BSODomizer: Mischievous hardware for mischievous people

Transcription

1 BSODomizer: Mischievous hardware for mischievous people BY: JOE GRAND AND ZOZ

2 () Hardware () Firmware () Results *** COMPLETELY OPEN SOURCE *** ALL DESIGN DOCUMENTATION HERE: or

3 Early Design Notes

4 Early Design Notes

5 The Propeller *** COMPLETELY CUSTOM, GROUND UP DESIGN BY CHIP GRACEY/PARALLAX *** ALL ON-CHIP STRUCTURES BUILT FROM SCRATCH *** EIGHT YEARS OF DEVELOPMENT/TESTING, RELEASED IN 00 *** CAN BE PROGRAMMED IN SPIN, ASSEMBLY, OR C *** EIGHT INDEPENDENT COGS (0 MIPS EACH) *** INFORMATION: *** DISCUSSION FORUMS: *** OBJECT EXCHANGE: *** DIP-0, QFP-, QFN-

6 The Propeller

7 The Propeller *** POWER REQUIREMENT =.V DC *** EXTERNAL CLOCK SPEED = DC to 80 MHz *** INTERNAL RC OSCILLATOR = MHz or 0 KHz *** GLOBAL/HUB MEMORY = KB ROM, KB RAM *** COG MEMORY = KB RAM *** I/O PINS = (0mA SINK/SOURCE PER PIN) *** PROGRAM CODE LOADED FROM EXTERNAL EEPROM ON POWER- UP

