It is a classic Hackaday situation. You have an Egret GT E-scooter. It has a screen that shows the usual dash stats, but that led to an annoyance. You could accidentally enter firmware update mode and, from there, enter operational mode without the security PIN. [Ben] couldn’t let that stand, so he reverse-engineered the protocol and rewrote the firmware in Rust. As he put it, “… because I have to break… everything I own…” We get it.
The mobile app was useful for some basic info, since sniffing Bluetooth is fairly easy and analyzing mobile code is, more or less, straightforward. Analysis revealed some data that doesn’t show on the display and that several things are sent back to home base tagged with the scooter’s unique ID — another reason to gut the existing firmware.
Internally, the scooter uses the CAN Bus, so out came the oscilloscope and a homebrew CAN decoder. Surprisingly, the CAN bus is accessible on the USB-C port’s data pins. Officially, the port is only for charging phones, so you have to wonder what your phone makes of the alien signals on the data pins when it is charging.
Firmware updates actually come in at least three flavors: display, input panel, and main controller. Reverse engineering the firmware update process was crucial to installing the new firmware.
If you own a similar scooter, this post is a goldmine. If you don’t, it is still a very detailed breakdown of a reverse-engineering workflow, and you can apply many of the tools and techniques to your next project.
Of course, another option is to just keep the scooter and replace the brains. If you want to learn more about reverse engineering, there are literally dozens of Hackaday posts to help you get started.
During his continuing analysis of the architecture and microcode of Intel’s highly influential 8087 floating point unit (FPU) co-processor, [Ken Shirriff] has now arrived at the point where he can put together how the 8087’s microcode implements various x87 instructions. One of these, the FSCALE instruction turned out to be far more complicated than assumed, with one might assume to be a straightforward powers-of-two scaling turning out to entail over 140 micro-instructions and three levels of sub-routine calls just to handle all cases.
The annotated die shot in the heading image shows the functional blocks that are used by this one x87 instruction, to give some kind of idea of what amount of hardware even ‘just’ scaling a floating point number involves.
Much like with the x86’s CISC-style ISA, these 8087 instructions break down into individual steps that involve everything from loading values into registers, performing operations, checking for and handling error conditions as well as stack management. As can be seen in [Ken]’s breakdown of the FSCALE implementation in the 8087 it’s all very logical, taking a high-level instruction and doing all that’s needed for a robust implementation, without bothering the developer with the details.
Of note is that the 8087’s implementations led to the IEEE 754 floating point standard, providing what definitely at the time was one of the most mathematically accurate FPUs that somehow still was financially responsible enough to make it into a relatively affordable PC.
The U.S. Federal Bureau of Investigation (FBI) has issued an advisory warning of a wave of OAuth consent phishing attacks targeting “prominent victims, their family members, and personal acquaintances.”
OAuth phishing is an increasingly popular social engineering tactic that tricks users into granting access to their accounts without handing over their passwords.
A recent survey from Experian found that 60% of companies report fraud losses that are “somewhat or significantly higher” than in previous years, with a majority of respondents citing AI-generated phishing attacks as their top AI-related fraud concern.
Researchers at INKY observed a major phishing campaign that used SVG (Scalable Vector Graphics) image files to deliver malicious JavaScript. While abuse of SVG files isn’t new, INKY says their use in phishing campaigns has exploded over the past year.
The Philips PM5139 is not famous. It won no great victories on the battlefield, nor was instrumental in changing the political landscape. It was just a useful function generator that you might find on a workbench somewhere, doing its job quietly and relatively accurately. [doctormord] has been doing the work to reverse engineer this humble piece of hardware.
The PM5139 is poorly documented; the only existing service manual out there is for the PM5138A, a less-capable sister model. Hence, there was some value in reverse engineering the device to understand it better. Work started with two EPROM dumps capturing what Philips put in the box all the way back in the early 1990s. From there, the code was examined and tinkered with until [doctormord] felt confident to modify it and improve upon what was already there. This was achieved with the aid of an 8051 emulator that could run the code to make it obvious what was going on. The result was a custom “V2.0” firmware that adds six arbitrary waveforms to the function generator and the ability to play simple music, amongst other tweaks.
The NEC V20 is an Intel 8088-compatible processor that features the same use of microcode, though with its own characteristics. This makes it important to use this same microcode if your goal is to create a cycle-accurate emulator of this processor, as [GloriousCow]’s goal is. Cue decoding the microcode ROM in a die shot of this CPU, in order to create a usable ROM image.
