Users

Users

Unfortunately, due to ongoing spam problems, and various new and innovative methods of spamming, new user account creation is currently suspended

Non-logged-in users can still continue to leave (non-spam) comments as normal.

The site in its current form has no need for individual user accounts. Perhaps when I upgrade the site, and potentially split off the humor/funny content, it will be used for submitting new content. However, the system as it stands is only good at gathering spam.

Sorry for any inconvenience.

QuahogCon 2010: My Freeduino (From AlphaOne)

QuahogCon 2010: My Freeduino (From AlphaOne)

This is my new Freeduino, which I purchased as a kit from the fine folks at the AlphaOne Hackerspace table at QuahogCon 2010.

I assembled the kit together at the Hardware Hacking Lounge with some super-sweet soldering irons, then spent the next hour and a half trying to figure out why it wouldn’t work. Turns out that it needed a jumper on the USB/External power selector. Thanks to Mr. Jimmie Rodgers for the eagle-eye lack-of-jumper spotting.

I already have an Arduino (the original); however, it doesn’t have a pin for the reset line or 3.3V line on the headers, so I guess it will just be relegated to different tasks.

I had planned to submit an entry into the Alpha One Labs Hackerspace’s Arduino Hacking Contest, though I ended up spending every waking moment trying to hack the Humans vs Zombies game. Apparently, I was not the only one with not enough time; there were unfortunately no entries into the contest 🙁 I ended up receiving honorable mention (consisting of a T-shirt) for constructing my Freeduino.

Hopefully, there will be an Arduino Hacking contest next year… Start building those Arduino projects!

QuahogCon 2010 Badge Hardware Hacking – The Beginning

QuahogCon 2010 Badge Hardware Hacking – The Beginning

What I Did:

I took a Cellboost IPR3 that was otherwise destined for a dull life of providing power to an original iPod Shuffle, and converted the cable normally used for charging it into a USB-A-to-2-pin cable using the cable from an old computer case’s hard drive activity light. (Using the cable is a bonus for me, since this cable has been kicking around the junkbox for ages.)

What I Wanted to Do:

I’ll be the first to admit this isn’t so much a ‘hack’ since it’s what the badge was designed to do. I had planned to populate the two 2×16 rows of headers with female headers, then put a piece of perfboard on top either with male headers pointed down or with female headers with double-length legs. The plan was to have something akin to an Arduino shield: Removable, changeable, and replaceable. What you see here is what I got done during the ‘con. I’ll post updates as I progress in badge-hacking now that the ‘con’s over.

About the Cellboost IPR3 Hardware

The Cellboost device contains 1 Li-Ion battery, 5V charging circuitry, and 5V output circuitry; the charging circuitry is the best part, since Li-Ions are a pain to charge otherwise. It includes a USB extension cable (USB-A Male to USB-A Female) that supplies power only (no wires for data) to charge the Cellboost unit with. The unit itself has a USB-A Male (for charging the Li-Ion) and a USB-A Female receptacle on it (for the iPod to plug into).

I acquired a number of these Cellboost devices from Princess Auto; at their last big clearance sale, they were on for (IIRC) $0.79 each. As an aside, I had someone at Quahogcon ask me if I had been to the MIT Garage Sale. Apparently they were sold there as well. Regardless, I still have 4 or 5 in their original packaging to be used to power other projects.

QuahogCon 2010 Loot

QuahogCon 2010 Loot

Here’s what I gained (physically) from QuahogCon 2010 (in no particular order):

(And yes, I would have preferred to photograph against a plain white background, but hey.)

QuahogCon 2010 Humans vs. Zombies Game

QuahogCon 2010 Humans vs. Zombies Game

For those who are curious about some of the particulars of the game, here is what I gleaned from the goings-on at the ‘con (And from a lot of borrowing Jimmie’s badge, and soliciting button-presses from random ‘con attendees).

Spoiler Warning: If you want to try to disassemble, packet-sniff, or otherwise decode the Humans vs Zombies game completely on your own, don’t read on.

Most of this is just a brain dump, it’s not really in any particular order.

