@azonenberg@ioc.exchange
@azonenberg@ioc.exchange avatar

azonenberg

@azonenberg@ioc.exchange

Security and open source at the hardware/software interface. Embedded sec @ IOActive. Lead dev of ngscopeclient/libscopehal. GHz probe designer. Open source networking hardware. "So others may live"

Toots searchable on tootfinder.

This profile is from a federated server and may be incomplete. Browse more on the original instance.

NanoRaptor, to random
@NanoRaptor@bitbang.social avatar

A small manufacturing defect destroys your computer's main storage, and it's nonrecoverable. All data lost.

Do you have backups so that you can restore what you cannot do without, and quickly? Have you checked those backups are happening? do you have multiple backups? have you checked they're restorable?

azonenberg,
@azonenberg@ioc.exchange avatar

@tommythorn @darkling @NanoRaptor An ex-cofounder of mine from a previous company had his house catch fire.

Including a server containing a ton of irreplaceable data belonging to a client that was super paranoid and had an NDA clause mandating all data be stored on premises (his house since it was a tiny startup).

Luckily he had fiber with fast upload.

The client ssh'd into the burning building and managed to save most of the data before power was lost. Talk about a close save.

azonenberg, to random
@azonenberg@ioc.exchange avatar

1 μF.

azonenberg, to random
@azonenberg@ioc.exchange avatar

PSA: if you ever find yourself in need of a horrible pun on short notice, you can just grab one from the US Government Strategic Dad Joke Stockpile.

Yes, this is a real taxpayer funded resource. https://www.fatherhood.gov/for-dads/dad-jokes

Use this knowledge wisely.

azonenberg, to random
@azonenberg@ioc.exchange avatar

Anybody have a comprehensive list of GPOs to disable all of the ai/cloud/telemetry functionality in MS products? Copilot, onedrive, alt text generation in office, the works. Anything that can potentially violate NDAs by sending content of your system to MS.

azonenberg, to random
@azonenberg@ioc.exchange avatar

Do I know any artists interested in drawing some GUI icons for a F/OSS project? Simple vector line art, maybe with an outline/backdrop of some sort common to the entire set.

Hoping to find someone willing to donate time since we don't have much in the way of budget, but I understand time isn't free and if someone offers me a reasonable rate I'll try and scrounge up the cash to make it happen.

azonenberg, to random
@azonenberg@ioc.exchange avatar

Every customer service interaction I've had recently:

(hold music)

(Suspiciously cheerful voice) Did you know that you can manage the intensity and depth of your torment online? Simply log into TormentNexus dot com and click "My Account"!

(hold music)

Me: (muffled expletives) if your website would let me do what I was trying to do I wouldn't be calling you...

azonenberg, (edited ) to random
@azonenberg@ioc.exchange avatar

You write safe Rust.

I disabled SIGSEGV in my C++.

We are not the same.

In all seriousness, I'd love if anyone had a better solution to this problem. But there doesn't seem to be any SFR bit I can set to make the STM32H7 flash IP not throw a bus fault on an ECC failure.

So if you ever have a bug in your firmware that writes to the same flash ECC block twice without erasing it, that flash block will become toxic and any future attempt to deref any address within it will segfault. Not good if you're trying to make a robust, log-structured data store (in which any bug or unexpected power cycle poisons the entire key-value store, segfaulting future reads).

Turning off faults when writing, or when doing CRC checks on read data, allows graceful degradation when things go wrong.

Still trying to figure out why the bootloader seems to be stepping on non-blank flash cells (it should be appending at the end), but at least it's not soft-bricking the board by throwing the bootloader into a fault handler before it reaches the DFU flow.

azonenberg, to random
@azonenberg@ioc.exchange avatar

Better demo of the ngscopeclient waterfall display showing scrolling and zooming. Same QSGMII signal as input.

Video of ngscopeclient waterfall display showing scrolling and zooming

azonenberg, to random
@azonenberg@ioc.exchange avatar

Anyone know of good Linux software for interfacing with microscope cameras (specifically ones that show up as standard UVC devices, not proprietary) and adding scale bars, annotations, etc to the images?

Or am I going to have to write something...

azonenberg, to random
@azonenberg@ioc.exchange avatar

According to a quick skim of their catalog, NIST does not sell a SRM of swamp mud.

