SD Card Bootloader by Backdoor Code Injection

For various reasons, I decided to try writing a SD card bootloader for my Ultimaker2.

The project is open source and on my GitHub here.

My goal was to install this new bootloader without having physical access to the circuitry. Thus I cannot use a ISP tool and must be done through the bootloader that is already present on the Ultimaker2. The only way to do this is to partition off a portion of application memory region for a secondary bootloader that executes after the original bootloader. But the ATmega2560 has a restriction that prevents anything in the application memory region from modifying the flash memory at all. Overcoming this restriction is what this hack is all about, continue reading if you are interested in learning more.

Continue reading

PS4 Playing NES Cartridges

Update March 2015

This project won 2nd place in this Reddit contest about functional 3D printed projects. Thank you very much to ToyBuilder Labs for being the sponsor.

Questions and Answers

  • Why not use a bigger 3.5″ drive? They can hold much more and cost much less.
    • I can edit the design anytime I want and 3D print it anytime I want, so I will definitely consider it.
    • But I had a few spare 2.5″ drives laying around.
    • The fake cartridge is a funny idea so I did it for the LULz! (and protects the drives)
    • Please note: 3.5″ drives will require an external 12 volt power supply, while 2.5″ drives only require the 5 volts from the motherboard.
  • What parts are needed?
    • #4-40 thread 0.25″ long countersunk machine screws, for holding the hard drives inside the cartridges
    • #4-40 thread 0.5″ long countersunk machine screws, for holding the dock to the cover
    • 0.5″ long nails to hold the SATA connector in place
    • something like this SATA extender, but note that this isn’t the exact same one I used, so you should measure it yourself and edit my files before printing my files
  • How did you connect the cable to the motherboard?
    • This was actually pretty hard, I ended up gluing a popsicle stick to the connector first, and then used the stick to poke the connector inside and into the motherboard’s connector.
    • This can be improved by some sort of 3D printed dummy drive, but I got tired and wanted to wrap the project up.
  • In the picture of the Ultimaker, why do the plastic look a bit rough?
    • Those are failed prints, I only used them for the picture, specifically because the roughness emphasizes the fact that they are 3D printed.
    • The final good prints are so good that you cannot tell that they are actually 3D printed. The Ultimaker is very high quality.
  • Why didn’t you launch the game?
    • I didn’t connect the system to my network, so the PS4 didn’t let me launch them, since they are all digitally downloaded and thus require authorization first
    • Don’t worry, they all work once connected to the internet.
  • I’ve seen something similar before…
    • Adding a hard drive to the PS4 using SATA extensions isn’t a new idea at all, somebody already added 6 TB to it, using a 3.5″ drive, but he used a external enclosure and a external 12 volt power supply.
    • I went to CES2015 and saw Nyko’s Data Bank. I want to make it clear that I started my design a long time before Christmas, and was not inspired or influenced by Nyko
  • Ask me a question, if it is a popular question, I will answer it here.

You want files? Click Here. I hosted the files on YouMagine, and I provided the STEP file format, which you should be able to open with most 3D modeling software. So if you want to change the design for 3.5″ drives, or chose another cartridge shape, you can!

NOTE: the dimensions of the fake NES cartridge I used are not the same dimensions as genuine NES cartridges, so genuine cartridges will not fit in this project, and the fake cartridges will not fit inside a genuine NES deck.

Ultimaker2 Bearing Spool and Bearing Guide Upgrade

This is an upgrade to the Ultimaker2 3D printer for people who have spools that do not fit the original spool holder, and spools that are too tight and thus do not feed smoothly, causing under-extrusion.

It is composed of two assemblies: a replacement for the filament guide and a replacement for the spool holder. Both utilizes ordinary skateboard bearings to achieve smooth rotation. The conical shape of the spool holder allows for any sized spool to be used, easily swapped because it uses a wing nut.

um2 spool holder upgrade angleum2 spool holder upgrade sideum2 spool holder upgrade cross section

um2 filament guide upgrade angleum2 filament guide upgrade sideum2 filament guide upgrade cross section

Files are available on YouMagine. I want to emphasize that I am sharing the STEP files, not just STL, because STL are harder for people to import and modify than STEP files. SolidWorks files are also provided.

