iiinova — where your digital self keeps evolving

stacksmashing @stacksmashing.bsky.social · 12h

I got the original, unmodified Commander Keen running on the Pico 2 😀 This uses Frank-x86, a new ILI9341 driver, and (ab)uses the flash on the Pico 2 as swap RAM (which I'm sure is great for it's longevity - sorry, didn't have a PSRAM at hand) Next: Input support!

1171

stacksmashing @stacksmashing.bsky.social · 05/10/2026

How it feels to miss a very obvious bug🥲

090

stacksmashing @stacksmashing.bsky.social · 18/08/2026

Found a Supermicro BMC vulnerability yesterday and now getting Supermicro ads all day 🤡

1131

stacksmashing @stacksmashing.bsky.social · 16/08/2026

I don't know what to do with this information, so just sharing it here: Apparently Stern Pinball game-code updates are encrypted LUKS containers 😀

2263

stacksmashing @stacksmashing.bsky.social · 15/08/2026

At DEF CON I had the idea to look at a particular subsystem of iOS & macOS. When I came back I started reversing - and found exactly the type of bug I was looking for 😀

0240

stacksmashing @stacksmashing.bsky.social · 14/08/2026

Google releases their own AirTag. Also Google: Let's make sure it ALSO does not attach to a key.

2141

stacksmashing @stacksmashing.bsky.social · 28/07/2026

Did KiCAD get compromised? Or some over-eager AI-scraping prevention?!

230

stacksmashing @stacksmashing.bsky.social · 11/06/2026

My DEF CON talk "Hacking jetskis - from Sea-Don't to Sea-Doo" got accepted 🥳 We'll be having some good fun - such as bypassing the immobilizer using a custom Flipper Zero app, building a custom diagnostic adapter, and some big plot-twists 🛥️

0270

stacksmashing @stacksmashing.bsky.social · 16/05/2026

Opposite of solder-pr0n: Messed up the stencil solder application and was hoping for surface tension to fix it for me 🥲 The expired paste probably didn't help either

2150

stacksmashing @stacksmashing.bsky.social · 08/05/2026

This guy doesn’t even use AI for bug hunting 🙄

1170

stacksmashing @stacksmashing.bsky.social · 04/04/2026

Told someone their "vulnerability report" is bs (result of an automatic scanner that has a false positive...) This was the response 😑

Thanks for the confirmation.

I will follow the steps to reproduce to confirm the status.

Let me know if you need anything else from myside

I hope this type of hard effort deserve something rewards

Paypal or bank transfer

Best Regards

2150

stacksmashing @stacksmashing.bsky.social · 30/03/2026

Sometimes it’s nice to go back to basics: Built firmware that’s just 246 bytes, uses no RAM at all, and runs parasitically from a 1-wire bus at just 0.2 mA. Yet it emulates a full jetski key! You can see voltage rising until the chip starts running based on the BOD threshold.

3291

stacksmashing @stacksmashing.bsky.social · 17/03/2026

Sometimes, you simply need Bluetooth HIGH Energy📡

2450

stacksmashing @stacksmashing.bsky.social · 17/03/2026

If the datasheet says to use tantalum capacitors - then use tantalum capacitors! Blue = Ceramics Yellow = Tantalum

1160

stacksmashing @stacksmashing.bsky.social · 06/03/2026

Things I didn’t see coming: apparently I own a Game Boy signed by a Eurovision contestant?! 😆 youtu.be/8XR2RvfZ-68

4412

stacksmashing @stacksmashing.bsky.social · 05/03/2026

No JLC, component placement is not correct 😂

3280

stacksmashing @stacksmashing.bsky.social · 28/02/2026

Won today’s bet of “Do I really have no oil pressure, or is the gauge just broken?” 😅

0280

stacksmashing @stacksmashing.bsky.social · 27/02/2026

If you find one where some channels don’t move: In 90% of cases it’s just the transistors that are broken. Simple to change and readily available at Digikey & co. Replaced all on mine just to be sure.

