i3Detroit - User contributions [en]

Red Bull Creation 2013

2013-04-07T21:40:21Z

Emerrill: /* Package */

== Package ==

The "Let there be light" package: 
[[File:RBC2013Box.jpg|600px]]

Contents: 
[[File:RBC2013Contents.jpg|600px]]
# - Bull Shield
# - 1m LED Strip http://www.adafruit.com/products/1138
# - 1 spool http://www.adafruit.com/products/346

== Major Parts ==

The Game Board provided for the Red Bull Creation 2013 qualifier has the following major parts BOM.

[[File:RBC2013GameBoardLabeled.jpg|1000px]]
# - 9R030 AA 02 D106 [30V N-Channel logic level MOSFET] http://www.nxp.com/products/mosfets/standard_mosfets/PSMN9R0-30LL.html#section_discontinued
# - PIC24FJ64GA002 (1xDMX 0x54 and 1xADDR 0x53)) http://www.microchip.com/wwwproducts/Devices.aspx?dDocName=en026374
# - PCA9685PW [I2C PWM LED controller] http://www.nxp.com/products/automotive/display_instrumentation/led_controllers/PCA9685PW.html#Q900
# - PIC16F1827 (RGB 0x51 and 0x52) http://www.microchip.com/wwwproducts/Devices.aspx?dDocName=en538963
# - 24LC512 (EEPROM 0x50) http://www.microchip.com/wwwproducts/Devices.aspx?dDocName=en010828
# - ADT7410 TRZ (TEMP 0x48) http://www.analog.com/static/imported-files/data_sheets/ADT7410.pdf
# - PA9512B [I2C Buffer] http://www.nxp.com/documents/data_sheet/PCA9512A_PCA9512B.pdf
# - Ti YE04 2BK AYGZ [4-bit bidirectional voltage level translator] http://pdf1.alldatasheet.com/datasheet-pdf/view/257049/TI/YE04.html
# - KXTI9 2073F (ACCL 0x0F) http://www.kionix.com/accelerometers/kxti9
# - VN12 28M AH2F [3.3V RS485 transceiver SN75HVD12] http://www.ti.com/lit/ds/symlink/sn65hvd12.pdf
# - CTS23CB3 8M0000 [8MHz Crystal]
# - APE1 (DAC 0x62) [12-bit Digital-to-Analog Converter with EEPROM Memory] http://ww1.microchip.com/downloads/en/DeviceDoc/22039d.pdf
# - 1086 33 6K0DL031 [1.5A Low Dropout Voltage Regulator] http://pdf1.alldatasheet.com/datasheet-pdf/view/70293/LINER/LT1086.html

== EEPROM Dump ==
The EEPROM starts with: "What happens when you read out an I2C EEPROM in reverse?<NL>" Followed by "LO" repeated 32336 times, with a "L<NL>" after that. Then:

<blockquote><code>!uoy truh dna eil a llet annog reveeN 
ybdoog yas annog reveN 
yrc uoy ekam annog reveN 
uoy tresed dna dnuora nur annog reveN 
nwod uoy tel annog reveN 
pu uoy evig annog reveN 
ees ot dnilb oot er'uoy em llet t'noD 
gnileef m'I woh em ksa uoy fi dnA 
ti yalp annog er'ew dna emag eht wonk eW 
no gniog neeb s'tahw wonk htob ew edisnI 
ti yas ot yhs oot er'uoY 
tub gnihca neeb s'traeh ruoY 
gnol os rof rehto hcae nwonk ev'eW 
uoy truh dna eil a llet annog reveN 
eybdoog yas annog reveN 
yrc uoy ekam annog reveN 
uoy tresed dna dnuora nur annog reveN 
nwod uoy tel annog reveN 
pu uoy evig annog reveN 
dnatsrednu uoy ekam attoG 
gnileef m'I woh uoy llet annaw tsuj I 
yug rehto yna morf siht teg t'ndluow uoY 
fo gnikniht m'I tahw s'tnemtimmoc lluf A 
I od os dna selur eht wonk uoY 
evol ot sregnarts on er'eW</code></blockquote>

