Close

Hack Chat Transcript, Part 1

A event log for AVR Reverse Engineering Hack Chat

On beyond Arduino

Dan MaloneyDan Maloney 04/21/2021 at 20:550 Comments

Hi everyone, welcome to the Hack Chat today. My name is Dan and I'll be moderating today along with Dusan. We're joined by Uri Shaked today, who's doing a HackadayU course soon on RaspPi 2040 and Pico, and completed a course earlier in the year on AVR programming.

Uri Shaked12:01 PM
"Hello world\n"

Welcome Uri! Can you start us off with a little about yourself?

rjtescher12:01 PM
Howdy!

Is there audio?

Uri Shaked12:01 PM
Sure!

@rjtescher - No, just text. Old school, like IRC

Uri Shaked12:02 PM
no audio today, but here's a recommended soundtrack for this hackchat:

- Atom heart mother by Pink Floyd

then

- Court of the Crimson King by King Crimson

rjtescher12:02 PM
TY

Radu Motisan12:02 PM
hehe, nice!

Uri Shaked12:03 PM
About me...

Uri Shaked12:03 PM
Software engineer by passion, and in the recent year, this passion has grown for projects that also involved hardware

Uri Shaked12:04 PM
Especially ones that challenge my gray cells and teach me new skills. Like building an in-real-life version of the Chrome T-Rex game

I feel like I wrote an article on that...

Uri Shaked12:05 PM
or trying to decipher encrypted 3D printer firmware for weeks

Inne12:05 PM
@Uri Shaked do you remember a revelation you experienced when diving deeper into MCU programming, (like "wow now I can do something really cool").

Uri Shaked12:05 PM
About the 🦖?

Dave Blundell12:05 PM
decypher files on PC or reverse engineer a code dump that just doesn't have symbol tables?

I knew it:


https://hackaday.com/2017/11/26/mechanical-build-lets-you-jump-cacti-in-real-life/

Hackaday Dan Maloney

Mechanical Build Lets You Jump Cacti In Real Life

Simple to learn, hard to master, a lifetime to kick the habit. This applies to a lot of computer games, but the T-rex Runner game for Chrome and its various online versions are particularly insidious. So much so that the game drove one couple to build a real-world version of the digital game.

Read this on Hackaday

Dave Blundell12:06 PM
(re: printer fimrware)

Uri Shaked12:06 PM
@Inne that's a great question.

Uri Shaked12:07 PM
I think that 3 days into writing a simulator for AVR, when I got "blink" to work for the first time, I realized how little of the MCU features most code actually uses

Galactic creature 4212:07 PM
What’s up ;)

Michael Möller12:08 PM
The AVR instructins or the specific hardware extra IO ?

Uri Shaked12:09 PM
Mostly the hardware extra IO. I don't remember exact numbers, but I think Arduino's blink used between 50% to 80% to the overall instructions.

Nathan Brown12:09 PM
It that a comment on what programs use, or the boat of Arduino?

Nathan Brown12:10 PM
*bloat

Uri Shaked12:10 PM
but that instructions was really the easier part about the emulator. The peripherals, especially the timers, took a lot longer to write. But for blink, I initially faked the timer with a few lines of code

Michael Möller12:10 PM
Friend of mine was using the library to time a pulse, there is a specific way to do it. He couldnt get it to work for two inputs. So I looked at the code and found there was a special hardware register setup for that - which I then found in the specs, whch is limited to one pin (on the 328)

Uri Shaked12:10 PM
@Dave Blundell decrypt the firmware on the PC, using python + numpy/scipy and jupyter:

Jean-Charles joined the room.12:11 PM

Uri Shaked12:11 PM
@Nathan Brown what programs actually use.

Phil.sydor12:12 PM
@uri - Was your simulator written in HLL ? And what assembler package (s) do you use to code AVR?

Uri Shaked12:12 PM
The ATmega328p has 3 hardware timers. Most programs run fine with just Timer 0.

Uri Shaked12:12 PM
@Phil.sydor the simulator is written in TypeScript (a variant of JavaScript), so yes.

