Posts on Colin O'Flynn

Announcing my "Small Scale Electronics Production" Book

Sun, 11 May 2025 13:09:53 +0000

During the pandemic I started a project I long wanted to do, which is to write down many of my lessons learned around building a hardware business. While this has now taken much longer than planned, I’m approaching a (hopeful) end of the draft process over the next couple of months. In combination with my Amp Hour discussion with Chris Gammel, I thought it was a good time to “officially” announce this!

Modifying Welding Pedal for a Miller 6-Pin Connector (ArcCaptain Pedal)

Mon, 17 Mar 2025 02:45:53 +0000

I bought a Miller 161 STH welder which has a little hand remote control included, and found it was more difficult to use. I wanted to try a welding pedal but the miller ones are much more expensive than other brands, like ArcCaptain, and I found the ArcCaptain one sturdy enough. This post is how you can adapt other welding pedals to the Miller 6-pin connector. I made a video about the process, this post has the reference material:

My 2003 Low Cost SMD Soldering Guide

Wed, 15 Jan 2025 12:03:46 +0000

Back in 2003, I wrote a guide for AVRFreaks.net about low-cost SMD soldering. I had never mirrored this to my website, but recently needed a more permanent link to it for a PCB introduction lecture.

The information may no longer be the most current (22+ years later!), but I wanted to keep an official mirror of it on my website. You can find it inline below:

Fixing Ubiquiti Dream Machine (UDM) SE Hard Drive Not Detected Errors

Wed, 11 Dec 2024 02:34:43 +0000

My UDM SE can fit various hard drives. Ubiquiti have decided to have a cool tray the hard drive snaps into & slides into the UDM, which also means you have to have a very good fit. As it turns out, the fit may not be good enough without shimming the drive out!

I used a Seagate Skyhawk 4TB Video 3.5 Inch SATA (ST4000VXZ16/ST4000VX016) drive, which is reported as being compatible. In sliding the drive in there was no spin-up sound. I then tried rebooting it & repositioning the drive several times, it wasn’t clear if the hot-swap should work or not. But there was never a spin-up sound or a LED flashing on. Very annoying, especially if you are rebooting your houses internet for a “5 min project”!

Dumping Parallel NAND with Glasgow

Sun, 14 Apr 2024 23:00:05 +0000

I recently got my Glasgow device, which is a rather impressive piece of tech. I followed the Windows installation instructions and it “Just Worked”, including installing the toolchain! On one computer I needed to use Zadig to force the driver to be libusbK, but on another Windows computer it wasn’t needed. In this blog post, I’m going to explore a parallel NAND device that I wanted to dump, and find out how well Glasgow works.

RECON 2023: Adventures of My Oven (Pinocchio) with ChipWhisperer

Fri, 09 Jun 2023 14:40:27 +0000

At RECON2023 I gave a talk about reverse engineering my Samsung Oven. This blog post has slides & links to information, with more to come! You can get a copy of the slides below:

OFLYNN-RECON2023 Download

Oven-Specific Stuff: https://github.com/colinoflynn/samsung-ovens-deconstructed
Python Loader for TMP91 Series: https://github.com/colinoflynn/pytoshload
Resource CD for TLCS900: https://github.com/colinoflynn/Toshiba-TLCS-900-L-Resources

Intel LGA1700 (12th/13th gen, i9 3900k) Top Resistors/Capacitors

Thu, 16 Mar 2023 01:46:06 +0000

If you’re a bit careless with your CPU (especially if e.g., delidding it) you can knock these resistors off the topside. From measuring a known-good device (but without removing them) I measured the following values as a reference:

i9 13900K image source: techpowerup.com

These all appear to be 0402 sized resistors.

If you do damage them, the best source would be another 12th/13th gen device, as they look to be identical. You could find a used/defective low-performance device and use that to get resistors/capacitors.

Danni Build - Feb 11/23

Sat, 11 Feb 2023 13:50:40 +0000

Hours: 8

Parts complete: 1 (lateral support), 2 (cylinder support), 3 (frame base)

Test assembly of three parts built today. The parts come pre-milled, so this was mostly time spent getting setup.

Start of build. Lots of marking & drilling of items, which was done on a milling machine with DRO. Having the DRO read-out is useful here rather than marking pieces I found. I had mounted cheap iGaging DROs to a small X2 mini-mill, there is a YouTube Video of how I did this. Here is drilling some holes in part 1:

New England Hardware Security Day 2022 Talk

Fri, 01 Apr 2022 11:50:25 +0000

On April 1st, 2022 I gave a “workshop” at New England Hardware Security Day. This blog post is a quick summary of some of the links to recreate my demos from that talk. Here is a copy of the slides if you’d like them:

New-England-Hardware-Security-Day-2022 Download

DFA on Raspberry Pi with PicoEMP

Pi on Pi Violence

This demo is pretty simple - it recreates the classic DFA attack on RSA (I find David’s description great here, or you can see my Hardware Hacking Handbook which includes another derivation of it using a different method).

Apple AirTag Teardown & Test Point Mapping

Sat, 08 May 2021 18:24:32 +0000

What’s inside of Apple’s new AirTag? There was already an iFixIt teardown (which I swear was missing a few items that are there now), but of course was curious to see what sort of protection was enabled. Notably the nRF chip used is likely vulnerable to a known bypass of security as well. With that in mind, I set out to see how we could dump some data from this thing - the good news is you can access a lot of interesting stuff (including the SPI flash) right from the backside, which requires you to simply pop the first plastic cover off. This is super-easy to do without damaging anything. Going further than that is tricky to keep it all intact.

