Red Bull Creation 2011 - Revision history

Cmounts: /* Structure Analysis Attempts */

2012-06-24T20:47:24Z

Structure Analysis Attempts

Red stapler at 03:14, 5 April 2011

2011-04-05T03:14:16Z

Emerrill: /* Dump of SPI Storage Chip */

2011-04-05T00:58:41Z

Dump of SPI Storage Chip

Emerrill at 23:42, 4 April 2011

2011-04-04T23:42:32Z

Emerrill: /* Dump of SPI Storage Chip */

2011-04-04T23:38:25Z

Dump of SPI Storage Chip

Emerrill: /* Dump of SPI Storage Chip */

2011-04-04T23:33:58Z

Dump of SPI Storage Chip

Emerrill: /* Dump of SPI Storage Chip */

2011-04-04T23:32:54Z

Dump of SPI Storage Chip

Emerrill at 23:31, 4 April 2011

2011-04-04T23:31:35Z

Emerrill at 21:38, 4 April 2011

2011-04-04T21:38:30Z

Emerrill at 21:36, 4 April 2011

2011-04-04T21:36:54Z

← Older revision		Revision as of 20:47, 24 June 2012
Line 124:		Line 124:

	Unfortunately since we couldn't get an X-Ray image in time, we tried some less conventional approaches including heating the board with a heat gun while watching it with a thermal camera to detect heat absorption variations, shining a bright light through it for an extended period with a long exposure photograph, waving it around RFID readers and more. Unfortunately, none of our approaches turned up anything interesting, but who knows for the next challenge!		Unfortunately since we couldn't get an X-Ray image in time, we tried some less conventional approaches including heating the board with a heat gun while watching it with a thermal camera to detect heat absorption variations, shining a bright light through it for an extended period with a long exposure photograph, waving it around RFID readers and more. Unfortunately, none of our approaches turned up anything interesting, but who knows for the next challenge!
		+	[[Category:Projects]][[Category:Group Projects]][[Category:Completed Projects]]

