Hacking Interview on Radio Hauraki

Last Friday I got to do live radio for the first time! Since I didn’t come across as a complete idiot I thought I’d share the clip with everyone. The subject was hacking and the clip was recorded during the breakfast show on Radio Hauraki.

Unfortunately I miss-heard the question about the Whaleoil hack and landing up talking about the likely attack vector for The Fappening (the August 2014 celebrity photo leaks)… the perils of live radio I guess :)

BTW the tool I was referring to was called ibrute and it took advantage of an issue with Apple’s find my phone service which, did not lock out accounts if successive incorrect passwords were entered. The application simply tries a bunch of common passwords for a list of email addresses you give it and reports back on the ones that worked.

The passwords that the tool uses where the 500 most common ones used by users of the RockYou website that was hacked (the details of around 32 million accounts were stolen). If your password is on this list you should really go and change it right now! And of course never, ever use the same password on different sites. Here is a handy way to come up with unique but easy to remember passwords.

Random pic: Morning Moon

Morning Moon

It looked a lot bigger to the naked eye…

Project Frankensapien – Part 1

Silver RobosapienYears ago I was given a shiny, silver Robosapien. It’s an awesome humanoid robot controlled and programmed with an infrared remote. Unfortunately with 90+ commands and functions the remote is pretty cumbersome. So I always intended to see if I could put something together to control him from a PC, but I never got around to doing it.

My 5 year old is in his first year of school and since he now has some basic reading skills I thought I’d try to introduce him to programming. Initially I tried out Scratch and whilst he loved playing with the outputs the UI was too abstract and complex for him to grok. However he is enamored with robots, gears, motors and inventions, so I figured that controlling something physical with a simple set of commands would work better for him.

And so Project Frankensapien was born.

First off I decided that I didn’t want to do anything invasive to the Robosapien (now know as Frank). This means that my interface to him would need to be via IR, emulating his remote control. Secondly I want to be able to control him from a PC to shorten the development and testing/hacking cycle. Additionally I’d like to play with some computer vision stuff and I figured that I’d go RoboCup styles, using the processing grunt of the PC as the brains of the robot and broadcasting simple instructions to the robot to carry out.

Lastly I’d like to try make Frank autonomous by strapping a Raspberry Pi to him!

With this in mind I purchased an USB Infrared Toy v2. Its USB interface means it can be plugged into my PC and into the Raspberry Pi. The device is also both an IR receiver and transmitter which means I can use it to record, analyse and emulate the IR command sequences sent by Frank’s remote.

USB Infrared Toy

The first step in the project was to be able to send Frank’s commands via the USB Infrared Toy. To do this I settled on trying to get WinLIRC up and running. This software is a Windows port of LIRC and provides tools  to capture and execute IR commands. Better yet it has direct support for the USB Infrared Toy and its config files are compatible with LIRC so I should be able to use the same configuration files on the Raspberry Pi.

Installation of the USB Infrared Toy was pretty straight forward, I just followed the instructions detailed on the dangerousprototypes website. Next I downloaded WinLIRC and a LIRC configuration for the Robosapien I found on the web (I had to retrieve the file from the Wayback Machine as it had fallen off the Internet).

I fired WinLIRC up and… nada. It did not like the configuration at all :( Additionally the COM port for the USB Infrared Toy (yes, you talk to the USB Infrared Toy via a serial over USB connection) kept disappearing on me. Things were not looking good at all.

After digging around on the web I found that I could use the IRGraph to get a visualization of what the USB Infrared Toy is receiving. This generated a graph looking like this:

IRGraph plotting STOP command

and showed that the toy was able to read the IR commands sent by Frank’s remote.

Next up I tried to use the IRRecord tool to record commands from Frank’s remote and then generate a LIRC config file. The tool seemed to have real issues dealing with the Robosapien remote and the config file that it generated did no work. It did however generate a good config for my Samsung TV remote.

Looking at the software for the USB Infrared Toy, I discovered a tool called irtoy that records and plays back IR commands. So I thought I’d give this a try. Unfortunately it required a firmware update and when I tried the update it got stuck in bootloader mode and I could not access the USB Infrared Toy! After some cursing and switching of USB ports (and waiting), windows finally found the toy (which turns into a USB human interface device in bootloader mode) and I was able to complete the firmware upgrade. Phew!

The irtoy tool recorded and played back a command so further confirmed that the USB Infrared Toy could be used to communicate with Frank. So (slightly in frustration) I bought a copy of AnalysIR which apparently supported LIRC export and the USB Infrared Toy.

Whilst I waited for the license key for AnalysIR, I figured I’d try to roll a config by hand. Using info gleaned from the following links:

I put together a config file that only handled the STOP command, fired it up and got Frank to… fart! (the OOPS command). Which was pretty funny but also slightly indicative of my feelings towards my efforts so far.

Comparing the bitmasks of the STOP and OOPS commands, I didn’t see much correlation. I figure I just got lucky and managed to send some junk that Frank managed to understand.