As with any fabricated ROM you can technically do it by hand, the ROM section in the die shot contained 29,928 bits which even at a pretty zippy pace would take up a considerable amount of time to parse. Here you can divide-and-conquer by handing parts of the ROM off to good friends, or you can use automation and some machine vision and theoretically get an answer as soon as you have finished writing and testing the tool.
Close-up of some of the microcode bits.
Although [Travis Goodspeed]’s MaskRomTool exists exactly to automate bit detection, it was found that there wasn’t enough contrast in the die shot for it to work reliably. What it did provide were the locations of the bits and from it 42×42 pixel PNG files of each bit.
Next a convolutional neural network (CNN) was trained to determine the difference between a 0 and 1 bit. This still took the manual classifying of 1,000 images, but seemed to work fairly well. Although some bits were marked as ambiguous, it was easy enough to use Mark 1 eyeballs to run a classification on these handful of images than to tweak the CNN model.
With this microcode in hand it was then possible to match it against the V20’s internal architecture to fully determine what each part does. Although not quite finished yet, there’s a GitHub repository containing the progress so far.
The V20’s microcode has been the focal point of much legal fighting back when NEC and Intel were still duking it out in how far one could make a CPU compatible with that of a competitor.
University of Washington College of Engineering Vice Dean Jihui Yang, right, and professor Xu Chen walk a robot dog on the UW campus. (Photo courtesy of Xu Chen)
Robotics jobs in the Pacific Northwest are multiplying faster than universities can train people to fill them. The University of Washington thinks it has an answer — or at least a start.
The university capped enrollment at 35 students for the inaugural cohort. More than 30 people had already signed up for an information session before applications even opened. It’s an early signal, engineering leaders say, of pent-up demand from regional powerhouses racing to hire engineers who can operate at the intersection of AI, software and hardware.
Program leaders say that skill set is rooted in a traditional, narrowly focused engineering degree that hasn’t kept pace with the rapid evolution of technology. UW is betting that the fix lies at the intersection of AI and hardware, echoing an industry buzzword called “physical AI.”
“Robotics is no longer confined to a single discipline,” said Xu Chen, a UW engineering professor and director of the Boeing Advanced Research Collaboration, who played a large role in the committee that designed the new programs. “The future will need a wide variety of robotics knowledge, and that’s what we built these programs to deliver.”
Applications opened Sept. 1 and will close Sept. 10, with UW aiming for a roughly one-week turnaround before notifying applicants. For its inaugural year, the university is intentionally keeping things small: 25 seats in the master’s program and 10 in the certificate track, which is designed for working professionals who want robotics training without leaving their jobs.
Chen said the small first cohort is by design, not a limitation. The goal, he emphasized, is to get the fundamentals right before scaling up. He expects the programs to roughly triple in size within three to five years.
“Companies are seeing newer potential in robotics as advanced computing and the wave of AI technology mature,” Chen said. “They see that their workforce will benefit from a modern robotics program, and that need is really what drove this.”
Getting there will take machines, and lots of them. UW is purchasing robots and computing hardware for its initial course offerings while also leaning on industry donations: robots, GPUs, and computing infrastructure among them, according to Chen.
Amazon and Microsoft anchored the effort early; the list of partners has since grown to include NVIDIA, Boeing, Dassault Systèmes — the French software company behind design tools like SolidWorks — and at least one smaller robotics manufacturer.
“The industry board was incredibly supportive from the start,” Chen said. “We’ve had almost a year of continuous meetings and collaboration with them and with representatives across our own engineering departments.”
The broader structure of the program is meant to make it easier for students from different corners of engineering, such as electrical, mechanical and computer science, to land in the same classroom and eventually choose their own path deeper into robotics through electives.
The program is also drawing on UW’s existing research muscle in the region. It taps directly into the Boeing Advanced Research Collaboration, which Chen directs, along with robotics labs inside the Paul G. Allen School of Computer Science & Engineering. That gives students a line into the same research infrastructure that already feeds Seattle’s aerospace and e-commerce giants.
The university’s ambitions extend well past this fall’s launch. Chen said UW has already mapped out longer-term plans for an undergraduate robotics degree and, eventually, a Ph.D. program, with the two new offerings serving as the foundation.