@@ Line 15: / Line 15: @@
 # - 16Mb SPI Storage device - for storing audio files
 # - Analog Devices chip that runs video output
-Each PIC has a pogo-pin JTAG port which still needs exploring.
+Each PIC has a pogo-pin JTAG port which still need exploring.
 ===Morse Code===
@@ Line 21: / Line 21: @@
 ===USB Storage===
-Upon plugging the device into a computer, we found that USB provided more than just power, It offered the computer a tiny mass storage device containing two files.
+Upon plugging the device into a computer, we found that USB provided more than just power, it offered the computer a tiny mass storage device containing two files.
 CLUE.TXT:
 <blockquote><code>Looking for a password?!
@@ Line 51: / Line 51: @@
 <blockquote><code>Strong work.  Now  peel  up  the  foam  that  was  under  the  circuit  board  to  get  a  password  to  the  website.</code></blockquote>
-The baud rate was hinted at in the Morse Code message, however as previously stated, none of us were familiar with it so we did it the hard way. Brute force is sometimes the best way!
+The baud rate was hinted at in the Morse Code message, however as previously stated, none of us were familiar with Morse Code so we did it the hard way. Brute force is sometimes the best way!
 ===Headphone Jack===
-When we plugged a pair of headphones into the audio jack connected to chip 2, we heard a digitized voice spell out <code>LOOKDONTLISTEN</code> into our right ear while crazy static blasted us in the left. While still much less grating than listening to Rick Astley, it wasn’t very understandable, at least until one of our members walked into the room and upon hearing the sound declared “I hear shapes!” After our team ensured that he was of sound mind, we recorded the audio signal, passed it through a spectrum analyzer and dropped our jaws as the image below took shape on our screen, clearly indicating the ownership of our bulls.
+When we plugged a pair of headphones into the audio jack connected to chip 2, we heard a digitized voice spell out <code>LOOKDONTLISTEN</code> into our right ear while crazy static blasted us in the left. While still much less grating than listening to Rick Astley, it wasn’t very understandable. At least it was until one of our members walked into the room and upon hearing the noise track declared, “I hear shapes!” After our team ensured that he was of sound mind, we recorded the audio signal, passed it through a spectrum analyzer and dropped our jaws as the image below took shape on our screen, clearly indicating the ownership of our bulls.
 Right channel - Robot voice that spells out: <code>LOOKDONTLISTEN</code>
@@ Line 63: / Line 63: @@
 ====Extra Audio Pads====
-Extra audio pads (1 and 2 below) are 180 degrees out of phase of their neighbor.
+Beside the two pads that connected the audio PIC to the headphone jack were a pair of unconnected pads (1 and 2 below.) Looking at them on an oscilloscope, they appeared to be a clone of the audio signal but 180 degrees out of phase. Our best guess at this point is that they are vestigial, and were intended to produce a balanced output, but in the final design were no longer needed. Feel free to tweet us if you figure out a better reason for these pads!
-−
-Provides a possible balanced output.
 [[file:Image10.jpg|450px]]
 ====Extra Audio Tracks====
-Solder pads (3 and 4 above) allow you to select between different audio tracks, which give the outputs below. When you select different channels, the LED attached to the audio PIC changes from a 60% duty cycle to a 30% duty cycle. Significance of this is unknown.
+When the board originally arrived, the two solder pads (3 and 4 above) had nothing attached. When presented with situations like this, the wise words of Dr. Zoidberg come to mind, "I'm a surgeon; when I see two body parts I sew them together and see what happens!" If that's not a ringing endorsement of blindly bridging unknown pads, it's hard to imagine something that is! Upon attaching the lovely blue wires you see in the photo to the pads and connecting them together, two interesting things became immediately apparent: the LED attached to the audio PIC changed from a 60% duty cycle to a 30% duty cycle and we were informed that double rainbows are quite intense. By shorting 1 pad, then the other, then both, we were able to find a total of 3 additional audio tracks in addition to the "All Your Bulls" track above, where two were images encoded the same way as the image above and the third was a short audio clip from the double rainbow video. We're currently unsure why the LED blinking changes when these pads are utilized, but we're assuming that it's for testing. It would be easier to power the board before shipping and check for the fast blinking LED than to listen to the audio on each one to ensure there were no shorts on these two key pads. If you've got a better explanation, again, tweet us your thoughts!
 - Audio Image - BAD RABBY - who appears to be the be the designer of the board!
@@ Line 95: / Line 93: @@
 ===Board Text===
-Silkscreened on the board was the cryptic string <code>U2V0ZWMgQXN0cm9ub215</code> but did not require any magic box to convert this Base64 encoded string back to “Setec Astronomy”.
+Silkscreened on the board was the cryptic string, <code>U2V0ZWMgQXN0cm9ub215</code> but did not require any magic box to convert this Base64 encoded string back to “Setec Astronomy”. (If you don't get it, go watch the movie Sneakers. You'll thank us later.)
 <code>U2V0ZWMgQXN0cm9ub215</code> - Base64 encode of <code>Setec Astronomy</code>
 ===Dump of SPI Storage Chip===
-A full dump of the SPI storage chip (16Mb) was created by desoldering it, and using a Bus Pirate to directly communicate with it. After getting a complete dump and examining it's contents, there are 4 audio files (which we had captured above), as well as a plain text credits at address 0x1AF300. The dump process produced a high rate of errors, so the chip was copied and compared multiple times to complete a clean copy.
+A full dump of the SPI storage chip (16Mb) was created by desoldering it and using a Bus Pirate to directly communicate with it. After getting a complete dump and examining its contents, there were found to be 4 audio files (which we had captured above), as well as plain text credits at address 0x1AF300. The dump process produced a high rate of errors, so the chip was copied and compared multiple times to complete a clean duplicate.
 [[file:IMG_2329.sm.jpg|450px]]
-The full dump can be downloaded here [[file:RedBull.Spi.bin]].
+The full dump can be downloaded here: [[file:RedBull.Spi.bin]].
 ===Empty Chip Pads===
 [[file:Image02.jpg|450px]]
-Pin connections match that of the serial storage device connected to the audio driving PIC. The USB PIC does not seem to poll for this chips existence though (no activity seen on CS, CLK, or DIN), which indicates the code on the USB PIC was not extended to use it. Maybe previous plan was to do the mass storage on an external storage device, but ultimately it was decided to do it with the PICs internal memory? Moved SPI storage here, no effect.
+The pin connections on these pads match that of the serial storage device connected to the audio driving PIC. The USB PIC does not seem to poll for this chips existence though (no activity seen on CS, CLK, or DIN), which indicates the code on the USB PIC was not extended to use it. We theorized that previous plans included doing the mass storage on an external storage chip, but ultimately it was decided to do it with the PICs internal memory. Despite the indications, we tried moving the SPI storage chip here in case additional files were embedded in it that would be revealed by the mass storage PIC, but no effect was observable.
-There are also empty pads in the top right of this image (not numbered). When shorted it ties ground to a input pin of the USB chip. No noticeable effect.
+There were also empty pads in the top right of this image (not numbered). When shorted it ties ground to a input pin of the USB chip. Given our prior success shorting random pads together, we tried bridging it but found no observable effect.
-===Empty pads near middle of board===
+===Empty Pads Near Middle of Board===
 [[file:Image03.jpg|450px]]
-Seems to just be a place for a possible additional, larger, decoupling cap - runs from VCC to ground plane.
+This pad seems to just be a place for an additional, larger decoupling cap as it runs from VCC to ground plane.