Which reverses to:
<blockquote><code>
We're no strangers to love 
You know the rules and so do I 
A full commitment's what I'm thinking of 
You wouldn't get this from any other guy 
I just wanna tell you how I'm feeling 
Gotta make you understand 
Never gonna give you up 
Never gonna let you down 
Never gonna run around and desert you 
Never gonna make you cry 
Never gonna say goodbye 
Never gonna tell a lie and hurt you 
We've known each other for so long 
Your heart's been aching but 
You're too shy to say it 
Inside we both know what's been going on 
We know the game and we're gonna play it 
And if you ask me how I'm feeling 
Don't tell me you're too blind to see 
Never gonna give you up 
Never gonna let you down 
Never gonna run around and desert you 
Never gonna make you cry 
Never gonna say goodby 
Neever gonna tell a lie and hurt you!</code></blockquote>

File:RBC2013Contents.jpg

2013-04-07T21:39:48Z

Emerrill:

File:RBC2013Box.jpg

2013-04-07T21:39:14Z

Emerrill:

Red Bull Creation 2013

2013-04-07T21:36:31Z

Red Bull Creation 2013

2013-04-07T21:10:53Z

Emerrill: Blanked the page

2011-04-03T17:01:36Z

Emerrill:

==Ongoing Work==
*Audio storage chip unmounted and placed in breakout for data dump
*Possibly place audio storage in empty chip location
*Trying to get a X-Ray
*JTAG dump PICs

==Findings==
===The Password===
Under-the-Foam password: <code>JMT479</code>

===Board Layout===
[[File:Image01.jpg|450px]]
# - ATMega - runs the ‘video game’
# - PIC33FJ64 - Runs the audio headphone output
# - PIC24FJ64 - Runs USB Mass Storage
# - PIC - Runs TTY out and 2 morse code LEDs
# - 16Mb Serial Storage device - for storing audio files
# - Analog Devices chip that runs video output
Each PIC has a pogo-pin JTAG port which still needs exploring.

===Morse Code===
Two blue LEDs on the board were connected to a small microcontroller and blinked in a seemingly erratic pattern. We all agreed that these blinks looked like Morse Code, but none of us knew Morse Code... so we winged it. After utilizing an advanced logic sniffer to decode the dits and dahs (we’re aware of the irony) the short message decoded to <code>48007e2</code> and the longer message decoded to <code>WinstonChurchill</code>. Both of these hints gave us a part of the solution to other hidden gems, or they would have if we didn’t figure them out through other means first.

===USB Storage===
Upon plugging the device into a computer, we found that USB provided more than just power, It offered the computer a tiny mass storage device containing two files.
CLUE.TXT:
<blockquote><code>Looking for a password?!

He might have enlisted Bletchly Park to figure it out, but you've probably got what it takes... and it's not "SamuelMorse" either.

Good luck with this mystery inside an enigma!</code></blockquote>

In retrospect, this clue was likely directing us to look at the blinkenlights on the board. In actuality, we tapped into the near encyclopedic knowledge of crypto history in our group and quickly found the password to the encrypted text file.

Encrypted zip file (password: WinstonChurchill):
<blockquote><code>K, that was an easy one… but you’re not there just yet.

The riddle that ol’ Winston mentioned was Russia, but we’re talking about a different kind of puzzle altogether.

Somewhere in this box there is another password, this time for a website.

Poke, probe, and hack away at this circuit board… it’s an egg hunt.

When you find the url and the password… go tell us what else you’ve found along the way.

Good luck for real this time… you’ll need it!</code></blockquote>

Not too much to say on this one, we decrypted the zip, read the file, tore back the foam and found...exactly the same thing we did when the video game section told us to do it an hour earlier!

===TTL Serial Port===
By attaching a logic analyzer to the TTL and GND pads (this was before we know the baud rate and config given by the morse code lights), we were able to decode:

<blockquote><code>Strong work. Now peel up the foam that was under the circuit board to get a password to the website.</code></blockquote>

The baud rate was hinted at in the Morse Code message, however as previously stated, none of us were familiar with it so we did it the hard way. Brute force is sometimes the best way!