Analog Discover Pro Teardown

Sat, 17 Apr 2021 16:14:13 +0000

NOTE: This was going to be a twitter thread but twitter was down? So this is a lazy blog post…

Analog Discovery Pro (from Digilent Website)

Anyone used to Digilent would expect this to be based on Zynq or similar - the fact the device has USB + ethernet ports makes it a pretty much sure thing! Taking the screws off the bottom gives us this view:

Experimenting with Metastability and Multiple Clocks on FPGAs

Sat, 26 Dec 2020 22:58:43 +0000

NOTE: This article appeared in Issue 293 of Circuit Cellar, back in December 2014. I’ve posted it here for your reading pleasure as well. References to previous articles are for Circuit Cellar Issues, as this was originally written for the print publication. This version differs slightly from the print version – this is my own ‘author copy’ version before the Circuit Cellar editing. References to “ProgrammableLogicInPractice.com” are broken for now, but material has been mirrored to the bottom of this page.

BAM BAM!! On Reliability of EMFI for in-situ Automotive ECU Attacks

Sun, 08 Nov 2020 21:50:11 +0000

This post is a summary of some work on an accepted paper for ESCAR EU 2020. This work was demonstration on certain NXP chips & GM ECUs, but the idea of both the attack & understanding how portable results are is applicable across the entire domain.

NOTE TO CAR TUNERS: I won’t perform this for hire on your ECU, please don’t email me asking this. The cost for me to do this type of work under hire would also be many times the HPTuners fee, and without any of of the actual tuning interface (I’m only attacking the bootloader, I never ever built a reflash tool that would be needed, yet alone the mapping work etc).

FPGA Board Design Tips

Tue, 04 Aug 2020 16:33:34 +0000

NOTE: This article appeared in Issue 315 of Circuit Cellar, back in October 2016. I’ve posted it here for your reading pleasure as well. References to previous articles are for Circuit Cellar Issues, as this was originally written for the print publication. This version differs slightly from the print version - this is my own ‘author copy’ version before the Circuit Cellar editing.

Back in December 2015, I discussed how I solder BGA devices (such as FPGAs) using a low-cost reflow oven. This article will discuss the design of the FPGA board itself, which you could then assemble using the tips in my previous article.

Square Terminal Teardown

Mon, 06 Apr 2020 13:30:57 +0000

Part-way through the Square Terminal Teardown

I recently tore down a square terminal (the one with the LCD screen) and wanted to share some of these results. I haven’t photographed everything as was mostly interested in how the secure areas of it are down. You can see an overview in the following video if you want to see how the whole thing fits together.

https://www.youtube.com/watch?v=pB8T5wZJLcM

Teardown of Square Terminal Video

Amazon Echo Dot Gen 3 - Microphone Disable Circuitry

Sat, 18 Jan 2020 17:36:11 +0000

Have you been interested in the Echo Dot device? One feature they mention is that there is a microphone off button. I spent a few hours reverse engineering this, and recorded (in un-edited glory) the process:

https://youtu.be/xH8LnK9hh6w

The resulting schematic is shown below:

The astute reader will note the only pin under direct control allows the disabling of the microphone, it cannot re-enable it. However - there is one more loophole to check.

A Call for Time Travel Resistant Cryptography (TTRC)

Thu, 19 Sep 2019 02:16:08 +0000

At CHES 2019 [rump session], I presented my revolutionary talk on Time Travel Resistant Cryptography (TTRC). This is a hugely important area of research that has been widely ignored in academic work, and it’s time to finally make this right.

Why is this so critical? While Post Quantum Cryptography (PQC) gets NIST contests, and invested companies, nobody is considering TTRC. The general thought-process of PQC is that the existence of sufficiently powerful quantum computers is an open problem with no clear solution. BUT - if someone solves that problem (that is unclear is even physically possible to solve), it’s going to be hell on Earth for crypto implementations. Better safe than sorry.

USB Triggering & Hacking

Mon, 02 Sep 2019 01:50:39 +0000

This blog post covers several topics that I should have made independent posts about… but anyway. Here we are. It’s September and I should have done this months ago.

Trezor / USB Hacking Updates (Black Hat + WOOT)

I had an earlier blog post with details of the Trezor attack. It turns out this is more generic type of attack than I realized, so I extended this work into a WOOT paper as well. Quickly I thought I should update on that…

FICHSA ChipWhisperer Tutorial Requirements

Mon, 06 May 2019 11:31:39 +0000

At the FICHSA Conference (
https://fichsa.sise.bgu.ac.il ) I will be running a short workshop on ChipWhisperer using the ChipWhisperer-Nano.

A direct link to a Google Doc with the most up to date information is available here: https://docs.google.com/document/d/1IgDeGZ6d0FEYJbaF4a-KsBhdIHlMZg04-wQYUSZgnks/edit?usp=sharing

If you want to fully play along, please bring a laptop with the following installed and setup:

VirtualBox 5.x (5.2.28 is latest supported). You CANNOT use VirtualBox 6 due to some unknown incompatibility.
VirtualBox Extension pack for version you installed (direct link to 5.2.28, does not depend on the host OS).

I will be (hopefully) posting a VirtualBox image once one is fully updated.

Glitching Trezor using EMFI Through The Enclosure

Wed, 06 Mar 2019 15:13:45 +0000

As mentioned on the Trezor blog post, their latest security patch fixes a flaw I disclosed to them in Jan 2019. This flaw meant an attacker with physical access to the wallet can find the recovery seed stored in FLASH, and leave no evidence of tampering.

This work was heavily inspired by the wallet.fail disclosure - I’m directly dumping FLASH instead of forcing the flash erase then dumping from SRAM, so the results are the same but with a different path. It also has the same limitations - if you used a password protected recovery seed you can’t dump that.