mercredi 6 juillet 2011

[EN] NDH 2011 badge hacking part 3 : Let's code!

Hello folks!

Here is the final part of my NDH 2011 Badge Hacking serie.
We know how to plug it, read it ... how about we write in it now?

Pre-requisites

As you could see from the first post about the pinout, there are PORTA, PORTB and PORTD.
These are defines in AVR C headers that allows you to set those corresponding ports.
Setting one of the bits of a PORT would set the corresponding PIN to high or 1. Basically if you set bit 6 (we are counting from 0), you will switch on LED 5.

On tixlegeek's blog, you should also have seen DDRB and DDRD. These sets the pins as inputs or outputs. Setting a bit to 1 set the corresponding pin as an output and 0 as an input.

LED stand for "Light Emiting Diode" for those who do not know. And Diodes are component that allow the current to flow in only one direction (not speaking about the Zener diode though).

And last thing but not the least, do not forget that we are coding on a micro-controller so we have a limited amount of space (either in RAM, ROM, etc), limited amount of processing power, well limited resources.
Taking that into account, you will see some "ugly hacks" to go around problems such as RAM exhaustion like you will see in my example program.

So what can you do with such a small micro-controller?

To be simple, a micro-controller is a chip with very limited resources or a component integrating multiple functionnalities in one chip: video, audio, CPU, image processing, etc.

A micro-controller can be used as a control device, smalls robotics or mapping LEDs to boards, etc.

In this case, the badge only have 7 LEDs for outputs and not inputs but the programming of the badge.
You are only limited by your creativity (and resources).

You could do those for example:
- small animations from right to left, left to right, etc
- counting
- sending data (you would need a receiver though)
- showing a dump from a network capture for example
- etc
Yeah pretty much anything you can represent with 7 LEDs, 7 bits, etc.
But to tell the truth, yeah you can't code much stuffs on it :p.

I decided to code a morse code emitter :).
But first, let's see the original code.

Original firmware

Here what the original firmware is:

//B1 B0 D6 D5 D4 D3 D2
/*
** Compiler Include Directives
*/
#define F_CPU 8000000
#include <avr/io.h>
#include <util/delay.h>

void copy2array(char value);
int main(void)
{
 char EasterMSG[]="Nothing there N00b!";
 char CHALL[]={0x62,0x4f,0x46,0x46,0x45,0xa,0x7d,0x45,0x58,0x46,0x4e,0xa,0x65,0x4c,0xa,0x64,0x6e,0x62,0x18,0x61,0x1b,0x1b, 0x00}, *challptr=CHALL, i=0;
 PORTB=EasterMSG[72];
 DDRD=0xff;
 DDRB=0xff;
 while(1==1)
 {
  i=0;
  while(*(CHALL+i))
  {
   copy2array(*(CHALL+i));
   _delay_ms(4000);
   i++;
  }

 }
}

void copy2array(char value)
{
 char byte=0;
  PORTB=0;
  PORTD=0;
  PORTB |= (((value^42)&_BV(0))?_BV(1):0);
  PORTB |= (((value^42)&_BV(1))?_BV(0):0);
  PORTD |= (((value^42)&_BV(2))?_BV(6):0);
  PORTD |= (((value^42)&_BV(3))?_BV(5):0);
  PORTD |= (((value^42)&_BV(4))?_BV(4):0);
  PORTD |= (((value^42)&_BV(5))?_BV(3):0);
  PORTD |= (((value^42)&_BV(6))?_BV(2):0);
}

For the most attentive people, you must have spotted the buggy code:
void copy2array(char value)
{
 char byte=0;
  PORTB=0;
  PORTD=0;
  PORTB |= (((value^42)&_BV(0))?_BV(1):0);
  PORTB |= (((value^42)&_BV(1))?_BV(0):0);
  PORTD |= (((value^42)&_BV(2))?_BV(6):0);
  PORTD |= (((value^42)&_BV(3))?_BV(5):0);
  PORTD |= (((value^42)&_BV(4))?_BV(4):0);
  PORTD |= (((value^42)&_BV(5))?_BV(3):0);
  PORTD |= (((value^42)&_BV(6))?_BV(2):0);
}

If you recall the full pinout:
-------------------------
|          PORTD        |
-------------------------
|   PIND0   |   RX      |
|   PIND1   |   TX      |
|   PIND2   |   D4      |
|   PIND3   |   D3      |
|   PIND4   |   D2      |
|   PIND5   |   D1      |
|   PIND6   |   D5      |
-------------------------
|          PORTB        |
-------------------------
|   PINB0   |   D6      |
|   PINB1   |   D7      |
|   PINB2   |   NC      |
|   PINB3   |   NC      |
|   PINB4   |   NC      |
|   PINB5   |   MOSI    |
|   PINB6   |   MISO    |
|   PINB7   |   SCK     |
-------------------------
|          PORTA        |
-------------------------
|   PINA0   |   NC      |
|   PINA1   |   NC      |
|   PINA2   |   RESET   |
-------------------------

