Flipper Zero: How it’s made and tested(blog.flipperzero.one)
blog.flipperzero.one
Flipper Zero: How it’s made and tested
https://blog.flipperzero.one/electronics-testing/
35 comments
I loved their post on the iButton. https://blog.flipperzero.one/taming-ibutton/
I've never actually come across this interface. It's not common in Australia, I still really enjoyed the write up and seeing how they overcame the difficulties.
I've never actually come across this interface. It's not common in Australia, I still really enjoyed the write up and seeing how they overcame the difficulties.
I think I started noticing circa ~2003 (and possibly as far back as ~1999) how cleaners at larger shopping centers (like Westfields) in Sydney would prove they've visited a specific area by tapping a little box they carry with them against iButtons discretely squirreled away in random corners. You generally have to know where to look to find them; the easiest way would probably be to get into the habit of hawkeyeing every cleaner you see, particularly if they're walking somewhere - but I noticed (back when I was actively hunting for the things) they tended to pop up around entries/exits for some reason (including major entrances and carpark exits).
The epoxy jobs I often see anchoring iButtons to walls visibly aren't at the level of detail/engineering required to run invisible wiring (eg through concrete) etc, so I theorize that the iButtons themselves are completely passive (eg, they contain a resistor, or maybe a microcontroller), and the box is a transponder (unlikely) or that it records to internal storage and then gets dropped onto a sync cradle (more likely).
The gadgets the cleaners use are very literally about as featureful as a cigarette packet: a dark grey rectangle with an iButton connector on the back and a small LCD. I've not really ever had the impetus to go pin a cleaner down and politely ask for more details :D
The epoxy jobs I often see anchoring iButtons to walls visibly aren't at the level of detail/engineering required to run invisible wiring (eg through concrete) etc, so I theorize that the iButtons themselves are completely passive (eg, they contain a resistor, or maybe a microcontroller), and the box is a transponder (unlikely) or that it records to internal storage and then gets dropped onto a sync cradle (more likely).
The gadgets the cleaners use are very literally about as featureful as a cigarette packet: a dark grey rectangle with an iButton connector on the back and a small LCD. I've not really ever had the impetus to go pin a cleaner down and politely ask for more details :D
They contain an EEPROM and/or a microcontroller. Some just play a serial number, others can run full-blown Java (or maybe it was JavaCard) applets. "Java Ring" was such an iButton on a ring to be worn.
Oooooh. That means the score chart would go something like...
If EEPROM:
Level 0: Determine that it's an EEPROM and dump the full contents
Level 1: Locate the undocumented vendor control string (which doesn't exist) and unlocks the EEPROM and makes it fully rewritable
Level 2: Rewrite the EEPROM to change the area code or label or whatnot to something funny
Level 3.14159265359: Rewrite the EEPROM such that its contents cause a buffer overflow in the handheld gadget and achieve remote code execution
Level 42: Rewrite the EEPROM such that the RCE achieved in the handheld gadget then causes nested RCE in the synchronization software, then use the opportunity to, say, open a popular YouTube video
If Java:
Level 0: Send data through the iButton link that breaks the Java sandbox and allows for general execution on the CPU
Level 1: Dump the full contents of the firmware
Level 2: Alter the firmware such that every time you tap the iButton it sends area information from shopping centres in entirely different states (counties) :D
Level 3.1e10: Alter the firmware to achieve RCE in the scanner gadget, then stream individual video frames through the iButton link onto the scanner LCD :D
If EEPROM:
Level 0: Determine that it's an EEPROM and dump the full contents
Level 1: Locate the undocumented vendor control string (which doesn't exist) and unlocks the EEPROM and makes it fully rewritable
Level 2: Rewrite the EEPROM to change the area code or label or whatnot to something funny
Level 3.14159265359: Rewrite the EEPROM such that its contents cause a buffer overflow in the handheld gadget and achieve remote code execution
Level 42: Rewrite the EEPROM such that the RCE achieved in the handheld gadget then causes nested RCE in the synchronization software, then use the opportunity to, say, open a popular YouTube video
If Java:
Level 0: Send data through the iButton link that breaks the Java sandbox and allows for general execution on the CPU
Level 1: Dump the full contents of the firmware
Level 2: Alter the firmware such that every time you tap the iButton it sends area information from shopping centres in entirely different states (counties) :D
Level 3.1e10: Alter the firmware to achieve RCE in the scanner gadget, then stream individual video frames through the iButton link onto the scanner LCD :D
I ordered one of these. I've ordered tons of goofy lil gadgets and doo-dads over the years, but I've been super impressed by their transparency and progress on their quality!