Uri Shaked12:13 PM
When I need I just use the GNU assembler. You can use it from directly in Arduino projects, e.g. https://wokwi.com/arduino/projects/289908049496244744 - look at simon.S)

Uri Shaked12:14 PM
Other than being a maker with passion for software (especially everything web), electronics and hardware, I also used to be a Salsa dance teacher

Uri Shaked12:15 PM
and that's also how I met my life partner

Dusan Petrovic12:15 PM
Nice ; )

Uri Shaked12:16 PM
@Michael Möller you could probably also do that with INT2/INT3, or even with PCINT which would support any number of pins

Uri Shaked12:17 PM
unless the inputs would fire almost simultaneously, and then you won't be able which one fired first

Uri Shaked12:17 PM
(awkward silence)

Christopher12:18 PM
Salsa dancer by night. AVR hacker.. also by night. Cool :)

Michael Möller12:19 PM
I'm trying to find the original reference, but lets not derail the chat with my old (and solved) problem.

Salsa?

Christopher12:19 PM
What kind of environments do you like to use? Text editor and makefile?

Uri Shaked12:19 PM
Salsa. Hold on, I'll find something for you...

Nights can be busy, I guess

Inne12:19 PM
I was wondering when reading the Datasheet for the RP2040 (for HaDU) for instance, do you have a strategy or read the whole thing mostly chronologically.

Nathan Brown12:20 PM
I have another question about writing a simulator. What do you use to simulate the "rest" of the hardware? Thinks like I2C components, etc.

Uri Shaked12:20 PM
there you go, @Michael Möller . Me, 12 years ago:

Uri Shaked12:21 PM
@Christopher nowadays? mostly Visual Studio code. Working on Windows machine, and heavily using WSL (Linux integrated into windows).

Christopher12:21 PM
Cool

Uri Shaked12:22 PM
Then for most stuff that involves compiling things I use docker.

Phil.sydor12:22 PM
Whoa - that is energetic dancing!!

Michael Möller12:22 PM
@Uri Shaked (sidetracking issue: "input Capture Unit", on pin 8 (Portb0), The FreqMeasure library)

Uri Shaked12:22 PM
For instance, last night I compiled a gdb-multiarch buildroot image to run in an emulator inside the browser, similar to what I did here: https://blog.wokwi.com/running-gdb-in-the-browser/

Thomas Shaddack12:24 PM
What about code visualisation, for static analysis? Some way to show the instructions in a way molecular modeling shows protein structure, show how the code flows in a "folded together" way as a 3d model, more compact than the usual 2d approach?

Uri Shaked12:24 PM
@Inne RP2040 is a great example. I got a series when I'm building an emulator for it in a live stream, so you can actually see how I read the data sheet. Also, I showed which parts I focus on in the AVR course (you can find it on Hackaday's YouTube)

rjtescher12:25 PM
@Thomas Shaddack protein folding on an AVR?

Inne12:25 PM
Cool I'll look them up.


https://www.youtube.com/playlist?list=PL_tws4AXg7avNexvQxkfxfEBtvTtBi6Tu

YouTube

Uri Shaked12:26 PM
but in general, there's always a section talking about the general architecture. memory map, registers, etc. I usually start there to understand where the code is loaded, where the RAM starts, how is the stack managed, etc.

Uri Shaked12:26 PM
Thanks @Dan Maloney !

FYI, I'll post a full transcript after the chat in case anyone needs to refer back for links, etc.

Uri Shaked12:27 PM
Some architectures have weird features. For example, ESP32 uses Xtensa, which has something called Windowed Registers

Mark J Hughes12:27 PM
Do you have a link to Uri's course?

Uri Shaked12:27 PM
It's like a micro-stack implemented inside the MCU. It confused me much!

@Mark J Hughes - the playlist above is Uri's AVR course.

Uri Shaked12:27 PM
Thanks @Phil.sydor

His RP2040/Pico course is coming up in May


https://www.youtube.com/watch?v=OLV-TSRTTE8

YouTube

RichardCollins12:28 PM
Isn't AVR a generic concept of programming, not a particular piece of hardware or software? I found an AVR instruction set manual at http://ww1.microchip.com/downloads/en/devicedoc/atmel-0856-avr-instruction-set-manual.pdf. But, because they limited the language to a specfic set of hardware, it is not generalizable. Maybe I am wrong about the limited nature of AVR language.

