[00:27.180 --> 00:34.080]  Music plays Thank you.
[02:07.060 --> 02:08.220]  Should I just go?
[02:09.720 --> 02:11.620]  I like them on, if that doesn't matter.
[02:12.140 --> 02:13.940]  I like being able to see people.
[02:15.600 --> 02:16.920]  It's helpful to me.
[02:18.100 --> 02:20.460]  I don't really care about any of their opinion.
[02:20.880 --> 02:24.780]  If you guys want the lights off, elsewhere, I guess.
[02:27.560 --> 02:31.100]  So today I'm going to talk about reverse engineering.
[02:31.760 --> 02:37.060]  And in particular, a project I worked on for a few weeks for a friend of mine.
[02:38.540 --> 02:41.840]  And hopefully impart some information to y'all.
[02:42.820 --> 02:44.780]  Starting with, I'm Mog.
[02:45.700 --> 02:46.540]  Hi, everybody.
[02:46.700 --> 02:46.940]  I'm Mog.
[02:47.320 --> 02:47.880]  I'm Mog.
[02:48.940 --> 02:51.020]  Way in the back, that's my friend, Will Pig.
[02:52.140 --> 02:52.960]  Say hi, Will Pig.
[02:55.220 --> 02:56.620]  It's Will Pig's birthday.
[02:57.180 --> 02:57.860]  Happy birthday.
[02:58.660 --> 03:02.540]  Now, we can't sing a song because it couldn't be posted.
[03:02.560 --> 03:05.500]  But if everybody could wish him a happy birthday, I would really appreciate it.
[03:08.490 --> 03:09.290]  Thank you.
[03:10.210 --> 03:10.630]  Okay.
[03:11.210 --> 03:13.010]  Now to unimportant stuff.
[03:14.370 --> 03:16.970]  I'm a hacker with Maker's Local 256.
[03:17.490 --> 03:19.990]  It's a make space in Huntsville, Alabama.
[03:20.290 --> 03:21.910]  A little bit of a ways from here.
[03:23.090 --> 03:24.450]  We do a lot of fun stuff.
[03:25.290 --> 03:27.410]  Just about anything you can imagine, I would say.
[03:29.370 --> 03:32.550]  And so now I guess I will have to tell you what the talk is actually about.
[03:32.970 --> 03:35.010]  This is what I think reverse engineering is.
[03:35.490 --> 03:38.010]  I guess not the definitive definition.
[03:38.010 --> 03:47.950]  I think it's the act of taking apart a system, figuring out all the internals and understanding each individual aspect of it.
[03:49.850 --> 03:52.290]  Being able to clone it, so to make your own.
[03:53.050 --> 03:57.370]  And then finally, being able to improve it or change it.
[03:57.370 --> 03:59.590]  I guess you could say it could get worse.
[03:59.810 --> 04:01.470]  But as long as it suits your needs, it's better.
[04:02.210 --> 04:14.250]  And so I would say that having the tools to be able to do that with products and systems in your life is a very essential tool today.
[04:14.610 --> 04:16.050]  So I talked about it.
[04:16.130 --> 04:17.550]  So why is it essential?
[04:17.670 --> 04:20.430]  Why do people need to know how to take things apart?
[04:21.770 --> 04:25.250]  Especially, so, reinventing the wheel is dumb.
[04:25.990 --> 04:31.930]  There were a lot of talks this week about 3D printers and making parts like your shower head.
[04:32.510 --> 04:36.450]  And other random trinkets like key chains.
[04:36.650 --> 04:38.550]  I have a really cool...oh, it's not here.
[04:38.770 --> 04:42.210]  I have a really cool key chain that I printed on a 3D printer.
[04:42.570 --> 04:47.970]  But for a lot of things, the mass produced item is effective.
[04:48.270 --> 04:48.870]  It's cheap.
[04:49.490 --> 04:50.830]  It's easy to replace.
[04:50.830 --> 04:52.030]  It's easy to get parts for.
[04:52.310 --> 04:56.610]  So working within things that already exist can be very beneficial.
[04:56.870 --> 04:58.050]  So don't reinvent the wheel.
[04:58.190 --> 04:58.990]  That's stupid.
[04:59.350 --> 05:00.170]  It's a good wheel.
[05:00.550 --> 05:08.450]  And then, like I was saying, it's cheaper to reuse parts that already exist because there's so many.
[05:09.150 --> 05:13.990]  And then, if you really understand the wheel, maybe it is good to reinvent it.
[05:13.990 --> 05:22.810]  But if you don't understand the problems of a product, you can't make a better version of it unless you have knowledge.
[05:24.290 --> 05:34.150]  And so, this project that I worked on, I called it Closed Sesame because it turns out there's already a project called Open Sesame, which is a language project.
[05:34.150 --> 05:38.810]  And I was very disappointed because I already, like, made the Git repo and everything.
[05:38.970 --> 05:40.990]  And I was just like, oh, that sucks.
[05:41.250 --> 05:43.050]  So Closed Sesame, it's just as good.
[05:44.610 --> 05:48.070]  It's a lock that I started.
[05:48.730 --> 05:52.330]  And so, it kind of got its roots from a previous project.
[05:52.330 --> 05:55.410]  This is our lock on our Makerspace.
[05:55.890 --> 06:01.390]  We use a Kwikset Powerbolt to lock and unlock our door.
[06:01.530 --> 06:07.290]  We have USB keys that we stick into a keyhole right by the door.
[06:07.470 --> 06:10.570]  It detects the USB vendor ID on it, and then it opens the door for you.
[06:10.570 --> 06:11.950]  So you can get into your hackerspace.
[06:12.310 --> 06:13.970]  It's a very cool project.
[06:13.970 --> 06:19.230]  It was made, like, almost 10 years ago now at our Makers Local.
[06:20.090 --> 06:23.490]  And so, the nice thing about it, though, is that it was so simple.
[06:23.790 --> 06:27.910]  The Kwikset locks used a...
[06:28.830 --> 06:32.510]  Had the open and close pins for their lock controller exposed.
[06:32.870 --> 06:35.290]  So if you just applied current, it would open the lock.
[06:35.390 --> 06:37.630]  If you applied current to the other pad, it would close the lock.
[06:37.790 --> 06:41.470]  So it was very trivial electronically to build this device.
[06:41.510 --> 06:45.890]  It was just an Arduino and some sensors to know if the door was open or closed.
[06:45.990 --> 06:48.530]  So we didn't try to, like, lock the door while it was open.
[06:48.530 --> 06:50.670]  And then leave the shop open.
[06:51.270 --> 06:52.890]  And so, that was that.
[06:53.130 --> 06:53.510]  And then...
[06:53.510 --> 06:54.970]  So this is a picture of the old lock.
[06:55.790 --> 06:56.550]  Where's my mouse?
[06:57.090 --> 06:59.510]  So, as you can see, there's just the pads for the open.
[06:59.750 --> 07:00.970]  Or do you guys not see the mouse?
[07:01.090 --> 07:01.410]  Oh, you do.
[07:01.610 --> 07:01.830]  Okay.
[07:02.090 --> 07:04.910]  So there's the pads just for the open and then the pad for the closed.
[07:05.130 --> 07:06.850]  So you could just solder wires to it.
[07:07.170 --> 07:07.990]  Worked really well.
[07:08.790 --> 07:11.890]  Ran off six or four AA batteries.
[07:12.450 --> 07:13.130]  Works great.
[07:13.390 --> 07:15.470]  Most of the time, sometimes we have batteries go dead.
[07:15.470 --> 07:16.650]  Nobody can get in the shop.
[07:16.830 --> 07:17.350]  It's unfortunate.
[07:20.010 --> 07:25.050]  And so, a member of the shop was like, oh, I love this lock.
[07:25.450 --> 07:26.250]  Works great here.
[07:26.390 --> 07:27.710]  I'm gonna buy some myself.
[07:28.090 --> 07:30.890]  And so he found a deal on eBay for four of them.
[07:30.890 --> 07:34.550]  But unfortunately, for him, it's the new version.