I really can't wait to see if I can start replaying RFID fobs I use in my daily life with this.
I really can't wait to see if I can start replaying RFID fobs I use in my daily life with this.
Reminds me of the early days of the Pineapple before everyone switched to WPA2 (yes, I know you can attempt to have the cloud crack WPA2 after getting enough IVs but APs are smart enough to know when someone is issuing resets). Hack5 makes some great stuff, but almost everything they is now obsolete due to improved sec. Well, I guess in non-US countries where the hardware is older.
I think Flipper0 it'll be fun for playing with garage door openers, or maybe some local havok on non-NIST cert'd NFC cards, but I don't really see much else. BLE has bonding and Wi-Fi has TLS1.3 for embedded (smaller ciphersuites), so no go there, and flash programmers already spoken for. Sooo.. what am I missing?
I think Flipper0 it'll be fun for playing with garage door openers, or maybe some local havok on non-NIST cert'd NFC cards, but I don't really see much else. BLE has bonding and Wi-Fi has TLS1.3 for embedded (smaller ciphersuites), so no go there, and flash programmers already spoken for. Sooo.. what am I missing?
Looks like a fun gadget. Definitely going to check that out, should be able to do some interesting things.
I have reader/writer that handles several RFID/NFC chip frequencies. When I replace a fob at the office my co-workers think I'm doing something legit - they have no idea that I have a cheap device from Asia that can clone them. And I could clone your fob silently just standing next to you in the lunch line, you wouldn't even know.
I have reader/writer that handles several RFID/NFC chip frequencies. When I replace a fob at the office my co-workers think I'm doing something legit - they have no idea that I have a cheap device from Asia that can clone them. And I could clone your fob silently just standing next to you in the lunch line, you wouldn't even know.
I like the way they communicate. It almost makes the wait enjoyable.
Easily the most frequent and interesting/meaningful updates for any Kickstarter that I've backed before.
It has been a long wait, but I am really impressed with the amount of work they have put into this.
Agreed. The transparency into all the issues that come with manufacturing a real product makes the wait a lot more understandable-- it's clear they didn't just take the money and run. Honestly, I almost feel like I'm getting my money's worth just from the blog posts
If you can get one. Ordered mine last April, still don’t have it, no sign of getting it, and they don’t respond to email/Twitter. I’ve given up.
You didn't "order" it. You backed a Kickstarter which has a reward that has no guarantee of shipping.
They've been more than transparent on the delays they've had to deal with, and they launched a product during a global pandemic and supply shortage. I'd cut them some slack.
They've been more than transparent on the delays they've had to deal with, and they launched a product during a global pandemic and supply shortage. I'd cut them some slack.
Let me put it this way, I was backer #816. They currently have 37,987 backers. They raised $4,882,784 during a global pandemic. I think I’m not off base when I said “If you can get one.”
No one has one - none have shipped. Your backer position is irrelevant right now. If they had released a batch of 2000 and you missed out, yes I'd be upset. They are still fine tuning their tooling to mass produce. It's way behind schedule, but with everything on kickstarter - allow for 2x the time to avoid disappointment.
They also let you pick which batch yours would come from.
We shouldn't normalize this stuff.
While I understand that there has been a long history of Kickstarter projects underdelivering or not delivering at all... I would think the context of a global pandemic causing record resource shortages would allow cutting these guys some slack, yeah?
I mean, if Nvidia and AMD can't get a graphics card into my hands over the course of a year then I can't imagine a super tiny group of engineers would have much luck bootstrapping the supply chain for their brand new product.