===Headphone Jack===
When we plugged a pair of headphones into the audio jack connected to chip 2, we heard a digitized voice spell out <code>LOOKDONTLISTEN</code> into our right ear while crazy static blasted us in the left. While still much less grating than listening to Rick Astley, it wasn’t very understandable, at least until one of our members walked into the room and upon hearing the sound declared “I hear shapes!” After our team ensured that he was of sound mind, we recorded the audio signal, passed it through a spectrum analyzer and dropped our jaws as the image below took shape on our screen, clearly indicating the ownership of our bulls.

Right channel - Robot voice that spells out: <code>LOOKDONTLISTEN</code>

Left channel - Audio, using spectrum analysis you see: All your bulls are belong to us

[[file:Image04.jpg|450px]]

====Extra Audio Pads====
Extra audio pads (1 and 2 below) are 180 degrees out of phase of their neighbor.

Provides a possible balanced output.

[[file:Image10.jpg|450px]]

====Extra Audio Tracks====
Solder pads (3 and 4 above) allow you to select between different audio tracks, which give the outputs below. When you select different channels, the LED attached to the audio PIC changes from a 60% duty cycle to a 30% duty cycle. Significance of this is unknown.

1 - Audio Image - BAD RABBY - who appears to be the be the designer of the board!

[[file:Image08.jpg|450px]]

2 - Audio Image - Rick Astley

[[file:Image06.jpg|450px]]

3 - Double Rainbow audio

===Video Game/TV===
Powering up or resetting the board causes the “Red Bull Creation” screen to appear as well as a jaunty tune (Never Gonna Give You Up). After entering “The Code” (Up, Up, Down, Down, Left, Right, Left, Right, Start) the display cycles through the following not so secret screens including a series of codes at the bottom of the screen. When converted from hexadecimal values to ASCII, they spelled <code>PEEL THE FOAM</code> and <code>SUP, GOLD DIGGA?</code> before advancing to a stern talking to from HAL followed by what we have dubbed as the “Kill Screen” despite this game being a far cry from Donkey Kong.

[[file:Image09.png|200px]]
[[file:Image12.png|200px]]
[[file:Image07.png|200px]]

[[file:Image05.png|200px]]
[[file:Image11.png|200px]]
[[file:Image00.png|200px]]

===Board Text===
Silkscreened on the board was the cryptic string <code>U2V0ZWMgQXN0cm9ub215</code> but did not require any magic box to convert this Base64 encoded string back to “Setec Astronomy”.

<code>U2V0ZWMgQXN0cm9ub215</code> - Base64 encode of <code>Setec Astronomy</code>

===Dumped JTAG of ATMega===
We found nothing interesting so far

===Empty Chip Pads===
[[file:Image02.jpg|450px]]

Pin connections match that of the serial storage device connected to the audio driving PIC. The USB PIC does not seem to poll for this chips existence though (no activity seen on CS, CLK, or DIN), which indicates the code on the USB PIC was not extended to use it. Maybe previous plan was to do the mass storage on an external storage device, but ultimately it was decided to do it with the PICs internal memory? Still may move serial storage there and see if anything happens.

There are also empty pads in the top right of this image (not numbered). When shorted it ties ground to a input pin of the USB chip. No noticeable effect.

===Empty pads near middle of board===
[[file:Image03.jpg|450px]]

Seems to just be a place for a possible additional, larger, decoupling cap - runs from VCC to ground plane.

Red Bull Creation 2011

2011-04-03T17:00:58Z

Emerrill:

==Ongoing Work==
*Audio storage chip unmounted and placed in breakout for data dump
*Possibly place audio storage in empty chip location
*Trying to get a X-Ray
*JTAG dump PICs

==Findings==
===Board Layout===
[[File:Image01.jpg|450px]]
# - ATMega - runs the ‘video game’
# - PIC33FJ64 - Runs the audio headphone output
# - PIC24FJ64 - Runs USB Mass Storage
# - PIC - Runs TTY out and 2 morse code LEDs
# - 16Mb Serial Storage device - for storing audio files
# - Analog Devices chip that runs video output
Each PIC has a pogo-pin JTAG port which still needs exploring.

