Zibri's Blog

Obfuscation will never work.

2009-11-06T12:45:00.000-08:00

Hello again, sweet readers !
OpenRG is an embedded OS for routers.It's based on Linux and it's inside many ISProuters out there.
Inside OpenRG configuration file,passwords appear in a way that can seemto be crypted, but it's just obfuscated.
For example: (username(admin)) (password(&b7;X&5c;&b9;&a2;))
Above you can see a simple deobfuscator.Enjoy!
You can try it with:&ad;Y&5b;&b3;&a3;&17;T&8b;&c4;&b9;#&96;&04;c&ea;&1d;$%&5d;&16;&08;B3&c0;
:)
Zibri.

Success! :)

2009-09-24T14:00:00.000-07:00

I successfully connected the

Uncle Milton's Force Trainer

to my PC..

It was easier than expected.

Here's a sample interface, but

you can also use a cellular cable like the CA-42

And connect it to RX,TX and GND on the base.

The serial speed is 57600 8N1 and the data stream

is pretty easy to understand.

I also (lousily) coded a sample application

which gives the two brain 'parameters' the headset

sends to the main game station.

In the above example I was focusing

on a particular thought very intensely.

In this other example I was relaxing

and focusing on my breath with my eyes closed.

Stay tuned for more about this!

May the force be with you :)

2009-09-19T11:37:00.000-07:00

Yes.. I bought this game.Fun aside, both the headsetboth the base have a nice JTAG portand maybe a serial interface.I got it this morning and I just startedinspecting the devices.They communicate on 2.478 and 2.408 Ghz frequenciesit's not bluetooth but a normal serial overthe air. If you are curious like me,the FCC site has FULL documentationand pictures of the inside.You will find them under theseFCC IDs: XCY150511UMI2009 and XCY150512UMI2009.I'll keep you posted.~~Yoda.~~Zibri

Note:
The 'unknown' chip on the base
you can't see on FCC site is a PIC16F727 44 pin.The other 'blank' chip on the headsetis a PIC16F722 28 pin.

Hidden things are usually the best :)

2009-08-20T08:29:00.000-07:00

Well, what to say? The best feature I've seenin blackberry phones is hidden!Let's unhide it!On 8900 and 9000 (for example)press ALT+CAP+H.You will get to the "Help Me!" screen.That screen is not really what you thinkit is. It's a crippled engineering screen.How to uncripple it?Enter on the above formthe data you see on your 'crippled' screen.For App Version you must includethe space and parethesis.For Uptime, just enter the number.After filling all the form, you'llget your key.To enter it just press the keys.(You won't see anything)Use ALT for numbers andnormal keys for the characters.To enter C8, for example, youwill have to type: c then ALT+xAs soon as you have entered all 8characters you will see the abovescreen every time you willpress ALT+CAP+H Stay tuned,Namaste! Zibri

Yawn..

2009-08-12T00:11:00.000-07:00

When I heard the new blackberry 8900 was'difficult to unlock' I got curious.The BB security is nothing compared to the iPhone's.Do you want to laugh?I initially thought this unit had a defective display..do you see that strange stripe of dotted vertical lines?Well.. putting a ruined image as the default backgroundis a really nice joke... RIM, you got me on this.If anyone else have "secure" devices for me to test,you're welcome to send them in ;)Happy holidays,Namaste!Zibri

Qualcomm chips insecurity.

2009-07-21T13:55:00.000-07:00

Since I can't be too far from phones and alikes,I started studying Qualcomm chips.These chips are included in a LOT of data cardsand MANY phones (blackberry,android based phones, etc) Well Security on these chips (all of them)is ridiculous compared to competitors. Now, let me tell you one thing:I found a way to know the unlock code(SP lock, sim lock, network lock, whatever)directly from the card with a simple procedure. For now I won't spread this information.I will wait sometime and give time toqualcomm or any company producingphones or cards based on qualcomm chipsto contact me. If you want to contact me,you can write your message andcontact as a comment to this post. Namaste,Zibri

He's growing...and learning... :)

2009-06-29T15:59:00.000-07:00

A shell script..

2009-06-21T16:19:00.000-07:00

Ditto.

2009-05-15T16:01:00.000-07:00

Consequences..

2009-05-04T09:33:00.000-07:00

I kept this image for a long time know, but I knewI would have used it for a post sooner or later.Finally developers fought back piracy of iPhone apps:with a simple yet effective method they are securingtheir apps so that if you crack them (any of them) your iPhone will be blacklisted.As a bonus, any developer can choose not to allow anyone who cracked ANY app to run theirs.To get deleted from the blacklist, fairly enough, you have to buy all cracked apps.As I already told you, I stopped developing ZiPhone when I noticed the MAIN reason the most of you used it was to install cracked applications.In short:I am the one who allowed you to use the iPhone worldwide when that wasn't possible.The "others" are the ones allowing you to run cracked apps.And stop bragging about "freedom" since the "alternate" download services are now just a hypocritical way to circumvent the AppStore.In a single word: black market.To Apple:learn from developers: it's time you implement the same mechanismand stop this theft. Developers need to be rewarded for their work and for offering very cheap apps that contribute to make your product one of the best seen so far. Namaste,Zibri

Powerline Ethernet fun and secrets.