The cross section images shows you how to assemble the upgrade parts. The screw diameters are #6 for the filament guide and 5/16″ for the spool holder. Please figure everything else out from the cross section images.

Weekly Report December 20 2014

I have been using my new Aquarium Computer for a week now. It’s performance is great, but that is subjective, because I built it for my own needs and I feel that it meets them perfectly. The circuit I built for it is having problems, I will investigate further.

But I had to take it out of the tank already. I attempted to implement full drive encryption, which required secure boot to be enabled in the UEFI BIOS. Well… long story short, the UEFI BIOS crashed when I tried to save settings and the motherboard stopped booting. The only fix is to use the CMOS reset jumper on the motherboard. So I drained the mineral oil and did exactly that, and I also connected the jumper to some spare wires so if this happens again, I wouldn’t have to drain the oil again.

In the process, I found out that most of the hot glue has come loose. So now I have no fake plants or rocks anymore. I will rebuild the tank again with decorations, but next time I will use epoxy. (although the tank still looks beautiful without any decorations)

I also picked up a Seek Thermal camera. I have some pictures of the Aquarium Computer. Notice that I can see the hot and cold zones of the radiator, and the hot and cold tubing. The tank itself is pretty much one color only, thermal cameras cannot see through the tank, only the temperature on the surface.

img_thermal-2117189312img_thermal-1112600730img_thermal461972647

The Seek Thermal is neat, I’d say it’s worth it. Apparently it’s not the best sensor, but it is the only one for Android right now. I don’t have any real professional uses for it, it’s just a toy for me.

Back to the Aquarium Computer. I noticed many things about the mineral oil. First, make sure you understand fluid dynamics a bit, you want to make sure you are not making the pump work harder than it is. What I mean is, place the outlet tubing in a shallow depth. The hot and cold oil don’t mix well, you can clearly see the temperature gradient visually because they have different refraction index. This means that the cold oil sinks extremely fast, instead of dispersing into the hot oil. I mention this because originally, I aimed my outlet tubing deep at the power supply, but now that I know this fact, I can have my outlet tubing much shallower and just let the cold oil fall onto the power supply. This made the pump work better because there is less pressure at the outlet. Also, hot oil flows much quicker, I noticed that running the radiator without fans will make the pump work better because hot oil flows better.

Also to the people who thinks that I don’t actually need so much RAM: i really need ram

Aquarium Computer

My trusty laptop is showing its age. 8 GB of RAM is not enough for the amount of 3D stuff I do now, and it can’t run the latest games at all any more. Since I got a full time job now (instead of a constantly travelling student), it’s time to get a desktop PC (first PC build, yay). But the process of building a PC is pretty boring, it’s just an exercise of picking out compatible parts for the right price. I decided to make it slightly more interesting by submerging the entire computer in a fish tank full of mineral oil.

UPDATE March 2015, I added a funny naked HDD activity indicator

Some pictures from the build process

20141214_234026gfx cardradiators under deskpcie risertop coverfirst bootdecorationfans

Animated Loop

Short Story (long story later, technical details and stuff):

Intel i7 4790S, Nvidia GTX 970, H97M chipset, Corsair CX600M. Built onto a polycarbonate tray that is then dipped into a fish tank full of mineral oil. Fancy features like bubbling treasure chest, NeoPixel LED strip, oil pump+radiator, temperature monitoring, removable SSD.

(part list? fine… here… these are not the prices I paid but here it is http://pcpartpicker.com/user/frank26080115/saved/HFDmP6)

Comments and questions are welcome, I would love to chat with you!

Reddit posts, please upvote: http://www.reddit.com/r/battlestations/comments/2pdd3q/aquarium_computer_mineral_oil_submerged_details/ and http://www.reddit.com/r/buildapc/comments/2pdeak/build_complete_aquarium_computer_mineral_oil/

Hi Hack a Day visitors, small correction: there’s 32 GB of RAM, I just didn’t put the same item twice in the part list.