  • AFAIK, 5 types of badges existed: Human, Zombie, Cleric, Mussel and Uber. All of these attacks are explained later on in the “giant list ‘o attacks”, with the only exception: Mussels can attack either humans or zombies, and have no unique attack code.
  • I managed to peek at an instruction sheet for a Cleric that was left behind by one of the lovely ladies from the CORE table; however, it held no unexpected information. (Though it was quite nice, and fit with the story in the Attendee pamphlets/schedules
  • Attendees began as humans, and were turned into zombies by attacks from other zombies, or from coaxing from an Uber badge.
  • In the download provided at con-time (q10-pub.tar.gz), there lives a file known as rftest-rx.c. By default, this will list (over UART1), the unencrypted attack type and attack power of whatever attacks it hears.

    rftest-rx.c also has a line commented out that will print the entire packet received. Note that the packet [3] and [4] need to be XOR’d with packet [2] to make any sense. (<– Uber encryption) 
    Example:
    [2] ^ [3] = Attack Type
    [2] ^ [4] = Attack Power

  • From soliciting keypresses, I managed to make a list of the following attacks/powers:
    1,1: Human Defensive
    1,2: Human Normal
    1,3: Human Offensive
    1,6: Human Critical Hit
    2,1: Zombie default attack OR attack with 1 LED of charge
    2,2: Zombie charged to 2 LEDs
    2,3: Zombie charged to 3 LEDs
    2,4: Zombie charged to 4 LEDs
    2,5: Zombie charged to 5 LEDs
    3,20: Cleric Heal Humans
    3,50: Cleric Heal Humans (Critical Hit)
    4,20: (Really? 4:20? *groan*) Cleric Turn Undead
    4,50: Cleric Turn Undead (Critical Hit)
    99,5: Uber ???
    99,6: Uber Epic Win
  • During his talk on 802.15.4 security regarding replay attacks, Josh Wright briefly showed the packets that he managed to sniff from an Uber badge, which turned anyone in range into any of the 6 modes (the 5 discussed above, and also ‘dead’.) He then proceeded to execute a replay attack on the audience, and it apparently hit @innismir (Ben Jackson) in the next room during his presentation. Twitter thread: [1][2][2.5][3][4][5]

I’ll add more here if/when I think of it, and once I start sniffing in earnest. I spent the entire ‘Con trying to reinvent the wheel… Apparently all the good stuff was in the q10-pub/firmware directory… I had been tweaking code in the q10-pub/tests directory. I still managed to sniff the above code, however I didn’t get transmit working in time to pwn the closing ceremonies. Totally looking forward to pwning whatever badge they throw at us next year, though.

Sparkfun.com Stuff: Arduino Shield, Breadboarding Supplies, etc

Sparkfun.com Stuff: Arduino Shield, Breadboarding Supplies, etc

My latest Sparkfun.com order.

For PIC programming:
BOB-00193 (1): Adapter board for Microchip ICD and ICD2

For (hopefully) adding some IR functionality to my QuahogCon badge:
COM-09349 (4): Infrared LED – 950nm

For parts:
DEV-00348 (2): Olimex Carrier Board for OKI ML67Q5003

For prototyping on the Arduino (and otherwise generic prototyping):
DEV-07914 (1): Arduino ProtoShield Kit
PRT-07915 (1): Breadboard Mini Self-Adhesive (For Protoshield Kit)
PRT-09567 (1) : Breadboard Clear Self-Adhesive (For other breadboarding)
PRT-00124 (1): Jumper Wire Kit
PRT-08430 (1): Jumper Wires Premium 6″ F/F Pack of 10
PRT-08431 (1): Jumper Wires Premium 6″ M/M Pack of 10
PRT-09140 (1): Jumper Wires Premium 6″ M/F Pack of 10

QuahogCon Badge Details Released

QuahogCon Badge Details Released

In the fine tradition of hacker con badges, QuahogCon presents its inaugural badge, based on the Freescale MC13224v.

More info and badge specs can be found at mc1322x.devl.org: MC13224 Hardware, and more contest-related info can be found at QuahogCon: Contests.
.
MC1322x-related Open Source tools and guides are available at mc1322x.devl.org.

I’ll be adding more badge-hacking-related stuff before/during/after QuahogCon, once I get to play around with my badge.

FT4232H-Based Eee 701 Internals Controller

FT4232H-Based Eee 701 Internals Controller

Attachment: Schematic PDF

This controller will be designed for installation into an Eee 700-series netbook to serve the following purposes:

  1. Provide a communications interface to I2C, SPI and UART devices over USB
  2. Control power switching to various internally-mounted low-current (~0-25mA) and high-current (~25-125mA) devices.
  3. Provide non-USB-Host 5V power to the high-current USB devices through high-current SPST switches so as not to overload the USB Bus (Update: This will be done by off-board MOSFETs. There just wasn’t enough room on the board to allow it to still fit in the space allocated for the MDC1.5.

