1
00:00:00,000 --> 00:00:01,240
in the lab.

2
00:00:01,240 --> 00:00:05,400
We're going to be covering everything from kind of the basic level to the advanced level.

3
00:00:05,520 --> 00:00:13,700
When this thing's all with, I'm going to be jumping on IoT Village Discord, where you'll be able to ask me more questions.

4
00:00:13,720 --> 00:00:18,200
I also, everything we're going to talk about to show today, I actually have a price list.

5
00:00:18,200 --> 00:00:24,860
It's kind of an Amazon type price list, showing a lot of, well, not just Amazon, but various places that you can buy this stuff.

6
00:00:24,860 --> 00:00:25,960
That'll give you an idea.

7
00:00:25,960 --> 00:00:29,540
Of course, if you shop around, you'll be able to get some of this stuff cheaper.

8
00:00:30,000 --> 00:00:34,240
So, let's go ahead and talk about what our agenda is today.

9
00:00:34,240 --> 00:00:38,200
So, we've broken this up into a number of categories.

10
00:00:38,700 --> 00:00:42,480
Disassembling, assembly of hardware tools for taking things apart.

11
00:00:43,200 --> 00:00:45,780
Soldering, desoldering equipment.

12
00:00:46,060 --> 00:00:48,140
Magnification, which may come in handy.

13
00:00:48,140 --> 00:00:51,020
If you have that perfect eyesight, more power to you.

14
00:00:51,020 --> 00:01:05,380
But for some of us that may not have great eyesight or getting a little older, magnification plays a big role into how we can actually see things and do soldering at surface mount level type technology.

15
00:01:05,380 --> 00:01:09,340
We're going to be looking at monitoring devices and technology.

16
00:01:09,420 --> 00:01:11,080
Debugging tools.

17
00:01:11,080 --> 00:01:14,400
And then I'm going to cover probably one of the most important ones.

18
00:01:14,400 --> 00:01:16,040
It's the odds and ends.

19
00:01:16,040 --> 00:01:20,860
The pieces and the parts that make your life way much easier in a lab.

20
00:01:20,860 --> 00:01:28,520
And often the pieces and parts build within your lab as you kind of work through the various aspects of testing things.

21
00:01:28,520 --> 00:01:35,260
You go, hey, if I bought this little item here, this header, this plug, this switch, it would make my life easier.

22
00:01:35,260 --> 00:01:38,480
So, you start building up a good ensemble of those type of techs.

23
00:01:38,480 --> 00:01:42,780
We're going to be talking about those at the end also, which I think is very important.

24
00:01:43,020 --> 00:01:52,460
But let's go ahead and jump out over to a screen and let's go ahead and get a camera going in here and see how this works.

25
00:01:53,100 --> 00:01:54,720
Oh, that's kind of interesting.

26
00:01:57,460 --> 00:01:58,140
Control.

27
00:01:58,140 --> 00:01:58,720
There we go.

28
00:01:58,720 --> 00:01:59,840
That's much better.

29
00:02:00,520 --> 00:02:04,100
So, let me get out of the way of the camera so you all can see me.

30
00:02:04,100 --> 00:02:08,760
So, again, this is kind of my lab.

31
00:02:08,760 --> 00:02:13,780
And we wanted to start off with looking at tools to take things apart.

32
00:02:14,020 --> 00:02:17,340
To start with, a screwdriver set.

33
00:02:17,340 --> 00:02:19,000
These things are critical.

34
00:02:19,260 --> 00:02:27,800
And I would recommend, I had a previous screwdriver set, if I can get it apart, that did not have a box for it.

35
00:02:27,800 --> 00:02:33,880
And one of the things I found out is they're literally laying all over the place because I never had one good place to put them.

36
00:02:33,880 --> 00:02:37,960
Or they ended up in a bag somewhere and all disjointed.

37
00:02:37,960 --> 00:02:41,940
So, get something you can pop them in and out and it holds them real well.

38
00:02:42,060 --> 00:02:45,460
This has straight slots, Phillips.

39
00:02:45,900 --> 00:02:48,840
The other thing you want to consider is star tips.

