt;/a> some 7 years ago
(wow that was &lt;em>realllyy&lt;/em> a long time ago!).&lt;/p>&lt;p>Now, avrdude is at version 6.3 and
the TPI bitbang implementation has already been integrated in.
The upstream avr-gcc (and avr-libc) also have proper support for ATtiny10s now.
These software components are bundled with most distributions,
including the &lt;a href=https://www.arduino.cc/en/Main/Software rel=noopener target=_blank class=external>Arduino IDE&lt;/a>,
making it easily accessible for anyone.
Previously a fully integrated and working toolchain only came from Atmel and it was behind a registration page.&lt;/p>&lt;p>The price of the ATtiny10 has also dropped by a lot.
When I first bought this microcontroller in 2010,
element14 carried it for $1.85 in single quantities.
Now, they are only $0.56 each.&lt;/p>&lt;p>I thought I&amp;rsquo;d write up a short post about writing and compiling code for it.&lt;/p>&lt;p>&lt;picture>&lt;source srcset=/posts/2017/img/attiny10-closeup.jpg.webp type=image/webp>&lt;img src=https://irq5-7854a1fdb9f4.pages.dev/posts/2017/img/attiny10-closeup.jpg alt="ATtiny10 on a prototyping board" width=1023 height=682>&lt;/picture>&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2017/09/writing-code-for-the-attiny10/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>Framework for Writing Flexible Bruteforcers</title><link>https://irq5-7854a1fdb9f4.pages.dev/2017/08/framework-for-writing-flexible-bruteforcers/</link><pubDate>Wed, 30 Aug 2017 01:01:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2017/08/framework-for-writing-flexible-bruteforcers/</guid><description>&lt;p>When writing a bruteforcer, it&amp;rsquo;s easiest to think of it as mapping some kind of
output to a monotonically-increasing number.&lt;/p>&lt;p>Like for one of the solved PlaidCTF question, the answer string was composed from the eight letters &amp;ldquo;plaidctf&amp;rdquo;,
which conveniently is a power of 2, meaning each output character can be represented with 3 bits.
To write a bruteforcer for a string composed of these characters,
you might imagine generating a 3-bit number (i.e. from 0 to 7)
then mapping it to the character set for one output character,
or a 30-bit number if the output string was 10 characters.
Unsurprisingly, this was &lt;a href=https://gist.github.com/geekman/6b749c6dcb6acd6ba1d2/d69f852e30374376ce8a9cd4a65e49c72d4ef991 rel=noopener target=_blank class=external>exactly what I did&lt;/a> for my solver script.
The output string was generated from a &lt;em>BitVector&lt;/em> of &lt;code>171 * 3&lt;/code> bits.&lt;/p>&lt;p>But what if the output was composed of several different pieces that cannot be
represented uniformly as a set of bits?&lt;/p>&lt;p>One solution might be to emulate such a behaviour using an array of integers, like
how I &lt;a href=https://irq5-7854a1fdb9f4.pages.dev/2016/08/labyrenth-2016-write-up-regex/ rel=noopener>modified my solver script in version 2&lt;/a>
to handle a character set of arbitrary length.&lt;/p>&lt;p>In this post, I will walk-through writing a basic, but flexible, bruteforcer
with accompanying code snippets in &lt;a href=https://golang.org/ rel=noopener target=_blank class=external>Go&lt;/a>.&lt;/p>&lt;h1 id=keeping-state>Keeping State&lt;/h1>&lt;p>Continuing on the CTF puzzle, the &lt;em>BitVector&lt;/em> was replaced with an array of &lt;code>Int&lt;/code>s.
Each &lt;code>Int&lt;/code> will represent one character of the output string.
