I've been using KiCAD as my PCB design tool of choice for years, and as my designs grew in complexity I began using Sonnet for EM field simulation prior to manufacturing boards. Unfortunately, interoperability between these tools was less than ideal. KiCAD export formats Gerber/Excellon: Stable and reliable DXF: Generates one file per layer. Drill hits can be plotted as Xs, but there's no obvious…
Introduction Over the years I've grown to have quite the collection of RF cables in my lab, some with better datasheets than others. But how good were they really? I decided to fire up the VNA and collect some data to see how a few of them really performed. Experimental setup: Data was collected on a Pico Technology PicoVNA 106 with current traceable calibration, at a controlled 21C ambient…
It's been two years but I'm back! I've had a lot going on and have been way too busy to post about it, but here's a sneak peek... Long story short, I bought a house with my wife and have been renovating it into the lab of my dreams. When complete, it will have a dedicated wet chemistry bench, 400 square feet of ESD-floored lab space, 200 square feet of office/conference room space, over a mile of…
For those of you who aren't keeping up with my occasional Twitter/Facebook posts on the subject, I volunteer with a local search and rescue unit . This means that a few times a month I have to grab my gear and run out into the woods on zero notice to find an injured hiker, locate an elderly person with Alzheimer's, or whatever the emergency du jour is. Since I don't have time to grab fresh food on…
In my previous post , I characterized the STARSHIPRAIDER I/O circuit for high voltage fault transient performance, but was unable to adequately characterize the high speed data performance because my DSO (Rigol DS1102D) only has 100 MHz of bandwidth. Although I did have some ideas on how to improve the performance of the current I/O circuit, it was already faster than I could measure so I had no…
Working as an embedded systems pentester is a lot of fun, but it comes with some annoying problems. There's so many tools that I can never seem to find the right one. Need to talk to a 3.3V UART? I almost invariably have an FTDI cable configured for 5 or 1.8V on my desk instead. Need to dump a 1.8V flash chip? Most of our flash dumpers won't run below 3.3. Need to sniff a high-speed bus? Most of…
I've written a couple of posts in the past few months but they were all for the blog at work so I figured I'm long overdue for one on Silicon Exposed. So what's a GreenPak? Silego Technology is a fabless semiconductor company located in the SF Bay area, which makes (among other things) a line of programmable logic devices known as GreenPak. Their 5th generation parts were just announced, but I…
Hi everyone, I've been busy lately and haven't had a chance to post much. There will be a pretty good sized series coming up in a month or two (hopefully) on my next-gen FPGA cluster and JTAG stuff but I'm holding off until I have something better to write about. In the meantime, I've decided that my circa 2009 GPG key is long overdue for replacement so I've issued a new one and am posting the…
So, it's been a busy couple of months and I haven't had time to post anything. Here's a few quick updates: I successfully defended my Ph.D thesis few weeks ago and will be graduating next weekend. You can download the thesis and browse the code if you're so inclined. I plan to continue developing the project in my spare time and using it as the basis for future embedded gadgets so expect more…
This post is a bit different from my usual ones in that it discusses the business side of the semiconductor industry, not the technical side. The issue has been getting more and more problematic lately so I figured I'd write up a few quick thoughts on it. Let's suppose you're a large semiconductor company who is currently making a large amount of money selling chips to a couple of major customers.…
A few months ago, I wrote about a project I had been thinking of for a while but not had time to work on: a time-domain reflectometer (TDR) for testing twisted pair Ethernet cables. TDR background The basic theory of operation is simple: Send a pulse down a transmission line and measure the reflected voltage over time to get a plot of impedance discontinuities over time. Unfortunately, doing this…
While my optical microscopes are capable of sufficient resolution for imaging larger-process ICs, taking massive die images ( this one , for a comparatively small 3.2mm^2 die, is about 0.6 gigapixels) has been beyond my capability because I have better things to do with my time than sit in the lab for a week turning the stage knob a little, clicking a button to take a picture, turning the knob a…