Then after fixing the code you get this:
void copy2array(char value)
{
 char byte=0;
  PORTB=0;
  PORTD=0;
  PORTD |= (((value^42)&_BV(0))?_BV(5):0);
  PORTD |= (((value^42)&_BV(1))?_BV(4):0);
  PORTD |= (((value^42)&_BV(2))?_BV(3):0);
  PORTD |= (((value^42)&_BV(3))?_BV(2):0);
  PORTD |= (((value^42)&_BV(4))?_BV(6):0);
  PORTB |= (((value^42)&_BV(5))?_BV(0):0);
  PORTB |= (((value^42)&_BV(6))?_BV(1):0);
}

Ok now, let's go on with Morse code :).

Let's code: Morse code

Here is my "firmware" to do morse code:

// @author  : m_101
// @license : beerware
// @year    : 2011
// @program : Do morse code on leds of NDH 2011 badge

// standard libraries
#include <ctype.h>
#include <string.h>

// avr specific libraries
#define F_CPU 1000000
#include <avr/io.h>
#include <avr/pgmspace.h>
#include <util/delay.h>

// defines for turning on a single led at a time
#define D1_ON()     PORTD |= _BV(5)
#define D2_ON()     PORTD |= _BV(4)
#define D3_ON()     PORTD |= _BV(3)
#define D4_ON()     PORTD |= _BV(2)
#define D5_ON()     PORTD |= _BV(6)
#define D6_ON()     PORTB |= _BV(0)
#define D7_ON()     PORTB |= _BV(1)

// defines for turning off a single led at a time
#define D1_OFF()    PORTD &= ~_BV(5)
#define D2_OFF()    PORTD &= ~_BV(4)
#define D3_OFF()    PORTD &= ~_BV(3)
#define D4_OFF()    PORTD &= ~_BV(2)
#define D5_OFF()    PORTD &= ~_BV(6)
#define D6_OFF()    PORTB &= ~_BV(0)
#define D7_OFF()    PORTB &= ~_BV(1)

// morse code duration (international standard)
#define DOT_DURATION        200
#define DASH_DURATION       3*DOT_DURATION
#define INTERGAP_DURATION   DOT_DURATION
#define GAP_LETTERS         3*DOT_DURATION
#define GAP_WORDS           7*DOT_DURATION

void leds_morse(char value);

// turn off the leds
#define leds_off()      \
            PORTB = 0;  \
            PORTD = 0

// put morse table in program space (not enough RAM)
// international morse code
// letters
char morse_A[] PROGMEM = ".-";
char morse_B[] PROGMEM = "-...";
char morse_C[] PROGMEM = "-.-.";
char morse_D[] PROGMEM = "-..";
char morse_E[] PROGMEM = ".";
char morse_F[] PROGMEM = "..-.";
char morse_G[] PROGMEM = "--.";
char morse_H[] PROGMEM = "....";
char morse_I[] PROGMEM = "..";
char morse_J[] PROGMEM = ".---";
char morse_K[] PROGMEM = "-.-";
char morse_L[] PROGMEM = ".-..";
char morse_M[] PROGMEM = "--";
char morse_N[] PROGMEM = "-.";
char morse_O[] PROGMEM = "---";
char morse_P[] PROGMEM = ".--.";
char morse_Q[] PROGMEM = "--.-";
char morse_R[] PROGMEM = ".-.";
char morse_S[] PROGMEM = "...";
char morse_T[] PROGMEM = "-";
char morse_U[] PROGMEM = "..-";
char morse_V[] PROGMEM = "...-";
char morse_W[] PROGMEM = ".--";
char morse_X[] PROGMEM = "-..-";
char morse_Y[] PROGMEM = "-.--";
char morse_Z[] PROGMEM = "--..";
// digits
char morse_0[] PROGMEM = "-----";
char morse_1[] PROGMEM = ".----";
char morse_2[] PROGMEM = "..---";
char morse_3[] PROGMEM = "...--";
char morse_4[] PROGMEM = "....-";
char morse_5[] PROGMEM = ".....";
char morse_6[] PROGMEM = "-....";
char morse_7[] PROGMEM = "--...";
char morse_8[] PROGMEM = "---..";
char morse_9[] PROGMEM = "----.";
// conversion table
PGM_P code[] PROGMEM = {
    // A ... M
    morse_A, morse_B, morse_C, morse_D, morse_E, morse_F, morse_G, morse_H,
    morse_I, morse_J, morse_K, morse_L, morse_M, 
    // N ... Z
    morse_N, morse_O, morse_P, morse_Q, morse_R, morse_S, morse_T, morse_U,
    morse_V, morse_W, morse_X, morse_Y, morse_Z,
    // 0 .. 9
    morse_0, morse_1, morse_2, morse_3, morse_4, morse_5, morse_6, morse_7,
    morse_8, morse_9 
};