40
00:02:49,080 --> 00:02:54,880
There's a number of small IoT devices when you go to take them apart will have the star pattern tips.

41
00:02:54,960 --> 00:02:59,580
So, you want to take that into consideration as a big component when you're doing this.

42
00:03:00,640 --> 00:03:03,560
And then you can get some other small toolkits.

43
00:03:03,560 --> 00:03:07,900
This is one I had sitting in my thing over here.

44
00:03:07,940 --> 00:03:09,500
And I didn't even know I had it.

45
00:03:09,500 --> 00:03:24,420
So, it's a good breakout with some basic sockets, needle nose, some of these different heads, stars, Phillips, straight slots, a little bigger size than the small ones that may come in handy.

46
00:03:25,180 --> 00:03:33,380
And then also, when you start thinking about it, kind of wrenches and different things like this, a set of cutters is always good.

47
00:03:33,620 --> 00:03:36,100
So, you want to have a good assortment of these.

48
00:03:36,380 --> 00:03:39,060
And every once in a while, I have a tendency to lose these things.

49
00:03:39,060 --> 00:03:41,860
So, I end up buying more sets of them over time.

50
00:03:42,200 --> 00:03:48,720
Also, something to consider is a pair of good cutters.

51
00:03:48,960 --> 00:03:52,960
Now, I've had wire cutters before, small ones like this.

52
00:03:52,960 --> 00:03:56,600
But I like these because the tips are way much thicker.

53
00:03:56,940 --> 00:03:58,840
These things are actually great.

54
00:03:58,840 --> 00:04:02,040
And they come in handy for not only cutting wire.

55
00:04:02,040 --> 00:04:11,040
But here's an example of a bracelet type thing, a tracker, that was hermetically sealed.

56
00:04:11,040 --> 00:04:14,700
This came in really handy for cutting through some of the plastic.

57
00:04:14,700 --> 00:04:15,560
Very durable.

58
00:04:15,560 --> 00:04:21,680
I've used this for removing shielding that are over components where I need to get access to shielding.

59
00:04:21,680 --> 00:04:27,340
So, having something that can cut through metal and plastic and durable, and the tip on this doesn't chip up.

60
00:04:27,340 --> 00:04:30,380
So, having something like that is pretty critical.

61
00:04:30,380 --> 00:04:33,840
The other thing you want to consider is spudges.

62
00:04:34,020 --> 00:04:35,720
So, what's a spudge?

63
00:04:35,720 --> 00:04:39,180
So, this one I managed to lose half the stuff that's in it.

64
00:04:39,180 --> 00:04:42,780
But this one has little fiberglass spudges in it.

65
00:04:42,780 --> 00:04:47,860
And these are pry tools that you can use for prying things open.

66
00:04:47,940 --> 00:04:49,720
These are all fiberglass.

67
00:04:49,720 --> 00:04:53,060
Several of them are kind of mangled because they've been beat up pretty heavy.

68
00:04:53,060 --> 00:05:02,140
I also have some small metal thin spudges in here and some ones that look like kind of the tip of guitar picks.

69
00:05:02,140 --> 00:05:05,100
Those come in handy for popping open plastic cases.

70
00:05:05,100 --> 00:05:11,060
And I also bought a kit, and this one's been really handy, that is basically metal ones.

71
00:05:11,420 --> 00:05:17,420
So, you have to be careful with these because they can like seriously hurt you if you're not careful or do some damage to the equipment.

72
00:05:17,620 --> 00:05:26,280
But these come in really handy for opening certain cases, removing certain plugs or connectors or things like that.

73
00:05:26,280 --> 00:05:30,340
So, having a good set of spudges is pretty good.

74
00:05:30,340 --> 00:05:33,720
Most of these are fairly inexpensive, $8, $9, $10.

75
00:05:34,000 --> 00:05:35,740
You can often get a set of these.

76
00:05:35,740 --> 00:05:40,140
I've seen some much bigger, nicer sets that run in the $20, $30 range.

77
00:05:40,360 --> 00:05:42,420
But always good to have a set of these.

78
00:05:42,420 --> 00:05:48,140
It'll make it very important when you're actually opening stuff up.