[07:34.830 --> 07:37.010]  And the new version is much improved.
[07:37.650 --> 07:40.170]  If you can see, it has this little home connect symbol.
[07:40.190 --> 07:41.850]  Which means it supports Z-Wave.
[07:42.070 --> 07:45.850]  Which is a wireless standard, kind of like Wi-Fi or Bluetooth.
[07:46.550 --> 07:49.990]  But intended to do home automation and machine automation.
[07:50.330 --> 07:51.250]  Lots of fun stuff.
[07:52.350 --> 07:55.770]  But the problem is, it's not simple to control.
[07:56.110 --> 07:58.070]  It's this guy.
[07:58.850 --> 08:02.170]  So, as you can see, there are no really pads exposed.
[08:03.210 --> 08:06.450]  There's some debug headers for the microcontroller right here.
[08:06.710 --> 08:08.030]  But those don't really do it.
[08:08.090 --> 08:10.550]  Like if you apply current to them, they don't do anything effective.
[08:10.690 --> 08:11.530]  They turn the lock off.
[08:11.730 --> 08:12.690]  It's kind of frustrating.
[08:14.870 --> 08:16.750]  And so, he was stuck.
[08:16.890 --> 08:18.610]  He couldn't do anything with it.
[08:18.770 --> 08:23.430]  And he started to take it apart and wanted some help with it.
[08:23.430 --> 08:25.750]  And so, I said, sure, let's do it.
[08:25.890 --> 08:27.770]  And then, I thought, talk for hope.
[08:28.030 --> 08:28.410]  Sure.
[08:29.330 --> 08:30.510]  That will make me actually finish.
[08:30.890 --> 08:33.370]  And so, we got started on it.
[08:35.610 --> 08:39.070]  And this is, I guess, where the more reverse engineering side comes in.
[08:39.230 --> 08:45.530]  This is how I think the effective way to take something from scratch and get it done.
[08:46.130 --> 08:49.010]  So, I think you need to start off by creating two lists.
[08:49.790 --> 08:51.670]  The first list is, what do I know?
[08:52.250 --> 09:05.210]  I think people, when you get something like this, you just want to immediately start probing pins and tying things together and trying to figure out the fastest way to get the object to do what you want it to do.
[09:05.210 --> 09:09.090]  And the problem with that is, you make a lot of assumptions.
[09:09.570 --> 09:15.490]  And particularly, I think what most people do is, what they do know, or what they...
[09:15.490 --> 09:18.350]  Their list of what I do know is really what they think they know.
[09:18.550 --> 09:20.430]  What they think different parts do.
[09:20.950 --> 09:26.450]  And so, you really have to go with the bare essentials and figure out what you know.
[09:26.550 --> 09:28.150]  And the other list is the things you think you know.
[09:28.230 --> 09:29.090]  The things that could change.
[09:29.090 --> 09:38.850]  But you want to write them down so that as you're collecting all this data, you don't have conflicting thoughts in your head.
[09:39.070 --> 09:41.110]  You need to know what you saw.
[09:41.930 --> 09:43.510]  Because you're going to see a lot of stuff.
[09:44.610 --> 09:46.610]  And so, next slide.
[09:46.950 --> 09:50.650]  So, what I know with this lock, I immediately...
[09:50.650 --> 09:54.310]  I found the... this is the module it ships with.
[09:54.510 --> 09:56.070]  This is the Z-Wave module.
[09:57.610 --> 10:02.990]  Looking at it, I was able to find the part number for this module right here.
[10:03.590 --> 10:07.810]  And with that, you can find the data sheets and explains what all these pins do.
[10:08.030 --> 10:12.010]  And so, you can begin to map the schematic of the board.
[10:12.210 --> 10:17.890]  So, by doing that, I was able to tell that this board talked to a memory chip on the back.
[10:17.890 --> 10:27.190]  That's where this board stores all of its information about the passcodes and other preferences and stuff that's put into the lock.
[10:27.610 --> 10:36.170]  It also talks to the main board over UART, which is just a serial communication protocol.
[10:36.330 --> 10:41.170]  Just like those old DB9 serial connectors that everybody uses.
[10:42.530 --> 10:44.630]  So, I was able to find out where those pins were.
[10:45.010 --> 10:46.750]  And that really set everything way ahead.
[10:47.010 --> 10:54.790]  Because knowing those things, you could actually begin to look at traffic and get going.
[10:55.930 --> 11:01.390]  One of the other things that's real easy to find out is to map all the ground points on the board that matters.
[11:01.390 --> 11:06.670]  So, you know that the back of the battery is going to be the ground.
[11:07.230 --> 11:09.410]  It will be ground throughout the board, most likely.
[11:09.650 --> 11:17.090]  And so, you can test by putting a meter and checking for ground on that pin.
[11:17.270 --> 11:18.330]  And then you can go to other pins.
[11:18.530 --> 11:25.430]  And so, doing that, I was able to map all the ground pins on the daughter board connector.
[11:25.870 --> 11:29.790]  And so, that took off four pins right there.
[11:30.270 --> 11:32.090]  14 pins on the back connector.
[11:32.690 --> 11:38.330]  And so, being able to see that stuff, it gives you a good grounding.
[11:39.510 --> 11:46.170]  And then the other thing that I did after that is, I was really excited when I found the Z-Wave module.
[11:46.270 --> 11:48.270]  So, I kind of didn't look at any of the other data sheets.
[11:48.690 --> 11:53.010]  It turns out the data sheets for everything on the daughter board were available.
[11:53.350 --> 11:56.010]  They're all just stock parts that you could buy yourself, actually.
[11:56.250 --> 11:59.310]  And so, I found the data sheet for the SPY module.
[11:59.310 --> 12:03.070]  That's the memory that was the Z-Wave controller used.
[12:03.270 --> 12:07.350]  And then I also found on the back side, there are two I2C chips.
[12:07.430 --> 12:16.590]  It has a real-time clock on this and a data... whatchamacallit, another memory chip for the real-time clock.
[12:16.910 --> 12:22.670]  Like I said, this is significantly more complicated than the last lock for seemingly no reason.
[12:24.870 --> 12:26.910]  So, I was able to figure all that out.
[12:27.270 --> 12:29.370]  And that's what I knew.
[12:29.790 --> 12:37.710]  And then after we've collected all this data, we could begin probing things and trying to see what was going on when the lock was functioning properly.
[12:38.170 --> 12:43.330]  And so, one of the first things we did was try to assess the pinout of the board.
[12:44.590 --> 12:50.150]  So, the best... the easiest way to do that is multimeter continuity testing.
[12:50.430 --> 12:54.990]  So, this is pretty average multimeter to Unity.
[12:55.270 --> 12:56.050]  They're cheap.
[12:56.470 --> 12:57.410]  I like them.
[12:58.430 --> 13:01.810]  And they have a mode where... I'm sure a lot of you have seen this.
[13:01.930 --> 13:05.270]  You just touch the pins together and it makes...
[13:05.750 --> 13:07.190]  This is going to be great for so long.
[13:08.750 --> 13:09.770]  I can't find it.
[13:10.030 --> 13:10.430]  There it goes.
[13:10.510 --> 13:12.570]  Anyways, it makes a beep when the pins touch.
[13:12.730 --> 13:16.470]  That means that you have found one end of the wire all the way to another end of the wire.
[13:16.890 --> 13:27.410]  And so, what you can do is you go pin one and then you try to find how it snakes through the PCB all the way to where it comes out the other end.
[13:28.030 --> 13:31.650]  And then you just note that down over and over and over again.
[13:34.110 --> 13:39.610]  And then, once you've done that, almost all of the pins terminate at one of the other ICs.
[13:39.830 --> 13:46.690]  And the IC... the database... or the datasheet for the IC says, this is what this pin is.
[13:46.790 --> 13:53.650]  And so, now you know that pin one is a... it's connected to the voltage of the battery.
[13:53.650 --> 13:57.030]  Or pin three is not connected.
[13:57.510 --> 13:59.370]  So, you can... you can find where everything goes.