===Morse Code===
Two blue LEDs on the board were connected to a small microcontroller and blinked in a seemingly erratic pattern. We all agreed that these blinks looked like Morse Code, but none of us knew Morse Code... so we winged it. After utilizing an advanced logic sniffer to decode the dits and dahs (we’re aware of the irony) the short message decoded to <code>48007e2</code> and the longer message decoded to <code>WinstonChurchill</code>. Both of these hints gave us a part of the solution to other hidden gems, or they would have if we didn’t figure them out through other means first.

===USB Storage===
Upon plugging the device into a computer, we found that USB provided more than just power, It offered the computer a tiny mass storage device containing two files.
CLUE.TXT:
<blockquote><code>Looking for a password?!

He might have enlisted Bletchly Park to figure it out, but you've probably got what it takes... and it's not "SamuelMorse" either.

Good luck with this mystery inside an enigma!</code></blockquote>

In retrospect, this clue was likely directing us to look at the blinkenlights on the board. In actuality, we tapped into the near encyclopedic knowledge of crypto history in our group and quickly found the password to the encrypted text file.

Encrypted zip file (password: WinstonChurchill):
<blockquote><code>K, that was an easy one… but you’re not there just yet.

The riddle that ol’ Winston mentioned was Russia, but we’re talking about a different kind of puzzle altogether.

Somewhere in this box there is another password, this time for a website.

Poke, probe, and hack away at this circuit board… it’s an egg hunt.

When you find the url and the password… go tell us what else you’ve found along the way.

Good luck for real this time… you’ll need it!</code></blockquote>

Not too much to say on this one, we decrypted the zip, read the file, tore back the foam and found...exactly the same thing we did when the video game section told us to do it an hour earlier!

===TTL Serial Port===
By attaching a logic analyzer to the TTL and GND pads (this was before we know the baud rate and config given by the morse code lights), we were able to decode:

<blockquote><code>Strong work. Now peel up the foam that was under the circuit board to get a password to the website.</code></blockquote>

The baud rate was hinted at in the Morse Code message, however as previously stated, none of us were familiar with it so we did it the hard way. Brute force is sometimes the best way!

===Headphone Jack===
When we plugged a pair of headphones into the audio jack connected to chip 2, we heard a digitized voice spell out <code>LOOKDONTLISTEN</code> into our right ear while crazy static blasted us in the left. While still much less grating than listening to Rick Astley, it wasn’t very understandable, at least until one of our members walked into the room and upon hearing the sound declared “I hear shapes!” After our team ensured that he was of sound mind, we recorded the audio signal, passed it through a spectrum analyzer and dropped our jaws as the image below took shape on our screen, clearly indicating the ownership of our bulls.

Right channel - Robot voice that spells out: <code>LOOKDONTLISTEN</code>

Left channel - Audio, using spectrum analysis you see: All your bulls are belong to us

[[file:Image04.jpg|450px]]

====Extra Audio Pads====
Extra audio pads (1 and 2 below) are 180 degrees out of phase of their neighbor.

Provides a possible balanced output.

[[file:Image10.jpg|450px]]

====Extra Audio Tracks====
Solder pads (3 and 4 above) allow you to select between different audio tracks, which give the outputs below. When you select different channels, the LED attached to the audio PIC changes from a 60% duty cycle to a 30% duty cycle. Significance of this is unknown.

1 - Audio Image - BAD RABBY - who appears to be the be the designer of the board!

