An introduction to Firmware Analysis [30c3]

For  many, the term "firmware" refers to some kind of black box software that no one really has access to. This talk explains how to analyse such an image. For example, that's how recently it was found that certain consumer routers have a default hardcoded username/password, or that some administrative pages were accessible without authentication.

A very good talk from Stefan Widmann. Enjoy!

zBox4 Construction: a supercomputer in 24 hours

What happens when you have a herd of turbonerds, 24 hours and the need to crunch lots of numbers? You get a cool video of a number crunching cluster being built!

The Institute for Theoretical Physics in Zurich needed an upgrade to the existing zBox cluster and the decision was taken to built the zBox4. Several details on the construction can be found here.


This monstrous beast is running Scientific Linux, a distribution oriented towards labs and universities and specially designed for clusters. With a theoretical value of 282 GFLOPS per CPU, this has a peak performance around 108 Teraflops, an impressive number that would be a candidate for the top500 list.

On not proving the twin prime conjecture with AutoCAD

A nice hack with AutoCAD on visualizing prime numbers.

On not proving the twin prime conjecture with AutoCAD:

As an HVAC engineer by trade, [Carlos Paris] spends a lot of time in AutoCAD designing all those hidden pipes, tubes, and ducts hidden in a building’s rafters. One day, [Carlos] read of an open contest – the prize was over a million dollars – to generate a prime number with a billion digits. [Carlos] misheard this as, ‘a prime number greater than one billion’ and of course said this was a trivially easy task and opened up his favorite tool – AutoCAD – in an effort to discover the largest prime ever. [Carlos] never generated a remarkably large prime, but he did come up with a very, very cool visualization of prime numbers on a number line, as well as a great justification of the twin prime conjecture, a problem in mathematics that has remained unsolved for several generations.
[Carlos] started his investigations into the properties of prime numbers by drawing a series of circles on a number line in AutoCAD. These circles were of diameters of all the integers, and going down the number line, these circles started to have an interesting, chaotic pattern (see above picture). [Carlos] found that whenever two circles intersected, that position was a prime number. It’s really nothing more than a Sieve of Eratosthenes, but it’s a very cool-looking visualization nonetheless.
Looking deeper into his graph, [Carlos] discovered there were certain primes that had another prime number just two places down the number line. For example, the numbers 3 and 5, 29 and 31, and 41,and 43 are twin primes, as the difference between the primes is only 2. The idea there are infinitely many twin primes is a famous unsolved problem in mathematics – it’s obvious it must be true, but no mathematician has yet come up with a proof of this conjecture.
[Carlos] looked at his number line and simplified it to a generic prime number. By taking a generic number line and overlaying the multiples of other prime numbers on this graph, [Carlos] had a very, very clever way of understanding exactly how twin primes come into existence.
In the end, [Carlos] is no closer to proving the twin prime conjecture than anyone else. We’ve got to hand it to him, though, for nerding out with an engineer’s favorite tool – AutoCAD – and managing to derive some fairly obscure mathematics on his own.
After the break you can see [Carlos]‘s videos describing the though process that went into his creation. Very, very cool work.

Discrete FPGA will probably win the 7400 logic competition

This is a mega hack!

Discrete FPGA will probably win the 7400 logic competition:

For this year’s 7400 logic competition, [Nick] decided to build an FPGA out of logic chips.
Perhaps a short explanation is in order to fully appreciate [Nick]‘s work. The basic component of an FPGA is a slice, or cell, that performs boolean operations on its input and sends the result on its output. The core of these slices is a lookup table – basically a truth table that stores the result of every possible input combination.
One very easy way to implement a lookup table is to use a RAM or EEPROM chip. By tying the address lines of an EEPROM to the input and the data lines to the output, it’s possible to create a single slice of an FPGA very easily.
Unfortunately for [Nick], 74-series memories have long been out of production. There is another option open, though: shift registers. A shift register is basically an 8-bit memory chip with parallel inputs, so combining a shift register with an 8-input multiplexer is a very simple way to implement a 3-input, 1-output FPGA slice.
After figuring out how to tie these slices to bus lines, [Nick] needed a way to program them. Verilog or VHDL would border on insanity, so he wrote his own hardware description language. It’s certainly not as powerful or capable as the mainstream solutions to programming an FPGA, but it’s more than enough.
In the video after the break, you can see [Nick]‘s overview of his very large 8-slice FPGA while he runs a combination lock and PWM program. All the code, schematics, and board layout are up on [Nick]‘s git if you’d like to build your own.



