❌

Reading view

There are new articles available, click to refresh the page.

Rusting an E-scooter (In a Good Way)

It is a classic Hackaday situation. You have an Egret GT E-scooter. It has a screen that shows the usual dash stats, but that led to an annoyance. You could accidentally enter firmware update mode and, from there, enter operational mode without the security PIN. [Ben] couldn’t let that stand, so he reverse-engineered the protocol and rewrote the firmware in Rust. As he put it, β€œβ€¦ because I have to break… everything I own…” We get it.

The mobile app was useful for some basic info, since sniffing Bluetooth is fairly easy and analyzing mobile code is, more or less, straightforward. Analysis revealed some data that doesn’t show on the display and that several things are sent back to home base tagged with the scooter’s unique ID β€” another reason to gut the existing firmware.

Internally, the scooter uses the CAN Bus, so out came the oscilloscope and a homebrew CAN decoder.Β  Surprisingly, the CAN bus is accessible on the USB-C port’s data pins. Officially, the port is only for charging phones, so you have to wonder what your phone makes of the alien signals on the data pins when it is charging.

Firmware updates actually come in at least three flavors: display, input panel, and main controller. Reverse engineering the firmware update process was crucial to installing the new firmware.

If you own a similar scooter, this post is a goldmine. If you don’t, it is still a very detailed breakdown of a reverse-engineering workflow, and you can apply many of the tools and techniques to your next project.

Of course, another option is to just keep the scooter and replace the brains. If you want to learn more about reverse engineering, there are literally dozens of Hackaday posts to help you get started.

Analyzing the FScale Instruction in Intel’s 8087 FPU

During his continuing analysis of the architecture and microcode of Intel’s highly influential 8087 floating point unit (FPU) co-processor, [Ken Shirriff] has now arrived at the point where he can put together how the 8087’s microcode implements various x87 instructions. One of these, the FSCALE instruction turned out to be far more complicated than assumed, with one might assume to be a straightforward powers-of-two scaling turning out to entail over 140 micro-instructions and three levels of sub-routine calls just to handle all cases.

The annotated die shot in the heading image shows the functional blocks that are used by this one x87 instruction, to give some kind of idea of what amount of hardware even β€˜just’ scaling a floating point number involves.

Much like with the x86’s CISC-style ISA, these 8087 instructions break down into individual steps that involve everything from loading values into registers, performing operations, checking for and handling error conditions as well as stack management. As can be seen in [Ken]’s breakdown of the FSCALE implementation in the 8087 it’s all very logical, taking a high-level instruction and doing all that’s needed for a robust implementation, without bothering the developer with the details.

Of note is that the 8087’s implementations led to the IEEE 754 floating point standard, providing what definitely at the time was one of the most mathematically accurate FPUs that somehow still was financially responsible enough to make it into a relatively affordable PC.

3 great new Netflix documentaries to watch this weekend (September 11 - 13)

Documentaries continue to thrive on Netflix this month, as evidenced by the solid stance of the true-crime three-parter Death of the Pastor's Wife that's been holding strong in the top spot on the streamer's Top 10, as of this writing. But the hits keep on coming, with two of this weekend's picks below also occupying space on that chart, proving that Netflix knows how to doc.

Artemis II commander and pilot become NASA's first astronaut emeriti

The commander and pilot of NASA's Artemis II mission have gained a new distinction five months after splashing down from the Moon: They're not fully retiring from the space agency.

Reid Wiseman and Victor Glover are the first astronauts to join NASA's emeritus program, enabling them to continue to support the work being done at Johnson Space Center in Houston. They will remain available to train and mentor the current workforce while still being able to pursue employment and opportunities outside of NASA.

"I have asked NASA ... to not use the term 'retire' as much, but technically emeritus is a retirement program," Glover told collectSPACE.com on Wednesday. "It's something we have typically done for scientists when they have groundbreaking research, and they want to go back to academia to teach or to research and publish."

Read full article

Comments

Β© NASA/Kim Shiflett

Reverse Engineering The Philips PM5139

The Philips PM5139 is not famous. It won no great victories on the battlefield, nor was instrumental in changing the political landscape. It was just a useful function generator that you might find on a workbench somewhere, doing its job quietly and relatively accurately. [doctormord] has been doing the work to reverse engineer this humble piece of hardware.

The PM5139 is poorly documented; the only existing service manual out there is for the PM5138A, a less-capable sister model. Hence, there was some value in reverse engineering the device to understand it better. Work started with two EPROM dumps capturing what Philips put in the box all the way back in the early 1990s. From there, the code was examined and tinkered with until [doctormord] felt confident to modify it and improve upon what was already there. This was achieved with the aid of an 8051 emulator that could run the code to make it obvious what was going on. The result was a custom β€œV2.0” firmware that adds six arbitrary waveforms to the function generator and the ability to play simple music, amongst other tweaks.

We love to see old hardware given new functionality, even decades down the line, and we love some good reverse engineering, too. Video after the break.

Decoding the NEC V20 Microcode ROM

The NEC V20 is an Intel 8088-compatible processor that features the same use of microcode, though with its own characteristics. This makes it important to use this same microcode if your goal is to create a cycle-accurate emulator of this processor, as [GloriousCow]’s goal is. Cue decoding the microcode ROM in a die shot of this CPU, in order to create a usable ROM image.

As with any fabricated ROM you can technically do it by hand, the ROM section in the die shot contained 29,928 bits which even at a pretty zippy pace would take up a considerable amount of time to parse. Here you can divide-and-conquer by handing parts of the ROM off to good friends, or you can use automation and some machine vision and theoretically get an answer as soon as you have finished writing and testing the tool.

Close-up of some of the microcode bits.
Close-up of some of the microcode bits.

Although [Travis Goodspeed]’s MaskRomTool exists exactly to automate bit detection, it was found that there wasn’t enough contrast in the die shot for it to work reliably. What it did provide were the locations of the bits and from it 42Γ—42 pixel PNG files of each bit.

Next a convolutional neural network (CNN) was trained to determine the difference between a 0 and 1 bit. This still took the manual classifying of 1,000 images, but seemed to work fairly well. Although some bits were marked as ambiguous, it was easy enough to use Mark 1 eyeballs to run a classification on these handful of images than to tweak the CNN model.

With this microcode in hand it was then possible to match it against the V20’s internal architecture to fully determine what each part does. Although not quite finished yet, there’s a GitHub repository containing the progress so far.

The V20’s microcode has been the focal point of much legal fighting back when NEC and Intel were still duking it out in how far one could make a CPU compatible with that of a competitor.

❌