[14:00.530 --> 14:06.930]  And then after you've done that, the next thing you really have to do is voltage test everything.
[14:07.470 --> 14:11.930]  So, this board runs at 3.3 volts.
[14:12.650 --> 14:17.030]  But the battery supply actually is six volts because it's four double A's.
[14:17.030 --> 14:24.130]  And so, one of the things you have to check for is to be sure that each of these pins is actually 3.3 volt tolerant.
[14:24.430 --> 14:28.350]  Because you don't want to cook your equipment that you're using to test it.
[14:28.690 --> 14:35.110]  And so, it's helpful to get an idea of what each pin is doing by measuring the voltage that's on it at any given point.
[14:35.110 --> 14:39.070]  And, like, that's how we found the battery pins.
[14:39.330 --> 14:41.210]  The battery pins were high at six volts.
[14:41.330 --> 14:45.430]  But everything else was either floating in ground or high at three volts.
[14:46.050 --> 14:49.330]  And so, that's a good step to take.
[14:49.650 --> 14:52.030]  I burnt a lot of equipment not doing that.
[14:53.110 --> 14:59.550]  Connecting stuff that's only like 1.8 volt tolerant to a nine volt pin, you get some blue smoke pretty quickly.
[15:01.190 --> 15:07.470]  And so, after we did that, there's a very helpful tool called a logic analyzer.
[15:07.810 --> 15:09.230]  I have two of them with me today.
[15:10.710 --> 15:21.610]  The OpenBench logic analyzer is a really inexpensive open hardware device that you can get from SparkFun or Seeed Studio.
[15:22.850 --> 15:28.450]  And it has a little bit of memory, but enough to be useful.
[15:28.950 --> 15:35.270]  And I was able to connect all the pins that I wasn't sure of what were doing.
[15:35.590 --> 15:41.650]  I was able to connect to each one of them and then power the device up and capture all the traffic on the pin.
[15:42.050 --> 15:49.750]  And I would see every time the pin would go high or low and then for a period of a few hundred milliseconds.
[15:49.750 --> 15:54.250]  So not a long time, but enough to try to figure out what the device was doing.
[15:54.890 --> 16:04.830]  And so I was able to ascertain which were the I2C pins, which were the UART pins correctly, and able to move on from there.
[16:05.910 --> 16:14.470]  It's a more difficult tool to use, but it pretty much can solve any problem that you throw at it.
[16:17.790 --> 16:25.150]  So once you have a better understanding of what you think you do, you don't necessarily, because we were wrong about some of this stuff.
[16:25.570 --> 16:31.190]  But once you think you have a better understanding of it, you can start monitoring traffic on the board.
[16:31.850 --> 16:34.790]  So what we used to do that was another tool.
[16:35.510 --> 16:37.090]  It's called a Bus Pirate.
[16:37.990 --> 16:39.250]  Does everybody know what a Bus Pirate is?
[16:39.810 --> 16:40.150]  Some people?
[16:40.730 --> 16:43.410]  Bus Pirate's a little guy like this also sold.
[16:43.850 --> 16:45.070]  Seeed, Spark, everywhere.
[16:46.030 --> 16:55.870]  And the nice thing about it is you plug it into your computer, you tell it to expect SPY, UART, I2C, Single Wire, Dallas, all these different protocols.
[16:55.870 --> 17:01.290]  And it'll decode them for you on your screen and show you the binary representation of what's being sent across the wire.
[17:01.950 --> 17:08.290]  So with that, we were able to capture our first real chunk of data.
[17:08.590 --> 17:15.050]  So this is something I saw on pin 8 as I triggered the lock from a Z-Wave device.
[17:16.110 --> 17:19.330]  So those are two messages that were sent across the wire.
[17:19.490 --> 17:20.810]  At the time, we didn't know what they meant.
[17:20.810 --> 17:25.210]  But they fired routinely every time we fired the lock.
[17:25.470 --> 17:26.570]  And so we were pretty happy.
[17:26.830 --> 17:29.550]  And then we did the other side of it as well.
[17:29.770 --> 17:32.630]  So the other pin was pin 6.
[17:32.950 --> 17:40.090]  And we watched it and we saw how the module or the lock responded to the module when it said, Lock me.
[17:41.610 --> 17:44.190]  And so we didn't really know what any of that meant.
[17:44.190 --> 17:49.730]  But we knew we were on the right trail because those were the pins that were active when things were locked or unlocked.
[17:49.730 --> 17:51.550]  Everything else kind of stayed dead.
[17:52.330 --> 17:58.570]  The other chips didn't seem to really matter much in the conversation between the two boards.
[17:59.670 --> 18:06.570]  And so we started trying to figure out what these messages meant because I'm not sure... I don't know how to go back.
[18:06.730 --> 18:09.150]  Like that means nothing to me right now.
[18:09.810 --> 18:13.170]  I'm sure some of you guys might have noticed like the repeated data.
[18:13.790 --> 18:15.450]  Like this 0x04.
[18:15.870 --> 18:19.230]  I'm not sure if I figured out that it's four bytes after that.
[18:19.630 --> 18:21.470]  It's kind of standard encoding.
[18:22.510 --> 18:25.850]  But so we tried to... we looked at a whole bunch of messages.
[18:26.270 --> 18:27.890]  We had the status messages.
[18:28.190 --> 18:30.010]  We found a battery status message.
[18:30.490 --> 18:36.670]  A command when it registers the device, unregisters the device, locks, unlocks, adds a code, deletes a code.
[18:36.670 --> 18:39.050]  And what happened when we sent it garbage.
[18:39.490 --> 18:41.670]  It would respond saying, I don't know what to do with you.
[18:43.030 --> 18:47.650]  And so we got about to trying to figure out what these codes actually meant.
[18:47.650 --> 18:55.210]  So this was... this is what happens when you tell the lock to add the code 1234.
[18:55.670 --> 18:57.570]  And so we tried to figure out what it meant.
[18:57.750 --> 19:01.930]  So the first thing... you guys... it was moving really fast.
[19:02.090 --> 19:10.770]  But the OXBD is always the address of the module going to the lock that we saw.
[19:11.050 --> 19:15.670]  So every message that came from the module going to the lock always leads off with OXBD.
[19:15.670 --> 19:22.430]  And then OXOA, in this case, is the length of everything following it, like I said before.
[19:22.830 --> 19:27.590]  So that's 10 bytes following... following it.
[19:28.110 --> 19:32.210]  The next we saw... we kind of figured out was actually a sequence number.
[19:32.650 --> 19:40.510]  So every time the module sent a message to the lock, it seemed to increment this number again and again and again.
[19:42.110 --> 19:45.510]  And the next... also always seemed to be the same was OXE7.
[19:46.090 --> 19:49.990]  That's the address of the... where we're sending the message.
[19:50.130 --> 19:52.250]  In this case, the lock.
[19:53.310 --> 19:57.670]  And then we found... after every time there's always this one.
[19:57.890 --> 19:58.770]  So there's OXOB.
[19:59.370 --> 20:02.870]  And that's the command type that the lock is going to interpret.
[20:03.590 --> 20:13.150]  And then the lock supports... I think it's 120 lock codes once you've added the Z-Wave module.
[20:13.370 --> 20:15.850]  And for some reason it uses two bytes to store that.
[20:16.150 --> 20:25.170]  So they're 1,020... no, not 1,024... 65,533.5 options to fill 100 slots.
[20:25.810 --> 20:26.510]  But that's okay.
[20:27.850 --> 20:30.430]  And then this is actually one of the sillier things.
[20:30.650 --> 20:32.290]  So that's the passcode 1,2,3,4.
[20:32.790 --> 20:35.250]  The lock only actually has five buttons.
[20:35.570 --> 20:40.330]  So there's a 1,2 button, a 3,4 button, a 5,6 button, a 7,8 button, and a 9,0 button.
[20:40.870 --> 20:44.210]  And they display it in the code as that exactly.
[20:44.390 --> 20:44.870]  In hex.
[20:45.050 --> 20:48.010]  So it's 1,2,1,2,3,4,3,4.
