Name that Ware December 2005

The Ware for December, 2005, is shown below. Click on the image for a much larger view.

A friend of mine gave this to me to try out, and I had to open it up to see what was inside. I was a bit surprised when I looked in there, I thought there would be a lot more, but I guess simplicity is elegance. The board was well-marked, so I had to pixelate portions of the silkscreen and chip markings to make this contest non-trivial. However, based on past performance, I’m guessing people will figure this one out in no time flat.

Again, sorry for this month’s ware coming so late! I’m posting at the last possible moment to still claim a ware for December, 2005. It’s been an exciting month though; a lot of very interesting projects I’m working on have passed pivotal stages and I’m looking forward to seeing what January will bring. I’ve also been observing the progress on the Xbox360 hacking, and I’m impressed. The hacking scene is more or less an organized anarchy that is frightfully productive. Now that I’ve had a little brush with being a manager in my day job, I can see that clarity of purpose obviates the need for management; people just self-organize and things happen. I could ponder on this for many parargaphs, but I’ll spare you my treatise on human social behavior.

At any rate, some very interesting things are afoot. Much of it stems from the discovery of an all-media bootable kiosk demo disk. Many hackers will instantly recognize the value of this, but it’s still interesting to reflect on the significance of this find.

Like the original Xbox, the Xbox360 uses a media flag on its executables. The media flag tells the OS what type of media it should be on; typically, games are released with the flag set to Microsoft’s proprietary secure Xbox DVD format (which is in itself not that secure…). Significantly, only the executable is signed for a game; the data sections typically are not signed (presumably for performance reasons). Thus, one has the ability to fuzz the executable by corrupting the data sections, potentially invoking a buffer overrun or some other unintentional behavior–if one could effectively modify the data sections. Remember that this is normally not possible, since modifying the data segment requires making a copy to a writeable media, and this contradicts the signed media flag.

Thus, the run-anywhere demo disk now enables software hackers to create and test the interaction of signed executables with modified game data using no tool other than a DVD-RW drive (and an Xbox360 console, still considerably rare and difficult to obtain in the US). Some of the more interesting modifiable data regions include Shockwave Flash movies, and the pixel shaders executed by the GPU (more info can be found on the xboxhacker.net website). Of particular interest is the MEMEXPORT shader command in the 360, which could enable people to dump physical memory to the screen (where it can be digitized or extracted with a sniffer upstream of the ANA chip), or to some other peripheral function. Presuming plaintext kernel code can be extracted this way, it bootstraps further efforts in vulnerability analysis of the code running in the Xbox…and so forth. Of course, its quite possible that this hole is plugged, since Microsoft’s NGSCB spec calls for the Northbridge to limit DMA access from the graphics card to main memory. Furthermore, buffer overrun exploits have questionable applicability since each process runs as its own virtual machine and rumors has it that the no-execute bit is used on heap space. Still, I’m very surprised that such a media was even released into the wild by Microsoft…their own worst enemy is their own haste to get to the market and carelessness; security is for naught without consideration of human factors. Very exciting! Perhaps the Xbox360 will be opened without the need for significant hardware hacking.

Oh, and happy new year to everyone! I’ll be at Spundae’s New Year event in LA with some friends. If you happen to be going, give me a shout if you see me. Should be great fun!

21 Responses to “Name that Ware December 2005”

  1. Roastbeef says:

    I’m going to say it’s a G-meter (accelerometer) for the car.

    1. Lack of batteries, implies vehicle use
    2. ADXL I believe is a MEMS sensor (I’m too lazy to look up the part number right now)
    3. On right is a slide switch (labeled with a Uxx part designator? cretins!) for power and a 2 digit (may 3 fake digits) LED display.

  2. Travis says:

    I think its also believe it is probably used to measure the acceleration of a vehicle, though I haven’t got a clue as to the model name/#.

    If the front display is an LED bar, then it could also be used as a persistence of vision (POV) display. In fact, if it is not actually used for this purpose, it would definitely make an interesting hardware hack.

    ~Travis

  3. Nate says:

    Ok, I checked your web page again to see what’s going on and saw another contest. Do some analysis, start writing my reply, and someone was up before me! Blarg.

    Anyway, here’s my analysis:
    10V in upper left w/ strain relief, automotive. No battery.
    No I/O, just LED display lower right and power switch upper right.

    First thought “radar detector”. But where’s the op-amps, antenna coil, etc.

    Ok, so now let’s check out the IC that is visible. It is an ADXL105JQC accelerometer, High Accuracy 1 g to 5 g, Single Axis.

    So next thought is “G sensor”, for checking cornering forces or acceleration (I think the latter). I also found “reaction timers” that calculate how fast you respond to the drag racing lights. There’s no push button or connector on the front to go to your transbrake so it can’t be that.