Although the "raised floor" design for my FPGA cluster looked cool, it really didn't scale. My entire desk was full, there was very limited room for new hardware, and the boards kept getting dusty. To make matters worse, long wires were needed to connect everything and it was difficult to manage them all. Original FPGA cluster I ended up moving forward with the plan I came up with a few months ago…
For a long time, my microscopes have lived on a folding plastic table in the corner of my lab. It was wobbling and causing blurry images, but I never got a chance to do something about it... until now. It's been replaced it with a custom-built wooden workbench. I made it big and heavy on purpose to reduce vibrations: The tabletop is 3/4" flooring-grade plywood and the legs are 4x4" posts resting…
A few months ago, I wrote about some of my pending projects . Several of them are actively running, some are done, and a few new ones cropped up :) I'll be making a bunch of short posts in the next day or so on some of them. It's been a busy fall so I haven't had time to post anything lately. I'm working hard on my thesis and plan to defend this spring. It's 84 pages and counting... After I…
Recent news headlines have made a big deal of Apple encrypting more of the storage on their handsets, and claiming to not have a key. Depending on who you ask this is either a huge win for privacy, or a massive blow to intelligence collection and law enforcement capabilities. I'm going to try avoiding expressing any opinions of government policy here and focus on the technical details of what is…
I've been interested in the security of compilers and related toolchains ever since I first read about Ken Thompson's compiler backdoor many years ago. In a nutshell, this famous backdoor does two things: Whenever the backdoored C compiler compiles the "login" command, it adds a second code path that accepts a hard-coded default password in addition to the user's actual password Whenever the…
It's been a while since I've written anything here so here's a bit of a brain-dump on upcoming stuff that will find its way here eventually. Thesis stuff This has been eating the bulk of my time lately. I just submitted a paper to ACM Computing Surveys and am working on a conference paper for EDSC that's due in two weeks or so. With any luck the thesis itself will be finished by May and I can…
This is part 2 of a 2-part series. Part 1, Target Recon, is here . Once I knew what all of the wires in the ZIA did, the next step was to plan an attack to read signals out. I decapped an XC2C32A with concentrated sulfuric acid and soldered it to my dev board to verify that it was alive and kicking. Simple CR-II dev board with integrated FTDI USB-JTAG After testing I desoldered the sample and…
This is part 1 of a 2-part series. Part 2, The Attack, is here . One of the reasons I've gone a bit dark lately is that running CSCI 6974 , RPI's experimental hardware reverse engineering class, has been eating up a lot of my time. I wanted to make the final lab for the course a nice climax to the semester and do something that would show off the kinds of things that are possible if you have the…
Those of you keeping an eye on the MIPS microcontroller world have probably heard of Microchip's PIC32 series parts: MIPS32 CPU cores licensed from MIPS Technologies (bought by Imagination Technologies recently) paired with peripherals designed in-house by Microchip. Although they're sold under the PIC brand name they have very little in common with the 8/16 bit PIC MCUs. They're fully pipelined…
I've been reverse engineering a programmable logic device (Xilinx XC2C32A) made on UMC's 180nm eNVM process for the last few months and have been a little light on blog posts. I'm a big fan of the process writeups Chipworks does so I figured I'd try my hand at one ;) The target devices were packaged in a 32-pin QFN. The first part of the analysis was to sanding the entire package down to the…
So, it's been a while since I've posted anything and I figured I'd throw up a quick update. I've been super busy over the winter break working on my thesis, as well as something new: My advisor and I are running a brand-new, experimental course, CSCI 4974/6974 Hardware Reverse Engineering , at Rensselaer Polytechnic Institute (RPI) this spring! I gave the first lecture for the class last Tuesday…
This is the story of the hunt for a bug that I've been chasing, on and off, for the last month. After my last post on the PDU, I began doing more exhaustive testing. I left Munin polling all of the stats every 5 minutes and kept the GUI open for maybe half an hour, turning channels on and off, and everything seemed fine... Then I went away to do something else, came back to my desk, and saw that…
As I mentioned in my last post, powering all of the prototyping boards on my desk presents some unique challenges. With only one exception (the Xilinx AC701 board), each of the 22 boards requires 5VDC at somewhere between 0.1 and 2 amps. Some are strictly USB powered, some have a 5.5/2.1mm barrel jack, and some can be powered by either USB or a barrel jack. Powered USB hubs would reduce the number…