redfast00

4 ms·

1.
by redfast00 4mo ago
From the datasheet, I see that there is a Bitscrambler peripheral that seems to be very similar in flexibility to the Raspberry Pi Pico's PIO: > Since bitwise operations can be relatively CPU-intensive and DMA is designed specifical
2.
First exclusive feature for open ESP32 Wi-Fi stack: standards-compliant meshing(esp32-open-mac.be)
2 points by redfast00 1y ago|1 comments
3.
by redfast00 2y ago
Author here; see also the entire series of posts on https://esp32-open-mac.be/
4.
by redfast00 2y ago
In my opinion, the author understates how good AES-GCM-SIV is: > The solution they designed is described in that linked paper: AES-GCM-SIV, which is able to tolerate some number of nonce collisions, but under a weaker notion of security
5.
Reverse engineering ESP32 Wi-Fi driver: the road ahead(esp32-open-mac.be)
192 points by redfast00 2y ago|63 comments
6.
Building a Faraday cage with data passthrough for ESP32 reverse engineering(esp32-open-mac.be)
3 points by redfast00 3y ago|0 comments
7.
by redfast00 3y ago
Please contact me via email (at the bottom of the blog post)
8.
by redfast00 3y ago
As part of the NLNet grant, I will build an affordable Faraday cage; I'll post the BOM, assembly process and a test report in a separate blog post.
9.
by redfast00 3y ago
Oops, my bad, copy-pasted it incorrectly; fixed now
10.
Unveiling secrets of the ESP32: creating an open-source MAC layer(zeus.ugent.be)
293 points by redfast00 3y ago|149 comments
11.
by redfast00 4y ago
You first need to find ground. You can do this by visual inspection (a bit less risky), or by using your multimeter in continuity mode across external metal parts (for example the outside of the USB port)/negative pin of the power supp
12.
by redfast00 4y ago
This is raw memory, so the concept of malloc/free does not really exist: the OS will just overwrite the data. I think (not entirely sure) that the kernel gets relocated to a more or less fixed address in memory anyway, this won't
13.
by redfast00 4y ago
Try to identify a serial port on the PCB, connect a serial adaptor to it (careful to get the pins and voltage right!) and take it from there (Edit: or google the PCB board markings, maybe somebody already did this)
14.
by redfast00 4y ago
Mainly by looking at what addresses the original bootloader loads them into. The addresses don't matter too much, as long as you load them into valid memory, since for most you pass a reference to them anyway in later steps.
15.
by redfast00 4y ago
(author here) We use the device instead of a Raspberry Pi, not for anything too serious: we attached it to a screen and have a small server running with an API where you can write single pixels into the framebuffer (a bit like /r/
16.
by redfast00 4y ago
(author here) this is indeed a Salea clone (one of the first results when searching for 'logic analyzer' on Aliexpress), with pulseview/sigrok as software. I try to use cheap tools if possible, so it's more accessible fo
17.
by redfast00 4y ago
author here, surprised to see this on HN. If you have any questions, don't hesitate to ask :)
18.
by redfast00 4y ago
There should be a double * there, but I think HN removed it
19.
by redfast00 4y ago
Thanks for the information! I think I know who you are, and I understand why you chose to comment with a throwaway handle ;)
20.
by redfast00 4y ago
This might not have been clear in the blogpost, thanks for asking. There are two storage locations on the PCB: the external flash chip, and the internal flash on the microcontroller. I recall that someone else tried to read out the external
21.
by redfast00 4y ago
The person who brought the tags has a lot of them, more than the 3 they donated to Zeus. If we replace the firmware, we have to do this for every device, which would be a lot of manual work (opening case, adding probes, flashing firmware, .
22.
by redfast00 4y ago
I had also thought about this, but this is much harder to pull off, since 1. You need a lot of instructions in sequence to succeed, enough that the chance that all succeed is very very small (recall that there's only about a 5% chance
23.
by redfast00 4y ago
Voltage injection is (IMO) the easiest attack. There's also optical fault injection, where you remove the black encapsulation from the chip and hit the bare die with a laser (that sounds really difficult though). On some chips, you can
24.
by redfast00 4y ago
Thanks for the interest :) If you have an RSS feed reader, you can add our RSS feed, so you'll automatically get the next blog posts https://zeus.ugent.be/feed.xml
25.
by redfast00 4y ago
The idea is indeed to communicate with the tags with their stock firmware (not necessarily using another CC2510, since these aren't made anymore, but that's a possibility). AES is symmetric cryptography, so that should be possible
26.
by redfast00 4y ago
When I recently visited, I saw that the local IKEA uses these tags, so I'd guess these are rather popular.
27.
Reverse engineering an e-ink display(zeus.ugent.be)
188 points by redfast00 4y ago|53 comments
28.
by redfast00 4y ago
There is a policy about this: https://wiki.openstreetmap.org/wiki/Disputed_territories
29.
by redfast00 4y ago
The author uses an FPGA, which is notoriously hard to program for. In the recent years, microcontrollers have become more and more capable: for example the Raspberry Pi Pico costs about 4 USD and can run at 250MHz and up. Thanks to PIO (pro
30.
by redfast00 4y ago
Related: a multi-program programmable LED strip (in Lua, allows the led strip to be split up into multiple segments) https://zeus.gent/blog/21-22/ledstrip_sandbox/ with the code on https://github.c

More ›