Recent content in Blog on Phillip Tennen
We’re plotting the satellite’s orbit according to the data the satellite is sending, but the resulting orbit is clearly nonsense. My first instinct was to track down where I was parsing the data format incorrectly. To my dismay, these bits are what the satellites are beaming down, and I was pretty sure I was parsing the data fields correctly. Next line of attack: I knew that the…
We can reliably track our satellites over many minutes! We’ve surmounted one of the major challenges in building out gypsum, and now just one obelisk stands before us: computing the user’s position. This brings us to the really fun part: reading and decoding the bits that these satellites are transmitting! Unfortunately, this isn’t as easy as I imagined at the start. Reading off…
We’re getting there! We’ve set up a pipeline that can read vast quantities of floating point samples from our radio hardware, and can pick out the hums of the GPS satellites amongst the noise. Our acquisition phase told us which GPS satellites are within view of the user, and has given us a coarse estimate of each satellite’s Doppler shift and PRN sequence phase. However, these…
Have you ever noticed that your Maps app still works during a flight? It can feel illicit, like someone just forgot to turn off the signal, and that watching yourself crawl along the earth should be done without drawing undue attention. A few months ago I learned that there were only around 30 GPS satellites serving the entire planet. This piqued my interest, because it reminded me of the 13 root…
I made a graphical IRC client that runs in UEFI. It’s written in Rust and leverages the GUI toolkit and TrueType renderer that I wrote for axle’s userspace. I was able to develop it thanks to the vmnet network backend that I implemented for QEMU. You can connect to an IRC server, chat and read messages, all from the comfort of your motherboard’s pre-boot environment.…
In 2019, I built a work-for-hobby iOS simulator on a strict regimen of weekends and coffee. While the full details of this project will stay in-house, there’s enough I can share to hopefully be interesting! First up, here’s what this looks like running against a simple demo app. On the right is the bona-fide iOS simulator from Xcode, and on the left is the simulator I built.
Text is the medium of digital interaction, and text rendering has an outsized impact on the overall fit and finish of any system. It therefore pains me that axle has for years relied on a low-resolution 8x8 bitmap font. Let’s fix it! Take a look at the characters composing this sentence. Note the curves, the negative space, the use of size and distance. If you’ve got a magnifying glass…
We’ve managed to flash and boot a modified iOS distribution! We’re now in the home-stretch of a user-facing jailbreak. The main thing that end-users typically expect from a jailbreak is that they can open up Cydia and install some runtime modifications that alter the behavior of system processes such as SpringBoard. I wasn’t sure exactly how jailbreaks install Cydia, aside from a…
The Authentication error string that asr would usually print out after it decides to reject the filesystem is interesting, though. Maybe we can poke further at that to try to find an approachable patch-point? Huh, zero hits! That’s curious, because asr is definitely printing this out… Let’s search the whole ramdisk for this string. Ah! This is coming from…
Eventually, I managed to glean the structure of what happens next: The Restore ramdisk contains a traditional, but heavily trimmed down, OS distribution. It has all the fun directories, like /usr/sbin/ and /System/Library/PrivateFrameworks/ . It also ships with some standard UNIX utilities, such as /bin/cat . The kernel loads and executes /etc/rc.boot from the ramdisk to drive the next piece of…
One thing that I initially found quite surprising about this whole process is that, with this approach of breaking each successive stage’s image validation and uploading patched images, the system we’re booting is arguably no longer iOS. It’s a custom OS distribution that’s very similar to iOS, but is based on custom firmware images that are essentially authored by the…
Now that we’ve gained confident control of the SecureROM environment, let’s move on to something more ambitious: booting iOS. Of course, running unsigned code in DFU mode, then handing the reigns back to a secure boot chain kind of defeats the purpose of running unsigned code in the first place. What would be great is if we could boot iOS, but in a special way that disables all the…
Years ago, I was active in the iOS tweak development scene. I made many products and tools, distributed on Cydia, that modified iOS system behavior and added new functionality to SpringBoard. This was a really fun time, and gave me valuable early career exposure to reverse engineering closed-source binaries, interacting directly with the Objective-C runtime, and entrepreneurship. I’m really…
I’m currently working on a huge project. Since I’d like to finish it soon, I’m instead going to spend an evening implementing a bespoke newsletter service.