[[file:Image08.jpg|450px]]

2 - Audio Image - Rick Astley

[[file:Image06.jpg|450px]]

3 - Double Rainbow audio

===Video Game/TV===
Powering up or resetting the board causes the “Red Bull Creation” screen to appear as well as a jaunty tune (Never Gonna Give You Up). After entering “The Code” (Up, Up, Down, Down, Left, Right, Left, Right, Start) the display cycles through the following not so secret screens including a series of codes at the bottom of the screen. When converted from hexadecimal values to ASCII, they spelled <code>PEEL THE FOAM</code> and <code>SUP, GOLD DIGGA?</code> before advancing to a stern talking to from HAL followed by what we have dubbed as the “Kill Screen” despite this game being a far cry from Donkey Kong.

[[file:Image09.png|200px]]
[[file:Image12.png|200px]]
[[file:Image07.png|200px]]

[[file:Image05.png|200px]]
[[file:Image11.png|200px]]
[[file:Image00.png|200px]]

===Board Text===
Silkscreened on the board was the cryptic string <code>U2V0ZWMgQXN0cm9ub215</code> but did not require any magic box to convert this Base64 encoded string back to “Setec Astronomy”.

<code>U2V0ZWMgQXN0cm9ub215</code> - Base64 encode of <code>Setec Astronomy</code>

===Dumped JTAG of ATMega===
We found nothing interesting so far

===Empty Chip Pads===
[[file:Image02.jpg|450px]]

Pin connections match that of the serial storage device connected to the audio driving PIC. The USB PIC does not seem to poll for this chips existence though (no activity seen on CS, CLK, or DIN), which indicates the code on the USB PIC was not extended to use it. Maybe previous plan was to do the mass storage on an external storage device, but ultimately it was decided to do it with the PICs internal memory? Still may move serial storage there and see if anything happens.

There are also empty pads in the top right of this image (not numbered). When shorted it ties ground to a input pin of the USB chip. No noticeable effect.

===Empty pads near middle of board===
[[file:Image03.jpg|450px]]

Seems to just be a place for a possible additional, larger, decoupling cap - runs from VCC to ground plane.

Red Bull Creation 2011

2011-04-03T17:00:29Z

Emerrill:

==Ongoing Work==
*Audio storage chip unmounted and placed in breakout for data dump
*Possibly place audio storage in empty chip location
*Trying to get a X-Ray

==Findings==
===Board Layout===
[[File:Image01.jpg|450px]]
# - ATMega - runs the ‘video game’
# - PIC33FJ64 - Runs the audio headphone output
# - PIC24FJ64 - Runs USB Mass Storage
# - PIC - Runs TTY out and 2 morse code LEDs
# - 16Mb Serial Storage device - for storing audio files
# - Analog Devices chip that runs video output
Each PIC has a pogo-pin JTAG port which still needs exploring.

===Morse Code===
Two blue LEDs on the board were connected to a small microcontroller and blinked in a seemingly erratic pattern. We all agreed that these blinks looked like Morse Code, but none of us knew Morse Code... so we winged it. After utilizing an advanced logic sniffer to decode the dits and dahs (we’re aware of the irony) the short message decoded to <code>48007e2</code> and the longer message decoded to <code>WinstonChurchill</code>. Both of these hints gave us a part of the solution to other hidden gems, or they would have if we didn’t figure them out through other means first.

===USB Storage===
Upon plugging the device into a computer, we found that USB provided more than just power, It offered the computer a tiny mass storage device containing two files.
CLUE.TXT:
<blockquote><code>Looking for a password?!

He might have enlisted Bletchly Park to figure it out, but you've probably got what it takes... and it's not "SamuelMorse" either.

Good luck with this mystery inside an enigma!</code></blockquote>

In retrospect, this clue was likely directing us to look at the blinkenlights on the board. In actuality, we tapped into the near encyclopedic knowledge of crypto history in our group and quickly found the password to the encrypted text file.

Encrypted zip file (password: WinstonChurchill):
<blockquote><code>K, that was an easy one… but you’re not there just yet.

The riddle that ol’ Winston mentioned was Russia, but we’re talking about a different kind of puzzle altogether.

Somewhere in this box there is another password, this time for a website.

Poke, probe, and hack away at this circuit board… it’s an egg hunt.

When you find the url and the password… go tell us what else you’ve found along the way.