[20:48.130 --> 20:48.890]  So that's 1,2,3,4.
[20:50.510 --> 20:52.250]  That really kind of threw me off for a little bit.
[20:52.250 --> 20:54.810]  Because I thought it was like an ASCII code or something.
[20:55.130 --> 20:56.470]  And I was like, it's way too low.
[20:56.790 --> 20:57.710]  And they repeat.
[20:57.910 --> 20:58.930]  It just was weird.
[20:59.490 --> 21:01.550]  And then I just looked at the lock and I felt really stupid.
[21:03.810 --> 21:04.970]  But it was okay.
[21:05.250 --> 21:07.650]  And then this last one threw me for a long time.
[21:08.090 --> 21:10.210]  I was pretty sure it was a checksum.
[21:10.370 --> 21:16.770]  Because if I made any changes to this message as a whole, I would always get an error code back from the lock.
[21:17.470 --> 21:19.570]  But I couldn't figure out how it was formulated.
[21:20.330 --> 21:22.350]  It turns out it's a LRC checksum.
[21:22.510 --> 21:25.450]  Which is a common single-byte checksum used in a lot of wire protocols.
[21:27.110 --> 21:28.750]  But I'll get back to that in a second.
[21:32.830 --> 21:36.030]  So then I tried... what have I tried?
[21:36.290 --> 21:41.230]  So these are things you should do once you have an understanding of how the system works.
[21:41.770 --> 21:44.030]  So one of the things was reduced complexity.
[21:44.030 --> 21:54.990]  So like I said before, I noticed that the other chips don't seem to talk to the lock in any given standard configuration that I saw.
[21:55.190 --> 21:59.450]  So adding codes, deleting codes, using it, unlocking it, getting status updates.
[21:59.730 --> 22:01.510]  It never talked to the real-time clock.
[22:01.850 --> 22:04.690]  I imagine that it's there for some kind of alarm.
[22:04.750 --> 22:07.110]  Or maybe you can put it in vacation mode.
[22:07.110 --> 22:10.970]  Or other weird features that my friend had no interest in.
[22:11.150 --> 22:12.290]  And I have no interest in.
[22:12.550 --> 22:16.850]  And so one of the first things we did, we decided to not mess with the I2C bus at all.
[22:17.170 --> 22:18.510]  Because we didn't need it.
[22:18.890 --> 22:26.430]  So when you're trying to get things working, if it doesn't matter, it doesn't matter.
[22:26.790 --> 22:27.630]  Leave it alone.
[22:28.790 --> 22:31.030]  So that saved a lot of time.
[22:31.930 --> 22:34.710]  And then the next thing that I was talking about was a replay attack.
[22:36.470 --> 22:41.690]  So once I had figured out all those messages, I could just send the messages over and over again.
[22:41.830 --> 22:43.690]  I'd send the lock and unlock that I had captured.
[22:44.370 --> 22:45.190]  And it works.
[22:46.630 --> 22:53.690]  So I had already achieved the majority of function I needed for this lock without knowing anything about the lock.
[22:54.310 --> 22:56.870]  Like I didn't know how these messages really worked.
[22:57.150 --> 23:00.290]  But I was able to just repeat what it had already done.
[23:00.510 --> 23:01.650]  And I could lock the door.
[23:01.650 --> 23:02.990]  I could unlock the door.
[23:03.170 --> 23:06.590]  I could even add codes as long as they were codes I had added in the past.
[23:06.850 --> 23:08.470]  So like I added 1, 2, 3, 4 again.
[23:08.630 --> 23:09.670]  And it added 1, 2, 3, 4.
[23:09.790 --> 23:10.530]  And I deleted it.
[23:10.630 --> 23:11.310]  And it deleted it.
[23:11.650 --> 23:13.950]  But if I made any changes to any of those things.
[23:14.090 --> 23:16.910]  So like if I wanted 1, 3, 5, 7.
[23:18.110 --> 23:18.830]  Which is different.
[23:19.710 --> 23:20.790]  It would not work.
[23:21.490 --> 23:22.810]  Because the checksum wouldn't match.
[23:23.550 --> 23:25.110]  And so that wasn't acceptable.
[23:25.230 --> 23:26.030]  We had to figure it out more.
[23:28.090 --> 23:31.510]  So the next thing that you should try is called fuzzing.
[23:32.030 --> 23:38.730]  Fuzzing is when you send messages that are close to correct to the lock to see how it reacts.
[23:39.130 --> 23:46.330]  So a lot of the time when you're dealing with microcontrollers, they don't have a lot of room for error codes.
[23:46.730 --> 23:49.430]  Or helpful error handling.
[23:49.730 --> 23:53.310]  So if you send it garbage, you could get something interesting back out.
[23:53.790 --> 23:56.910]  And so one of the first things I tried was I sent...
[23:57.950 --> 24:00.090]  I incremented the...
[24:01.990 --> 24:02.550]  Whatchamacallit?
[24:02.630 --> 24:04.710]  The sequence number by 1.
[24:05.030 --> 24:10.610]  And then I tried every single possible checksum to see if I could get the lock to move.
[24:10.610 --> 24:15.030]  And eventually it did because I actually had a collision of where the checksum was correct.
[24:16.730 --> 24:18.150]  And that was great.
[24:18.410 --> 24:24.770]  But realistically, given that it was a real checksum, I would never be able to...
[24:24.770 --> 24:30.530]  Like to map all of the possible correct data entry points, I would probably end up with like a table...
[24:30.530 --> 24:34.230]  A gigabyte big rather than just figuring out the checksum.
[24:35.610 --> 24:40.750]  And the way the device worked, if the checksum didn't match, it didn't do anything.
[24:40.870 --> 24:41.910]  It just reported back an error.
[24:42.250 --> 24:45.850]  And so in this case, fuzzing wasn't very fruitful.
[24:46.350 --> 24:53.230]  But in some cases, you'd be amazed that if you send a chip garbage, it will do exactly what you want.
[24:53.230 --> 24:56.750]  Or it will put the chip in a bad state and you can get more data out of it.
[24:57.050 --> 24:58.390]  And so it's definitely worth trying.
[25:00.310 --> 25:02.690]  And the final thing is search engines.
[25:03.050 --> 25:06.210]  And this is something that we should have done sooner.
[25:08.830 --> 25:12.710]  In looking at the messages that I sent...
[25:14.630 --> 25:16.170]  Oh, that's going the wrong way.
[25:18.230 --> 25:19.110]  Mistakes, yes.
[25:21.750 --> 25:24.770]  So this message, I basically put it into Google.
[25:24.770 --> 25:34.350]  And I found out by doing that, the Z-Wave module is actually sending Z-Wave code all the way down into the microcontroller.
[25:34.770 --> 25:43.930]  So this message is actually a standard Z-Wave message, except for the first byte has been removed that mentions the Z-Wave controller.
[25:43.930 --> 25:51.390]  So otherwise, it's a standard Z-Wave message, which was great because the checksum Z-Wave uses is a documented thing.
[25:51.510 --> 25:52.830]  It's this LRC checksum.
[25:52.950 --> 25:54.050]  It's very easy to implement.
[25:54.210 --> 25:55.130]  It's like four lines.
[25:55.430 --> 25:57.610]  We did that and bam, everything worked.
[25:58.210 --> 26:02.190]  And that was like a week wasted because I couldn't freaking Google.
[26:03.410 --> 26:06.150]  So always, always look around.
[26:06.630 --> 26:13.710]  Because even though no one has attacked this lock that I found, the information was out there already.
[26:13.750 --> 26:14.830]  I just didn't look.
[26:16.750 --> 26:18.210]  So do that.
[26:18.610 --> 26:19.870]  That's a positive thing.
[26:23.330 --> 26:26.170]  The next thing you need to do is to make a prototype.
[26:27.710 --> 26:29.930]  So it's hard for you guys to see.
[26:30.290 --> 26:33.710]  But the pin pitch on this is 0.8 millimeters.
[26:34.930 --> 26:36.430]  Or no, 0.08.
[26:37.050 --> 26:39.970]  No, 0.08 inches and something millimeters.
