tag:blogger.com,1999:blog-57055552011-12-31T16:12:31.918+01:00In this blog, you'll find some things I've figured out and wanted to share. Code snippets are examples on it's own and you should figure out how to use them yourself. My site with old stuff: http://darkfader.net/DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.comBlogger381100tag:blogger.com,1999:blog-5705555.post-78454163215675217822011-10-23T21:29:00.002+02:002011-10-29T21:05:06.292+02:00

Do you have a Google account and want to be more secure? Own a Sony PocketStation? Now you can use this device as a security token to login with 2-factor authentication on the Google site and even use it for logging into your linux machine using a PAM module. It supports one key using the 30-second Time-based One-time Password algorithm. It's hashing up a secret key together with the current time

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-22851741667998468672011-01-22T23:10:00.001+01:002011-01-22T23:12:13.684+01:00

I have the Tomato firmware loaded into my Linksys router (WRT54GL 1.1). I acquired a second router of the same type and thought it'd be nice to duplicate the configuration. (if it breaks down or for whatever reason) When I tried restoring the configuration, I got the error: "You cannot restore settings to a different router". So I first needed to check what I had to change in the cfg file...

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com1tag:blogger.com,1999:blog-5705555.post-39156687004800771692011-01-02T21:13:00.001+01:002011-01-02T22:03:59.111+01:00

Download and installation instructions here: Snow Leopard for Windows 7 theme by sagorpirbd If you run into problems with the free-activator (just click the advertisement) or just want to see what's in there beforehand, you can extract the files yourself. Extract "Snow Leopard for Win7 Setup.exe" using a RAR-extractor. The password is snhgqzsdhbktin7 Here's a batch file (put in "System Files")

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-60934772052712430532010-10-21T17:01:00.000+02:002010-10-21T17:01:30.362+02:00

This is for when you have a DataGridView in virtual mode in which you have both unbound and bound columns which depend on each other. It went wrong when editing the cells. I found out that I got a race condition. I then checked the stacktrace: - MyGridView.OnCellValueNeeded(System.Windows.Forms.DataGridViewCellValueEventArgs e) - System.Windows.Forms.DataGridView.OnCellValueNeeded(int

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-32006562849769292912010-10-06T02:02:00.005+02:002010-10-13T22:41:14.504+02:00

When I was on 3.1.2 I had native internet tethering working without much problems. Just use ultrasn0w or other unlock hack and install any carrier profile to make the switch visible. There was no real need to patch the CommCenter executable. The CommCenter patches were initially released as plain patchfiles that required entering shell commands, but later appeared in Cydia repositories too. With

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-32803680492314584752010-07-23T01:38:00.007+02:002010-10-22T19:38:22.147+02:00

With sudo, you can execute any or custom command as the root user, optionally asking for your password. That poses some risk if someone knows your password (e.g. by logging/tapping). But you could replace sudo with something that can login locally via other means like SSH. You need to use SSH(-agent) forwarding to pass down your identity so you won't have to type in any password. You then can

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-41014712968280609452010-07-20T01:43:00.001+02:002010-07-20T01:44:36.563+02:00

For security reasons, you may wish to set a static ARP entry for your gateway. This script automates this step. Note that this doesn't prevent DHCP or MAC spoofing however. The script runs whenever a network connection is made or broken by using the launchd feature to check a path for changes. In this case, I used resolv.conf. The scripts determines the default gateway IP address and then keep

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-18299998913613081312010-04-28T23:13:00.011+02:002010-05-17T22:16:43.802+02:00

My configuration:single internal hard drive in iMac with a single NTFS partition. This is BIOS identifier (hd0,1). In linux, this will be SATA device /dev/sda. The SATA controller is from ICH8M and has PCI identifier 8086:2828. Please change these references to your system configuration.Don't worry, I still have OS X on an external FW800 drive but that's not relevant here.First of all, I tried

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com5tag:blogger.com,1999:blog-5705555.post-91195613671627632012010-01-13T09:02:00.009+01:002010-01-13T09:46:05.401+01:00