Thomas Shaddack12:28 PM
@rjtescher Nope. Folding the AVR code in a protein model like way. Or the RNA or DNA structure. Instruction is like an atom, with "bonds" to the previous/next one (and calls and jumps).

Uri Shaked12:29 PM
@Thomas Flummer for the most part, I don't use code visualizations. I did use some visuals when trying to dechiper the 3D printed firmware, e.g. https://medium.com/@urish/visualizing-repetitions-in-string-using-python-and-matplotlib-5e4e1ddff0c9

Uri Shaked12:29 PM

https://urish.medium.com/visualizing-repetitions-in-string-using-python-and-matplotlib-5e4e1ddff0c9

Medium 
Uri Shaked

Visualizing Repetitions in String using Python and Matplotlib

A few months ago, I was accepted to present in BSidesTLV, a cyber security conferences. This was quite unusual for me, as I usually speak at Web / JavaScript / Angular related conferences. The conference covered topics such as malware analysis, block chain security, security vulnerabilities in movie subtitles (that was epic) and even hacking into luxury yachts.

Read this on Medium

Uri Shaked12:30 PM
@RichardCollins that's a good question. AVR is an architecture. It's not a concept - it's a specific set of instructions and defined behaviors that are implemented by a family of Microcontrollers.

ailaG12:30 PM
🌵,,,🌵,,,,,,,,,🌵,,,🦖,,,,🌵🌵,,,,,🌵,,,,

rjtescher12:31 PM
@Thomas Shaddack Oh! Okay

Uri Shaked12:31 PM
Other examples for architectures include ARM, x86 (intel), Xtensa (which I mentioned before, used by ESP8266/ESP32), SPARC, and RISC-V that everyone is talking about

Uri Shaked12:32 PM
Hi Galia! Very nice visuals, thanks ;-)

ailaG12:32 PM
It is my art.🙏

ailaG12:32 PM
Hi hi :)

RichardCollins12:32 PM
But your emulator would allow one to add "128 bit memory space" to some example project. Those instructions would show up in the language, You compile and send HDL to the chip maker and run a big memory project. Simulate to design and test, then get a particular language for particular needs?

Dave Blundell12:33 PM
@Uri Shaked have you done much in the way of glitching or attacks on fuse bits on avr?

Thomas Shaddack12:33 PM
@rjtescher The disassembler gives us the primary structure, the chain of instructions. Then apply rules that'd "fold" the 1d-structure to something 3d where the stuff that belongs together naturally clusters. Essentially a 3d graph. With molecules, the rules are the laws of physics governing attraction/repulsion and bond length. Here the rules would be set to make the code structure as obvious as possible, allow us to see the entire code size at once while zooming into the individual sections to the chain of instructions. Without it it is like looking at a map through a thin tube and seeing only a little area - but seeing it in detail.

Uri Shaked12:33 PM
Speaking of protein folding, I found Microbiology really intriguing as well. Two years ago I organized an intense 6-week microbiology training program for software hackers

Uri Shaked12:34 PM
and other than learning a lot about the subject, I couldn't help myself 3d-printing some E-colis: https://urish.medium.com/3d-printing-bacteria-fc48a41d3f76

Uri Shaked12:34 PM
@Thomas Shaddack I have never heard of this approach. Is there any software package that already does something like this? Or is it a new concept?

rjtescher12:35 PM
I took a course in bioinformatics a dozen or so years ago, interesting. Searching genetic codes with various data structures.

Thomas Shaddack12:35 PM
It is one of my pet ideas.

RichardCollins12:35 PM
Last year I went through many of the protein folding groups for covid on the Internet. They could have used purpose-built massively parallel computers. But no way to design the hardware from the software emulation.

Uri Shaked12:35 PM
I know IDA has a graph visualization feature, but I rarely found it useful

Uri Shaked12:37 PM
Organizing a biology course for hackers, the most challenging part (which I didn't anticipate), was to shift their way of thinking from asking: "Why is it like that? What are the rules? Where's the manual?" to simply accept what they observe as given.