2009-03-23T14:35:00.000-07:00

Many 200 Mb/s powerline adapters nowadays are based on the INTELLON 6300 chipset.
Despite what can be thought looking at them, they are all using the same hardware and firmwares.
I heard many people with Netgear XAV101 or Linksys PLK 200 or PLE 200 having problems after firmware updates and many other people with other brands having much more problems because of lack of support or configuration/upgrade utilities.

So let me explain a few things I learnt studying them.

Many of 200 Mb/s powerline ethernet adapters follow the "HomePlug AV" standard. (85 Mb adapters use HomePlug 1.0 standard which is completely different).
This standard uses ethernet broadcast packets using the HomePlug AV protocol.

The interesting thing is that their firmware is made of two different parts:
a .PIB file (Parameter Information Block) and a .NVM file (the code itself).
In the P.I.B. there are many interesting things:
The branding (mac address, device name, etc) and the tone map.

I tested many firmwares and many PIBs and benchmarked them.
The best one so far was 3.0.5.2 you can find here.
You can download the setup and upgrade utility from here.
(no matter what powerline adapter you have if it's INT6300 based)

Something you may not know:
there is no actual difference between the adapter without the security button and the ones that feature it.
Since the have no such button (if you open them you can easily solder one inside it) they tell you they can only be paired as they are sold, but that's a lie.
The button press can also be simulated using the utility, so you can make a big network also with units that don't have the button.

For your information, a total of 15 units can be connected in the same house.

For the braves and people who know what they are doing I finally found the
complete device manager from intellon.
This utility works with firmwares up to 3.0 and can be very useful and very dangerous.

With 'device manager' you can fully customize the powerline adapter and even dump and modify the tonemap!
The tonemap is a list of attenuations, one per carrier, so the adapter can comply with emission rules of any country and can support longer cables, worst conditions, best conditions, etc.

I made a few 'real world' speed tests using wget and a single ftp session on my lan.
Here are the results:

Direct ethernet connection (100 Mb/s): 11.25Mb/s
Connection with 2 adapters on the same wall socket: 4.20 Mb/s - 4.40 Mb/s
Connection with 2 adapters on opposite sides of my house: 3.24 Mb/s

Note
When they say 200 Mb they are meaning RX+TX RAW DATA rate.
During the ftp transfer I was, as a matter of fact, reading these values on the adapter diagnostic interface:

120 / 80 (raw)
90 / 60 (coded)

Caveat
For the best results, all your powerline adapters in your network
must have the same firmware version and the same PIB.

Mods
Testing, I uploaded different tone maps and a few custom ones.
I achieved 5 Mb/s - 5.3 Mb/s with 2 adapters close to each other but the speed
went down to 2.24 Mb/s when they were distant from each other.
The best PIB so far I tested was the "ClassB" one but this may differ in your country or in your house.

Warning
With firmwares above version 3.0, the device manager works in a reduced feature set.
Be careful on what you do.
They can anyhow be downgraded if needed to 3.0.5.2 and reupgraded as many times as you want. Don't ever take them off the power outlet for a minute during and after the firmware upgrade or you will brick them in a non recoverable way!

Now some firmwares:

Version Date Comment

1.4.5.4 2007/02/26
2.0.5.2 2007/05/31
3.0.3.1 2007/??/?? Found on Pirelli/Onda adapters
3.0.4.2 2007/08/07
3.0.5.2 2007/08/16 Fully supported by device manager
3.3.0.5 2008/06/06 Tested
3.3.4.8 2008/08/08 Tested
4.1.0.0 2009/09/03 Untested (latest so far)

Unleash your ADSL horses!

2009-02-27T05:40:00.000-08:00

Hello! I just made a discovery I want to share with you:As a few of you may know, on broadcom based adsl modems/routers there is a command line utility which allows to tweak the adsl physical connection.This command is adslctl and accepts many parameters.One of them is SNR which is used to force a lower (or higher) SNR.On the information page you will see that there is a maximum speed achievable on your own line due to noise, distance and quality and then you read the actual connection speed.An example:Max(Kbps): 18420 1027Rate (Kbps): 17972 1013If you issue the commandadslctl configure --snr 1You are telling the modem to set the minimum SNR(it may not give you any performance improves on a very noisy line)thus allowing the modem to 'hook' at higher speed.Since my line performed very well with snr=1 I wondered if it could be possible to lower the snr below 1. Then I thought that the variable used in the code is a signed WORD sosince a negative value is not possible why not trying an overflow ?adslctl configure --snr 65440This corresponds to -106 and it proved to be the best value on my line.Now my connection details are:Max(Kbps): 17740 1027Rate (Kbps): 22237 1027Yes! You read it right!You can try values from 65400 to 65500.Don't push the lower or the line will be so noisy that the remote dslam will degradate it's connection parameters and it will take long to come back to normal without a dslam reset!Some stats:URL http://na.mirror.garr.it/mirrors/ubuntu-releases/intrepid/ubuntu-8.10-desktop-i386.isoCompleted 698.82 MTotal Time 00:05:16Average Speed 2264.53 KB/s$ wget -O /dev/null http://na.mirror.garr.it/mirrors/Slackware/slackware-current/isolinux/initrd.imgLength: 13,477,400 (13M) [text/plain]
100%[====================================>] 13,477,400 2.25M/s ETA 00:00