Filed under: hardware

Exploring the Mandelbrot set in real time

This is truly a beautiful hack! From Hack-a-day.

Exploring the Mandelbrot set in real time:

The Mandelbrot set – the fractal ‘snowman turned on its side’ seen above – has graced the covers of magazines, journals, and has even been exhibited in art galleries. An impressive feat for what is nothing more than a mathematical function, and has become something of an obsession for [Chiaki Nakajima].

Even on modern computers, generating an image of a portion of the Mandelbrot set takes a good bit of time. When [Chiaki] discovered this fractal in the mid-1980s, the computers of the day took hours to generate a single, low-resolution image. Real-time zooming and scrolling was impossible but [Chiaki] made the best of what he had on hand and built Pyxis, a Mandelbrot set generator made entirely out of TTL logic chips (Google Translate here).

The original Pyxis connected to a desktop computer via a breakout box. while a special program toggled the bits and registers inside the Pyxis to generate pictures of the Mandelbrot set a thousand times faster than the CPUs of the day could muster.

Time marches on, and the original logic chip Pyxis is can be easily surpassed by even the slowest netbooks. There is, however, another way to build a hardware Mandelbrot set generator: FPGAs.
A few years ago, [Chiaki] began work on the Pyxis2010 (translation), an FPGA-based Mandelbrot set generator able to dynamically zoom and pan around the world’s most popular fractal. Built around an Altera Cyclone III FPGA he picked up from Digikey for $600 (no, not a dev board, just a bare chip), [Chiaki] began deadbugging his circuit directly onto the pins of the hugely expensive FPGA. A man with a steady hand and no fear if there ever was one.

Instead of connecting his Mandelbrot generator to a computer and using it as a co-processor, [Chiaki] decided he wanted something more portable. He found an old Sony PSP, removed the LCD screen, and integrated it into his circuit. After a careful bit of dremeling and fabrication, [Chiaki] had a hand-held Mandelbrot generator that is able to display images of the world’s most famous fractal faster than any desktop computer.

It goes without saying this build is incredible. The technical skill to build an insanely fast Mandelbrot generator on an FPGA is astonishing, but basing it off a logic-chip based build reaches into the realm of godliness. You can check out a video of this amazing build after the break.
Props to [Ian Finder] for sending this one in.




Filed under: hardware, misc hacks

John the Ripper rules!

And I mean that both as a verb and as a noun. For those who don't know, John the Ripper is a password cracking program. It supports various formats natively and the community-enhanced version brings it to an insane level.

It can run attacks based on the login name itself, a wordlist and variations (called "rules") and, last resort, a brute force.

Here are a few rules I usually add:

# Try with 2 prefixing digits
l ^[0-9]^[0-9]
# Try prefixing with possessives
l A0"My"
l A0"Your"
l A0"His"
l A0"Her"
l A0"Our"
l A0"Their"
# Try with 1, 2, 3 and 4 digits at the end, and the same with punctuation
l $[0-9]
l $[0-9]$[0-9]
l $[0-9]$[0-9]$[0-9]
l $[0-9]$[0-9]$[0-9]$[0-9]
l $[0-9]$[(){},?;.:/=+<>%$*-_]
l $[0-9]$[0-9]$[(){},?;.:/=+<>%$*-_]
l $[0-9]$[0-9]$[0-9]$[(){},?;.:/=+<>%$*-_]
l $[0-9]$[0-9]$[0-9]$[0-9]$[(){},?;.:/=+<>%$*-_]
# Try with 1 or 2 digits and 2 punctuations symbols
l $[0-9]$[(){},?;.:/=+<>%$*-_]$[(){},?;.:/=+<>%$*-_]
l $[0-9]$[0-9]$[(){},?;.:/=+<>%$*-_]$[(){},?;.:/=+<>%$*-_]

If you have your own killer rules, feel free to drop the URL in the comment section.