Good luck for real this time… you’ll need it!</code></blockquote>

Not too much to say on this one, we decrypted the zip, read the file, tore back the foam and found...exactly the same thing we did when the video game section told us to do it an hour earlier!

===TTL Serial Port===
By attaching a logic analyzer to the TTL and GND pads (this was before we know the baud rate and config given by the morse code lights), we were able to decode:

<blockquote><code>Strong work. Now peel up the foam that was under the circuit board to get a password to the website.</code></blockquote>

The baud rate was hinted at in the Morse Code message, however as previously stated, none of us were familiar with it so we did it the hard way. Brute force is sometimes the best way!

===Headphone Jack===
When we plugged a pair of headphones into the audio jack connected to chip 2, we heard a digitized voice spell out <code>LOOKDONTLISTEN</code> into our right ear while crazy static blasted us in the left. While still much less grating than listening to Rick Astley, it wasn’t very understandable, at least until one of our members walked into the room and upon hearing the sound declared “I hear shapes!” After our team ensured that he was of sound mind, we recorded the audio signal, passed it through a spectrum analyzer and dropped our jaws as the image below took shape on our screen, clearly indicating the ownership of our bulls.

Right channel - Robot voice that spells out: <code>LOOKDONTLISTEN</code>

Left channel - Audio, using spectrum analysis you see: All your bulls are belong to us

[[file:Image04.jpg|450px]]

====Extra Audio Pads====
Extra audio pads (1 and 2 below) are 180 degrees out of phase of their neighbor.

Provides a possible balanced output.

[[file:Image10.jpg|450px]]

====Extra Audio Tracks====
Solder pads (3 and 4 above) allow you to select between different audio tracks, which give the outputs below. When you select different channels, the LED attached to the audio PIC changes from a 60% duty cycle to a 30% duty cycle. Significance of this is unknown.

1 - Audio Image - BAD RABBY - who appears to be the be the designer of the board!

[[file:Image08.jpg|450px]]

2 - Audio Image - Rick Astley

[[file:Image06.jpg|450px]]

3 - Double Rainbow audio

===Video Game/TV===
Powering up or resetting the board causes the “Red Bull Creation” screen to appear as well as a jaunty tune (Never Gonna Give You Up). After entering “The Code” (Up, Up, Down, Down, Left, Right, Left, Right, Start) the display cycles through the following not so secret screens including a series of codes at the bottom of the screen. When converted from hexadecimal values to ASCII, they spelled <code>PEEL THE FOAM</code> and <code>SUP, GOLD DIGGA?</code> before advancing to a stern talking to from HAL followed by what we have dubbed as the “Kill Screen” despite this game being a far cry from Donkey Kong.

[[file:Image09.png|200px]]
[[file:Image12.png|200px]]
[[file:Image07.png|200px]]

[[file:Image05.png|200px]]
[[file:Image11.png|200px]]
[[file:Image00.png|200px]]

===Board Text===
Silkscreened on the board was the cryptic string <code>U2V0ZWMgQXN0cm9ub215</code> but did not require any magic box to convert this Base64 encoded string back to “Setec Astronomy”.

<code>U2V0ZWMgQXN0cm9ub215</code> - Base64 encode of <code>Setec Astronomy</code>

===Dumped JTAG of ATMega===
We found nothing interesting so far

===Empty Chip Pads===
[[file:Image02.jpg|450px]]

Pin connections match that of the serial storage device connected to the audio driving PIC. The USB PIC does not seem to poll for this chips existence though (no activity seen on CS, CLK, or DIN), which indicates the code on the USB PIC was not extended to use it. Maybe previous plan was to do the mass storage on an external storage device, but ultimately it was decided to do it with the PICs internal memory? Still may move serial storage there and see if anything happens.

There are also empty pads in the top right of this image (not numbered). When shorted it ties ground to a input pin of the USB chip. No noticeable effect.

===Empty pads near middle of board===
[[file:Image03.jpg|450px]]

Seems to just be a place for a possible additional, larger, decoupling cap - runs from VCC to ground plane.