[26:41.130 --> 26:42.390]  Or two millimeters, yes.
[26:42.530 --> 26:45.230]  Anyways, it's awful to try to attach probes to.
[26:46.630 --> 26:53.650]  You will waste a lot of time doing that because the little clips will fall off or you're going to have to hold pressure and it's a pain in the ass.
[26:53.650 --> 26:59.030]  And so one of the things I would recommend doing is it's very inexpensive to get PCBs made.
[27:00.270 --> 27:04.110]  And if you do it right, you can future proof them to some degree and still use them.
[27:04.410 --> 27:08.390]  So early on in the process, I designed this PCB right here.
[27:08.730 --> 27:14.830]  And you can see it's designed to actually take a microcontroller to do the work.
[27:14.890 --> 27:17.950]  But it's also designed to just be a breakout board.
[27:17.950 --> 27:24.610]  So I have all the pins routed to pins on these side pins.
[27:24.750 --> 27:26.730]  So I can connect a standard header.
[27:26.970 --> 27:30.690]  So like this is a standard serial header that I can just plug in.
[27:30.890 --> 27:38.250]  And if the microcontroller wasn't here, I could talk to the lock directly from my PC and write software and get things done faster.
[27:38.250 --> 27:41.070]  And so when I was doing this, I had it set up.
[27:41.190 --> 27:45.050]  I had C code that would try to do a lot of these things that I talked about.
[27:45.710 --> 27:48.770]  And it saves a whole lot of time if you do that.
[27:50.190 --> 27:59.930]  And in fact, I was able even... there's so much space because this board really doesn't do a whole lot that I was even able to route the pins that I didn't get to, the I2C pins right here.
[27:59.930 --> 28:05.330]  Their future, somebody can figure out what the clock was supposed to do if they wanted to.
[28:07.990 --> 28:11.390]  And so doing that is awesome.
[28:12.550 --> 28:13.750]  And mistakes.
[28:14.690 --> 28:18.950]  So like I already said, going out of order is a huge mistake.
[28:19.510 --> 28:22.710]  You will waste so much time if you try to go quickly.
[28:22.710 --> 28:29.650]  Just getting everything figured out first is tedious and frustrating.
[28:29.910 --> 28:31.830]  And writing it all down seems like a waste.
[28:32.330 --> 28:34.610]  But it is incredibly helpful.
[28:35.130 --> 28:36.650]  And everybody should do it.
[28:36.830 --> 28:38.150]  I cannot stress it more.
[28:41.150 --> 28:42.690]  Not searching the Internet enough.
[28:43.370 --> 28:47.050]  Even if you think you're doing something that no one's ever done before, you're not.
[28:47.770 --> 28:48.810]  Everyone's done everything.
[28:49.670 --> 28:51.310]  You are not a unique snowflake.
[28:51.310 --> 28:52.350]  It's out there.
[28:53.530 --> 28:54.650]  Definitely keep looking.
[28:56.470 --> 28:57.810]  Not verifying power.
[28:58.090 --> 29:00.310]  Oh, so this is the most embarrassing mistake.
[29:00.730 --> 29:04.110]  So I finished the project right before I got to HOPE.
[29:04.990 --> 29:09.530]  And I even wrote a little app for it.
[29:09.550 --> 29:11.430]  A little Android app that does the Bluetooth.
[29:12.210 --> 29:15.590]  My version of it actually doesn't use Z-Wave because my friend doesn't want Z-Wave.
[29:15.690 --> 29:16.870]  He wanted Bluetooth Low Energy.
[29:17.350 --> 29:20.070]  And so I built one that used Bluetooth Low Energy.
[29:21.730 --> 29:35.230]  And the problem I had with it was when you activate the lock, for a brief moment, all the power leaves the board, leaves the module.
[29:35.770 --> 29:40.850]  And I'm sure that their board actually has a capacitor that's big enough to deal with that.
[29:40.850 --> 29:42.650]  I did not plan for that.
[29:42.930 --> 29:47.350]  And so every time my board locks the board, it reboots.
[29:48.350 --> 29:50.110]  And that's a little embarrassing.
[29:51.430 --> 29:53.250]  And it's also difficult to get in.
[29:54.770 --> 29:57.590]  Oh, come on.
[30:00.560 --> 30:03.760]  0.8 pitch or whatever is awful.
[30:04.200 --> 30:05.860]  And no one should be allowed to make it.
[30:06.660 --> 30:10.000]  It's like just slightly smaller than one.
[30:11.740 --> 30:13.060]  N okay.
[30:13.060 --> 30:20.740]  Okay, so, this is in, and I'll be able to show y'all a second here.
[30:25.580 --> 30:31.960]  So, without this USB cable plugged into my laptop, the board would lose power.
[30:33.200 --> 30:34.780]  And, oh, popped out.
[30:35.040 --> 30:37.700]  Yeah, like I said, 0.8 does not hold anything in.
[30:38.280 --> 30:42.160]  When the lock is actually put together, it has, like, plastic to hold this board down better.
[30:42.160 --> 30:44.840]  But it's awful.
[30:48.340 --> 30:49.820]  Bear with me.
[30:53.540 --> 30:54.460]  Nope.
[30:55.540 --> 30:56.260]  Off by one.
[31:10.310 --> 31:11.910]  How is everybody today?
[31:12.410 --> 31:13.670]  There we go.
[31:18.100 --> 31:18.760]  Okay.
[31:19.740 --> 31:27.760]  So, it makes the beep, which means I'll have to do this real quick.
[31:31.930 --> 31:32.710]  So, yeah.
[31:36.820 --> 31:37.700]  Here we go.
[31:38.660 --> 31:42.760]  So, I will scan for the device and connect to it.
[31:43.340 --> 31:45.140]  And now I can lock.
[31:45.380 --> 31:46.120]  It's already locked.
[31:46.480 --> 31:47.500]  I can unlock.
[31:47.840 --> 31:50.120]  I'm not sure if you can hear that beautiful lock noise.
[31:51.680 --> 31:52.500]  Probably not.
[32:00.570 --> 32:02.350]  So, everything works on it.
[32:02.490 --> 32:04.630]  You can get the status and whatnot.
[32:04.870 --> 32:08.850]  But if I unplug this USB thing, as soon as I do it, they'll reboot.
[32:09.110 --> 32:09.370]  Yep.
[32:10.070 --> 32:11.030]  It was unhappy.
[32:11.870 --> 32:12.590]  So, it doesn't work.
[32:12.750 --> 32:23.430]  So, if you aren't accurate on all your assumptions, you can end up with something that's garbage right now and not a very good demo for hope.
[32:27.470 --> 32:32.630]  And the other thing, like I said, if you ever think you've made enough notes, you have not, make a few more.
[32:34.210 --> 32:35.330]  It'll save you a lot of time.
[32:37.330 --> 32:41.630]  So, I thought I'd tell you guys the kind of tools I use and what I'd recommend.
[32:42.370 --> 32:43.270]  Bus Pirate.
[32:44.090 --> 32:44.650]  Definitely.
[32:45.110 --> 32:46.250]  It's like $30.
[32:46.850 --> 32:48.230]  It's totally worth it.
[32:48.430 --> 32:51.030]  It can do everything.
[32:51.190 --> 32:57.310]  It can even be used slightly as a multimeter in some edge cases and power supply as well.
[32:57.310 --> 32:58.650]  It's just amazing.
[33:00.370 --> 33:02.770]  I forgot to bring it, but there's a thing called a C.
[33:03.390 --> 33:05.150]  It was made by Nautilus Labs.
[33:05.250 --> 33:06.990]  It was a Kickstarter a couple years back.
[33:07.510 --> 33:11.770]  It's an analog version of the Bus Pirate, basically.
[33:11.990 --> 33:16.230]  It allows you to source or detect voltage and amps.
[33:16.830 --> 33:17.390]  It's great.
[33:17.530 --> 33:22.270]  Like, when I was working on this, I used it to power the door lock.
