Viewing profile — redfast00

From the datasheet, I see that there is a Bitscrambler peripheral that seems to be very similar in flexibility to the Raspberry Pi Pico's PIO: > Since bitwise operations can be rel…

Author here; see also the entire series of posts on https://esp32-open-mac.be/

In my opinion, the author understates how good AES-GCM-SIV is: > The solution they designed is described in that linked paper: AES-GCM-SIV, which is able to tolerate some number of…

Please contact me via email (at the bottom of the blog post)

As part of the NLNet grant, I will build an affordable Faraday cage; I'll post the BOM, assembly process and a test report in a separate blog post.

Oops, my bad, copy-pasted it incorrectly; fixed now

You first need to find ground. You can do this by visual inspection (a bit less risky), or by using your multimeter in continuity mode across external metal parts (for example the …

This is raw memory, so the concept of malloc/free does not really exist: the OS will just overwrite the data. I think (not entirely sure) that the kernel gets relocated to a more o…

Try to identify a serial port on the PCB, connect a serial adaptor to it (careful to get the pins and voltage right!) and take it from there (Edit: or google the PCB board markings…

Mainly by looking at what addresses the original bootloader loads them into. The addresses don't matter too much, as long as you load them into valid memory, since for most you pas…

(author here) We use the device instead of a Raspberry Pi, not for anything too serious: we attached it to a screen and have a small server running with an API where you can write …

(author here) this is indeed a Salea clone (one of the first results when searching for 'logic analyzer' on Aliexpress), with pulseview/sigrok as software. I try to use cheap tools…

author here, surprised to see this on HN. If you have any questions, don't hesitate to ask :)

There should be a double * there, but I think HN removed it

Thanks for the information! I think I know who you are, and I understand why you chose to comment with a throwaway handle ;)

This might not have been clear in the blogpost, thanks for asking. There are two storage locations on the PCB: the external flash chip, and the internal flash on the microcontrolle…

The person who brought the tags has a lot of them, more than the 3 they donated to Zeus. If we replace the firmware, we have to do this for every device, which would be a lot of ma…

I had also thought about this, but this is much harder to pull off, since 1. You need a lot of instructions in sequence to succeed, enough that the chance that all succeed is very …

Voltage injection is (IMO) the easiest attack. There's also optical fault injection, where you remove the black encapsulation from the chip and hit the bare die with a laser (that …

Thanks for the interest :) If you have an RSS feed reader, you can add our RSS feed, so you'll automatically get the next blog posts https://zeus.ugent.be/feed.xml

The idea is indeed to communicate with the tags with their stock firmware (not necessarily using another CC2510, since these aren't made anymore, but that's a possibility). AES is …