News/Updates will be posted at the bottom of this page

Long Story… Continue reading

Q-Bot Tx Module for Taranis

Most micro (palm sized) quadcopters are RTF and comes with a crappy cheap transmitter, and I really want to use my awesome expensive Taranis. I found out that Q-Bot comes with a tiny transmitter module that I can connect to my Taranis.

I didn’t want some ugly thing dangling off of my Taranis so I decided to 3D print a module that will contain the Q-Bot transmitter circuitry and plug into the Taranis’ module bay, which fits “JR” style transmitter modules.

20141115_110602 (Large)
3d
20141115_110254 (Large)

and here is what it looked like before:
original

The 3D files (SLDPRT, STEP, STL) Continue reading

My First 3D Printed Quadcopter

20141102_144912 (Large)20141101_120057 (Large)

3D printed using my Ultimaker2 and many colors of PLA plastic at 100% in-fill. It is my first design, featuring folding arms, tucked away electronics, and anti-vibration mounted flight controller. It is designed to be friendly with FDM 3D printers, employing some special techniques. The frame is extremely strong.

20141101_120023 (Large)3d_screenshot_23d_screenshot_120141029_202031 (Large)

I need more practice. I need to buy a few more propellers and few more batteries as well so I can practice for longer.

Flight controller is a Continue reading

FrSky X4R-SB Smart Port hack and Naze32

Continuing from my previous FrSky X4R-SB hack (read for some context), I really wanted Smart Port telemetry to work with Naze32. I forked the original baseflight firmware and added two key new functionalities:

  • implemented the Smart Port telemetry protocol
  • GPS can be assigned to any serial port (as opposed to only one port)
    • this is important because we are running out of ports
    • I made it possible for GPS to be connected to software/bitbang serial, to free up a hardware UART

please read my fork’s wiki, at this time, I can only test with my limited hardware, more help testing/coding would be appreciated.

Update 10/26/2014: I was asked to make the same contribution to Cleanflight, which I have done today.

The new forked firmware requires a circuit modification on both the X4R-SB and Naze32, see pictures: Continue reading

FrSky X4R-SB S.BUS anti-invert hack

I am building a quadcopter using a FrSky Taranis X9D radio. It came with a FrSky X8R receiver. I wanted to keep my wiring clean by using the S.BUS feature on the FrSky receivers, I purchased a smaller FrSky X4R-SB receiver. The X8R has 8 PWM channel pins and the X4R-SB has 3 PWM channel pins, but if I use S.BUS (which is serial, not PWM), I can access 16 channels using only 1 pin, on both X8R and X4R-SB. The X4R-SB is much smaller, making it more ideal. (do not confuse the X4R-SB with the D4R-II, this is important, D4R-II uses CPPM, not S.BUS)

(update 10/25/2014: a follow up hack for Smart Port)

I want to use a Naze32 flight controller, which is open source and does have code to interpret S.BUS protocol. S.BUS is UART communication but it is inverted and the Naze32’s UART cannot accept inverted input. Some flight controllers, such as the Pixhawk, has a dedicated inverter just to solve this problem, but the Naze32 does not.

The first option is to buy a “S.BUS to CPPM converter” but CPPM is not a serial bus like S.BUS and thus does not have the advantages of being a serial bus. CPPM uses timing, timing needs to be measured (measuring things = possible error) and the signal edges can be affected by capacitance, noise, etc. Also having such a converter means there will be a tiny bit more latency in the system. These two disadvantages are probably too insignificant to notice performance wise. But I still didn’t want to spend another $13 + tax + shipping just to solve a problem that shouldn’t have existed in the first place.

The second solution is to buy an “inverter cable” which is a cable that has a NOT gate inline and then shrink wrapped. Or I can just buy a NOT gate and make the cable myself. I still didn’t want to spend the money. I opted to hunt down the inverter on the X4R-SB circuit instead, and connect a wire to the input of the inverter (labelled as “A” in the datasheet). This provides me access to the un-inverted signal that I can directly connect to the Naze32.

See the pictures below to understand how this hack was done.

identify_r25indentify_inverterinstructions

And just in case I confused you even more, all you need to do is connect a wire to the “A” pin.