This is a problem. How are we supposed to have bog-standard stuff if we don't have a standard bog to calibrate them against?

azonenberg, to random
@azonenberg@ioc.exchange avatar

@blinken was asking me about damage to ICs earlier.

Subtle stuff like bad memory bit cells is rarely if ever visible optically, especially on modern technology.

But blown IO cells from ESD/EOS are often quite obvious due to the extreme amounts of energy involved compared to what the device was intended to survive.

Here's a 100x view of an ATMega3216 that had been subjected to ~12V on the UART RX pin due to a ground fault. (I think @quantumdude836 might have been the one who sent me this chip years ago??)

You can clearly see the power and ground lines in the protection diode are completely fused and the surrounding glass dielectric is cracked.

azonenberg, to random
@azonenberg@ioc.exchange avatar

I can't be the only one who thinks this.

Given the circles I run in, often both meanings are equally plausible at first and I have to stop and think.

azonenberg, to random
@azonenberg@ioc.exchange avatar

So apparently you shouldn't give your WES51 to kids under 3 because they might choke on it. TIL.

But if they're 3 it's totally fine, no worries of them setting the house on fire or anything.

azonenberg, to random
@azonenberg@ioc.exchange avatar

I think I found a shader bug in my basement. The emissivity on the water bottle material is way too high.

azonenberg, (edited ) to random
@azonenberg@ioc.exchange avatar

Anyone know of resources/tips on minimally destructive disassembly of fire-damaged electronics for purposes?

Trying to pull a flash chip out of a slightly crispy [redacted] without destroying it in the process. No idea if any recoverable data survived, or if it's encrypted (which would require recovering another chip on the board to have any hope of getting a usable dump) but I'd like to at least try.

Outer housing looks to be some sort of metal (I think aluminum but can't be certain... any paint or markings are burned off, it's not rusted so probably not carbon steel, didn't melt or char so probably not zinc or plastic). Fasteners are all ferrous and seem rusted/seized up so I will probably have to drill them out.

(Focus is purely on data recovery, no need for the recovered info to be admissible as evidence or anything)

azonenberg, to random
@azonenberg@ioc.exchange avatar

I think this is next level cursed. But it actually worked.

azonenberg, to random
@azonenberg@ioc.exchange avatar

Anyone know what Wi-Fi APs do if you send layer-2 Ethernet broadcast traffic to them while no clients are associated on the 802.11 side?

Does it generate a radio packet even though there's nobody listening? Drop the packet since it knows nobody can hear? Does it depend on the specific AP and perhaps configuration (WPA enabled vs not, etc)?

azonenberg, to random
@azonenberg@ioc.exchange avatar

Just had someone suggest that I start a company making my probes and "exit" by selling out to a scope vendor (who would almost certainly bury the project as active probes are way more profitable).

He even offered to put me in touch with VCs. What part of "this is not a capitalist enterprise" did you miss??

azonenberg, to random
@azonenberg@ioc.exchange avatar

Optics nerds: What's the easiest, lowest cost way to build something that focuses a lot of light from a fairly wide (say 90 degree, give or take a bit) FOV into a spectrometer with a SMA 905 fiber input?

Goal is to collect UV-VIS-NIR spectra of the night sky (particularly interested in both light pollution and auroras) over as much of the 200-1200nm range as I can get with low-cost optics (i.e. I don't want to spend extra to get a bit further outside visible, but will take what I can get easily).

Since the device will be operated outside at night, it can be open frame (no need for any exterior light-shield tube, only mechanical support components).

My initial thought is some kind of 80/20 based frame holding a cheap Fresnel lens at one end, with the spectrometer mounted at the focal point (no fiber, directly bolted to a bracket at the focal point) with a cosine corrector on the input to increase the size of the entrance pupil and provide a bit of tolerance for misalignments.

azonenberg, to random
@azonenberg@ioc.exchange avatar

Back from a fun couple of days in Bochum presenting at the second Hardware Reverse Engineering Symposium (HARRIS) hosted by the Max Planck Institute for Security and Privacy.

The talk was titled "Secure Element vs Cloners: A Case Study". Slides will be uploaded shortly, I'll share a link here when I've had a chance to do that.