[33:22.270 --> 33:28.570]  So I could turn the door lock on and off in software every time I caused the screw-up that caused the door to crash to the point where it wouldn't talk to me anymore.
[33:28.790 --> 33:31.510]  So I didn't have to get up and pull the damn batteries out again and again.
[33:32.830 --> 33:33.930]  So, it's awesome.
[33:37.690 --> 33:40.390]  This multimeter is awesome as well.
[33:40.770 --> 33:42.070]  It's a common word I'm using.
[33:43.310 --> 33:47.410]  One of the nice things about it is it has, it comes with a serial cable.
[33:47.410 --> 33:50.730]  So you can plug it into your computer and data log as well.
[33:50.950 --> 33:54.430]  It is very inexpensive, too, because I'm incredibly cheap.
[33:55.390 --> 33:57.450]  So, it's good for that.
[33:58.950 --> 34:01.890]  OpenBench Logic Analyzer is this tool I used earlier.
[34:02.130 --> 34:05.190]  It is by far the most difficult tool out of these to use.
[34:05.890 --> 34:08.490]  So I wouldn't recommend it for, like, a beginner, I guess.
[34:08.710 --> 34:15.770]  But it's also probably the most useful at going into the dark on something and figuring out what it was.
[34:16.810 --> 34:20.370]  When we started, we really didn't know what the pins were.
[34:20.530 --> 34:23.410]  And we should have because we should have just Googled, like I keep saying.
[34:23.690 --> 34:24.490]  But we didn't.
[34:24.630 --> 34:31.170]  And so, with that, we were able to tell, you know, it was a 9600 baud serial port pretty quickly with this.
[34:31.330 --> 34:33.410]  And it would have taken us a lot longer with other tools.
[34:35.550 --> 34:37.650]  The other thing I recommend is an Arduino.
[34:37.950 --> 34:41.030]  In particular, I like Leonardo because you get two UARTs.
[34:41.030 --> 34:43.530]  You have a USB UART that goes directly into the PC.
[34:43.890 --> 34:49.190]  And then you have the two-pin UART, which you can use to connect serial to another device.
[34:49.770 --> 34:51.370]  I also just love Arduinos.
[34:51.690 --> 34:52.830]  Do people love Arduinos?
[34:53.550 --> 34:53.990]  Yeah?
[34:54.730 --> 34:55.250]  Arduinos are cool.
[34:58.230 --> 34:58.850]  Thanks, Matt.
[35:00.750 --> 35:05.190]  Finally, I'm a big free software hippie.
[35:05.610 --> 35:08.250]  I recommend gEDA and Emacs.
[35:08.630 --> 35:11.290]  gEDA is what I designed the PCB in.
[35:11.910 --> 35:13.890]  It allows you to do stuff really fast.
[35:14.190 --> 35:18.910]  And I used Emacs to write this presentation and then put it into LibreOffice.
[35:19.650 --> 35:21.430]  And I use it for everything.
[35:22.470 --> 35:24.170]  Everyone should use Emacs for everything.
[35:24.730 --> 35:25.550]  Especially Matt.
[35:28.190 --> 35:29.530]  So I think that's it.
[35:30.350 --> 35:31.590]  Does anybody have any questions?
[35:33.690 --> 35:34.050]  Yes?
[35:34.410 --> 35:35.810]  Do you use org mode?
[35:36.290 --> 35:36.990]  Org mode?
[35:37.190 --> 35:37.650]  All the time.
[35:37.790 --> 35:38.790]  Can you get into...
[35:38.790 --> 35:45.170]  No, I just typed it all out a few nights back and then dumped it in.
[35:45.330 --> 35:47.330]  I use org mode, though, for day-to-day stuff.
[35:47.650 --> 35:48.370]  Very cool.
[35:49.350 --> 35:51.950]  In fact, I was going to show you guys what questions were going.
[35:52.530 --> 35:57.430]  This is about two weeks ago or three weeks ago.
[35:57.610 --> 36:00.890]  I did the entire board design in a night.
[36:01.050 --> 36:06.870]  And so this is pretty sped up, but I can kind of show you all.
[36:06.970 --> 36:14.750]  This is from absolutely nothing, making the Git repos, forgetting how to make Git repos properly.
[36:17.710 --> 36:20.490]  My continuous integration script so that...
[36:20.490 --> 36:23.190]  I work with a friend a lot and he doesn't like make.
[36:23.690 --> 36:26.910]  And so he hates that pretty image of the board.
[36:27.130 --> 36:29.230]  He hates having to do that himself.
[36:29.610 --> 36:35.610]  And so I wrote a script so that our GitLab instance has that automatically created for him.
[36:35.670 --> 36:37.010]  So he never has to bug me about it.
[36:37.010 --> 36:41.750]  But this is me kind of just doing initial layout of all the parts.
[36:43.090 --> 36:44.270]  Putting them where they need to be.
[36:44.950 --> 36:48.290]  That's waiting for PCB to make those images, which is why my friend hates doing it.
[36:50.930 --> 36:52.510]  Lots of stuff.
[36:53.030 --> 36:53.430]  Yeah.
[36:54.090 --> 36:54.830]  Checking everything.
[36:55.870 --> 36:58.410]  Anybody else have any questions while this kind of goes?
[36:58.830 --> 36:58.850]  Yes?
[36:58.850 --> 37:00.970]  Do you have to make your own footprints?
[37:01.350 --> 37:01.790]  Yes.
[37:03.990 --> 37:08.390]  So my friend Tim actually usually makes the footprints for me because I think that math is really hard.
[37:08.970 --> 37:10.350]  But it's not too bad.
[37:10.570 --> 37:13.790]  I actually did the footprint for the microcontroller on this board.
[37:13.970 --> 37:15.030]  It took me about ten minutes.
[37:15.070 --> 37:16.630]  You'll see it here in about three seconds.
[37:17.110 --> 37:18.270]  It'll take three seconds, I mean.
[37:19.690 --> 37:21.870]  But I wouldn't steer anyone away from it.
[37:21.990 --> 37:27.530]  In fact, Tim and I two years ago at HOPE gave a talk about using gEDA and creating footprints and everything.
[37:27.530 --> 37:30.670]  And people should watch that because it's a better talk than this.
[37:31.610 --> 37:31.870]  Yes?
[37:32.170 --> 37:33.230]  Did you try firmware?
[37:35.380 --> 37:39.840]  So the question was, did we try to read out the firmware?
[37:40.720 --> 37:45.620]  In this case, there were two real chips that were involved.
[37:45.960 --> 37:51.640]  There was the Z-Wave microcontroller and then the lock itself has its own little microcontroller here.
[37:51.980 --> 37:58.440]  The lock microcontroller we couldn't find any information about and didn't really get anywhere with it.
[37:58.440 --> 38:06.160]  The Z-Wave module is... the firmware that runs on it is part of it.
[38:06.240 --> 38:07.240]  It's not really dumped anywhere.
[38:07.780 --> 38:11.980]  The EEPROM that we found attached to it, it just stores preferences.
[38:12.340 --> 38:13.060]  And we found that.
[38:13.180 --> 38:20.320]  We found the secret that was shared between the Z-Wave controller host and the client.
[38:20.320 --> 38:25.760]  And our super secret 1-2-3-4 passcode was in there.
[38:26.000 --> 38:32.460]  And a few other oddities that we didn't really figure out too much what were because we kind of thought that was a dead end.
[38:38.620 --> 38:46.160]  In theory, but one of the goals of the project was actually to not use Z-Wave.
[38:46.560 --> 38:51.600]  Because one of the problems with Z-Wave and why I think you haven't seen its adoption everywhere is it's very expensive.
[38:52.880 --> 38:56.900]  My friend Matt... Matt, how much was the module that you have?
[38:57.120 --> 38:57.540]  The controller?
[38:57.880 --> 38:58.280]  $250.
[38:59.060 --> 39:00.280]  $250 for the router.
[39:01.740 --> 39:04.640]  Whereas we were using our phones to control our...
[39:04.640 --> 39:05.960]  This is me buying stuff on Mouser.
[39:06.700 --> 39:07.900]  Please don't steal my credit card.