8 Schematic D D C C B B A A NOTE: RESISTORS ARE IN OHMS +/- a AND CAPACITORS ARE IN MICROFARADS, X7R UNLESS OTHERWISE NOTED. SEE BOM FOR ACTUAL VOLTAGE AND SPECIFICATION. 0.uF C.V SW EVP-AA00K BT BH800S SIZE DaTE REV SHT OF TITLE DRaWN BY 9/8/008 B. Joe Grand DEFCON : BSODomizer FILENaME V uf C 0.uF C VBATT 0.uF C7.V x CR0 Lithium Coin Cells av nominal) 8 7 SW 8-LPST E0 E E GND SDA SCL WC 7 VCC 8 U ATCB Y MHz.V VSS 9 VDD 8 VSS 7 P 8 P0 7 P9 P8 P P7 VDD 8 VSS 7 VSS VDD 0 VDD 0 XI 8 XO 9 RES 7 BOE P P P7 P P P P P P P0 P P P P P0 P P9 0 P8 9 P P P P0 P8 P9 P7 0 P 9 U PROPELLER J AMP7977- VGA Male to Target Computer J AMP7- VGA Female to Target Monitor.V P DNP Prop Clip I/F /RES TX RX SDA SCL C R 0k.V Configuration Switches Mode Test Button VGA_SEL EN 9 SEL V+ QP R G B R G B 7 R0 G0 B0 GND 0 EP H0 V0 DDCA0 7 DDCB0 8 VCL 0 V+ V+ 0 GND 9 GND DDCB DDCA V 9 H 8 DDCB 7 DDCA 8 V H M U MAX88 VIN VO EN NC GND U MIC-.0YC VIN VO EN NC GND U MIC-.YC uf C.V 0.uF C8 V 0.uF C9 V 0.uF C0 V V.V VCC OUT GND U GPUS0XP 7 R Infrared Receiver 7uF, V C 0.uF C.V IR_IN 70 R 70 R 70 R8 0 R0 0 R 0 R9 0 R 0 R7 R G B H V V, 7 ohm, -bit DACs VIDEO_ACT Video Out Video In P0BT0 P0BT0 P0C0 P0C0 P0C0 P0C0 P0C0 P0C0 P0C0 P0C0 P0C0 P0C0 P0C0 P0C0 P0C70 P0C70 P0C80 P0C80 P0C90 P0C90 P0C00 P0C00 P0J0 P0J0 P0J0 P0J0 P0J0 P0J0 P0J07 P0J08 P0J09 P0J00 P0J0 P0J0 P0J0 P0J0 P0J0 P0J0 P0J0 P0J0 P0J0 P0J0 P0J0 P0J07 P0J08 P0J09 P0J00 P0J0 P0J0 P0J0 P0J0 P0J0 P0P0 P0P0 P0P0 P0P0 P0R0 P0R0 P0R0 P0R0 P0R0 P0R0 P0R07 P0R08 P0R09 P0R00 P0R0 P0R0 P0R0 P0R0 P0R0 P0R0 P0R0 P0R0 P0R0 P0R0 P0R70 P0R70 P0R80 P0R80 P0R90 P0R90 P0R00 P0R00 P0SW0 P0SW0 P0SW0 P0SW0 P0SW0 P0SW0 P0SW0 P0SW0 P0SW07 P0SW08 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U07 P0U08 P0U09 P0U00 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U07 P0U08 P0U09 P0U00 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U07 P0U08 P0U09 P0U00 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U07 P0U08 P0U09 P0U00 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U07 P0U08 P0U09 P0U00 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U07 P0U08 P0U09 P0U00 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U07 P0U08 P0U09 P0U00 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U07 P0U08 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0Y0 P0Y0 P0P0 P0U07 N0/RES P0C0 P0C0 P0C70 P0R0 P0R00 P0R0 P0U08 P0U08 P0U00 P0U00 P0U00 P0U0 P0U08 P0U0 P0C0 P0C80 P0C90 P0C00 P0U0 P0U0 P0U00 P0U0 P0U0 P0U0 P0R70 P0R80 P0U0 N0B P0R0 P0R0 P0U0 N0G P0BT0 P0C0 P0C0 P0C0 P0C0 P0C0 P0C0 P0C70 P0C80 P0C90 P0C00 P0J0 P0J0 P0J07 P0J08 P0J00 P0J0 P0J0 P0J0 P0J07 P0J08 P0J00 P0J0 P0P0 P0SW0 P0SW0 P0SW0 P0SW07 P0SW08 P0U0 P0U0 P0U07 P0U07 P0U09 P0U0 P0U09 P0U0 P0U00 P0U09 P0U0 P0U0 P0U0 P0U0 P0U0 P0U07 P0U0 P0U0 P0U0 P0R90 P0U00 N0H P0U0 P0U0 N0IR0IN P0C0 P0C0 P0R0 P0U0 P0J0 P0U0 P0J0 P0U0 P0J0 P0U0 P0J0 P0J09 P0J0 P0U08 P0J0 P0U0 P0J0 P0U0 P0J0 P0U07 P0J0 P0U0 P0J0 P0U0 P0J0 P0U07 P0J0 P0J09 P0J0 P0U0 P0J0 P0U09 P0J0 P0U0 P0R0 P0R0 P0SW0 P0U0 P0R0 P0SW0 P0U0 P0R07 P0SW0 P0U0 P0R08 P0SW0 P0U0 P0R09 P0SW0 P0U0 P0R0 P0U0 P0R0 P0U0 P0R0 P0U0 P0R0 P0U0 P0R70 P0U0 P0R80 P0U0 P0R90 P0U0 P0R00 P0U0 P0U09 P0U00 P0U0 P0U0 P0U0 P0U0 P0U08 P0Y0 P0U09 P0Y0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U07 P0U08 P0U0 P0U0 P0R0 P0R0 P0U0 N0R P0P0 P0U07 N0RX P0R0 P0U0 P0U0 N0SCL P0R0 P0U0 P0U0 N0SDA P0P0 P0U08 N0TX P0R00 P0U09 N0V P0BT0 P0C0 P0U0 P0U0 P0U0 P0U0 N0VGA0SEL P0J0 P0U0 P0U08 N0VIDEO0ACT N0/RES P0P0 P0U07 P0C0 P0C0 P0C70 P0R0 P0R00 P0R0 P0U08 P0U08 P0U00 P0U00 P0U00 P0U0 P0U08 P0U0 P0C0 P0C80 P0C90 P0C00 P0U0 P0U0 P0U00 P0U0 P0U0 P0U0 N0B P0R70 P0R80 P0U0 N0G P0R0 P0R0 P0U0 P0BT0 P0C0 P0C0 P0C0 P0C0 P0C0 P0C0 P0C70 P0C80 P0C90 P0C00 P0J0 P0J0 P0J07 P0J08 P0J00 P0J0 P0J0 P0J0 P0J07 P0J08 P0J00 P0J0 P0P0 P0SW0 P0SW0 P0SW0 P0SW07 P0SW08 P0U0 P0U0 P0U07 P0U07 P0U09 P0U0 P0U09 P0U0 P0U00 P0U09 P0U0 P0U0 P0U0 P0U0 P0U0 P0U07 P0U0 P0U0 P0U0 N0H P0R90 P0U00 N0IR0IN P0U0 P0U0 P0C0 P0C0 P0R0 P0U0 P0J0 P0U0 P0J0 P0U0 P0J0 P0U0 P0J0 P0J09 P0J0 P0U08 P0J0 P0U0 P0J0 P0U0 P0J0 P0U07 P0J0 P0U0 P0J0 P0U0 P0J0 P0U07 P0J0 P0J09 P0J0 P0U0 P0J0 P0U09 P0J0 P0U0 P0R0 P0R0 P0SW0 P0U0 P0R0 P0SW0 P0U0 P0R07 P0SW0 P0U0 P0R08 P0SW0 P0U0 P0R09 P0SW0 P0U0 P0R0 P0U0 P0R0 P0U0 P0R0 P0U0 P0R0 P0U0 P0R70 P0U0 P0R80 P0U0 P0R90 P0U0 P0R00 P0U0 P0U09 P0U00 P0U0 P0U0 P0U0 P0U0 P0U08 P0Y0 P0U09 P0Y0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U0 P0U07 P0U08 P0U0 P0U0 N0R P0R0 P0R0 P0U0 N0RX P0P0 P0U07 N0SCL P0R0 P0U0 P0U0 N0SDA P0R0 P0U0 P0U0 N0TX P0P0 P0U08 N0V P0R00 P0U09 P0BT0 P0C0 P0U0 P0U0 N0VGA0SEL P0U0 P0U0 N0VIDEO0ACT P0J0 P0U0 P0U08