// get index in morse code table
int tomorse_idx (char value) {
    int idx = -1;

    if (isalpha(value))
        idx = (toupper(value) - 'A') % 26;
    else if (isdigit(value))
        idx = (value - '0') % 10 + 26;

    return idx;
}

int main (void) {
    // message to show and its index
    char idxMsg;
    char msg[] = "Hello World For NDH 2011";
    // morse code and its index
    char idxMorse;
    char morse[8] = {0};
    // index in morse conversion table
    char idxCode;    

    // init port B and D data direction as outputs
    DDRD = 0xff;
    DDRB = 0xff;

    // init PORTS
    PORTB = 0;
    PORTD = 0;

    // repeat message
    while(1) {
        idxMsg = 0;

        // print string while not ended
        while(*(msg+idxMsg)) {
            idxMorse = 0;

            // morse code index
            idxCode = tomorse_idx(*(msg+idxMsg));

            // ensure cleaning of the local buffer
            memset(morse, 0, sizeof(morse));

            // put code in RAM if got a correct idx
            if (idxCode >= 0 && idxCode < 36)                
                strcpy_P(morse, (PGM_P)pgm_read_word(&(code[idxCode])));

            // parse morse code
            while(*(morse+idxMorse)) {
                // led show morse code
                leds_morse(*(morse+idxMorse));

                // inter-gap between dots and dashes
                leds_off();
                _delay_ms(INTERGAP_DURATION);

                // next morse symbol
                idxMorse++;
            }

            // blank
            leds_off();
            // gap between letters
            if (isalnum(*(msg+idxMsg)))
                _delay_ms(GAP_LETTERS);
            // gap between words
            else
                _delay_ms(GAP_WORDS);

            idxMsg++;
        }
    }
}

// turn on leds for morse code
void leds_morse(char value) {
    // init PORTS
    PORTB = 0;
    PORTD = 0;

    // "long press"
    if (value == '-') {
        D1_ON();
        D2_ON();
        D3_ON();
        D4_ON();
        D5_ON();
        D6_ON();
        D7_ON();
        _delay_ms(DASH_DURATION);
    }
    // "short press"
    else if (value == '.') {
        D3_ON();
        D4_ON();
        D5_ON();
        _delay_ms(DOT_DURATION);
    }
}

The AVR chip is set to work at 1Mhz :).

I guess it is a bit more readable concerning switching ON or OFF a specific LED.

You must have seen the weird way of creating the string table and using it. We basically only have 128 bytes of RAM, the string tables would thus obviously not fit in it completely (with other local variables in a function). We thus force the compiler to put our string table in program space and copy the corresponding morse sequence to a local buffer before using it.

The code is well commented (too much commented? :)) so you would not have any problems reading it. If you were to spot any bugs, do not hesitate to send me a patch ;).

As an exercise to the reader, I let you modify the code so that it directly turns on the LED given a morse code sequence.

Here is a small utility to convert an ASCII string to morse code:

// @author  : m_101
// @license : beerware
// @year    : 2011
// @program : Convert ASCII string to Morse code sequence

#include <stdio.h>
#include <stdlib.h>

char* tomorse (char value) {
    char *code[] = {
        // A ... M
        ".-", "-...", "-.-.", "-..", ".", "..-.", "--.", "....", "..", ".---", "-.-", ".-..", "--",
        // N ... Z
        "-.", "---", ".--.", "--.-", ".-.", "...", "-", "..-", "...-", ".--", "-..-", "-.--", "--..",
        // 0 .. 9
        "-----", ".----", "..---", "...--", "....-", ".....", "-....", "--...", "---..", "----."
    };
    int idx;

    if (isalpha(value)) {
        idx = (toupper(value) - 'A') % 26;
        return code[idx];
    }
    else if (isdigit(value)) {
        idx = (value - '0') % 10 + 26;
        return code[idx];
    }

    return " ";
}

int main (int argc, char *argv[]) {
    if (argc < 2) {
        printf("Usage: %s str\n", argv[0]);
        return 0;
    }

    while (*argv[1]) {
        printf("%s ", tomorse(*argv[1]));
        argv[1]++;
    }
    putchar('\n');

    return 0;
}

Play with it,


$ avr-gcc -Os -g -Wall -I.  -mmcu=attiny2313 -c -o badge_morse.o badge_morse.c
badge_morse.c: In function 'main':
badge_morse.c:145: warning: array subscript has type 'char'
$ avr-gcc -g -mmcu=attiny2313 -o badge_morse.elf badge_morse.o
$ avr-objcopy -j .text -j .data -O ihex badge_morse.elf badge_morse.hex
$ sudo avrdude -c usbasp -p attiny2313 -U flash:w:badge_morse.hex -v

avrdude: Version 5.10, compiled on Jun 29 2010 at 21:09:48
         Copyright (c) 2000-2005 Brian Dean, http://www.bdmicro.com/
         Copyright (c) 2007-2009 Joerg Wunsch