We can thus represent the state like so (for simplicity,
let&amp;rsquo;s limit the output string to 2 characters):&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-go data-lang=go>&lt;span class=line>&lt;span class=cl>&lt;span class=kd>type&lt;/span> &lt;span class=nx>state&lt;/span> &lt;span class=kd>struct&lt;/span> &lt;span class=p>{&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> &lt;span class=nx>digit&lt;/span> &lt;span class=p>[&lt;/span>&lt;span class=mi>2&lt;/span>&lt;span class=p>]&lt;/span>&lt;span class=kt>int&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=p>}&lt;/span>&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>In order to increment each digit, we can write a function that increments
&lt;code>state.digit&lt;/code> until a certain number, then resets it to zero.&lt;/p>&lt;p>To make it generic, we will write a function that returns another function that
manipulates a digit position, so we don&amp;rsquo;t have to copy &amp; paste the code for
each digit position:&lt;/p>&lt;div class=highlight role=region aria-label="code block" translate=no>&lt;pre tabindex=0 class=chroma>&lt;code class=language-go data-lang=go>&lt;span class=line>&lt;span class=cl>&lt;span class=c1 translate>// returns a function that manipulates the digit at given pos
&lt;/span>&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=c1 translate>&lt;/span>&lt;span class=kd>func&lt;/span> &lt;span class=nf>digitManipulator&lt;/span>&lt;span class=p>(&lt;/span>&lt;span class=nx>pos&lt;/span> &lt;span class=kt>int&lt;/span>&lt;span class=p>)&lt;/span> &lt;span class=kd>func&lt;/span>&lt;span class=p>(&lt;/span>&lt;span class=o>*&lt;/span>&lt;span class=nx>state&lt;/span>&lt;span class=p>)&lt;/span> &lt;span class=kt>bool&lt;/span> &lt;span class=p>{&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> &lt;span class=k>return&lt;/span> &lt;span class=kd>func&lt;/span>&lt;span class=p>(&lt;/span>&lt;span class=nx>s&lt;/span> &lt;span class=o>*&lt;/span>&lt;span class=nx>state&lt;/span>&lt;span class=p>)&lt;/span> &lt;span class=kt>bool&lt;/span> &lt;span class=p>{&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> &lt;span class=nx>s&lt;/span>&lt;span class=p>.&lt;/span>&lt;span class=nx>digit&lt;/span>&lt;span class=p>[&lt;/span>&lt;span class=nx>pos&lt;/span>&lt;span class=p>]&lt;/span>&lt;span class=o>++&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> &lt;span class=k>if&lt;/span> &lt;span class=nx>s&lt;/span>&lt;span class=p>.&lt;/span>&lt;span class=nx>digit&lt;/span>&lt;span class=p>[&lt;/span>&lt;span class=nx>pos&lt;/span>&lt;span class=p>]&lt;/span> &lt;span class=o>==&lt;/span> &lt;span class=nx>MAX_NUMBER&lt;/span> &lt;span class=p>{&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> &lt;span class=nx>s&lt;/span>&lt;span class=p>.&lt;/span>&lt;span class=nx>digit&lt;/span>&lt;span class=p>[&lt;/span>&lt;span class=nx>pos&lt;/span>&lt;span class=p>]&lt;/span> &lt;span class=p>=&lt;/span> &lt;span class=mi>0&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> &lt;span class=k>return&lt;/span> &lt;span class=kc>true&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> &lt;span class=p>}&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> &lt;span class=k>return&lt;/span> &lt;span class=kc>false&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl> &lt;span class=p>}&lt;/span>
&lt;/span>&lt;/span>&lt;span class=line>&lt;span class=cl>&lt;span class=p>}&lt;/span>&lt;/span>&lt;/span>&lt;/code>&lt;/pre>&lt;/div>&lt;p>We will talk more about the boolean return value later.&lt;/p>&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2017/08/framework-for-writing-flexible-bruteforcers/#more">Continue reading…&lt;/a>&lt;/p></description></item><item><title>LabyREnth 2017: Binary 4</title><link>https://irq5-7854a1fdb9f4.pages.dev/2017/07/labyrenth-2017-binary-4/</link><pubDate>Thu, 27 Jul 2017 23:59:00 +0000</pubDate><guid>https://irq5-7854a1fdb9f4.pages.dev/2017/07/labyrenth-2017-binary-4/</guid><description>Hint: Send me this identifier together with your $$$$ to decrypt your file: da91e949f4c2e814f811fbadb3c195b8
Binary4 is a Mach-O binary, nothing IDA Pro can&amp;rsquo;t handle.
You will notice it has some obfuscated names, like wshwfknafsknfadj, pojklfasd, etc.
Looking at the main() function, IDA Pro&amp;rsquo;s decompiler produces the following pseudo-C code:
memset(&amp;v17, 0, 0x400uLL); v17 = 46; LODWORD(v3) = wshwfknafsknfadj(&amp;v17, 0LL); v15 = v3; LODWORD(v4) = bmasdfiukjwe(&amp;v17); v14 = v4; if ( 999 !&lt;p>&lt;a href="https://irq5-7854a1fdb9f4.pages.dev/2017/07/labyrenth-2017-binary-4/#more">Continue reading…&lt;/a>&lt;/p></description></item></channel></rss>