79
00:05:48,140 --> 00:05:55,220
Now, the ultimate tool, what happens when you end up with a case where you can't easily clip it open?

80
00:05:55,220 --> 00:05:58,660
You can't easily spudge it open.

81
00:05:58,660 --> 00:06:00,740
There's no screws in it.

82
00:06:00,780 --> 00:06:02,040
It is like thick.

83
00:06:02,040 --> 00:06:08,460
I've had cases that were actually eighth inch to three-eighths inch thick casing that were waterproof.

84
00:06:09,080 --> 00:06:10,060
What do you do?

85
00:06:10,060 --> 00:06:17,980
So, in those cases, what I like to do is a good old-fashioned Dremel tool.

86
00:06:18,520 --> 00:06:20,700
Now, you can get these in various prices.

87
00:06:20,700 --> 00:06:24,640
This one's probably the last one I got, which is reasonably new.

88
00:06:24,640 --> 00:06:26,020
My last one was cheaper.

89
00:06:26,020 --> 00:06:29,660
I think I paid like $35 for it like a decade ago.

90
00:06:29,660 --> 00:06:33,340
I finally burnt it up and had to go out and buy another one.

91
00:06:33,340 --> 00:06:38,980
And since I obviously make more money now, I went ahead and bought a better Dremel tool.

92
00:06:39,400 --> 00:06:47,880
So, if you were actually at the RSA event when we were working in the IoT village, we had a lot of light bulb type tech that we were playing with.

93
00:06:47,880 --> 00:06:56,640
And this is what I used to cut those good old-fashioned light bulbs apart that contained IoT-based technology in those.

94
00:06:57,200 --> 00:07:01,520
So, that's kind of the general hardware type stuff.

95
00:07:01,520 --> 00:07:16,000
The next thing we want to get to, and this is the price list that we want to get to before we jump into some other area or start asking questions, I want to talk about some of the soldering type tools or equipment.

96
00:07:16,120 --> 00:07:21,720
So, there's a number of solutions you can do from a soldering perspective.

97
00:07:21,820 --> 00:07:26,540
You can buy soldering irons in all kinds of different prices.

98
00:07:26,580 --> 00:07:30,300
Years ago, I used to like three or four soldering irons.

99
00:07:30,300 --> 00:07:35,580
So, they were all fixed heat levels or fixed wattage.

100
00:07:35,580 --> 00:07:37,220
I think I had one that was 25.

101
00:07:37,220 --> 00:07:38,660
I had one that was 45.

102
00:07:38,660 --> 00:07:40,340
I had one that was like 75.

103
00:07:40,340 --> 00:07:42,700
And I think I had one that would clear up to 100.

104
00:07:43,760 --> 00:07:45,700
Those worked for me back then.

105
00:07:45,700 --> 00:07:50,240
But as, you know, technology advanced, you start getting into surface mount devices.

106
00:07:50,240 --> 00:07:53,100
It becomes inherently more difficult to use those.

107
00:07:53,180 --> 00:07:54,700
They're a little more cumbersome.

108
00:07:54,700 --> 00:07:59,060
So, I always recommend actually picking one up that is kind of variable heat.

109
00:07:59,720 --> 00:08:01,980
So, you can change the heat on it.

110
00:08:01,980 --> 00:08:09,240
And if I don't smash everything in this lab, in the process, this is one you often will see a lot of people have.

111
00:08:09,240 --> 00:08:11,280
And I've used this as a HECO.

112
00:08:11,320 --> 00:08:17,780
And I've used this one for several years, like two or three years.

113
00:08:17,780 --> 00:08:19,240
It's variable heat.

114
00:08:19,440 --> 00:08:21,920
It worked for most point.

115
00:08:21,960 --> 00:08:24,300
And you can get a lot of tips for it.

116
00:08:24,300 --> 00:08:33,360
But as I got more advanced and more into more detailed type work, my biggest problem with this was heat recovery.

117
00:08:33,780 --> 00:08:45,480
So, when I went with really fine tips and I was soldering on something that was a ground, the problem I had was this device could not keep the heat level up.

