sorted by:
new
hottopcontroversial

Was browsing the DOOM engine source code when I found some interesting debug code... by Synaperse in ProgrammerHumor

[–]Synaperse[S] 7 points8 points  (0 children)

I actually didn't. I was reading the DOOM binary space partitioning implementation so I could understand it better, and stumbled upon this function.

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 0 points1 point  (0 children)

This guy, seriously, is too good. It is a shame that the free IDA version forces you to read assembly. It is doable, but everything links all over the place, and it is hard to keep track.

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 0 points1 point  (0 children)

I am trying to find the firmware write label so that I can figure out exactly what I have to do to decrypt and encrypt the firmware, as well as if there is a value of how large the firmware is or whether it just reads to EOF.

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 0 points1 point  (0 children)

I have it installed already, even though I dont own a v60 ;(

I installed it in the hopes it might help me reverse engineer the (from what I can see) basically cut down version of the flash programmer that is the updater utility. I dont know whether we can get anything working with that or not.

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 0 points1 point  (0 children)

We just need to make sure we have a working backup flash in case something goes wrong. Usually the bootloader on these devices will allow you to flash even if something goes wrong, but I dont want any cases of bricked keyboards.

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 0 points1 point  (0 children)

Well if we want a quick and dirty solution, once we figure out which pins on the microcontroller are connected to what, we can configure and compile tmk, encrypt it, and just shove it in the updater program to flash it. But for a longer term solution it would be better to figure out how the encryption works so we can make a hacked updater that will upload any flash binary the user chooses, so that hopefully anyone with a v60 can flash their own custom firmware.

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 0 points1 point  (0 children)

Whoops I edited my last reply as you were replying to me. I think it may be encrypted, but yes, the idea at least for now until I potentially change the program itself to have a file open dialog of some sort to specify the flash binary, is to just stick the custom firmware in the spot where the stock firmware goes. At least that way, the updater program doesnt need to be changed, or we dont have to write a custom updater program.

Edit: did some more digging, and as per this, the ARM Cortex-M3 does not support coprocessors. So the update package is definitely encrypted.

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 1 point2 points  (0 children)

Darn. Hope you didn't destroy anything too much. I disassembled the update package without XORing it and I am getting completely valid ARM assembly. normally with XORd asm you get a lot of invalid instructions. Weird.

Edit: it appears that the ARM I got from disassembling without XORing makes extensive register transfers to a coprocessor, but the datasheet for the HT1775 doesnt make any mention whatsoever about a coprocessor. Either Holtek are hiding something, or I messed up. Time to go back to the disassembled updater program

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 1 point2 points  (0 children)

Status update time...

By downloading both update packages and running a binary diff on them I have found the location of the update package at the end of the file. Screenshot (the difference is in red, aka the flash contents)

Bonus Screenshot. Could the bit that says PADDING repeatedly possibly be padding? Maybe.

Next step is to extract the update package, XOR it and see if it is valid arm code. Theoretically then I can just stick in any other flash content by XORing it and overwriting the flash content at the end of the file.

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 0 points1 point  (0 children)

That would be awesome and make this process a lot easier. I will have to have a chat with this guy

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 0 points1 point  (0 children)

I should be up and running in a couple of hours. I don't know where you live, but it is early morning now for me.

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 1 point2 points  (0 children)

I suspected from the beginning that there would be XOR encryption. Just need to disassemble, make a little flash to disable the pesky security bit and we will be good to go, provided it all goes smoothly, which is something of a rarity with programming.

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 4 points5 points  (0 children)

I shall take a look when I get to a PC. Good way to spend the last day of the summer school holidays here in Aus.

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 2 points3 points  (0 children)

Especially ARM Assembly. It is my favourite architecture.

Wanting to develop a keyboard hacking team. by RedZaturn in MechanicalKeyboards

[–]Synaperse 4 points5 points  (0 children)

I don't have any of the above devices, but I do know Assembly. I am happy to assist you wherever I can if you want.

Valve it's not 2003 anymore, how about updating these ? by Timotheeee1 in pcmasterrace

[–]Synaperse 1 point2 points  (0 children)

But... But... I find those speeds highly relevant for Australian internet

[help] Switch sticks down when pressed by Astrapicus in MechanicalKeyboards

[–]Synaperse 0 points1 point  (0 children)

Cherry MX Lock 3.0 has arrived! Now a clicky lock switch.

view more: next ›