For now, the clearest sign of the program’s ambitions arrived this summer in an unlikely form: a pack of robot dogs let loose on UW’s campus.
“Seattle’s hills make it a uniquely difficult place for robots to move around, which is exactly why it’s a great place to study it,” Chen said.
Both students and faculty got a chance to operate the robots directly, Chen said. It was a hands-on moment that underscored how much more accessible robotics technology has become in just the last few years.
“It was exciting to see the students so happy to see the robots,” Chen said. “That’s the kind of energy we want to build this program around.”
University of Washington computer science professor Stuart Reges. (Twinkle Don’t Blink Photo via Fire.org)
The University of Washington has agreed to pay $600,000 to resolve a high-profile First Amendment lawsuit brought by computer science professor Stuart Reges, who was disciplined after including a parody land acknowledgment in a course syllabus.
The settlement, announced Thursday by the Foundation for Individual Rights and Expression (FIRE), follows a December ruling by the U.S. Court of Appeals for the Ninth Circuit that found university officials violated Reges’ academic freedom rights by retaliating against his speech and engaging in viewpoint discrimination.
“I am deeply grateful to FIRE for this legal victory which will remind public universities that they are obligated to respect the First Amendment rights of their students, faculty, and staff,” Reges said in a statement Thursday. He added that he hopes his protest helps reverse “a decade-long trend towards ideological conformity in academia.”
Under the agreement, UW agreed to pay $600,000 to FIRE to cover damages, legal fees, and costs. The settlement prohibits the university from taking further adverse action against Reges or removing the parody statement from his syllabi in perpetuity. While the appeal was pending, UW also rescinded and replaced Executive Order 31, the anti-harassment policy used during the investigation.
The dispute began in January 2022 after the Paul G. Allen School of Computer Science & Engineering recommended that faculty include a statement acknowledging Coast Salish Indigenous lands in their syllabi.
Reges, a teaching professor who has been at the school since 2004, opposed the policy. Instead, he included a parody invoking philosopher John Locke’s labor theory of property to claim Indigenous groups held “almost none” of the land occupied by the university.
UW officials responded by censoring the parody from Reges’ course syllabus, opening a yearlong disciplinary investigation under an anti-harassment policy, and creating a competing “shadow” section of his course so students could opt out of taking his class.
Although the university ultimately declined to formally discipline Reges, officials warned him that repeating the statement could trigger further punishment. Reges sued the UW in 2022, and while a U.S. District Court initially sided with the university, a three-judge panel for the Ninth Circuit reversed that decision, ruling that student discomfort cannot justify retaliating against a professor’s speech on matters of public concern.
Reges’ lawsuit named top university leadership as defendants, including then-UW President Ana Mari Cauce, Allen School Director Magdalena Balazinska, Vice Director Dan Grossman, and College of Engineering Dean Nancy Allbritton. Current UW President Robert J. Jones is named in the final agreement.
The Ninth Circuit panel’s decision established that university teaching materials like course syllabi are protected academic speech, setting a binding First Amendment precedent across public higher education institutions in the Western U.S.
The University of Washington provided the following statement to GeekWire:
“The University of Washington maintains that we acted appropriately, and this settlement is in no way an admission of any wrongdoing. Given the Ninth Circuit’s 2-1 decision overturning the federal district court’s decision in favor of the University, a settlement agreement was the most reasonable option due to the attorney fees and costs that would have resulted from the Ninth’s Circuit’s decision. Prof. Reges has retained his faculty position and continued teaching throughout this process, and his status with the UW remains unchanged.”
Reges remains an active faculty member. Under the terms of the deal, he is free to include the Locke property statement on future course materials without administrative interference.
Researchers at Zimperium are tracking widespread phishing campaigns that use Browser-in-the-Browser (BitB) attacks to trick users into handing over their enterprise credentials. The attackers impersonate real HR employees at major companies and target job seekers with extremely realistic interview processes.
If you tear into old TVs or recording equipment, you may see shields made from some exotic-looking metal. Old timers will tell you it’s called mu metal, and its purpose is to — sort of — shield things from magnetic fields. The qualification is important. Unlike a conductive RF shield, mu metal doesn’t really stop a magnetic field. Instead, it gives magnetic flux an easier path to follow around whatever you’re trying to protect.
What’s In The Metal?