118
00:08:45,480 --> 00:08:47,100
And it would make things harder.

119
00:08:47,100 --> 00:08:52,800
And so, when you can't keep the heat, the heat recovery is terrible or not really good on a device.

120
00:08:53,040 --> 00:08:58,220
It causes you to spend more time on the device, more time on the chip, more time on the leg.

121
00:08:58,220 --> 00:09:00,000
And it leads to damage of the components.

122
00:09:00,000 --> 00:09:03,760
You can easily end up pulling leads and stuff like that.

123
00:09:03,760 --> 00:09:12,320
So, to keep the actual time on device down, I actually cranked the heat of this thing all the way up, high as it would go.

124
00:09:12,520 --> 00:09:15,060
And that made it possible for me to work really quick.

125
00:09:15,060 --> 00:09:16,600
That kind of worked for me.

126
00:09:16,620 --> 00:09:20,420
Other people will do other things when they're dealing with this.

127
00:09:20,420 --> 00:09:22,900
But then I finally decided I wanted to move on.

128
00:09:22,900 --> 00:09:25,240
And I think these are right around $100.

129
00:09:25,900 --> 00:09:30,240
Great product, in my opinion, for entry-level starter.

130
00:09:30,240 --> 00:09:31,400
And it works pretty good.

131
00:09:31,400 --> 00:09:34,980
Now, there are other vendors that produce soldering equipment.

132
00:09:35,400 --> 00:09:41,880
And one of the ones I went with... let's see if I can move some stuff out of the way here... I went with a Weller.

133
00:09:44,290 --> 00:09:51,090
So, the Weller unit, hopefully you can see it, I think this is a WX01 or WX02.

134
00:09:51,170 --> 00:09:54,630
It actually has two soldering irons on it.

135
00:09:54,630 --> 00:09:58,450
When I purchased it, it came with a single soldering iron.

136
00:09:58,450 --> 00:10:05,010
This does, I think, want to say 65, 75 watts, somewhere around there.

137
00:10:05,010 --> 00:10:06,150
It's pretty good.

138
00:10:06,150 --> 00:10:07,330
Works great.

139
00:10:07,330 --> 00:10:11,630
This thing's capable of pushing out 150 watts of power.

140
00:10:11,650 --> 00:10:13,790
So, you can run two irons.

141
00:10:13,790 --> 00:10:16,530
I turned around and actually purchased a micro iron.

142
00:10:16,530 --> 00:10:21,590
So, you can see this tip is really fine on the... probably can't even see it on the tip of my finger.

143
00:10:21,590 --> 00:10:22,910
It's pretty small.

144
00:10:22,990 --> 00:10:24,690
This is actually brilliant.

145
00:10:24,690 --> 00:10:26,190
Works really good.

146
00:10:27,150 --> 00:10:30,170
The difference is this is a very expensive unit.

147
00:10:30,170 --> 00:10:33,730
I think the retail on this was like $1,200.

148
00:10:34,230 --> 00:10:36,190
You can get it on sale and shop around.

149
00:10:36,190 --> 00:10:38,750
You can probably get it down around $800 or less.

150
00:10:39,090 --> 00:10:42,910
So, that's kind of where we want to think about soldering gear.

151
00:10:43,690 --> 00:10:48,730
You want to be able to have some good soldering gear that'll actually do what you want to do.

152
00:10:48,730 --> 00:10:56,790
You want to be able to deal with surface mount devices, small components, large components, you need good heat recovery.

153
00:10:57,010 --> 00:10:59,310
Good starter unit is the HECO.

154
00:11:00,010 --> 00:11:02,850
You can also get smaller range Wellers.

155
00:11:02,850 --> 00:11:04,070
That'll work pretty good.

156
00:11:04,070 --> 00:11:11,630
So, I would shop around and ask other people that have different equipment what they use.

157
00:11:11,630 --> 00:11:19,930
You'll find out a lot of people use the HECO, but you'll find a lot of people are fans of Weller or some of the other products.

158
00:11:19,930 --> 00:11:32,690
So, I definitely encourage you when you get ready to go out there, if that works for you, I loved it, had no problems other than the heat recovery issue.