Thomas Shaddack12:37 PM
The bioprinting is fun! :D The gene-engineering of bacteria with the kit is even more fun. On the wishlist it goes.

Thomas Shaddack12:38 PM
Biology research is reverse-engineering nature.

The other big challenge is dealing with the fact that in biology, every rule has at least one exception.

Thomas Shaddack12:38 PM
Only one?

Sometimes more exceptions than rules, yeah.

Uri Shaked12:39 PM
Unlike software / hardware, where everything was designed by a human, and if you dig deep enough, you'll probably find the reason why it works in a weird way (e.g. why the A20 line of the system bus is disabled on boot by x86, and you have to tell the keyboard controller to switch it on)

rjtescher12:39 PM
B^) sort of like UN*X then?

Exactly!

RichardCollins12:39 PM
Anthropology, economics, finance, government, education - every field has infinite exceptions because our models are finite and the universe unlimited.

Thomas Shaddack12:40 PM
Nature is like a codebase maintained by short-term interns, low paid, unmotivated, doing last minute patches with the least effort necessary before going home. Repeat for couple million years.

Uri Shaked12:40 PM
Exactly.

Uri Shaked12:40 PM
But then you find fascinating stuff like virus fragments hidden in bacteria.

Nicolas Tremblay left the room.12:40 PM

Thomas Shaddack12:41 PM
That's the result of that sleepy 4AM cut/paste.

Uri Shaked12:41 PM
And you start wondering how they even got there....

RichardCollins12:41 PM
Thomas Shaddack: Billion years. And rather large numbers of replicas.

Uri Shaked12:41 PM
haha

ailaG12:42 PM
Interviewer: And how did you get there?

Nature, exhausted: Trial and error. And error and error.

Uri Shaked12:42 PM
I think for me, one of the biggest revelations in the biology course, was that what I thought to be junk DNA, is just a piece of code the replicated itself many time

Uri Shaked12:42 PM
(google SINE / LINE in human DNA)

Uri Shaked12:43 PM
And error. And error.

RichardCollins12:43 PM
What do you guys want to build? Solar system colonization, warp drives, green the deserts, terraform earths poor regions, lift to orbit, atomic energy (original meaning), education for all? I have a list of abou 20,000 topics that need people working hard and efficiently.

Michael Möller12:43 PM
Early DNA biologists: Doesnt code for protein, must be junk.

Current theories: It is oart of the folding system, thus control which pieces are exposed, ie which genes are expressed.

Software analogy: Indirect jump

ailaG12:43 PM
Interviewer: So why does a giraffe have that nerve going all across its neck and back?

Nature: *sobs loudly*

rjtescher12:44 PM
Well, who knows? Maybe "Junk DNA" was needed at one time for a particular solution, sort of like the "light pen" driver in x86 software.

Rob Ward12:44 PM
Yes, if it works, then that is the answer for now, never mind the gadzillions of low cost random previous tries that did not work

Uri Shaked12:44 PM
haha exactly

Uri Shaked12:44 PM
fascinating stuff. Unfortunately, it's not really accessible for us, hackers (yet?)

Thomas Shaddack12:45 PM
@RichardCollins Get out of this stupid rock. The meek shall inherit the Earth, and they can keep it.

RichardCollins12:45 PM
@Rob Ward Best to remember every experiment and optimize the whole set, not just one particular sequence or outcome.

Thomas Shaddack12:46 PM
a lot of junk dna seems to serve structural or regulatory function. My hunch is that the function was gradually gained by that piece of code being there and having that particular shape that modulates access to some other shape a bit nearby.

ailaG12:46 PM
Nature: I was young and clueless.

Interviewer: You were millions of years old!

Nature: Exactly!

Interviewer: So did you learn anything from it? Will you get more efficient now?

Nature: ... No?

Thomas Shaddack12:46 PM
...and then comes epigenetics...

Uri Shaked12:47 PM
Yes. I also really liked some of the methods people use nowadays to brute-force reverse engineer genes.