Mu metal belongs to a family of soft magnetic nickel-iron alloys. A typical modern formulation is about 80% nickel and 15% iron, with molybdenum and a few other elements making up most of the remainder. What makes it useful is its extremely high magnetic permeability. Commercial material can have relative permeability around 100,000 or more, and some specialty alloys can reach even higher.
You can think about reluctance as the magnetic equivalent of resistance. Put a high-permeability shell around something sensitive, and magnetic flux would much rather travel through the shell than through the space inside it, just like current tends to take the path of least resistance.
This works particularly well for DC and low-frequency fields, exactly where your usual copper or aluminum EMI shield isn’t much help.
You May Have Seen It Before
A multilayer magnetic shield box. (Photo by [Zureks] CC-BY-SA-3.0)Classic applications included shielding CRTs, tape heads, transformers, photomultipliers, and sensitive analog instruments. Put a transformer too close to the wrong part of an old television or audio amplifier and 60 Hz magnetic fields could cause very visible — or audible — trouble. The disappearance of CRTs and magnetic tape might make mu metal sound like another material destined for the antique electronics cabinet.
However, mu metal is still around. Modern applications include magnetometers, precision current sensors, electron microscopes, scientific instruments, and experiments that require extremely low magnetic fields. Commercial multi-layer mu-metal chambers are still sold for creating near-zero-field environments; with suitable construction and degaussing, some claim attenuation of static and low-frequency fields by factors approaching a million.
Quantum and cryogenic instrumentation have also created some 21st-century magnetic shielding problems. Ordinary mu metal loses performance at very low temperatures, so related nickel-iron alloys are made specifically for operation at liquid-nitrogen and liquid-helium temperatures.
Don’t Bend It
There are a couple of catches. First, mu metal gets much of its impressive permeability from its metallurgical structure. Machining, stamping, welding, or even bending it can introduce stresses and seriously degrade its magnetic properties. High-performance shields are therefore commonly formed first and then hydrogen annealed to restore their permeability.
So buying a sheet of wonderfully permeable material and folding it into a box isn’t necessarily the recipe for a wonderfully permeable box.
The second surprise is saturation. Mu metal is superb with weak fields but isn’t necessarily what you want closest to a powerful magnet. Its saturation induction is only around 0.75 tesla. In strong fields, manufacturers recommend combining it with a lower-permeability material having higher saturation capability, letting that outer layer tame the field before the mu metal handles what’s left.
History
British scientists Willoughby S. Smith and Henry J. Garnett patented mu metal in 1923 for inductive loading of submarine telegraph cables for a British company that built the Atlantic undersea telegraph cables. The seawater surrounding these cables added capacitance, requiring inductance to compensate. This was first done by wrapping the conductors with a helical wrapping of metal tape or wire of high magnetic permeability, which confined the magnetic field.
Mu-metal was invented to directly compete with permalloy, the first high-permeability alloy used for cable compensation, but it belonged to competitor Western Electric. Mu-metal was developed by adding copper to permalloy to improve ductility. Each 1.6 km of cable needed about 80 km fine mu-metal wire so there was a great demand for the alloy.
Other Tricks
Mu metal isn’t the only way to fight magnetic interference, as you can see in [FesZ’s] video below. Ordinary steel and other high-saturation magnetic alloys can redirect stronger fields. At higher frequencies, conductive copper or aluminum shields become effective through induced eddy currents. Ferrite is good at high frequencies, too, but is not very ductile nor is it very conductive. When you really need a quiet magnetic environment, active compensation coils can measure the ambient field and generate an opposing one.
But if the problem is a weak DC or low-frequency magnetic field, the basic trick hasn’t changed much. You just give the magnetic flux an easier path. Sometimes the old material in that 50-year-old television can be at home in a quantum computer, too.
NFL technology executives share how AI-driven social engineering makes attacks faster and more convincing, offering practical strategies for IT leaders to build non-punitive, multi-channel defenses.
NFL technology executives share how AI-driven social engineering makes attacks faster and more convincing, offering practical strategies for IT leaders to build non-punitive, multi-channel defenses.
Attackers are using “wrong-number” texts to identify potential targets for scams, according to researchers at Malwarebytes.
These texts appear to be harmless messages meant for another person, such as “Are we still on for dinner tomorrow?” or “Where’s the PowerPoint?” Recipients often try to be helpful by replying to let the person know they’ve got the wrong number. This reply, however, informs the threat actor that the phone number is active and marks it for future scams.
Login
