Posts

Honeywell X2S Smart Thermostat Firmware Reverse-Engineering

Image
The Honeywell X2S Smart Thermostat is a Wi-Fi-enabled thermostat that is meant to integrate with your typical ‘smart home’ setup, with mobile app control available as well. Of course, just using it as-is would be extremely boring, so fortunately we have [author0] to take it apart and reverse-engineer its encrypted firmware . Of the two brains in this thermostat the first is a succinctly named Renesas R7FA6M4AF3CFP MCU containing a 200 MHz Cortex-M33 core with TrustZone features to theoretically keep out any firmware hackers. Handling the wireless side is a Realtek RTL8721DM Wi-Fi/BLE 5.0 SoC. There are also two Winbond Flash chips connected to these two main chips, with their contents of course encrypted. Fortunately there are plenty of test points to connect to, for which a custom pogo-pin equipped breakout board was created. Cracking the encryption for the Realtek turned out to be as simple as using its RSIP decrypt-on-the-fly feature. From there exploring the firmware...

Tiny C64 PSU Rejects Tradition, Embraces USB

Image
The Commodore 64 has, by modern standards, the interesting power requirement of needing both 5 VDC and 9 VAC. Traditionally, one would use an iron-core transformer to step-down the wall current — be it 220 V or 115 V, 50 Hz or 60 Hz — to produce the low-voltage AC. That’s how Commodore did it, and that’s how most of the aftermarket replacements do it, too. That iron-core transformer is bulky, though, and [Side Projects Lab] decided that in this day and age of switching supplies and USB-PD he could surely do better. Which he did, with the diminutive PD-64 . As you can see, it just covers the power port of the C64, and not much else. Partly that small size comes from offloading some of the hard work onto a USB-PD wall wart. The PD-64 requests 12 VDC, which it then steps down to 5 VDC with the usual buck converter, and inverts to 9 VAC in a circuit that is the most interesting part of the project. There are various ways one could do this, after all, and we’...

Peek Into IBM’s System/360 With Vintage Training Film

Image
Computing goes hand-in-hand with how to structure and access data, and this internal training film from IBM regarding file organization and data processing with System/360 is from a time when such decisions were crucial to system architecture. Some trends never change, like storage costs over time. The presenter talks about the transition from magnetic tape-based storage (in which data is stored and must be read sequentially) to DASD (direct access storage devices) which have more in common with modern mass storage media. The ability to access and process data at will instead of sequentially represented a tremendous opportunity to change how organizations handled data. System/360 redefined mainframe computing, introducing not just the concept of compatibility and interoperability of programs and data between systems, but also popularized the 8-bit byte. It’s not a particularly long presentation and it doesn’t go into deep technical detail — it was primarily aimed a...

Through-Glass Vias and the Long Road to Glass Substrates

Image
Credit: Keith Best, Semiengineering . Glass-based substrates are slowly beginning to push out organic substrates commonly used in PCBs due to often superior material properties. One area where glass substrates have however struggled is with through-hole vias and providing the conductive copper path through them. A 2024 article by [Keith Best] gives a good overview of the topic, with recent news showing how much companies like Intel are pushing for glass substrates, specifically for the packaging of dies. One major advantage with vias in glass substrates is that they can be much smaller, enabling smaller than 0.1 mm diameter holes with far finer pitch. The challenge here is to make perfect holes with a laser that are defect-free, as well as have the intended diameter. After that this through-glass via (TGV) has to be coated or filled with copper, much like their organic equivalent. Said TGV can be fully filled with copper, or use plating and add dielectric filler. Detecting flaws i...

z386: An Open-Source 80386 Built Around Original Microcode

Image
There are many ways you can implement an Intel i386 CPU on an FPGA, with the use of original microcode probably being one of the most interesting approaches. This is what [nand2mario]’s z386 project does, with a recent blog post summarizing development on this FPGA project so far. This project is similar to the previously developed z8086 project , which as one may guess does something similar, except for the Intel 8086 CPU. By executing the original microcode you’re basically guaranteeing close compatibility with the original hardware, though of course the sheer scale of this microcode between an 8086 and 80386 is quite different. There’s a much larger instruction set with a correspondingly much more complicated internal state to keep track of, including all those newfangled features like memory management, paging and register debugging, as well extensions to protected mode that began with the i286. Currently z386 runs on a number of FPGAs, including the Altera Cyc...

Lost Version of Amiga Unix Suddenly Reappears

Image
Some of you may know there’s a version of UNIX for the Commodore Amiga, aptly called Amiga Unix or AMIX. There is an almost complete record of versions from 1.0 to 2.03, but 2.02 was lost media–until [Forgotten Computer] found it on an old Amiga . It starts with an auction held for the 40 year anniversary of the Free Software Foundation where, by just one second, the highest bidder was too late. What do you do first with an artifact as valuable as an old FSF computer? You image the hard drive. Then you make several copies, including on different computers–after all, you wouldn’t want to lose the data on it. Preservation secured, the natural next thing is to boot it–and that’s when we see the magic 2.02c version number. According to thorough digging by [Forgotten Computer], this version was–until now–lost. In the video after the break, [Forgotten Computer] goes over what Amiga Unix is, the discovery process, and explores what’s on ...

Hacking a Video Walkie Talkie’s TXW818 MCU and Running DOOM

Image
Recently cheapo video walkie-talkies popped up on everyone’s favorite online retailers, which naturally lured in the usual gaggle of reverse-engineering enthusiasts of cheap tat to see what’s inside these devices, as well as what more they can be made to do. Cue [Aaron Christophel] doing just that , with the typical  DOOM demo as proof of concept. Inside these cheerful little devices is a TXW818 MCU, made by TaiXin Semiconductor. It provides its own CK803 CPU core at 240 MHz with 272 kB of SRAM, as well as BLE and 2.4 GHz Wi-Fi support. For these walkie-talkies an additional 4 MB of PSRAM is provided as well as 2-4 MB of SPI Flash. The display is a glorious 240×320 LCD, which actually fits rather well with a game like  DOOM . As also explained on the GitHub project page , to build the project you simply have to fetch the CDK IDE and build the binary. After that it can be flashed with an STM32F103 ‘Blue Pill’ based board. According to [Aaron] the SDK is ...