159
00:11:33,270 --> 00:11:35,230
So, where do we go from there?

160
00:11:35,730 --> 00:11:42,090
So, the next area I want to talk about... now, let's go ahead and start off with asking some questions.

161
00:11:42,590 --> 00:11:48,310
So, Jonathan, are there any questions out there?

162
00:11:49,590 --> 00:11:50,330
Yes.

163
00:11:50,330 --> 00:12:00,990
So, looks like right off the bat here, we've been talking a lot about like sharp tools and hot ends on the solder iron, things like that.

164
00:12:01,010 --> 00:12:06,890
One question that came up was, what kind of safety equipment do you keep on hand with your lab?

165
00:12:06,890 --> 00:12:12,670
And do they include things such as maybe like goggles, first aid kit, fire extinguisher?

166
00:12:12,830 --> 00:12:15,210
So, I don't have a first aid kit.

167
00:12:15,270 --> 00:12:16,750
Well, I do have a first aid kit.

168
00:12:16,750 --> 00:12:17,770
It's my wife.

169
00:12:17,770 --> 00:12:19,670
She knows how to use 911.

170
00:12:20,030 --> 00:12:22,090
Hopefully, she won't have to do that.

171
00:12:22,090 --> 00:12:25,230
But for safety equipment, there's some other things to think about.

172
00:12:25,290 --> 00:12:31,750
Obviously, when you're soldering, you don't want to have breathe all of the nasty smoke.

173
00:12:31,750 --> 00:12:34,150
That's a health and safety issue.

174
00:12:34,310 --> 00:12:36,170
So, I would recommend a fan.

175
00:12:36,170 --> 00:12:41,770
So, here's actually a fan that you can purchase that happens to be on a articulated arm.

176
00:12:41,770 --> 00:12:43,530
So, this works pretty good.

177
00:12:43,530 --> 00:12:55,450
The other thing I have in my actual lab, it's not within the picture range, but let me see if I can pull it off here, is a good old-fashioned fire extinguisher.

178
00:12:55,850 --> 00:13:02,770
And I also have safety goggles and safety gear associated with that.

179
00:13:02,770 --> 00:13:15,590
So, I would definitely recommend that if you set up a lab where you're going to be using hot equipment and sharp equipment or whatever the case may be, you want to be able to put out any fires that may actually show up.

180
00:13:15,590 --> 00:13:22,350
Luckily, I've never had to actually use this fire extinguisher.

181
00:13:23,650 --> 00:13:30,330
And speaking on that same thing, it becomes in handy when you start thinking about soldering your gear.

182
00:13:30,330 --> 00:13:35,770
This particular soldering gear here, if you go away from it after a period of time, it shuts off, which is nice.

183
00:13:35,770 --> 00:13:37,110
The Hakko does not.

184
00:13:37,910 --> 00:13:41,630
So, are there any other questions or you want to move on from here?

185
00:13:43,430 --> 00:13:45,670
Let me see here, taking a look at the list.

186
00:13:45,670 --> 00:13:48,170
I think we're okay to move on.

187
00:13:48,370 --> 00:13:49,010
Okay, good.

188
00:13:49,010 --> 00:13:54,610
So, let's go ahead and jump into the next thing, and that is kind of magnification.

189
00:13:54,830 --> 00:14:00,110
So, what kind of gear is available for actually magnifying or looking at things?

190
00:14:00,110 --> 00:14:02,550
I have a number of things that I use.

191
00:14:02,950 --> 00:14:06,290
One of them happens to be these goggles.

192
00:14:06,310 --> 00:14:09,730
So, they have adjustable eyepieces on them.

193
00:14:09,910 --> 00:14:11,090
You can turn a light on.

194
00:14:11,090 --> 00:14:12,770
This is good for close-up looking.

195
00:14:12,770 --> 00:14:14,970
So, you have to hold the item up close.

196
00:14:15,150 --> 00:14:22,550
So, you can't really do any soldering with that, but that comes in handy for quick examination of devices.