Thomas Shaddack12:47 PM
Nature: "Yes, I evolved gene engineers."

Uri Shaked12:47 PM
for instance, there's yeast. it exists. but does it needs all genes? apparently, not.

RichardCollins12:47 PM
The Internet is going through that kind of random experimentation and evolution. It is possible to measure and guide or modulate part of the process. And most of the pieces are visible.

ailaG12:47 PM
Interviewer: How did you evolve gene engineers?

Nature: They sort of... happened?

rjtescher12:47 PM
All interesting.

I have a few AVR chips of various types I bought years ago.

I also have an ST-500 programmer from before then.

What do I need / need to do to do assy lang. on my AVRs?

ailaG12:48 PM
But yeah. And it's fascinating, how things evolved to us talking about it - and more

Rob Ward12:48 PM
The ones that keep their heads down and concentrate on reproducing will inherit the earth. Obsession with money is a dangerous distraction.

Thomas Shaddack12:48 PM
@rjtescher Alcohol. Significant amount. And assembler.

Uri Shaked12:48 PM
how do we figure out which genes can be omitted? brute-force search

Uri Shaked12:48 PM
Haha :)

rjtescher12:49 PM
@Uri Shaked Muntz did that with Televisions

Uri Shaked12:49 PM
Yes, GNU assembler should do.

Uri Shaked12:49 PM
If you need to exact command line ping me after, I'll look it up for you

RichardCollins12:49 PM
The "useful" or "necessary" genes depend on the context. A better field equation is not needed if you are building water supplies for Mars.

Thomas Shaddack12:49 PM
@rjtescher And some hello-world examples. I usually start learning with modding something that already exists, even if small.

Uri Shaked12:50 PM
yes, actually the AVR course has some pieces you can use to stich together an hello world in assembly

Thomas Shaddack12:50 PM
@rjtescher But consider writing it in C. If you don't need clock-tight timing or save every possible byte, C is the lazier option. I swear on (and sometimes at) avr-gcc.

rjtescher12:51 PM
@Uri Shaked and @Thomas Shaddack , I came unprepared, I'll dig into Uri's .IO and YT after this....

Thomas Shaddack12:51 PM
Definitely do it.

Uri Shaked12:51 PM
And come back with questions, many, please :)

Thomas Shaddack12:51 PM
Questions are fun. The only stupid question is the one that was not asked, but should.

Uri Shaked12:51 PM
Are you a unicorn?

Thomas Shaddack12:52 PM
Me? Do I like barfing rainbows? :P

Thomas Shaddack12:52 PM
...do I *look* like...

Uri Shaked12:52 PM
;-)

rjtescher12:52 PM
@Uri, I am a Unique Orn(ery) S.O.B. B^)

Uri Shaked12:52 PM
hehe

Rob Ward12:53 PM
Programming is a mainly hard slog with deterministic expectations, interspersed with random genius events, teasing them apart is much harder. Nature is entirely random, so much, much harder to "follow any logic".

Thomas Shaddack12:53 PM
another fun chip is the ESP8266/ESP32. With C you can share big chunks code between the platforms, and the embedded approach is similar.

Uri Shaked12:53 PM
But if you do like torturing yourself with hardcore AVR internals, there's also my latest hardware project, The Skull

ailaG12:53 PM
Though NNs kind of throw some arbitrariness / randomness into the hot mess

Thomas Shaddack12:54 PM
Nature has a lot of logic. The problem is that it has so much logic it appears chaotic. (Chaotic. Not random.)

Uri Shaked12:54 PM
Today someone from Brasil actually managed to solve all the 3 parts of the challenge for the first time

RichardCollins12:54 PM
My brother, Clif, wrote a native Javascript compiler. He can compile to HDL. So you can take any program and, in principle, "print" the code to hardware.

Uri Shaked12:54 PM
Is that compiler on Github?

Thomas Shaddack12:55 PM
Printing hardware... that'd be royal fun. 3d nanoprinting of organic semiconductors...

Uri Shaked12:55 PM
I'd love to take a look

RichardCollins12:55 PM
No, he wants to commercialize it. I begged him to make it open, but he would rather make LOTS of money.

Discussions