0x8E - 10001110 - STOP
0xC7 - 11000111 - OOPS (Fart)

However I did get something useful out another of WinLIRC’s tool, RawCodes, when pressing the STOP button on Frank’s remote:

SPACE 16777215
PULSE 6741
SPACE 3605
SPACE 3605
SPACE 3626
SPACE 3647

Mapping the long spaces to 1’s and the short ones to 0’s I was able to figure out that:

  • The first space is just an artifact of the tool
  • The next pulse+space were long, acted as a header and the first bit and was always a 1
  • One’s were a short pulse and a long space
  • Zero’s were a short pulse and a short space
  • There was a single short pulse at the end of the sequence
  • The commands were thus 7 bits long (not including the header)

So I coded up the following config file and gave it a whirl:

begin remote

  name      Robosapienv1

  frequency 39200
  header    6666 3550
  bits      7
  eps       30
  aeps      100
  one       833 3333
  zero      833 833
  foot      833 16777215
    begin codes
        STOP 0x8E
    end codes

end remote

Success! Next I used the data on the RoboSapien IR Codes page to get the rest of the commands and added them to the file:

# WinLirc/Lirc config to control V1 Robosapien
# Testing with WinLirc and USB Infared Toy V2
# from http://www.markcra.com/robot/ir_codes.php
# and http://lirc.10951.n7.nabble.com/robosapien-config-td272.html
# and http://daverobertson63.wordpress.com/2013/05/05/updated-robosapien-ir-control-arduino/

begin remote

	name      Robosapienv1

	frequency 39200
	header    6666 3550
	bits      7
	eps       30
	aeps      100
	one       833 3333
	zero      833 833
	foot      833 833

	begin codes
# movement commands (no shift)
        TURN_RIGHT 0x80
        RIGHT_ARM_UP 0x81
        RIGHT_ARM_OUT 0x82
        TILT_BODY_RIGHT 0x83
        RIGHT_ARM_DOWN 0x84
        RIGHT_ARM_IN 0x85
        WALK_FORWARD 0x86
        WALK_BACKWARD 0x87
        TURN_LEFT 0x88
        LEFT_ARM_UP 0x89
        LEFT_ARM_OUT 0x8A
        TILT_BODY_LEFT 0x8B
        LEFT_ARM_DOWN 0x8C
        LEFT_ARM_IN 0x8D
        STOP 0x8E

# Programming commands (no shift)		
        PROGRAM_PLAY 0x91
# Green shift commands
        RIGHT_TURN_STEP 0xA0
        SLEEP 0xA3
        LEAN_BACKWARD 0xA5
        FORWARD_STEP 0xA6
        BACKWARD_STEP 0xA7
        LEFT_TURN_STEP 0xA8
        LEFT_HAND_THUMP 0xA9
        LISTEN 0xAB
        RESET 0xAE
        WAKEUP 0xB1
# Orange shift commands
        RIGHT_HAND_STRIKE_3 0xC0
        BURP 0xC2
        RIGHT_HAND_STRIKE_2 0xC3
        HIGH_5 0xC4
        RIGHT_HAND_STRIKE_1 0xC5
        BULLDOZER 0xC6
        OOPS_FART 0xC7
        LEFT_HAND_STRIKE_3 0xC8
        LEFT_HAND_SWEEP 0xC9
        WHISTLE 0xCA
        TALKBACK 0xCC
        ROAR 0xCE
        ALL_DEMO 0xD0
        POWER_OFF 0xD1
        DEMO_1_KARATE 0xD2
        DEMO_2_RUDE 0xD3
        DANCE 0xD4

	end codes

end remote

Using the Transmit tool that comes with WinLirc I can now send Frank commands using the the USB Infrared Toy, for example:

Transmit Robosapienv1 HIGH_5
Transmit Robosapienv1 BURP
Transmit Robosapienv1 TURN_RIGHT

My favorite to date is the “pull my finger” script which programs Frank’s right touch sensor to OOPS when touched:

Transmit Robosapienv1 RIGHT_SENSOR_PROGRAM
Transmit Robosapienv1 OOPS_FART
Transmit Robosapienv1 PROGRAM_PLAY

Next up I plan to cobble together a simple web interface so that Frank can be controlled via a browser. Unfortunately the USB Infrared Toy’s range seems a bit limited (about 50cm max) so I may have to accelerate the plan to strap the Raspberry Pi to Frank so that I can keep the IR emitter permanently near his head. I also want to have a good play with AnalysIR tool, whose license turned up just as I succeeded in hand coding the LIRC config.


Tech Tip: Start a simple web server

Python ships with a handy little web server that will serve up the files in the folder from which it is run. This is really handy for development.

Run the following command to start the server:

python -m SimpleHTTPServer

Or if you are using Python 3, run:

python -m http.server

Z is for Zentraedi

In the mid 80’s my tweenish self was introduced to something that blew my mind and that was Robotech. I (and most of the western world) had not encountered Japanese animation or Anime before. With it’s complex story arc, the alien Zentraedi intent on wiping out humanity, cool transforming robots and awesome mass battles, I was hooked.

When the story started to span generations of characters and the even bigger threat of the Invid was revealed, young me was stunned. This was perhaps the first time I had encountered space opera and never ever had I seen a “cartoon” which such a vast scope.

Here is the first episode of the 85 that made up the series:


Of course in later life I discovered that Robotech was actually a mashup of 3 different Japanese TV shows, artfully edited together and dubbed to make a cohesive story. Anime purists view Robotech as an abomination but personally I think it is one of my favorite Anime series.

One word of warning… it has singing, yep singing. For some strange reason the series always seemed to have a singer as one of the characters and in true 80’s Anime style the songs and accompanying animation  are endlessly recycled. Luckily older me has access to digital versions of the shows so I can just fast forward through these bits, a luxury that tween me did not :)