I have tested it with Naze32 Rev5 and firmware f4d556c68876ccd5902bddf1cade32f1bb382c9f. Works like a charm.

It is probably possible to perform the same hack on a X8R but the X8R is constructed using two PCBs and the inverter is covered up by one of them. Separating the two PCBs is very difficult and risky.

The Smart Port (I think it’s also called S.PORT) is another inverted serial bus available on the X4R-SB and X8R but it is bidirectional. Since whatever you want to connect to it will need a bidirectional circuit anyways, it is not worth it to perform another surgery on the Smart Port. Also, the Naze32 can use SoftSerial to transmit in an inverted fashion, so a dedicated inverter isn’t even required. (SoftSerial would not work well for taking inputs, but outputs is OK)

3D Printed Raspberry Pi Case + Camera Case + Server

There is a law of the universe which states that if you own a Raspberry Pi and a 3D printer, you must print a case for it.

3d_trans20141018_193540 (Large)20141018_193504 (Large)20141018_193521 (Large)20141018_193530 (Large)3d_exp_bot3d_exp_top20141018_005438 (Large)20141018_005336 (Large)3d.fw

There are plenty of case designs for the original R-Pi Model B, and some for the R-Pi Model B+, but there are a few minor annoyances I noticed about them. Plus I really like DIY my own designs, so I designed my own case to suit my own needs.

  • Designed specifically for 3D printing, meaning careful attention to how plastic is extruded, no weak spots, and no overhangs. Plenty of fillets and chamfers.
  • No screws required. The case is held together using latches that take advantage of the plastic’s natural flexibility. It is designed for just sitting on a desk, or attached via velcro/double-sided-tape.
  • I also designed a small case for the camera, which follows the same principles.

These parts are because I am going to set up a web server for my 3D printer, running OctoPrint and also serving live video through the camera. I also setup a cron job to take a picture periodically and upload it to this server. I can also stream video to my Ustream channel. (neither of these servers are 24/7)

I am sharing all of the source files for the models, not just STL files. It is very annoying when people only share STL files, because STL are not import or editing friendly. With my SLDPRT file, you can change one height dimension inside and it will re-adjust the entire case, maybe if you need more clearance on the bottom for screws.

files for R-Pi case

files for camera case

Ultimaker2 Improved Filament Feeder

The Ultimaker2 3D printer has a problematic filament feeder mechanism assembly. When the filament is stuck and the feeder motor turns, it can grind away the filament, causing a gouge in the filament. The gouge makes the problem worse since the tensioner bearing will force the gouge into the feeder’s knurled wheel more, causing even more grinding. This jam happens frequently because sometimes even if the temperature sensor reports that the print head hot end has heated up, the plastic hasn’t melted yet and can’t move yet.

The Ultimaker2’s feeder design is both beautiful and disappointing. It is beautiful in the sense that is is symmetrical and compact. If you had a dual extruder, you can use the same feeder mechanism for both feeders, cutting down on manufacturing costs. But it is impossible to disassemble without removing the stepper motor because the same 4 screws that holds the feeder together also holds the stepper motor in place. If you attempt to open the feeder mechanism to clear a jam, the motor will fall off. The motor is also covered by a metal casing so you need to remove the casing as well. This is very annoying.

There is no other way to move the tensioner bearing because the design is so compact and the spring is tight. There is no other way to remove the feed tube either.

What I needed was a feeder mechanism that can be opened up without removing the stepper motor, and also allow the tensioner bearing to be moved out of the way easily. I came up with the following design:


3dscreenshot23dscreenshot13dscreenshot3

Continue reading

3D Printed Tripod Adapter for Smartphones

I got a new 3D printer, a Ultimaker 2. After testing it out with some small test prints, I printed my first own custom design on this printer. (I’ve only designed for SLT printing previously and not extrusion printing before, this is my first design for extrusion printing).

It’s an adapter that holds my smartphone (Samsung Galaxy Note 3 with a wireless charging S-View flip cover case) and has threads (a 1/4″-20 threaded nut) so it can be mounted to a standard camera tripod. This phone has 4K video recording so why not?