As part of this research, I and the other IOA silicon lab folks examined two generations of an undisclosed consumer product with cryptographically vendor-locked peripherals, as well as a third party clone that appeared on the market shortly after the second-generation OEM hardware design was released (implying the DRM scheme was broken as a result of a weakness in the new-gen product). We also speculate on some of the market forces that may have lead to some unusual design decisions made by the cloner.

This work is ongoing and we hope to present a deep-dive at REcon this summer with more extensive analysis. The HARRIS talk was only 15 minutes so I had to cut a lot of detail out.

azonenberg, to random
@azonenberg@ioc.exchange avatar

Nice blog from a coworker about the silicon reverse engineering conference I presented at last week.

https://ioactive.com/ioactive-presents-at-harris-2024-chip-reverse-engineering-andrew-zonenberg/

azonenberg, to random
@azonenberg@ioc.exchange avatar

New video upload! Finished editing just in time.

"Introduction to Ramen and Ramune Spectroscopy"

https://youtu.be/CjfLq3RsJbU

azonenberg, to random
@azonenberg@ioc.exchange avatar

Early call to gauge interest: Who's seriously interested in attending a paid training on oscilloscope probing theory and practice, some time in the early summer at my lab just outside Seattle? It will be a one-day, in-person event including 4+ hours of lecture and lots of hands-on lab time for everyone on some very nice equipment (16 GHz oscilloscope, 28 Gbps BERT, multiple VNAs, and more).

I've done a few test runs with friends and I think I've finally got it refined to the point I'll be ready to do the class for paying students in the near future. Course notes are open source https://github.com/azonenberg/electronics-training/tree/master/oscilloscope-probing so you can take all the notes home after, you're mostly paying for the in-person instruction and lab access.

It will cover many different kinds of probe ranging from the classic passive R-C divider probe up to modern double digit GHz active differential probes, pros and cons of each design, non-idealities and limitations, and how to get the most out of your measurements.

This will be an in-person event hosted out of my lab with a very limited class size, 4-6 students, to ensure everyone gets enough lab time. Special introductory pricing of $1000/seat for industry professionals. If you're a student/hobbyist and would love to attend but can't afford the full price, ping me and I'll try to make something work out.

I'm tentatively shooting for the weekend of June 8th or 15th, but subject to change based on student availability etc. I plan to make this a regular thing so if more than one class worth of people are interested it will happen again for sure.

This will be a COVID-safe event, masks are (at minimum) strongly encouraged, and may be mandated if anyone attending has specific health concerns. The lab is a "cleanishroom" (engineered for very clean air with multiple HEPA filters etc, but not ISO 14644-1 certified) and additional portable filtration units will be present in the classroom.

Photo of a very expensive looking lab bench with a stereo microscope, three oscilloscopes, a vector signal generator, and lots of other test and measurement equipment with cables running to a prototype under development on the bench

azonenberg, to random
@azonenberg@ioc.exchange avatar

How did I just find out today that C++ supports digit separators in integer literals since C++ '14?

azonenberg, to random
@azonenberg@ioc.exchange avatar

All reflowed and ready for through hole component installation and serial number labels...

Tomorrow. it's late and I'm getting tired.

azonenberg,
@azonenberg@ioc.exchange avatar

And that algorithm plus a few tweaks did the trick beautifully.

Here's the same 100Base-T1 waveform with the new edge detector.

Plus some 50G PAM4 for good measure. Thanks again to @oxidecomputer for the test data, I'm still finding it useful!

ngscopeclient showing a very pretty 50G PAM4 eye pattern

  • All
  • Subscribed
  • Moderated
  • Favorites
  • JUstTest
  • GTA5RPClips
  • thenastyranch
  • ethstaker
  • everett
  • Durango
  • rosin
  • InstantRegret
  • DreamBathrooms
  • magazineikmin
  • Youngstown
  • mdbf
  • slotface
  • tacticalgear
  • anitta
  • kavyap
  • tester
  • cubers
  • cisconetworking
  • ngwrru68w68
  • khanakhh
  • normalnudes
  • provamag3
  • Leos
  • modclub
  • osvaldo12
  • megavids
  • lostlight
  • All magazines