         System wide configuration file is "/etc/avrdude.conf"
         User configuration file is "/home/kurapix/.avrduderc"
         User configuration file does not exist or is not a regular file, skipping

         Using Port                    : /dev/parport0
         Using Programmer              : usbasp
         AVR Part                      : ATtiny2313
         Chip Erase delay              : 9000 us
         PAGEL                         : PD4
         BS2                           : PD6
         RESET disposition             : possible i/o
         RETRY pulse                   : SCK
         serial program mode           : yes
         parallel program mode         : yes
         Timeout                       : 200
         StabDelay                     : 100
         CmdexeDelay                   : 25
         SyncLoops                     : 32
         ByteDelay                     : 0
         PollIndex                     : 3
         PollValue                     : 0x53
         Memory Detail                 :

                                  Block Poll               Page                       Polled
           Memory Type Mode Delay Size  Indx Paged  Size   Size #Pages MinW  MaxW   ReadBack
           ----------- ---- ----- ----- ---- ------ ------ ---- ------ ----- ----- ---------
           eeprom        65     6     4    0 no        128    4      0  4000  4500 0xff 0xff
           flash         65     6    32    0 yes      2048   32     64  4500  4500 0xff 0xff
           signature      0     0     0    0 no          3    0      0     0     0 0x00 0x00
           lock           0     0     0    0 no          1    0      0  9000  9000 0x00 0x00
           lfuse          0     0     0    0 no          1    0      0  9000  9000 0x00 0x00
           hfuse          0     0     0    0 no          1    0      0  9000  9000 0x00 0x00
           efuse          0     0     0    0 no          1    0      0  9000  9000 0x00 0x00
           calibration    0     0     0    0 no          2    0      0     0     0 0x00 0x00

         Programmer Type : usbasp
         Description     : USBasp, http://www.fischl.de/usbasp/

avrdude: auto set sck period (because given equals null)
avrdude: warning: cannot set sck period. please check for usbasp firmware update.
avrdude: AVR device initialized and ready to accept instructions

Reading | ################################################## | 100% 0.01s

avrdude: Device signature = 0x1e910a
avrdude: safemode: lfuse reads as 64
avrdude: safemode: hfuse reads as DF
avrdude: safemode: efuse reads as FF
avrdude: NOTE: FLASH memory has been specified, an erase cycle will be performed
         To disable this feature, specify the -D option.
avrdude: erasing chip
avrdude: auto set sck period (because given equals null)
avrdude: warning: cannot set sck period. please check for usbasp firmware update.
avrdude: reading input file "badge_morse.hex"
avrdude: input file badge_morse.hex auto detected as Intel Hex
avrdude: writing flash (898 bytes):

Writing | ################################################## | 100% 0.63s



avrdude: 898 bytes of flash written
avrdude: verifying flash memory against badge_morse.hex:
avrdude: load data flash data from input file badge_morse.hex:
avrdude: input file badge_morse.hex auto detected as Intel Hex
avrdude: input file badge_morse.hex contains 898 bytes
avrdude: reading on-chip flash data:

Reading | ################################################## | 100% 0.48s



avrdude: verifying ...
avrdude: 898 bytes of flash verified

avrdude: safemode: lfuse reads as 64
avrdude: safemode: hfuse reads as DF
avrdude: safemode: efuse reads as FF
avrdude: safemode: Fuses OK

avrdude done.  Thank you.

Conclusion

As you could see, with little imagination and work, you can achieve interesting and fun stuffs. We now know how to plug it, read it, write in/program it, hell yeah we mastered it ;).

Just a last message for those who got a NDH Badge 2011: Do you know that not all speakers/challengers/etc got to have one (I got really lucky, I almost did not get one)? By the way, a looot of people will not even play with it. Damn, if you take it, play with it! It is not just to look pretty (people put work into making them).

Hope you enjoyed it,

Have fun,

Cheers,

m_101

Resources: 
Morse code
[NDH2K11] Badges hackable!
NDH2K11's Badge: Spec. & hackz
NDH2K11's Badge: PROGRAMMATIONNNNNN!!!!
- Manual of avrdude

- AVR 8-bit Instruction Set
- AVR Programming
- AVR GCC Tutorial (1) – Basic I/O Operations
AVR : Tutorial 2 : AVR – Input / Output
- AVR GCC FAQ
Program Space

Aucun commentaire :

Publier un commentaire