Arko's Blog

I did this a while back at NSL.. not really a whole lot of hacking involved really, but I thought I’d share.

If you’d like to have ftp access to your ardrone you can follow these step:

1) Plug in your battery and using your laptop, connect to your Ar.Drone.

2) Download and open Putty (or whatever you use to telnet), telnet to 192.168.1.1 Port 23

3) ??? (This means you’re in, no password)

4) Profit

5) Congrats you’re in, but let’s make this easier to hack, let’s get it to give us ftp access to the root. cd into ‘/etc’

6) vi inetd.config

7) Change the first line “21 stream tcp nowait root ftpd ftpd -w /data/video” to “21 stream tcp nowait root ftpd ftpd -w /”

Open your web browser or filezilla and ftp into your Ar.Drone: ftp://192.168.1.1

9) Enjoy

The Ardrone uses AT commands, using google I found: https://projects.ardrone.org/boards/1/topics/show/852

I made a really quick hack while back where I replaced the terrible battery connector they use with a deans connector (http://www.wsdeans.com/products/plugs/ultra_plug.html). So now I can connect the helicopter batteries I have lying around. It allows me to put in higher mAh batteries for longer flight time, which is always good

Here’s the hardware teardown specs:

Processor Board: (Front)

• Parrot 6 – CPICS01192A 1022 R1A 7POF47424.00 ARM
• 01A17 D9HSJ M LTX1
• Atmel 58A870 AT73C246 0P0987A 1025
• ROCm ATHREOS AR6102G-8M2D 007K0523.51A F52257.1K 1023
• SMSC USB3317 1409600C CKR
• 32.000Mhz Crystal

(Back)

• 1012 I-2 29FIG08AAC WP C BTT9

Navigation Board:

• Microchip PIC24HJ 16GP304 I/PT 1019K WB
• 6L04STE 1017 V5B
• Invensense IDG 500 143363-H AL1020C
• 043 U018 206

For the past few weeks the Nullspace Labs hackerspace has been holding a gaming night every Thursday starting 8pm. The games range from some of the most modern games such as Starcraft II to some of the oldest games in existence such as Go. The first night was a great hit, we had a Starcraft II tournament resulting in much friendly yelling and exciting matches.

Interested in joining the NSL Gaming Night?

It’s simple, just show up! Bring your laptop, power brick, and game face.

Where: Nullspace Labs in Downtown Los Angeles (3rd Floor): http://g.co/maps/tst36

When: Every Thursday

About NSL: http://032.la/

First game of Go for the night ended up becoming a “How to play Go” match. As you can see, the player with the black stones is in quite some trouble.

Starcraft II matches taking place

Game of Cosmic Encounters going on

A seriously intense game of Mouse Trap!

Before I start, I’d like to note that this is my first reverse engineering project.

So the story here starts with me taking a class that required me to purchase one of these iClicker’s ( http://www.iclicker.com/Products/iclicker/ ), otherwise I wouldn’t get “participation” points in class :/ So I purchased one and booted it up during lecture to “participate”. It was neat to see some tech in the classroom, but the material wasn’t any more interesting, so I decided to tear this thing apart… I busted out my utilikey and tore it apart mid-lecture.

At this point the professor noticed all the students were “participating” except me. She then walked up to my desk and noticed the iClicker completely torn apart and asked “What are you doing?” to which I responded “Opening this thing up..” and she responded with ”This is not apart of the lecture, you shouldn’t be doing this in class. This is very important you should be paying attention.”  I figured it’s time to protect my grades so I said I would clean it up right away, and did so.. (unhappily)

I snapped a few shots of the tear down before doing so..

Here we see the Buttons “A”  ”B”  ”C”  ”D”  ”E”  and “ON/OFF”.

Noticed the RF hardware consisted of an XE1203F ( http://www.semtech.com/images/datasheet/xe1203f.pdf ) which does ISM band (iClicker is configured for 900Mhz)

Discovered the microcontroller is an ATMega8A ( http://www.atmel.com/dyn/resources/prod_documents/doc8159.pdf )  and best of all.. the ICSP pads are broken out for you already!! At this point I was hoping that the security bit wasn’t set so I could dump the firmware and EEPROM.