Atmel has implemented a so called 'production file' in its programmer software. It's a simple ELF file containing sections for Flash, EEprom and fuses. You can create these sections from your C code too.The board I developed for contains an Atmega128 attached to an ethernet controller. Also, it contains a bootloader that can program and dump the flash and eeprom memory.What I wanted is a complete

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com1tag:blogger.com,1999:blog-5705555.post-91084898950168882632009-10-05T15:33:00.004+02:002009-10-05T16:02:14.334+02:00

Since I have my (3GS) 3.0 ECID SHSH on file with Cydia, I decided a while ago to update to 3.1. So I Pwnagetool-ed a ipfw and installed. Now, I wanted to try out the new modem firmware too and updated to official 3.1 firmware, only to come to conclusion it makes things more difficult and fixes nothing. Anyways, I went back to 3.0 and had to redsn0w it because it doesn't work with the new modem

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-78716314540451756272009-06-23T12:14:00.011+02:002009-06-27T22:31:43.448+02:00

With the new OS installed on the iPhone, Xcode complains it needs an update. So it updated to 3.1.3.Again, I applied the modifications to skip provisioning profile.In terminal, type open /Developer/Platforms/iPhoneOS.platform/Info.plist (opens with Property List Editor)Under defaultProperties add/edit rows:PROVISIONING_PROFILE_ALLOWED = NO;PROVISIONING_PROFILE_REQUIRED = NO;This works however

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com9tag:blogger.com,1999:blog-5705555.post-4515814694074361622009-06-22T11:48:00.011+02:002009-06-23T13:41:40.285+02:00

Taking my chances to upgrade to the latest OS version 3.0 for iPhone.So, first needed to backup some things: AptBackup, SpringBack and finally, a backup with iTunes.Then create a custom ipsw with Pwnagetool. To install this ipsw, I put the iPhone into recovery mode (did not need the DFU mode, since it was already hacked) by holding both buttons on the iPhone and release the sleep button when

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-64058761162221719032009-06-19T12:52:00.008+02:002009-06-19T13:37:42.997+02:00

Code snippet of a UIProgressView subclass that implements custom draw method.This example uses four images for the left side, right side and ten sections that can be either on/off or partially filled.My images included edge and shadow and named: pb_left.png (9x32), pb_right.png (9x32), pb_on.png (28x32). pb_off.png (28x32)- (void)awakeFromNib{ [self setBackgroundColor:[UIColor clearColor]];}//

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com2tag:blogger.com,1999:blog-5705555.post-48212255202605102482009-06-17T10:17:00.007+02:002009-06-19T14:03:36.265+02:00

A little snippet for subclassed UIButton that adds an UIImageView overlay.You can then animate the alpha property.- (void)awakeFromNib{ UIImage *img = [self imageForState:UIControlStateSelected]; overlayImage = [[UIImageView alloc] initWithImage:img]; overlayImage.alpha = 0.0f; [self addSubview:overlayImage]; // [self addTarget:self action:@selector(buttonClicked:) forControlEvents:

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com1tag:blogger.com,1999:blog-5705555.post-23842943871030954682008-07-05T13:57:00.003+02:002008-07-05T14:44:55.989+02:00

Ok, I had it for now with this r8169 kernel driver. I even tried a suggested newer kernel version but even that didn't help. I put in a new Intel card and it seems to work fine.Because I switched ISP, I have to return my modem (not my property; Sagem BASE F@ST 3202). I still wanted to know if I could get access to superuser account again. It is still accessible by serial port for which there is

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-15788300555926949382008-06-04T22:06:00.004+02:002008-06-15T17:32:10.072+02:00

New SSH keys generated to login without password on my server, macbook, imac and website. Works nicely. I have set MacFusion to mount automatically.I've put back the r8169 network card in my server and it now appears to be running stable. Perhaps it's also because I upgraded the kernel version again to 2.6.24-gentoo-r3. Oh and I soldered 3 capacitors on it. They always leave out some to make it

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-51749570437266396422008-03-24T19:04:00.002+01:002008-03-24T19:28:12.217+01:00

Since updating my kernel of my linux server, the 1Gbit card (r8169) gave troubles. Occasionally, the link went down.dmesg shows some PCI quirks and IRQ routing conflicts but afaik it's been like that before.Although I also had enabled the onboard USB ports and added USB to the kernel.I then tried loading back the old kernel version only to find out that the problem persisted.Could the card have