9 Bill-of- Materials BSODomizer Bill-of-Materials Document Version., December, 009 Item Quantity Reference Manufacturer Manuf. Part # Distributor Distrib. Part # Description BT MPD BH800S Digi-Key BH800S-ND Battery holder for (two) CR0 cells C Kemet T9A7M00AT Digi-Key ND 7uF tantalum capacitor,.v, 0%, size A 7 C,C,C,C7,C8,C9,C0 Kemet C00C0KRACTU Digi-Key ND 0.uF bypass capacitor, V, X7R, 00 C,C Kemet C080C0K8RACTU Digi-Key ND uf ceramic capacitor, X7R, 0V, 080 J Tyco/AMP 7- Digi-Key A9-ND Connector, HD- VGA -pin, R/A, female J Tyco/AMP Digi-Key A97-ND Connector, HD- VGA -pin, R/A, male 7 R Panasonic EXB-A0P0J Digi-Key U70CT-ND 0k ohm 8-resistor network, %, /W, SMD 8 R,R,R7,R9,R0 Panasonic ERJ-GEYJV Digi-Key P0GCT-ND 0 ohm, %, /0W, 00 9 R,R,R8 Panasonic ERJ-GEYJ7V Digi-Key P70GCT-ND 70 ohm, %, /0W, 00 0 R Panasonic ERJ-GEYJ70V Digi-Key P7GCT-ND 7 ohm, %, /0W, 00 SW Panasonic EVP-AA00K Digi-Key P7SCT-ND Switch, SPST tactile momentary, 00gf,.mm x.9mm, SMD SW CTS 8-LPST Digi-Key CT8LPST-ND Switch, -position SPST DIP, half-pitch, SMD U Parallax P8XA-Q N/A N/A Microcontroller, Propeller, TQFP- U Maxim MAX88ETJ+ N/A N/A VGA -to- Multiplexer, QFN- U Atmel ATCB-TH-B Digi-Key ATCB-TH-B-ND Memory, Serial EEPROM, KB, TSSOP-8 U Sharp GPUS0XP N/A N/A Receiver Module, Infrared (IR), 8kHz,.V-.V, SMD 7 U Micrel MIC-.0YC Digi-Key 7-7--ND Linear Regulator, LDO, V, 80mA, SC70-8 U Micrel MIC-.YC Digi-Key 7-7--ND Linear Regulator, LDO,.V, 80mA, SC70-9 Y Citizen CS0.000MABJ-UT Digi-Key ND Crystal, MHz, 8pF, SMD 0 PCB N/A BSOD.0 N/A N/A PCB, Fabrication & Assembly *** APPROXIMATE COST: $0 IN SMALL QUANTITIES $ FOR K