I later got to my setup at Nullspace Labs ( http://032.la/ )  and soldered on a 6pin header for the ICSP line. Then connected my AVR Dragon and attempted to dump the firmware and EEPROM from the ATMega8A with an external power supply connected to the power leads for the battery. As soon as I attempted the read, the iClicker reset itself. So I figured the power management must be doing some funky things, so lets by pass all that and go directly to the ATMega8A’s VCC and GND line. I soldered on some kynar wire to pin 4 (vcc) and pin 5 (gnd) and attempted the read again..

Success!! The security bit was never set! So now that I could communicate with the chip, I decided dumped the firmware and EEPROM. (Reversing in IDA to come in Part 2)

At this point I realized the hardware ID must be in the EEPROM, so I went exploring looking for “3300B586″ which is the hardware ID written on the back of the device:

I noticed at line 0 column A the sequence “3300B5″, huzah!  At this point I could just modify this and change the hardware ID of the iClicker!

Next I decided to listen to the communication between the ATMega8A and XE1203F by sniffing the SPI bus, following the datasheets I soldered up some wire to the SPI lines. Once the wiring was done I used my handy AnnaLogic to sniff the SPI bus.

AnnaLogic (16-channel logic analyzer) from Nullspace Labs (available for purchase here for $40:  http://www.nullspacelabs.com/catalog/products.php?5&sid=mkkhjkoj10qo012972ufdfhka3 ) Totally easy to use and it fits in an egg!!

Once I powered up the iClicker (note: it’s not connected to an instructor machine) I began the sniffing and pressed the following sequence of buttons:  A  B  C  D  E . I noticed that there was only data on the Slave Input lines, which makes sense since there is no instructor machine to send data back. Between each button I pressed only one byte was changed, and it doesn’t seem to be as intuitive as ‘A’, ‘B’, ‘C’,'D’,'E’. Instead A = 177 (0xB1) , B = 181 (0xB5), C = 189 (0xBD), D = 190 (0xBE), E = 186 (0xBA).

Next I need to capture some traffic between my iClicker and the instructor machine to see a full cycle of registering the iClicker to the instructor machine, voting and receiving confirmation that the vote went through.. I’ll leave that for Part 2.

Please note that I will NOT be doing this packet capture in the classroom (it’s no place for learning anyway), I’ve decided to purchase an instructor base station to prevent any issues with my school. Plus it gives me control to test and try out things I normally wouldn’t be able to do.

For the mean time I need the clicker for lectures so I’ve poked a hole into it.. totally looks normal

Next up.. reverse engineering the firmware in IDA, stay tuned for Part 2:

So far the only defeat has been spoofing other iClicker hardware ID’s by reprogramming the EEPROM (thankfully iClicker never set any security bits ) It’s not much yet, but next up is to reverse the firmware and figuring out how the packets are sent, handled and then to create a new firmware with some extra features. A few new features I’ve thought of are listening in to other iClickers, submitting and spoofing as other iClickers, and making a  general purpose ISM band radio.

Interested in hardware hacking?   Layerone 2012 http://www.layerone.org/ 

So a few weeks ago Nullspace Labs got an old pick’n'place and decided it was time for a renovation with much newer technology. Charliex and mmca for the past few weeks have been working non-stop on rebuilding this thing. It went from a busted old computer running CP/M with “ok” precision to a higher precision, computer control/vision machine which controls the pnp with an Arduino! Charliex’s blog explains the process it has gone through is great detail (it is a must read): http://charliex2.wordpress.com/tag/juki/

I have been fortunate to have had a small role in this project by drafting up/CADing some of the new parts designed by mmca for the machine!  Here are a few pictures from the Solidworks files for what is to come!

Here is a plate with an adjustable height where components are placed for the pnp to pick them up!

Here is the new head plate adding the capability of 360 component rotation, camera mount, and a pneumatic solder paste applier!

Also, go to Layerone 2012: layerone.org 

I guess it’s time to start blogging about the things I do!