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-3900311267567131482008-03-24T18:41:00.004+01:002009-06-17T10:28:42.664+02:00

I tried moving some files from my linux server to the external firewire drive on my iMac. It just did not work and my iMac would not see the UTF-8 encoded filenames. Then I learned about the utf-8-mac encoding and though wtf. My gentoo linux installation doesn't know about that. (NT_STATUS_OBJECT_NAME_NOT_FOUND)I tried muCommander and bash in the hope that Finder was just screwing up. But nope...

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-901128226296964962006-01-12T09:43:00.000+01:002009-06-17T10:35:39.023+02:00

Yesterday, I stumbled upon a few SRL files that are stored in some romdumps. These are WMB programs, but yet contained encryption information which is only intended for card use. It is kind of odd they would left that in. (7 out of 52 SRL files)I found an unconnected button input on the mainboard named "R03" close to the SL1 contacts. It is mapped to bit 3 of the I/O register which also contains

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-13743898375005470122006-01-12T09:30:00.000+01:002009-06-17T10:35:20.309+02:00

As you might have seen already, PassMe2 programming files are available at http://darkfader.net/ds/games/. The CPLD logic is precompiled for XC9572XL-VQ44 devices, so it cannot be used directly on some PassMe brands which use a different chip.I will continue to update the list until KeyMe is out. Information on where to get up-to-date dumps easily is appreciated. Many thanks go to Loopy for

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-69108602389460883762005-11-02T14:03:00.000+01:002009-06-17T10:35:20.322+02:00

NDStool now can generate PassMe vhdl sourcecode and SRAM file from an nds rom file.Here's the full Changelog.Compiling the vhdl sourcecode requires Xilinx ISE, so I will look for a less tedious way to create a programming file since it's technically possible.Xilinx project files and a readme can be found here.I will soon update the nds rom database page with more info, functionality and download

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-1947871959963929002005-10-11T23:44:00.000+02:002009-06-17T10:35:39.036+02:00

I've added some information on the DSbrick trojan on my intro page.Bad news I'm afraid. Perhaps more to come or nothing at all.

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-30402069651472782682005-06-17T06:14:00.000+02:002009-06-17T10:35:20.330+02:00

NDStool now includes a PassMe loader by default, so you don't need to add a special loader in front of it. Again not very useful, except when developing perhaps or when you don't want an extra cartridge offset. It uses the WMB logo data area, so that will look like garbage.I've put up the schematic for the homebrew CompactFlash adapter and also Eagle files for it. I don't know where to buy small

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com1tag:blogger.com,1999:blog-5705555.post-90265442715624518332005-05-13T14:52:00.000+02:002009-06-17T10:35:20.338+02:00

I have successfully recovered the firmware of two DSes using the parallel port of my laptop. A bunch of wires, one cut trace on the PCB, external power supply and a piece of software did the trick. Source/executable available as "ppflash.zip".

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-55197519299946104602005-04-21T07:14:00.000+02:002009-06-17T10:35:20.346+02:00

I made the FlashMe web page (PHP, registration stuff... yay) to download Loopy's firmware patch. Currently located at http://ds.gcdev.com/dsfirmware/. It's currently in betatesting phase and it seems like it works allright.

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-78795790832937038932005-04-15T15:21:00.000+02:002009-06-17T10:35:20.353+02:00

I've made my own CompactFlash adapter by reusing a GBA cartridge (F-ZERO) and a CF connector of an old mainboard. Cut down the connector pins, prepare one side with wires and solder all pins to be grounded together onto the GBA edge connector. Connectors glued into the cartridge case and then started wiring the rest. It's a bit crampy and the cartridge doesn't go in the GBA slot all the way but

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-21654459882288570862005-04-09T00:04:00.000+02:002009-06-17T10:35:20.288+02:00

The PassMe Natrium42 sent, have arrived. Now I finally don't have to program my FPGA each time :) I soldered my own connector on it. Also made a picture to compare against another PassMe version which someone else made. This one fits in an original cartridge case. The makers of this one might mold some cases for it.