197
00:14:22,610 --> 00:14:29,390
One of the other things I have in here, I haven't used it in a while, but I used to use it quite a bit, and that is a pin camera.

198
00:14:29,390 --> 00:14:33,330
This is a USB pin camera that I can shine into things.

199
00:14:33,330 --> 00:14:36,790
It goes into smaller places, works pretty good.

200
00:14:36,990 --> 00:14:46,210
I also have a, actually, a borescope , an endoscope that can actually be put through small holes, and you can actually see stuff.

201
00:14:46,210 --> 00:14:48,470
That one's kind of packed away right now.

202
00:14:48,610 --> 00:14:56,270
The other equipment that I have is, and you may have seen this if you've been to the IoT Village where Rapid7 is working.

203
00:14:56,650 --> 00:14:59,390
This is a device that comes in pretty handy.

204
00:15:02,010 --> 00:15:05,590
Small bench camera with a screen.

205
00:15:05,650 --> 00:15:07,470
You can actually magnify it.

206
00:15:07,470 --> 00:15:09,450
It has variable settings on it.

207
00:15:09,450 --> 00:15:10,810
You can focus it.

208
00:15:10,810 --> 00:15:14,390
You can also hook a USB up to it and feed it into a TV.

209
00:15:15,050 --> 00:15:19,710
In this particular case, I went ahead and actually covered this with rubber.

210
00:15:20,350 --> 00:15:28,210
The purpose of the rubber in this case is to protect it, so I could actually put energized equipment on here and look at it also.

211
00:15:31,660 --> 00:15:40,980
So, some of the other equipment I have is, this is another USB microscope, and there's so many on the market.

212
00:15:41,180 --> 00:15:43,320
You know, which one's better than another one?

213
00:15:43,320 --> 00:15:45,560
Gosh, you know, that one's kind of a hard one.

214
00:15:45,560 --> 00:15:52,260
You can spend anywhere from 20 or 30 bucks up to $300 or $400 for one of these.

215
00:15:52,300 --> 00:15:59,380
I've seen these that would go clear to 5,000x, which was absolutely amazing.

216
00:15:59,380 --> 00:16:05,290
You could actually see the runs on a silicon chip with it, so it was kind of amazing.

217
00:16:05,840 --> 00:16:08,620
But that's, again, a very high end.

218
00:16:09,120 --> 00:16:20,520
So, but when we get into something bigger, something you want to solder under, this is the more expensive solution right here, which is a microscope.

219
00:16:20,760 --> 00:16:23,060
This is a great microscope that I have.

220
00:16:23,060 --> 00:16:28,920
This one does everything from 3x, I believe, all the way up to 90x.

221
00:16:28,920 --> 00:16:31,200
Has ability to mount a camera on it.

222
00:16:31,200 --> 00:16:41,900
It's variable focal length, and you can actually slide it in and out, which makes it really handy for this type of work, for magnification.

223
00:16:41,900 --> 00:16:45,540
And I do a lot of surface mount device work underneath this.

224
00:16:45,540 --> 00:16:48,960
I've used this for reball and BGAs and stuff like that.

225
00:16:49,020 --> 00:16:56,480
But this is an expensive unit, and they vary in price based on whether you go up to the higher caliber.

226
00:16:56,600 --> 00:16:58,380
This, like I said, this is 90x.

227
00:16:58,380 --> 00:17:00,500
It's about a $600 unit.

228
00:17:01,000 --> 00:17:13,920
But if we kind of move away from that and go, what can somebody who's entry level or right above entry level, looking for a good scope, here's one I used for a number of years, and I loved it.

229
00:17:13,920 --> 00:17:17,040
So, this here is also an Ampscope.

230
00:17:17,040 --> 00:17:21,260
This one will do 10 to 20x power.

231
00:17:21,260 --> 00:17:23,360
It is a fixed focal length.

232
00:17:23,360 --> 00:17:25,900
This device costs about $185.

233
00:17:26,040 --> 00:17:28,480
It is a brilliant piece of equipment.

234
00:17:28,500 --> 00:17:34,000
I have several of these that I use in various training that I've done in the past.

235
00:17:34,160 --> 00:17:39,560
And I would recommend, if you're looking for a scope and you don't have the big money, look at something like that.