I mean, if Nvidia and AMD can't get a graphics card into my hands over the course of a year then I can't imagine a super tiny group of engineers would have much luck bootstrapping the supply chain for their brand new product.
The fact that Nvidia and AMD are having trouble highlights that supply chain financing is a risky business where even professionals lose their money. Requiring customers to take part in it as a condition for (eventually) buying the product feels icky to me.
I think "requiring" is a funny word to use here.
Producing anything to sell commercially requires work up front. That work has to get paid for. While that work is happening, the people involved need to eat and to keep their families fed. Is the universe a big ol' meanie for "requiring" people to keep eating? I guess.
Regardless, up-front money is required. Previously something like this could only happen if you managed to find somebody with millions of dollars sitting around and then managed to convince them to give you enough to get your product built. And then you had the problem of finding your buyers, which cost more money for marketing.
I have my issues with Kickstarter. But inviting the individuals who want your product to participate in financing it seems like a giant step forward to me. If you have a better idea, I'm all ears. If not, maybe just block Kickstarter in your browser? Then you'll be free of any perceived burdensome requirements.
Producing anything to sell commercially requires work up front. That work has to get paid for. While that work is happening, the people involved need to eat and to keep their families fed. Is the universe a big ol' meanie for "requiring" people to keep eating? I guess.
Regardless, up-front money is required. Previously something like this could only happen if you managed to find somebody with millions of dollars sitting around and then managed to convince them to give you enough to get your product built. And then you had the problem of finding your buyers, which cost more money for marketing.
I have my issues with Kickstarter. But inviting the individuals who want your product to participate in financing it seems like a giant step forward to me. If you have a better idea, I'm all ears. If not, maybe just block Kickstarter in your browser? Then you'll be free of any perceived burdensome requirements.
You don't have to back the project to be able to buy one though: you can preorder from the second production wave on their site currently. It isn't as if they are only selling to backers and won't produce anymore after that
They're not out yet. Have you ever used Kickstarter before??
You're phrasing this like they're GPUs. But those GPUs have general availability, at least on paper. There are no people, other than the Flipper devs, their friends, and perhaps selected reviewers, who have one of these in their hands to play with. It has not hit 1.0 yet.
You're phrasing this like they're GPUs. But those GPUs have general availability, at least on paper. There are no people, other than the Flipper devs, their friends, and perhaps selected reviewers, who have one of these in their hands to play with. It has not hit 1.0 yet.
Just because they raised 4 million dollars doesn't mean they are immune to a global supply chain shortage.
It's only 5 months late, it's like you've never backed a Kickstarter before.
It's only 5 months late, it's like you've never backed a Kickstarter before.
They were lucky and had the orders for the chip in before the shortage. If they didn't the delay would be a lot greater than 5 months.
Ok, it’s clear where you stand. I’m not here to be negative, only to share with folks interested in the product that they are significantly back logged. Hopefully everyone knows what the means in a Kickstarter context. Their marketing is great, the jury is still out on their actual product.
If you're not here to be negative, then 1) don't say "no sign of getting it" and "I've given up" about something that's going through the early to medium stages of production with lots of updates, and 2) don't just say you ordered it "last April" without even mentioning that it was already expected to take 10 months even then.
"If you can get one. They're behind schedule and haven't shipped any yet." would have been fine.
"If you can get one. They're behind schedule and haven't shipped any yet." would have been fine.
Everyone is in the same boat - they are taking time with production. At least they are communicating and showing the effort that is going into production. This is 100x better than some of the other products I've `backed` on crowdsourcing platforms.
There’s a quite active Discord server.
Even if you aren’t interested in the product, if you have a passing interest in product design and manufacturing check out their other blog posts. This is by far the best kickstarter I’ve ever backed in terms of update details.
What's up with that FCC ID?
Here they explain nuances of getting an FCC approval:
https://blog.flipperzero.one/review-and-producing-plan/
https://blog.flipperzero.one/review-and-producing-plan/
It has a bunch of receiver/transmitter hardware and software. Definitely looks fun to play with!