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-11110014362649324652005-04-08T07:22:00.000+02:002009-06-17T10:34:57.538+02:00

Today, I opened my PSP. Turned it on with just the battery and button PCB with the power button on it. Wrote down some partnumbers and found two I/O pins for configuring the clockchip. Perhaps I'm going to capture that and then slow down the PSP or whatever.

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-73517531442625876482005-04-06T07:24:00.000+02:002009-06-17T10:35:20.301+02:00

NDS tool allows you to unpack/pack both commercial and homebrew NDS files.[edit]Source: http://cvs.sourceforge.net/viewcvs.py/devkitpro/tools/nds/ndstool/Binary: http://cvs.sourceforge.net/viewcvs.py/ndslib/ndslib/examples/tools/ndstool.exe (not the latest version!)[/edit]New features: add/extract header create filesystem Planned for next version: Build-in icon converterCostis is writing a

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-69653933718133804542005-04-06T07:23:00.000+02:002009-06-17T10:34:57.581+02:00

Yay! I received my PSP!Although my main focus is the Nintendo DS, I might still give a small try... but I do not want to break it or anything. And PSP is so much more secure. (I think)

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-85840187830483144602005-04-06T06:29:00.000+02:002009-06-17T10:35:39.049+02:00

Will DS flash cartridges be a reality soon?I think someone is making one. But how will it work? :)Mysterious...

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-32331043750802124192005-02-22T16:58:00.000+01:002009-06-17T10:35:39.063+02:00

I now dumped the secure area correctly of the Metroid demo. The CRC for that reports OK (0xC44D). I have put the tests on idle, since I don't know if they will be of any more use. Still need to figure out how the encryption on the first few commands work.

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-63997344917144000022005-02-11T02:26:00.000+01:002009-06-17T10:35:38.970+02:00

At about 80% of the first test, the correct value was found. This proves my theories and allows me to take the next few steps :). Thank you all for participation.

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-78768919000865543792005-02-09T22:25:00.000+01:002009-06-17T10:35:38.986+02:00

I would like to conduct some test(s) on data that has been captured from a cartridge. Because I know how the PRNG works, I made a simple distributed cracking tool to find the correct values for a given set of null-data.If you want to help out, check out http://darkfader.net/ds/stats.php

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-16588092232886995222005-02-08T01:00:00.000+01:002009-06-17T10:35:38.996+02:00

I stopped the Real Time Clock in the DS and proved the encryption bases its random number generator on the time and the 4-character gamecode in the header. The game does not start when the gamecode is altered. Most of the bios code has been dumped and we found some others things on the encryption.I've analyzed the random number generators and can reproduce the numbers, but unfortunately the

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-81396118638115180162005-02-08T00:58:00.000+01:002009-06-17T10:35:39.005+02:00

I've dumped the Metroid demo and Mario 64 DS.This could be done by capturing commands to the cartridge and then play them back and alter the first byte to turn a normal read into an ID command. The difference in data resulted in the original data.This gave me the idea of running two cartridges at the same time. One using normal commands and other ID commands. But since I didn't got a 2nd GBC

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-4507422663027469482005-02-08T00:51:00.000+01:002009-06-17T10:35:39.014+02:00

So... when I got my DS and games, I started to make an FPGA (a programmable logic chip) -based pass-through that would let me capture and alter the cartridge traffic. An etched PCB goes into the DS and a cut GBC-connector holds a DS cartridge. Once this worked, I tried fiddling with the header and found out that it could run own code from the GBA slot. There is even a bit that automatically

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0tag:blogger.com,1999:blog-5705555.post-63956312378764906012005-02-08T00:45:00.000+01:002009-06-17T10:35:38.951+02:00

After a few weeks the Nintendo DS was out, I found someone that was willing to ship me one at a nice price from USA to NL. One thing was on my mind... to hack it. I had looked at inside pictures of the cartridge and DS. I guessed the pinout rather nicely. Others started to capture the traffic of the cartridge. We then saw the header data and encrypted data. We somehow knew it was encrypted before

DarkFaderhttp://www.blogger.com/profile/14438606088136482649noreply@blogger.com0