236
00:17:39,560 --> 00:17:45,020
Look at Ampscopes and look at what they have to offer from a price point.

237
00:17:45,220 --> 00:17:50,000
And I think this model here was $185, and it worked like a champ.

238
00:17:50,000 --> 00:17:56,160
Again, I used it for a number of years, but then I kind of got greedy and wanted something that's like super-ass cool.

239
00:17:56,160 --> 00:18:00,100
So, I went ahead and bought this for work in my lab.

240
00:18:01,660 --> 00:18:03,880
So, what else can we dig into here?

241
00:18:04,020 --> 00:18:15,540
I think some of the most important thing we want to talk about in the area of soldering is to look at some of the other components that you may need for actual soldering.

242
00:18:16,700 --> 00:18:19,520
And when you get into soldering, it's kind of critical.

243
00:18:19,520 --> 00:18:23,940
You want to be able to... you want to have typical solder.

244
00:18:25,240 --> 00:18:29,980
So, let's go ahead and switch out the screen so we can actually dig into some of this stuff a little closer.

245
00:18:29,980 --> 00:18:36,440
Then we'll pop back to the other screen because we can actually show this stuff a little better here.

246
00:18:42,170 --> 00:18:46,750
So, here from the solder standpoint, there's a number of different brands out there.

247
00:18:46,750 --> 00:18:50,710
This particular brand is... sticks one after another.

248
00:18:50,890 --> 00:18:52,670
But I would get the small stuff.

249
00:18:52,670 --> 00:18:55,730
This one here happens to be the 0.3 millimeters.

250
00:18:56,250 --> 00:18:57,870
I use lead solder.

251
00:18:57,870 --> 00:18:59,730
I hate lead-free solder.

252
00:18:59,730 --> 00:19:01,090
Some people may like it.

253
00:19:01,090 --> 00:19:03,490
I think it's horrible to work with.

254
00:19:03,930 --> 00:19:08,390
So, I think this works much better in every case that I've ever worked with.

255
00:19:08,430 --> 00:19:11,770
And you also want to get solder wick.

256
00:19:11,850 --> 00:19:17,370
Solder wick comes in really handy for removing and cleaning solder off the board.

257
00:19:18,330 --> 00:19:37,370
But when you're thinking about actually removing solder and you want to dig in and remove surface mount devices, the ultimate solution for removing surface mount devices, in my opinion, easily is this product right here.

258
00:19:37,410 --> 00:19:45,910
If you have not used this ChipQuik surface mount device removal kit, you're missing out.

259
00:19:45,910 --> 00:19:47,890
This will make life much easier.

260
00:19:47,890 --> 00:19:50,190
It comes with a flux.

261
00:19:50,190 --> 00:19:54,110
So, you put the flux on it and then it comes... this looks like solder.

262
00:19:54,110 --> 00:19:55,350
This is not solder.

263
00:19:55,350 --> 00:19:56,710
It's way more brittle.

264
00:19:56,710 --> 00:19:58,430
It's a low-temperature metal.

265
00:19:58,430 --> 00:20:03,990
And what it'll do is it'll absorb the solder and it'll keep the temperature down low.

266
00:20:03,990 --> 00:20:15,970
So, let's say you're actually trying to move a TESOP 48, which is a 48-pin typical memory chip that is soldered down with 48 pins.

267
00:20:15,970 --> 00:20:19,590
It's kind of hard to keep 48 pins melted.

268
00:20:20,170 --> 00:20:26,090
But with this stuff, once you put it on there, you can easily spread it across each one of the leads.

269
00:20:26,390 --> 00:20:31,810
Gump it on there pretty good and it'll stay melted and you can lift the chip completely off the device.

270
00:20:31,810 --> 00:20:33,190
It's a true lifesaver.

271
00:20:35,330 --> 00:20:39,350
So, let's kind of move on.

272
00:20:39,350 --> 00:20:40,470
Are there any questions?

273
00:20:40,470 --> 00:20:42,470
Do we have any questions from the audience?

274
00:20:51,940 --> 00:20:54,080
Jonathan, any questions from the audience?