@@ Line 105: / Line 105: @@
 A full dump of the SPI storage chip (16Mb) was created by desoldering it, and using a Bus Pirate to directly communicate with it. After getting a complete dump and examining it's contents, there are 4 audio files (which we had captured above), as well as a plain text credits at address 0x1AF300. The dump process produced a high rate of errors, so the chip was copied and compared multiple times to complete a clean copy.
 [[file:IMG_2329.sm.jpg|450px]]
 ===Empty Chip Pads===

@@ Line 13: / Line 13: @@
 # - PIC24FJ64 - Runs USB Mass Storage
 # - PIC - Runs TTY out and 2 morse code LEDs
-# - 16Mb Serial Storage device - for storing audio files
+# - 16Mb SPI Storage device - for storing audio files
 # - Analog Devices chip that runs video output
 Each PIC has a pogo-pin JTAG port which still needs exploring.

@@ Line 103: / Line 103: @@
 ===Dump of SPI Storage Chip===
-A full dump of the SPI storage chip (16Mb) was created by desoldering it, and using a Bus Pirate to directly communicate with it. After getting a complete dump and examining it's contents, there are 4 audio files (which we had captured above), as well as a plain text credits at address 0x1AF300.
+A full dump of the SPI storage chip (16Mb) was created by desoldering it, and using a Bus Pirate to directly communicate with it. After getting a complete dump and examining it's contents, there are 4 audio files (which we had captured above), as well as a plain text credits at address 0x1AF300. The dump process produced a high rate of errors, so the chip was copied and compared multiple times to complete a clean copy.
 [[file:IMG_2329.sm.jpg|450px]]

@@ Line 83: / Line 83: @@
 ===Video Game/TV===
-Powering up or resetting the board causes the “Red Bull Creation” screen to appear as well as a jaunty tune (Never Gonna Give You Up). After entering “The Code” (Up, Up, Down, Down, Left, Right, Left, Right, Start) the display cycles through the following not so secret screens including a series of codes at the bottom of the screen. When converted from hexadecimal values to ASCII, they spelled <code>PEEL THE FOAM</code> and <code>SUP, GOLD DIGGA?</code> before advancing to a stern talking to from HAL followed by what we have dubbed as the “Kill Screen” despite this game being a far cry from Donkey Kong.
+Powering up or resetting the board causes the “Red Bull Creation” screen to appear as well as a jaunty tune (Never Gonna Give You Up). After entering “The Code” (Up, Up, Down, Down, Left, Right, Left, Right, B, A, Start) the display cycles through the following not so secret screens including a series of codes at the bottom of the screen. When converted from hexadecimal values to ASCII, they spelled <code>PEEL THE FOAM</code> and <code>SUP, GOLD DIGGA?</code> before advancing to a stern talking to from HAL followed by what we have dubbed as the “Kill Screen” despite this game being a far cry from Donkey Kong.
 [[file:Image09.png|200px]]

@@ Line 1: / Line 1: @@
 ==Findings==
 ===Credits===
@@ Line 115: / Line 109: @@
 [[file:Image02.jpg|450px]]
-Pin connections match that of the serial storage device connected to the audio driving PIC. The USB PIC does not seem to poll for this chips existence though (no activity seen on CS, CLK, or DIN), which indicates the code on the USB PIC was not extended to use it. Maybe previous plan was to do the mass storage on an external storage device, but ultimately it was decided to do it with the PICs internal memory? Still may move serial storage there and see if anything happens.
+Pin connections match that of the serial storage device connected to the audio driving PIC. The USB PIC does not seem to poll for this chips existence though (no activity seen on CS, CLK, or DIN), which indicates the code on the USB PIC was not extended to use it. Maybe previous plan was to do the mass storage on an external storage device, but ultimately it was decided to do it with the PICs internal memory? Moved SPI storage here, no effect.
 There are also empty pads in the top right of this image (not numbered). When shorted it ties ground to a input pin of the USB chip. No noticeable effect.

@@ Line 107: / Line 107: @@
 ===Dumped JTAG of ATMega===
 We found nothing interesting so far
 ===Empty Chip Pads===