Richard Aplin raplin

Why would you even want to do that?

Well, there are some vendor locked dongles out there (I'm looking at you Panasonic!) that use regular off-the-shelf chips but cost a lot of money and not $5 that they're really worth. E.g. there's the AJ-WM50E dual band AC dongle (sold for 160 USD) that you should use with AG-UX180 camera to get wifi CCU running.

I happen to have one such dongle, couple of summer holiday nights and family far, far away. Why not do some hacking then?

The camera is - as far as I can tell - running Linux or a similar system. If so, it has a limited set of tools to get to know what's getting connected to it.

Ultimate goal

Make the not-so-Panasonic dongle resemble the Panasonic one as much as possible, so that the camera just enables it thinking it's legit.

Introduction

This project makes a wifi router out of an ASUS PCE-AC88 wireless adapter and your Ubuntu Linux computer that can exceed top of the line routers.

Instead of buying a gaming grade router or another computer that you install openWRT on, follow this project and put the savings towards upgrading your main computer or modem.

Add Adapter

The adapter needs to be added to a PCI slot and the wireless antenna needs to be connected to the adapter. If your computer does not detect it, you may need to re-seat the adapter in the slot. If you can't detect wireless networks after installing the firmware below then this is probably why.

Install Firmware for Adapter

For your computer to use the wifi adapter you need to add the missing firmware that Asus won't provide.

Dumping the flash of the Syscan 2015 badge

The badge of the Syscan 2015 conference included an ARM-based STM32F030R8 processor running some challenges. Although SWD pins are accessible on the badge, some have noted that the STM32 is readout-protected, meaning that it will refuse to dump its flash memory.

Fortunately, two researchers (Johannes Obermaier and Stefan Tatschner) recently published a paper at the WOOT '17 conference, in which they reveal a vulnerability allowing to bypass the readout protection. Their technique allows to dump the flash one DWORD at a time, rebooting the CPU between each access.

I implemented this attack using a BusPirate and the PySWD module. Here is a quick'n dirty PoC to

What I Wish I'd Known About Equity Before Joining A Unicorn

Disclaimer: This piece is written anonymously. The names of a few particular companies are mentioned, but as common examples only.

This is a short write-up on things that I wish I'd known and considered before joining a private company (aka startup, aka unicorn in some cases). I'm not trying to make the case that you should never join a private company, but the power imbalance between founder and employee is extreme, and that potential candidates would

Adventures in Python Core Dumping

After watching Bryan Cantrill's presentation on [Running Aground: Debugging Docker in Production][aground] I got all excited (and strangely nostalgic) about the possibility of core-dumping server-side Python apps whenever they go awry. This would theoretically allow me to fully inspect the state of the program at the point it exploded, rather than relying solely on the information of a stack trace.

	#!/bin/bash

	echo "Downloading QCA9377 firmware..."

	# qca9377-sdio-wifi firmware
	mkdir -p /lib/firmware/ath10k/QCA9377/hw1.0/
	cd /lib/firmware/ath10k/QCA9377/hw1.0/
	wget https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/plain/ath10k/QCA9377/hw1.0/board.bin
	wget https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/plain/ath10k/QCA9377/hw1.0/board-2.bin
	wget https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/plain/ath10k/QCA9377/hw1.0/firmware-sdio-5.bin

	#!/usr/bin/env python
	#
	# tool to parse JFFS2 images
	# and more importantly, guess the erase block size
	#
	# 2015.10.19 darell tan
	#

	from struct import unpack
	from argparse import ArgumentParser