The design is very custom because I need to consider the fact that I have a S-View flip cover case.

(I know I could also use threaded metal inserts, but nuts are easier to buy at the local Home Depot)

Continue reading

Weekly Report August 16 2014

Nothing geeky to talk about. I managed to rent a 1 BR apartment in San Mateo for about $1725/month in a pretty good spot (but whoever built the place did not seem to own a ruler and whoever painted it didn’t own masking tape). Here’s me planning the layout using SolidWorks and Ikea’s catalog.
ikea floor plan

Weekly Report July 20 2014

My project involving the PlayStation 4 and DualShock 4 has caught the attention of Sony, and after interviewing me, Sony Computer Entertainment America hired me as hardware engineer for PlayStation peripherals. Today is the day I take a one way flight from Toronto to San Francisco, and tomorrow will be my first day! Follow your passion, don’t be afraid to fail, and don’t be afraid to show off your skills.

And since I’m leaving my family… Continue reading

PS4 Laser Cut Stand

Summer is coming so I was worried about cooling the PS4. This stand lifts the PS4 off the desk a bit to give it more airflow. I had this cut by Ponoko, using 9mm thick clear acrylic. If you want to make your own, click here to download the EPS file, follow Ponoko’s instructions.

Another way is to 3D print them using black ABS, but I don’t have a 3D printer. The acrylic is left over from another project, hence why I used it.

Trip to China

I went on a short trip to China, seeing some family and some sightseeing.

No trip is complete without seeing some Chinglish

Chinglish

Some wiring near WuXi (please ignore the camera flash being reflected in the glass window, I was on a moving bus, I didn’t have time to disable my flash)

Some BBQ Pupa


Simple 6X USB Charger with Current Monitor

This is a simple 6 port USB device charger with a individual current monitor on each port. The charging current is indicated using RGB LEDs. Blue means slow charge (under 250mA), green means 250mA to 750mA, red means over 750mA, and purple means over 1500mA (for tablets). This circuit involves an ATmega328P (if you do hobby electronics, I bet you have plenty spares of these), INA169 (check out this breakout board), and a OKR-T10-W12.

While this project is not as impressive as my other projects in terms of difficulty, I soldered and Continue reading

Kinetis Microcontroller SRAM Region Hard Faults

I am doing a project that involves a K10DX128 microcontroller from Freescale, which is advertised to have 128 KB of flash memory and 16 KB of SRAM memory. It’s similar to the microcontroller used by the Teensy 3.0 platform. The project involves a lot of dynamically allocated memory because it deals with a lot of files inside a file system.

I ran into one of those “sometimes it happens, sometimes it doesn’t happen” bugs that causes a hard fault. Tracing the source of the hard fault lead to a few ordinary SRAM storage instructions, and apparently it happened half way through processing the list of files. This made me suspect that the memory was allocated incorrectly, and I checked all the things I should check(the address of the allocation, how much memory I should have, the status of my stack, the linker script, etc).
Continue reading

Keyboard and Mouse for PlayStation 4 Games (second prototype)

Why did you do this?

I like playing shooter games on PC but my laptop is too weak to play them. Game consoles do not support USB keyboards and USB mouse, they only support gamepads. Gamepad controls are not suitable for shooter games, using a keyboard and mouse is much more comfortable for gameplay.

How does it work?

I designed a circuit that features a microcontroller and USB hub. The keyboard and mouse plugs into the USB hub, and then the microcontroller takes the data from the keyboard and mouse, translates them to the data format used by the PlayStation 4. It does the translation in a way as though the mouse was the right thumbstick, and the keys are mapped to buttons (the WASD keys are mapped to the left thumbstick).








If you want to buy one from me, you can’t, I don’t want to sell anything. If you want to buy something similar from somebody else, try the XIM4 (my top choice), CronusMAX, Venom X, etc. (if there’s another product you would like to see on this list, give me one to try out first, and I’ll add it if it works)

Development Story

Latest News – July 20 2014

I wanted to share this story because I am very happy that I finally managed to get this far! Anybody who is attempting this and thought it was impossible to do can now breath a sigh of relief because it definitely can be done.