Requirements:

  • The finished PCB should fit comfortably inside an Eee 700-series netbook, in the MDC1.5 spot (A modem was planned for the Eee 700-series, but never released. There is an empty space in the Eee 700-series case to fit a Mobile Data Card (Modem), but one was never included, and the option was removed from later BIOSes. In later netbooks the connector was no longer soldered in.)
  • The finished PCB will have through-hole connectors for attaching external devices, USB, external power, etc. for ease of soldering and to help prevent solder-pad lifting.
  • Surface-mount parts will be used to save space (I know, they’re a pain to solder. I don’t look forward to it, but there just isn’t a whole lot of room inside the Eee)
  • It would be nice to have all pins aligned at 0.1″ so it could be put on a breadboard for prototyping.

Background:

This came about in its current form through discussions on #sparkfun as I was looking for a controller to go along with devices such as GPS that I would (hopefully) purchase on SparkFun’s Free Day. I was stuck between the Arduino Pro Mini and the Mini Bully to allow for SPI communication; however, I would still have had to include a USB-TTL FT232R-based converter. It was suggested that I use the FT2232 since I could do SPI and UART on the same chip.

Unfortunately, or fortunately (depending on how you look at it), I looked again at the size of the USB-capable GPS I wanted (GS407), and found that there was no way it was going to fit, despite my previous measurements. I instead chose the Venus GPS with SMA for its size; however, it has a UART interface, and I was stuck now with SPI and UART devices (And maybe some I2C). This is why I’m looking now at the FT2232H and the FT4232H (Which is pin-identical to the FT2232H, just with 4 ports instead of 2).

FTDI Chips:

FT2232D:

The FT2232D has 2 channels and is slightly smaller and takes less than half the power of the newer FT2232H, but the FT2232D only allows for one MPSSE (Multi-Protocol Synchronous Serial Engine: the encoder that allows you to use I2C, SPI, etc.) channel. This means you can have one JTAG, I2C or SPI channel. Channel 2 (Also called B) doesn’t support the MPSSE engine; it is only for RS232 UART, RS245 or other serial modes.

FT2232H:

The FT2232H is larger than the FT2232D, and consumes more than double the current. However, the FT2232H supports MPSSE on both of its 2 channels: You can now have SPI, I2C, RS232 UART, etc in any configuration. It has a direct upgrade path to the FT4232H thanks to a shared size, footprint and power requirements.

FT4232H:

The FT4232H is a direct replacement for the FT2232H, and allows for 4 channels instead of 2. The MPSSE can be used on channels A and B simultaneously. Though the number of channels goes up for the FT4232H, the number of supported protocols goes down; however, this chip supports all of the protocols this project would ever require: UART, SPI, I2C and maybe bit-banging. This project has no plausible requirement for RS245, FIFO, Host Bus Emulation or the like.

FT4232H Channels:

  1. RS232 UART, JTAG, SPI, I2C or bit-banging
  2. RS232 UART, JTAG, SPI, I2C or bit-banging
  3. RS232 UART or bit-banging
  4. RS232 UART or bit-banging

Ports: Here’s what I personally plan to attach on each of the ports of my copy of the project board.

Channel A: SPI #1

  • 3-Axis Accelerometer (Has an optional interrupt for motion detection. Has buffer room for 64 samples per axis. Supports reading of its 9-bit temperature sensor over the serial bus.)
  • Cable Select for each SPI device on GPIOs.
  • Interrupt from 3-Axis Accelerometer, if needed

Channel B: I2C or SPI #2

  • Sensors: Temperature, …?
  • FM Radio Receiver AR1010

Channel C: UART #1

  • Venus 634FLPx GPS (I’ll have to see what this GPS supports in regards to buffering to see if it could handle being on the SPI bus along with the accelerometer.)

Channel D: UART #2

  • Kenwood D7A APRS In or GPS Location Out

GPIOs: (Spare pins on Channels A or B)

  • Triggers for high-current SPST Switches or MOSFETs for switching power to internal devices
  • LED(s)?

Voltages: Voltage requirements of each device I intend to connect

  • FM Receiver AR1010: 3.3V
  • 3-Axis Accelerometer SCA3000: 3.35V-10V
  • Venus 634FLPx GPS: 2.7V-3.3V
  • FT4232H or FT2232H: 3.3V

Amperages Required and Equivalent Current Draw at 5V: 5V Current Equivalents for determining if all devices specified can be safely run on USB power or if they would require power from another source. (These are based on rough figures, and are always subject to the device’s operating conditions. I just want to see if it’s in the ballpark)
AR1010:
(Max current 16mA at 3.3V, as per module datasheet.)