[39:09.340 --> 39:13.340]  Yeah, that was the funny thing I think about this video is when I started this...
[39:13.340 --> 39:19.560]  It was hard for you guys to tell, I'm sure, but I was going to use an Atmel chip for it because I use Atmels a lot.
[39:20.120 --> 39:22.260]  And then I was just going to use a radio module.
[39:22.600 --> 39:25.320]  And then I thought that was way too much work and I was lazy.
[39:25.760 --> 39:29.980]  And so I searched for about 10 minutes there and found this RF module.
[39:30.100 --> 39:30.800]  And I was like, yeah, that'll do.
[39:31.400 --> 39:32.620]  And banged it all together.
[39:32.800 --> 39:38.860]  And this is me going through the documentation, making sure it will actually work as I build the part for it.
[39:39.420 --> 39:39.780]  Yes?
[39:45.610 --> 39:46.890]  People call it Z-Wave?
[39:47.950 --> 39:49.790]  That's what I'm going to say from now on.
[39:49.830 --> 39:50.590]  That's so much better.
[39:52.410 --> 39:55.810]  But I was wondering if there's any interest in actually hacking Z-Wave.
[39:56.150 --> 39:58.850]  Do software-defined radios and stuff.
[40:00.510 --> 40:04.210]  A little module where you can do that and do whatever you want.
[40:04.510 --> 40:04.870]  Really?
[40:05.170 --> 40:06.530]  I haven't played with it that much.
[40:08.050 --> 40:11.350]  I found the whole Z-Wave process a little interesting.
[40:12.350 --> 40:15.810]  I looked... when I was doing the documentation for this, I read about...
[40:15.810 --> 40:18.430]  I think it's OpenZ-Wave, which is an OpenZ-Wave controller.
[40:18.570 --> 40:22.130]  I don't know what hardware it actually uses to talk to the other Z-Wave devices.
[40:22.390 --> 40:24.370]  But it does seem like there is some progress out there.
[40:25.190 --> 40:30.850]  In it, I found that it actually... the OpenZ-Wave controller actually supported this lock.
[40:32.570 --> 40:38.130]  The Z-Wave protocol, which kind of surprised me, it defines two different lock types.
[40:38.890 --> 40:39.950]  And this is one of them.
[40:40.070 --> 40:40.610]  It's a door lock.
[40:40.690 --> 40:41.990]  It's supported by Z-Wave.
[40:42.570 --> 40:43.150]  Pretty standard.
[40:43.330 --> 40:43.570]  Yes?
[40:43.810 --> 40:49.390]  I don't mean to start a framework or anything, but why gEDA instead of KiCAD?
[40:49.970 --> 40:51.490]  Why gEDA instead of KiCAD?
[40:51.670 --> 40:51.810]  Yeah.
[40:52.350 --> 40:52.810]  So...
[40:54.350 --> 40:55.530]  KiCAD is awesome.
[40:56.030 --> 40:57.270]  And it's actually...
[40:57.270 --> 41:00.910]  KiCAD in long term is going to be even more awesome than gEDA, I would say.
[41:01.150 --> 41:05.470]  Especially since... I'm not sure if people are aware, but CERN is backing KiCAD like crazy.
[41:05.990 --> 41:09.510]  They just got push-and-shove routing, which is so f*cking sexy.
[41:09.510 --> 41:11.010]  And I'm very jealous.
[41:12.850 --> 41:25.150]  But when we started working together, Tim and me, we looked at KiCAD and it didn't really seem to support the workflow that worked best for us.
[41:26.370 --> 41:32.310]  He... my friend Tim spends most of his time making footprints and then actually laying out traces on our PCBs.
[41:32.450 --> 41:37.690]  And I spend a lot of the time writing software and doing the schematics and connecting everything together.
[41:38.290 --> 41:41.450]  And so gEDA allows you to separate those very well.
[41:41.690 --> 41:42.430]  And so...
[41:43.030 --> 41:43.970]  That's how we did it.
[41:44.070 --> 41:47.670]  The other thing is I am a make fiend.
[41:47.790 --> 41:48.630]  I love make.
[41:48.990 --> 41:52.970]  And with gEDA, I was able to script like so much stuff.
[41:53.590 --> 41:59.630]  Like if you check out this repo and see the make file, I want a thank you.
[41:59.870 --> 42:00.730]  Because it's awesome.
[42:01.550 --> 42:02.770]  I'm very proud of it.
[42:03.750 --> 42:04.310]  Yes?
[42:04.310 --> 42:06.330]  Who do you use to print PCBs?
[42:07.450 --> 42:09.170]  Who do I use to print PCBs?
[42:09.650 --> 42:10.050]  So...
[42:10.650 --> 42:11.450]  I typically...
[42:11.450 --> 42:13.630]  And actually, I think I'm on this board in a second, I think.
[42:13.930 --> 42:17.490]  I typically get my PCBs done by a guy named Hackvana.
[42:17.930 --> 42:20.070]  He's on Freenode and pound Hackvana.
[42:20.450 --> 42:23.010]  It's a pretty cool place to hang out.
[42:23.710 --> 42:24.590]  A lot of people...
[42:24.590 --> 42:29.950]  All of his customers kind of hang out there and we talk about PCB design and other kind of hobbyist stuff.
[42:30.570 --> 42:35.290]  The only other company that I would recommend is OSH Park.
[42:35.590 --> 42:36.110]  OSH Park.
[42:36.110 --> 42:36.730]  OSH Park.
[42:36.890 --> 42:36.950]  Yeah.
[42:37.590 --> 42:42.890]  I like that they are very inexpensive and kind of timely.
[42:44.490 --> 42:52.190]  If you aren't in a large rush and you just need prototypes, I think OSH Park, OSH Park is a great way to go.
[42:53.050 --> 42:54.290]  But I really like...
[42:54.290 --> 42:57.930]  Hackvana typically lets me do really crazy things with my boards.
[42:58.890 --> 42:59.870]  And I like that.
[43:00.190 --> 43:02.450]  And he also has very good prices in bulk.
[43:02.630 --> 43:05.650]  So, if you buy like a hundred boards, I think it's worth buying from him.
[43:09.230 --> 43:09.910]  I'm sorry?
[43:11.210 --> 43:12.090]  Develop the...
[43:12.090 --> 43:12.150]  What?
[43:12.910 --> 43:13.970]  Oh, Hackvana.
[43:14.210 --> 43:16.890]  H-A-C-K-V-A-N-A.
[43:18.870 --> 43:19.350]  Yes?
[43:19.350 --> 43:28.670]  So, it seems like as somebody who's sort of new to this hardware hacking, it seems like one of the most difficult parts was interpreting the message that you got.
[43:29.210 --> 43:41.710]  And I'm wondering, you know, besides, because there was a lot of trial and error in that process, so besides using Google, are there any good software tools for analyzing patterns in a series of messages to help you interpret them?
[43:41.710 --> 43:49.150]  So, I think what works best is, like I was saying before, is taking notes and getting lots and lots of data.
[43:50.290 --> 43:52.230]  So, I think I can quit out of this.
[43:54.750 --> 43:55.970]  I'll make it bigger in a second.
[43:58.850 --> 43:59.790]  Close this to me.
[44:00.910 --> 44:01.770]  So, notes.
[44:03.550 --> 44:05.670]  And I think g-edit will be easiest.
[44:06.270 --> 44:07.370]  What I think I know.
[44:08.550 --> 44:13.850]  So, when I was attacking this, is this readable at all or do I need to make it a lot bigger?
[44:14.870 --> 44:15.070]  Bigger.
[44:15.470 --> 44:15.750]  Bigger?
[44:16.370 --> 44:18.670]  Does anybody know how to make things bigger in geode?
[44:19.410 --> 44:19.990]  Probably this.
[44:21.290 --> 44:21.770]  Font.
[44:22.010 --> 44:22.370]  Font.
[44:22.530 --> 44:23.270]  Fonts and colors.
[44:25.790 --> 44:26.730]  Let's go big.