I have already accomplished a similar project that worked with a PS3 (UsbXlater), something that connected to the PS3 via USB that translated keyboard and mouse data format to gamepad data format.

Once the PS4 launched, I reversed engineered the USB protocol used by the DualShock, and then attempted the same technique. But… Continue reading

Weekly Report February 23 2014

Since the RN42HCI does not support SSP (see previous weekly report post), I’ve switched to using a USB Bluetooth dongle to perform the spoof. This will allow me to get a huge data rate improvement, but at the cost of an USB port. I’ve made massive improvements to the USB host code, and my Total Phase Beagle USB 12 Analyzer really proved itself by telling me exactly how many tokens were sent and how many NAKs were received, which allowed me to gage my maximum sample rate, and see noticeable differences when I make code changes.

But the bad news is that I can only see these tokens and NAK events as “collapsed records”, which means I can see that in the span of 2 seconds, I have gotten X amount of NAK from device A, Y amount from device B. But I can’t see if I get them in the order A B A B or A A B A A B. I’ve contacted Total Phase support about this, and it turns out that their more expensive analyzers support “packet view”. I asked if this was a hardware limitation, they stated that it was not, and I can capture the packets myself if I use their API that they provide. I asked them to update their software to add the support for my model, and they said they’ll pass on the request to their engineers and they’ll consider it.

Progress on the DualShock 4 spoof is great. I managed to get a reliable connection between the DualShock and my UsbXlater circuit via Bluetooth, and my UsbXlater circuit to the PlayStation via Bluetooth. I have a basic man-in-the-middle Bluetooth proxy working completely. The only problem now seems like the PlayStation doesn’t want to take the input yet, although I can see the data being passed, the PlayStation does not respond. The bigger issue is that the data being passed is coming so fast that my monstrous STM32F405RG chip is actually running out of RAM, I need to figure out whether or not this is indeed a performance issue or maybe I’m stupid and caused a memory leak.

Here I have my debug output a millisecond timestamp with the amount of RAM left, then it crashes

8000 FreeRAM 98132
10000 FreeRAM 88364
12000 FreeRAM 80868
14000 FreeRAM 72460
16000 FreeRAM 63092
18000 FreeRAM 53836
20000 FreeRAM 46428
22000 FreeRAM 37364
24000 FreeRAM 27756
26000 FreeRAM 17788
28000 FreeRAM 10068
30000 FreeRAM 716

Exception Handler, source: 1
r0: 0xF0127C08, r1: 0x2000293C, r2: 0x0000000A, r3: 0x0000000A, r12: 0x000002FF
LR: 0x00000000, PC: 0x20002948, PSR: 0xA1000200,

Neat… I’ve worked all weekend on this and got this far, I’m going to take a break and work on something else now. But my next goal is to figure out if I am freeing memory correctly, then maybe improve USB performance even more, and then implement flow control. Once the system doesn’t crash, I can focus on why the PlayStation doesn’t respond.

Weekly Report February 9 2014

I am playing around with BTstack (an open source Bluetooth stack) as a part of my on-going efforts to spoof a DualShock 4. After a bit of coding, I got it compiled into the UsbXlater firmware and now I am testing it.

One huge problem I ran into is that the RN42HCI I purchased from Microchip does not seem to support SSP (simple secure pairing). The Microchip website clearly states that the RN-42 is a “Fully certified Class 2 Bluetooth 2.1 + EDR module”. But using the read_local_version_information and read_local_supported_features commands, it is revealed that it does not support SSP and the version is actually Bluetooth 1.0b.

The PlayStation 4 uses SSP, this means the RN-42 cannot be used. I am hoping that Microchip will owe up to their mistake and either provide a replacement or a firmware update. Meanwhile, I will try doing some hacking to see if I can avoid the pairing problem, and also upgrade my USB stack a bit to see if using a USB BT dongle is still a viable option.

EDIT: According to Microchip tech support: “The current RN42HCI module does not support SSP. Updating the RN42HCI to BT3.0 for SSP support will have implications for our existing RN42HCI customers that do not use SSP.” So I was right, they are falsely advertising the product.