    I agree with the previous poster, it’s a G sensor and timer.

  4. Anunnaki says:

    We have

    – 5V Regulator
    – Accelerometer (+- 2mG)
    – PIC running @ 4Mhz
    – LED Bar

    Acellerometer has an output propotional to the tilt/vibration/acelleration, which might be going to the PIC (cant see the trace due to C7 blocking sight), the PIC drives a LED bar.

    Long talking’s short:

    a) Car Alarm.
    b) Seismometer

  5. Mouser says:

    Here’s some random comments about this board:

    The layout is sort of strange; several of the parts have positions for both thru-hole and SMT versions, suggesting that either the vendor was unsure about part availability (for a 7805??) or the designer hadn’t decided which would be most appropriate. The silkscreen labels (e.g. [thru-hole]BigResistor) on the board and some of the layout choices (e.g. very non-symmetric layout of C1 and C2 relative to the crystal) suggest to me that it was designed by a hobbiest or at least in an amateurish way. I’ll bet this is not the product of a large company; probably a cottage industry with very few offerings.

    The ADXL105 measures acceleration along the axis of the chip (parallel to the rows of pins) with the positive direction being acceleration in the direction of pin 7. The orientation of the accelerometer on the board indicates that it measures acceleration “front-to-back,” assuming the LED display and power switch are the “front” of the device. If this is a G-meter for a car, then it is used for vehicle acceleration and braking—not for cornering forces, so Nate’s intuition was probably good.

    I find the car alarm hypothesis to be unlikely, as it would only be responsive to vibration along the length of the car and would be much less sensitive to, say, someone smashing through the side window. Similarly, the seismometer idea seems unlikely if for no other reason than the board is not rigidely connected to the case. If we wanted to use the accelerometer to measure transient vibrations, then we would have to go out of our way to remove any mechanical sources of signal dampening. We would need the seismometer to be mechanically coupled to whatever we wanted measure the vibration of, and this case design doesn’t suggest that to me. I believe this device is for measuring continuous acceleration, and a car G-meter sounds about right.

    The two huge electrolytic capacitors at the bottom of frame are a bit odd; presumably they are used in conjunction with the free opamp on the ADXL105 to form a signal filter of some kind, but why use such enormous capacitors? My guess is this is just another example of amateur design. In fact I’d be willing to bet that the filter is one of the ones layed out in the ADXL105 datasheet. The 2-pole Bessel low-pass filter requires two similar-valued capacitors (but not identical like the high-pass filter), though they could probably be better served by ceramic SMT devices. Even better, though, is the datasheet’s active low-pass filter with offset and gain adjustment. This schematic calls for two identical capacitors *and* the potentiometer seen in the photograph.

    Anwyay, I agree with everyone else that this is a G-meter for a vehicle.
    The design is not very efficient or original, and shows signs of uncertainty on the part of the designer. I’ll bet that it was designed by some hobbyist and commercialized by a small company.

  6. t0ggle says:

    I think its a 0-60mph timer for a car. Outputting G-forces to most people doesn’t mean a whole lot. The 4.096Mhz crystal would sure make for a pretty accurate RTC. A good enough RTC and integrating the acceleration gets you what you need.

  7. Anunnaki says:

    True, but also you said it was designed in an amateur way *g*

    I didnt come up with a g-meter for a car because it didnt make sense to me to have a LED bar displaying the acelleration :-) But I am by all means no carfreak – maybe I should get a car once hehehe

    The boards felxibility as i call it – allowing different outlines of the components and also space for an integrated Transistor array chip rather than single T’s shows me insight… its common nowaday because that way you dont have to reproduce the board if components are changed – either due to availability, price or function :)

    bunniiiie .. ?^^

  8. JimmyJo says:

    Ok this is my first post, so excited!!!
    I am in first year engineering, just found this great site…
    anyways heres what i think.

    the LED bar thought is possible, but unlikely.
    1. why would anyone/company use a high accuracy detector with a bar display?
    2. what good will the bar tell?
    3. why is it so wide? normal(*the ones I’ve seen*) bar are as wide as the legs go

    so i am guessing that it’s somekind of duplex/mulitplex 7segment moldule

    So now lets say its a multi digit 7 segment display
    displaying acceleration only?
    i don’t think so! we got a PIC there!
    lets program some more functions.

    then you would say, howabout input?
    there is only a “slide switch” for power.
    it does look like a slide switch, but don’t you think it’s i little too big?
    the the two, smaller tracks at the lower left corner of the SW?
    Two thicker tracks for power, how about the small ones?
    components at the bottom?i doubt
    besides I have a slide sw on my flash voice recorder which is also a momentary sw,

    Oh, and if thats not enough, you also have a Gmeter/tilt detector,
    wouldn’t it be neat if you can shake it or somekind?
    just like those old tamagotchi thingys.

    so now let me guess the functions,
    Gmeter is basic, both +/-
    I would like to know how good my breaks works as well as my engine!
    then with some calculus
    and the Xtal time base, i suppose we can get some velocities, distances.
    1/4 mile time?
    0-60 time?
    deceleration? breaking distance?

    well, all these are based on my assumptions of the LED *Bar* and the *slide* SW, and all the great posts before me.
    i might be totally off, but if the unit is not built this way, it should be hacked/upgraded!
    New project Bunnie?