050

stacksmashing @stacksmashing.bsky.social · 27/02/2026

Wow, used Yamaha 01V96 are a steal - and 17 motor faders are a lot of fun 😀

2170

stacksmashing @stacksmashing.bsky.social · 20/02/2026

Yes VSCode, I obviously want to use the color-picker to edit the address offsets in Arm assembly 😂

5706

stacksmashing @stacksmashing.bsky.social · 05/02/2026

Fancy, the board-house sent me x-rays of my PCBs!

1230

stacksmashing @stacksmashing.bsky.social · 03/02/2026

We were able to find some minor correlations, but by far not enough to leak the key successfully. If you think you found something - even if it's not a full attack - send an e-mail, it's about making the implementation more secure, not about building the best attack.🛡️

080

stacksmashing @stacksmashing.bsky.social · 29/01/2026

Yeah I have a script that takes multiple dumps and then creates one "true" dump with the most likely bytes from multiple dumps. It also logs out outliers which is helpful!

130

stacksmashing @stacksmashing.bsky.social · 28/01/2026

9d3e36fc632d77f24c810cb89892dd1959dfb05b output.bin (Created from multiple dumps, something is messing with the signal)

5192

stacksmashing @stacksmashing.bsky.social · 28/01/2026

For those playing along at home: Preliminary flash pin-out! 13 - SPI Flash CLK 16 - SPI Flash DI / MOSI 18 - SPI Flash DO / MISO 19 - SPI Flash VCC 20 - SPI Flash CS

2261

stacksmashing @stacksmashing.bsky.social · 28/01/2026

Pulled off the flash and soldered on some magnet-wire on all of the pins to get a decent pin-out. This stuff is smol! 🤏

1200

stacksmashing @stacksmashing.bsky.social · 28/01/2026

Numbered the test-pins on the back of the device - let's try to document the signals!

1190

stacksmashing @stacksmashing.bsky.social · 28/01/2026

But there's at least something to dump - the SPI flash chip seems to be a Winbond W25Q64

2210

stacksmashing @stacksmashing.bsky.social · 28/01/2026

Now interestingly this chip variant - CKABD0 - does not appear in the official datasheet. Package variant: CK (WLCSP) Function variant: AB - not listed in the datasheet Hardware revision: D Production device identifier: 0 Likely that this version has enhanced AP protection 😭

1170

stacksmashing @stacksmashing.bsky.social · 28/01/2026

Now, the question we've all been wondering: Which microcontroller did they use this time? It's the NRF52840 - a chip very similar to the one in the first AirTag - and that, at least in earlier revisions, is vulnerable to the same fault-injection attack! Time to dive in!

4292

stacksmashing @stacksmashing.bsky.social · 28/01/2026

On the other side we have again have a plastic cover - and we can already see the UWB shine through (the silver thing) and a nice antenna connection!

2170

stacksmashing @stacksmashing.bsky.social · 28/01/2026

Not much new on the backside! The accelerometer (black blob on top) seems to still be there, and otherwise just caps.. And a lot of test-points that look quite similar to the ones from the first AirTag (see second picture of the first generation by Colin O'Flynn)

1200

stacksmashing @stacksmashing.bsky.social · 28/01/2026

The new AirTags 2 just arrived! Time to take them apart 🧵

414429

stacksmashing @stacksmashing.bsky.social · 28/12/2025

Laser fault-injection drip just dropped

3120

stacksmashing @stacksmashing.bsky.social · 27/12/2025

En route to #39c3 - come to our talk at 4pm! I will only be there today and tomorrow, but happy to meet-up & chat. Also, if you are at #39c3 and often dump SPI flash-chips please let me know, I might have something for you that I'm looking for feedback on 🙂

1180

stacksmashing @stacksmashing.bsky.social · 18/12/2025

Work: Fix rust issues 🦀 Hobby: Fix rust issues 👨‍🏭 😭

0210

stacksmashing @stacksmashing.bsky.social · 31/07/2025

Also kudos to the great jokesters at Yamaha who named the marine diagnostic stuff “YDS” and then went ahead and launched a series of saxophones *also* named Yamaha YDS🤡