10 PCB Layout Inner Top Bottom *** FOUR LAYER PCB, THREE USED *** ROUTED BY HAND W/ ALTIUM DXP *** DESIGNED FOR SMALLEST FOOTPRINT ***." X."

11 Assembly Drawings

12

13 Firmware *** VGA DRIVER: COGS 0x78 XGA TEXT OUTPUT *** IR DECODER: COG THREAD FILLS FIFO WITH IR CODES RECEIVED ^^^ (BOTH FROM THE PARALLAX OBJECT EXCHANGE) *** CUSTOM: Hz MAIN LOOP VGA DRIVER & IR DECODER REQUIRE 80 MHz 0 80 MHz TO ACCEPT IR CODES REST OF VIDEO PASSTHROUGH MHz AVERAGE CURRENT: ~ma AT 80 MHz, π ma AT MHz (APPROX. 78 HOUR RUNTIME W/ CR0 CELLS) PROPELLER CAN SWITCH OSCILLATORS/PLL ON THE FLY 0 ms FOR OSCILLATOR TO RAMP UP 7 us TO PERFORM CLOCK SWITCH

14 Firmware *** BSOD TIMER BIT SYSTEM COUNTER - WRAPS IN SECONDS AT 80 MHz COUNT SECONDS OFF SYSTEM COUNTER IN MAIN LOOP *** REBOOT BEHAVIOR MIMICRY MONITOR TARGET COMPUTER'S VIDEO HSYNC DEPENDING ON RESOLUTION, EITHER ACTIVE HIGH OR ACTIVE LOW ASSERTS EVERY 0 us SAMPLE TIMES 0 us & us SEPARATED *** DIP SWITCH SETTINGS : WINDOWS/MAC BSODs,: TIMEOUTS: (mins) INF,, 0, 0 [extra sadism mode] : BGOD MODE (blue goatse of death) *** IR COMMANDS (SONY TV REMOTE CONTROL) POWER: BSOD (FROM PASSTHROUGH) CH UP: PASSTHROUGH (FROM BSOD) CH DN: BGOD OVERLAY (FROM BSOD)

15 Other Uses *** JUST MODIFY THE FIRMWARE AND REPROGRAM WITH THE PROP CLIP *** GENERIC DEVELOPMENT PLATFORM FOR PROPELLER/VGA/IR *** MONITOR CALIBRATION TOOL (DISPLAY COLOR BARS) *** TIMER (REPLACE BSOD WITH A REMINDER TO TAKE A BREAK FROM SITTING IN FRONT OF THE COMPUTER)

16 Insert funny video here...

17 The Future of BSODomy *** PARASITIC MODULES THAT CAN... STORE SCREENSHOTS TRANSMIT IMAGES/VIDEO ON DEMAND SURVIVE ON MICROAMPS OF MONITOR SIGNAL POWER BE SMALLER THAN A CONNECTOR NEVER TRUST A CABLE AGAIN