[44:31.570 --> 44:32.330]  It's great.
[44:32.650 --> 44:32.850]  Okay.
[44:33.810 --> 44:37.530]  So, these are the kind of notes that I kept as I was doing it.
[44:37.530 --> 44:40.150]  And most of it is actually just stream of consciousness.
[44:41.010 --> 44:42.970]  Some of it is wrong, actually, I would bet.
[44:43.030 --> 44:44.510]  And I just never went back and cleaned it.
[44:47.030 --> 44:48.690]  But here is where I started.
[44:49.870 --> 44:52.870]  I wrote a program to print out the hex bytes.
[44:53.270 --> 44:56.150]  And I just started appending them to the log over and over again.
[44:56.410 --> 44:59.270]  And so, actually, even here, you see some stuff.
[44:59.610 --> 45:02.810]  Early on, for the most part, I always would get the correct thing.
[45:02.810 --> 45:04.870]  But occasionally, I'd actually get garbage.
[45:05.130 --> 45:09.750]  And I didn't know it was garbage at the time, because I didn't know there was a big enough pattern.
[45:09.990 --> 45:13.310]  And so, I had to get a lot of data to get it down.
[45:13.770 --> 45:18.870]  But over time, you know, you get so much, it's dead easy to see.
[45:19.550 --> 45:23.270]  So, like, the majority of the message, I thought I understood very easily.
[45:23.470 --> 45:27.750]  Like, for example, this is what happens when you unlock.
[45:27.750 --> 45:31.990]  So, when you unlock, it's the standard header that I was talking about before.
[45:32.190 --> 45:35.610]  Four bytes, sequence number seven, and the addresses.
[45:36.370 --> 45:41.650]  The command that's being sent is a seven, which is a status check.
[45:41.870 --> 45:43.490]  And then the checksum.
[45:43.670 --> 45:47.690]  And then it sent it again, because the microcontroller was slow, because it was sleeping.
[45:48.050 --> 45:49.890]  And it was like, give me the damn status.
[45:50.350 --> 45:52.910]  And it finally replied back.
[45:54.210 --> 45:58.310]  And then I said, okay, so the status was that the door was still locked.
[45:58.470 --> 46:00.770]  So, then I sent this command, which is the lock command.
[46:00.870 --> 46:02.070]  O5 is the lock command.
[46:02.390 --> 46:04.310]  And so, it's pretty...
[46:04.310 --> 46:06.830]  Now it's pretty obvious that it was that.
[46:07.070 --> 46:10.970]  But even before that was clear to me, like, when you look at the...
[46:12.230 --> 46:13.850]  Where's the lock from the web interface?
[46:15.070 --> 46:16.230]  I think O3, yeah.
[46:16.630 --> 46:20.430]  So, when you look at the same thing here, this is when I sent the lock command.
[46:20.430 --> 46:26.150]  So, the lock command, you see the same kind of message preceding the lock actually firing that the unlock did.
[46:26.290 --> 46:28.290]  So, it makes sense that that's going to be a status message.
[46:28.670 --> 46:31.610]  And then O3 is the command to lock the door.
[46:32.950 --> 46:39.590]  But I'm certain that I don't actually know all the valid commands yet, because some of the commands are more complicated.
[46:39.750 --> 46:45.850]  Like, the add code command has the slot, another signifier, and then the data.
[46:45.850 --> 46:52.490]  So, it can be trickier, but it's a good way to start is just to collect as much data as you can.
[46:53.470 --> 46:53.950]  Yes?
[46:54.130 --> 46:55.850]  How did you figure out what they were with the slot?
[46:56.610 --> 46:59.850]  The slot was because later in here...
[47:01.270 --> 47:03.750]  So, I entered multiple codes.
[47:04.190 --> 47:08.010]  So, this code right here, it's wrapped.
[47:08.010 --> 47:10.590]  So, this is adding the code 2244.
[47:10.950 --> 47:13.790]  And you'll see that in the slot space, it's 0x02.
[47:14.190 --> 47:17.010]  And I had just entered the one before, and it was 0x01.
[47:17.310 --> 47:19.250]  And I entered another one, and it was 0x03.
[47:19.330 --> 47:22.050]  And so, that appears to be what slot it's in.
[47:22.350 --> 47:29.500]  So, the remove code seems to do the exact same thing.
[47:29.680 --> 47:32.320]  So, the code is OD for delete.
[47:32.760 --> 47:34.620]  I like to think that somebody did that.
[47:34.740 --> 47:36.100]  It probably was just chance.
[47:36.100 --> 47:40.160]  But it's OD, and then it's the slot number.
[47:40.380 --> 47:41.420]  And then they do...
[47:41.420 --> 47:43.680]  They verify that the code was actually deleted.
[47:43.800 --> 47:44.980]  You'll see OC is a...
[47:44.980 --> 47:49.080]  What is the status of this slot being fired right after it sent the delete key?
[47:49.580 --> 47:49.880]  Saying...
[47:49.880 --> 47:51.000]  Did it really happen?
[47:52.100 --> 47:52.580]  Yes?
[47:59.050 --> 47:59.530]  So...
[47:59.530 --> 48:01.450]  That was a very funny thing I found.
[48:01.690 --> 48:04.710]  It only cares if it's the same sequence number.
[48:04.950 --> 48:08.970]  So, the microcontroller was keeping track to say, did I already see this message?
[48:09.350 --> 48:10.710]  But only to that degree.
[48:11.770 --> 48:17.470]  So, when I was doing my replay attacks, as long as I didn't send the same message repeated...
[48:17.470 --> 48:18.290]  So, like if I had...
[48:18.290 --> 48:21.770]  I sent the lock command, the door locked, and then I physically unlocked it.
[48:21.870 --> 48:29.410]  If I sent the lock command again, because it was the exact same message, and there hadn't been any in between, it assumed it had already seen that message, and it dropped it on the floor.
[48:30.510 --> 48:32.890]  And that's why I actually bothered with the sequence number.
[48:32.990 --> 48:33.310]  Because you're right.
[48:33.370 --> 48:35.150]  Otherwise, it probably doesn't matter.
[48:38.540 --> 48:38.900]  Post...
[48:39.300 --> 48:40.140]  Fixed lock codes?
[48:40.140 --> 48:44.480]  Is it essentially a back door where it's been put in there at one, two, three, four, five?
[48:45.660 --> 48:47.440]  Actually, that is one of the things I did.
[48:48.340 --> 48:54.340]  When I got it all working, one of the problems I saw with it was there's this...
[48:54.340 --> 48:57.400]  I didn't realize there was this unregister and register part of it.
[48:57.400 --> 49:04.600]  So the module, when you connect it to the lock, you can send it a command saying, hey, I'm your new module.
[49:04.940 --> 49:05.860]  Let's work together.
[49:06.260 --> 49:12.260]  And when it does that, it's supposed to delete all of the lock, lock codes that it knows.
[49:12.460 --> 49:13.560]  And it actually does that.
[49:14.480 --> 49:15.680]  And when you...
[49:16.820 --> 49:17.600]  And so...
[49:17.600 --> 49:18.080]  I'm sorry.
[49:18.140 --> 49:19.200]  When you unregister, it does that.
[49:19.320 --> 49:24.600]  And when you register, the module will send over any lock codes it had already known in advance.
[49:26.620 --> 49:28.480]  And so one of the things once...
[49:28.480 --> 49:32.360]  Before I'd figured that out was I wrote a routine that just scrolled through all the slots.
[49:32.860 --> 49:35.080]  And that's actually how I found out about the limit.
[49:35.240 --> 49:40.980]  Because when I hit, like, slot number 100, it started throwing me errors saying there is no such slot at that number.
[49:42.620 --> 49:45.400]  And there were no hidden codes, fortunately.
[49:48.460 --> 49:49.500]  Any other questions?
[49:52.500 --> 49:54.400]  Can we give Wilpik another happy birthday?
[49:54.400 --> 49:55.440]  Happy birthday.
[49:55.440 --> 49:57.290]  Happy birthday.
[49:57.870 --> 49:58.210]  Thanks.