Microsoft suicidal? :)

2009-02-01T09:56:00.001-08:00

Well, see for yourself!

Isn't this a MacBookPro?

Believe it or not this was captured from a

MicroSoft commercial for SongSmith.

SongSmith is the Microsoft way to try

to destroy the music industry :)

Oh by the way,

get a HEX editor and search for:

20 60 54 00 00

inside SongSmith.exe

change it to:

20 FF FF FF 7F

(6 occurences)

You will have a lifetime trial time :D

(Product security must be revised)

To get rid of the annoying

splash screen search for:

2D 5B 14 73 27 02 00 06

and change 2D into 2C.

Google: Hack or Bug ?

2009-01-31T07:34:00.000-08:00

For a few minutes GOOGLE today

suffered of a denial of service.

Every search was redirected to a page

stating that the site (ANY!) could harm your computer.

Was this a stupid glitch/bug or a hack ?

Lucky for them it's Saturday and stock exchange is closed.

I wonder what will happen on monday.

Knight Rider phone...

2009-01-25T05:30:00.000-08:00

What's this ?The UI looks like the iPhone's..The phone doesn't.(Spotted in episode 12 of first season)

Nostalgy :,)

2009-01-22T18:05:00.000-08:00

I'm a nostalgic, I know.Since David changed the layout of the old site.Here you have a backup of the original ZiPhone site.Not much of fun, but much better than google cache :)
The new address is:http://ziphone.zibri.org
Namaste,Zibri

R.I.P. Ricardo Montalban

2009-01-14T14:54:00.000-08:00

New playlist...

2009-01-12T09:49:00.000-08:00

I'm setting up a new playlist..Let me know what you think about it..And enjoy!

Merry Christmas !

2008-12-17T08:02:00.000-08:00

James R. Kirk :)

2008-12-05T17:47:00.000-08:00

As a Star Trek fan I'm suprised I only noticed this today after

watching again and again the series on my beloved dvds.

No big deal, I just wanted to share this funny thing.

Movie piracy...

2008-11-24T11:33:00.000-08:00

Many movies are pirated using a camerain theaters.Maybe some of you don't knowthat any camera "sees" infrared light.To test it, pick your camera and aima remote (your tv remote is ok) at it.You will see the infrared L.E.D. blinking.Well.. I was thinking...What if many infrared leds will be put behindthe projecting screen in theaters?The IR light won't be seen by people.But it will appear in recorded videos :)Obviously this could be defeated putting an IRfilter on the cam lenses.. but that's the road imho :)

And he said... BOOM!

2008-10-30T12:46:00.000-07:00

Here we are again!When Steve says something it usually happens...So what do we have here?A video.Yes a stupid nasty video which can crashANY iPod/iPhone.A different version of this videocan even crash many pc applications.Apple was contacted and a mailwas sent to bugtraq mailing list.Only a Forbes journalist showed up.You will read about it on Forbes on monday.Later that day the video will be postedhere for further "booms"Clicking on the picture above ~~after monday~~ will crash your iPod/iPhone but it won't harm it.

Secrets..oh secrets!

2008-10-28T08:47:00.000-07:00

Picture by erregiro
Secrets, hidden things, I really hate this.It's common practice nowadays for companiesto sell devices that can do many things butlocked and constrained to do only one or two.So, when you buy a device you don't knowthe many things it can do.Let's see an example:Sierrawireless produces astonishing 3G cards;AT&T disables the top 7.2mb/s speed and theinternal GPS (yes! AC881 and 881U do havean internal GPS unit!).On such units there are a lot of undocumentedcommands (AT commands).If you happen to have one of these cards,try this from hyperterminal, putty orany terminal program connected to the cardAT command port:AT!HSDCAT=8 (for 7.2mb)This will set the HSDPA category to 8.The default is 6 (3.6mb/s)There is also a command to set the HSUPA category:AT!HSUCAT=5 (2mb/s upload)andAT!HSUCAT=3 (1.4 mb/s upload)
About the GPS, things are a little more difficultbut I could enable it on any card with a simpleone-click program.Stay tuned.Zibri

Welcome !

2008-10-25T07:26:00.000-07:00

Photo courtesy of floridapfe

Welcome on this new site.

Here you will find news thoughts and various things.

I hope you'll like it.

Zibri