  • 3.3 Volts * 0.016 Amps = 0.0528 Watts
  • 0.0528 Watts / 5 Volts = 0.01056 Amps
  • 0.01056 Amps = 10.56 milliamps at 5V

SCA3000: (Typical current during motion capture of 650uA at 3.3V, as per chip datasheet)

  • 3.3 Volts * 0.00065 Amps = 0.002145 Watts
  • 0.002145 Watts / 5 Volts = 0.000429 Amps
  • 0.000429 Amps = 0.429 milliamps at 5V (== 429uA at 5V)

Venus 634FLPx GPS: (Typically 28mA at 2.7-3.3V in tracking and navigation mode, per chip datasheet. A commenter on the Sparkfun product page notes that the added LED will add an extra 10mA (when the LED is turned on), so I’m going to go with 38mA for now. I’m going to assume their rated current is at the higher of the range: 3.3V)

  • 3.3 Volts * 0.038 Amps = 0.1254 Watts
  • 0.1254 Watts / 5 Volts = 0.02508 Amps
  • 0.02508 Amps = 25.08 milliamps at 5V

FT4232H/FT2232H: Icc1 (Vcore) is typically 70mA @1.8V, as per chip datasheet (pg 26)

  • 1.8 Volts * 0.070 Amps = 0.126 Watts
  • 0.126 Watts / 5 Volts = 0.0252 Amps
  • 0.0252 Amps = 25.2 milliamps at 5V

FT4232H/FT2232H: IPHY (VPHY) (For the USB Interface) is typically 30mA @3.3V, as per chip datasheet (pg 28)

  • 3.3 Volts * 0.030 Amps = 0.099 Watts
  • 0.099 Watts / 5 Volts = 0.0198 Amps
  • 0.0198 Amps = 19.8 milliamps at 5V

FT4232H/FT2232H: IReg (VReg) (For the 3.3V to 1.8V internal regulator) is maximum 150mA @3.3V, as per chip datasheet (pg 26)

  • 3.3 Volts * 0.15 Amps = 0.495 Watts
  • 0.495 Watts / 5 Volts = 0.099 Amps
  • 0.099 Amps = 99 milliamps at 5V

Therefore, total expected current required at 5V is (10.56 + 0.429 + 25.08 + 25.2 + 19.8) = 81.069 mA., and at the very worst case scenario, the VReg will draw 99mA at 5V. Power requirements will be tested again later with an ammeter. Anything under 100mA is easily provided by the USB Bus. Anything over 100mA should be specifically noted in the EEPROM of the device so it knows to request a higher power allocation from the computer.

Parts List (And Digikey Part#): [Might need updating for v1.1?]

  • C1, C2: CAP TANTALUM 4.7UF 10V 20% SMD (511-1491-1-ND)
  • C3, C7: CAP CER 1UF 25V X5R 0603 (490-3897-1-ND)
  • C4-6,C8-13: CAP CER .1UF 25V 10% X7R 0603 (490-1524-1-ND)
  • C14, C15: CAP CER 18PF 50V C0G 5% 0603 (445-1272-1-ND)
  • C16: CAP CER 3.3UF 10V X5R 0603 (445-5168-1-ND)
  • U1: IC REG LDO 3.3V 250MA SOT-23A (MCP1702T-3302E/CBCT-ND)
  • U2: IC EEPROM 1KBIT 2MHZ SOT23-6 (93LC46BT-I/OTCT-ND)
  • U3: IC USB UART/MPSSE QUAD HS 64LQFP (768-1026-1-ND)
  • U4: CRYSTAL 12.0000 MHZ 18PF SMD (535-9836-1-ND)
  • R1, R3, R4: RES 10K OHM 1/10W 1% 0603 SMD (RMCF1/1610KFRCT-ND)
  • R2: RES 2.2K OHM 1/10W 1% 0603 SMD (RMCF1/162.2KFRCT-ND)
  • R5: RES 1K OHM 1/10W 1% 0603 SMD (RMCF1/161KFRCT-ND)
  • R6: RES 12.0K OHM 1/10W 1% 0603 SMD (311-12.0KHRCT-ND)
  • L1, L2: FERRITE 1A 60 OHM 0603 SMD (240-2370-1-ND)

Schematic:

v1.1 as attached. NB, it was made with gEDA, not Eagle.

PCB Layout:

v1.1 as attached. NB, it was made with gEDA / PCB, not Eagle.

Suggestions:

All suggestions are welcome. Please leave a comment below to let me know what you think, or if you have any feature requests.

License:

This project is released under the CC BY-NC-SA 3.0 license. If you wish to use this project for commercial purposes, please contact me.

Availability:

I have a number of v1.1 boards available. I will be able to put one together for testing/debugging once I get parts for it. Unfortunately, the high-accuracy, small-form-factor crystal is backordered until something like November (2010).

Disclaimer:

This is for educational purposes only. I’m not liable for damages caused to you or your property (including but not limited to netbooks).