A couple of months ago, I added a prominent RSS button to the overview of this blog, acquiescing to the venture capital overlords that line my pockets on the promise of a dedicated audience willing to trudge through inane…
When I’m being first-order productive, I’m programming: creating and interacting with a system.
This first-order productivity is great, but it isn’t discoverable for others: there’s generally a high bar to entry for comprehending another person’s work when it’s expressed solely as a structured program.
Second-order productivity is when I’m writing…
Recently, the epic yak shave that is my life dragged me down into oblong pits of page table corruption. I’ve made it out the other side, with a primary takeaway of “how the hell did this ever work?”, followed closely by “what the hell is still hiding?”. Picture this: you’re carefree, healthy, “hey, I should rewrite axle’s network stack in…
I had a hankering to tweak this blog’s presentation a bit. Here’s what it looked like this morning:
Bleugh! Straightforward content? Simple design? Restraint? Thanks, but no. It’s like this guy’s never heard of responsive web pages.
First, let’s make each of those posts pop a little bit more.
Yeah, yeah! Subtle, I like it. Tiny thing, it needs more…
Programming the computer allows you to take something you see and rearrange the pieces a bit to better fit your needs. It’s really a delightful and powerful thing.
A few weeks ago, Daisy and I were staying in a cottage with poor internet speeds. We were trying to stream a series of videos, but the embedded player would only get through a few seconds of playback before it choked for…
axle used to be a 32-bit-only OS. In late 2021, I had a hankering to fix this longstanding limitation, and plunge into a world that expanded not just our address spaces, but our hope. Roughly, if you want to add support for x86_64 to an existing x86 OS, you’ll need to update these components: Global descriptor table, interrupt descriptor table, interrupt handlers, hand-coded assembly…
Over the course of developing an operating system, things are going to crash, and they’re going to crash a lot. One way to make crashes slightly less annoying is to isolate them: the rest of the system continues running, and you can poke around further after an unexpected condition arises in one process. Perhaps surprisingly, it took me several years before this became feasible! Previously,…
Every hobby operating system developer dreams of the day that a stack wrought from their own blood, sweat, and keystrokes renders its first webpage. Back in early 2021, I decided to break ground on the first step towards this goal. Before we can connect to the web, we need to handle all the necessary protocols to exchange packets over both the web and our humble local network link. This includes…
In the beginning, Intel created the 8086. This has been widely regarded as a bad move, but boy is it popular. The enduring success of the 8086 has been bought on the blood altar of Compatibility: software written for the original 8086, even very low-level software that runs without any supporting OS infrastructure, must continue to function on every new x86-line CPU manufactured today. This…
Syscalls are a fundamental piece of the processes model within contemporary operating systems.
OS’s generally like to provide the abstraction that a given program is running on the CPU, linearly and largely in an uninterrupted fashion, from start to finish.
Of course, this isn’t the case; programs are interrupted all the time, for a variety of reasons. Some examples of times…
Chess.com is a great online chess server and content creator. One of their hallmark features is their chess puzzles:
Present the player with a position
The player needs to find the ’tactic’: the best sequence of moves, typically resulting in an advantage over the opponent
The quicker the player completes a puzzle, the more points they earn
They look like…
Imagine you have a compass.
Instead of the 4 cardinal directions, mark the compass with 10 evenly-divided indications.
Let’s play a game together. You’re standing on a plane, and in front of you is a ball.
I’m going to tell you a number. Push the ball with enough force to impart a 1 meter-per-second change in velocity in the direction matching the number’s…
The Nintendo GameBoy is an exceptionally well-documented system, perfect for anybody who’d like to take a crack at emulation. Publicly-maintained resources like the Pan Docs make it both approachable and convenient to get an overview of the GameBoy’s address space layout, to understand the mechanics of hardware peripherals, and to learn about various edge-case behaviors that some games depend on.…