    Oh, and can anyone tell me how Gmeter works?

  9. James Walter says:

    I guess the same as everyone…but more specifically I think it is the G-Tech Pro (http://www.gtechprostore.com/cgi-bin/shopper.cgi?preadd=action&key=010100).

  10. mark says:

    G-Tech pro 1994

  11. mark says:

    G-Tech pro 1994 performance meter

  12. Troed says:

    Bunnie, I’m quite sure Microsoft didn’t restrict the kiosk demo on purpose. After all, they haven’t protected the harddrive. They’re relying fully on their signing process, buffer overflow protections etc.

    The “shader hole” was indeed the most interesting of them all, but it seems not possible to use with the King Kong demo – and any future demos that might’ve been exploitable instead will now probably include binary-only shaders with a hash check. Or not.

  13. Raisingod says:

    I know some one have already posted the answer ( I do think its G-Tech pro 1994) but here is how I got to the conclusion its an accleration meter or some thing of that sort:

    1. The voltege is n’t from a battery but from an outside power supply wich also seem to be the only connector .

    From this I reached the conclusion that the voltage comes from an outer source which is connected to the device ( means that what this device is planned for has its own voltage source)

    2.The crystal seem to be connected to the main chip ( the one that was blured by bunny) and since I presume that you don’t need 5 connection to give power to the crystal I guess they are connected to the input legs of the main chip. the other legs of the main chips are connected to the LCD plus another trace (to an input leg ) which ill explain later.

    3. The other input of the main chip come from the voltage plug (power supplay connectio) and before them there is a voltage stablizer which is connected to at least one of them.

    At that point I reached to the absolute concllusion that this is a mesurment device that has something to do with time VS input.

    4.The input Voltage isn’t that big and is a DC one ( there is not AC to DC converter here and the power source is connected directly to the capcitators so unless this device just charge capcitator in 1/50 of a second and then 1/50 seconds later discharge it its a DC connection).

    Now there are only limted amount of devices that produce power and the power is a DC one I can sum it up like this:
    1. Car
    2.Cellphone.
    3. Some Toys
    4. Portable devices.

    Since I don’t see the point in mesuring one of 2-4 spification I will go for car mesurment.

    5. There is no antena! as mentiond this eliminates the posablity for rader check etc.
    whats leaves us with:

    1. Accelartion check.
    2. Avg. speed check (assuming that you start from a full stop, its actually a result of the first use)
    3. Some engine proformence device ( you check the output voltage against the time see what lost etc.

    6. From some reason there is no input port visable other then the voltage input. guessing this is logical since a car has only one input inside the car I thought about some points:

    you can acctually check 1 and 2 with Voltage and what proformence devices are basicly devices that interpet car voltage and Amper changesto display something .

    With this conclusion I was aidded with the fact that one of the power input of the Crystal is a connected to a switch. The only thing of the above that need a switch is the profemence device since it is a sort of multichecker :)

    reached coclusion!!!

    OK so I know there are probebly other devices that work this way like voltage and amper checker but I eliminated those at first glance.

    And another thing considirate that I am an high school student I don’t really know that much electrical mesuring devices :)

  14. Push says:

    It’s a XBOX360 Mod-Chip! :o)

  15. visha says:

    i need info from u.. I need information about ADXL105 ic… Pls send it too me… Wer can i get it? very inportant

  16. bunnie says:

    The vendor’s website has datasheets and info–Analog devices:

    http://www.analog.com/en/prod/0%2C2877%2CADXL105%2C00.html.

    That’s probably the best publicly available information you can get.

  17. lmUdjTDxEo says:

    qFkGfMVCcAOyBSZRp

  18. Bun2k says:

    i have two different G-tech meters:
    one as in picture on top,(rev 03. 3-22-2001),have on board ADXL105JQC accelerometer,
    and one G-tech (rev 00 7 01 95) with other accelerometer,without identification number.
    G-tech rev 00 is more sensitivity,start measurements earlier,always shows more better time and more HP.
    I try to understand,what of them show more correct measurements
    pic:
    http://lh4.google.com/image/bun2kk/Ri6pVd7URzI/AAAAAAAAAAo/8pwfQkdECc0/IMGP7253.JPG

  19. Hannah says:

    Does someone know when Velvet Assasin for Xbox360 will be released?