275
00:20:54,220 --> 00:20:56,400
Looks like the question list is empty here.

276
00:20:56,400 --> 00:20:58,200
One quick thing that did come up.

277
00:20:58,200 --> 00:21:02,260
You mentioned earlier you're going to provide a parts list, but one high-level question.

278
00:21:02,260 --> 00:21:12,540
Most of the parts that you've just mentioned now, such as like the chip quick and solder, do you generally purchase that going through maybe like SparkFun or maybe through Amazon?

279
00:21:12,540 --> 00:21:16,260
Again, knowing that you're going to provide the parts list, just a high-level question.

280
00:21:16,260 --> 00:21:21,980
Yeah, typically when I buy this stuff, I'll be honest with you, everyone.

281
00:21:21,980 --> 00:21:23,280
I'm kind of lazy.

282
00:21:23,280 --> 00:21:24,720
I'm an Amazon kind of guy.

283
00:21:24,960 --> 00:21:30,900
I can usually turn stuff around and a lot of times Amazon has stuff available quicker.

284
00:21:31,120 --> 00:21:39,380
So, if Amazon has it available within 24 hours, 48 hours, I'm going to pay that little extra and have that sent to me quickly.

285
00:21:39,480 --> 00:21:57,980
But yet, you can go off and buy this stuff from a number of vendors, a number of organizations that sell these types of products, hacker groups, hacker organizations, technology organizations, AliExpress.

286
00:21:58,160 --> 00:22:04,200
For a lot of the stuff you're going to see today, you can easily just order it and have it straight shipped from China.

287
00:22:04,580 --> 00:22:10,600
But again, I have a tendency to be a little lazy and when I want it, I like want it now.

288
00:22:10,600 --> 00:22:15,280
I don't want to wait a week for it because if I think I need it, I need it now.

289
00:22:15,280 --> 00:22:18,260
And that's usually how I go with Amazon.

290
00:22:18,260 --> 00:22:28,880
So, you'll see a lot of the links on here going off to Amazon or Weller or some of the other places for equipment manufacturers and buying it that way.

291
00:22:30,660 --> 00:22:33,920
Okay, so let's kind of move on here.

292
00:22:34,100 --> 00:22:38,160
So, the next area we want to look at is monitoring equipment.

293
00:22:39,040 --> 00:22:47,420
So, we start thinking about monitoring equipment, you know, how do we gain access to circuit boards and how do we start looking at data?

294
00:22:47,480 --> 00:22:51,800
One of the first things is kind of that USB to serial component.

295
00:22:52,060 --> 00:22:55,840
And I think a lot of people online are probably familiar with these.

296
00:22:55,840 --> 00:22:57,780
These are reasonably inexpensive.

297
00:22:57,780 --> 00:22:59,000
It's a bus pirate.

298
00:22:59,520 --> 00:23:04,680
And this will give you that level of access to be able to look at start looking at devices.

299
00:23:05,600 --> 00:23:08,620
One of the other things, I'm not a big fan of this.

300
00:23:09,280 --> 00:23:13,260
I have a tendency to like using this in a different way.

301
00:23:13,860 --> 00:23:23,200
There's other software you can actually install on these and actually turn these into debuggers for Atmel chips.

302
00:23:23,200 --> 00:23:33,280
So, if you need to debug or read data off an Atmel chip, you can easily take these and put I think it's SDK 500 V2 software on it.

303
00:23:33,280 --> 00:23:40,260
I think we demoed this last year at the IoT village was hands-on exercises that actually did that.

304
00:23:40,320 --> 00:23:43,380
We're using reprogrammed bus pirates.

305
00:23:43,560 --> 00:23:44,920
So, that's pretty good.

306
00:23:45,020 --> 00:23:51,240
The other thing, and I'm a fan of this, I have a whole box of these sitting around here.

307
00:23:51,340 --> 00:23:52,720
And it's the Shikra.

308
00:23:52,720 --> 00:23:55,080
The Shikra has a lot of capabilities.

309
00:23:55,480 --> 00:23:57,980
And here's kind of a little data sheet that comes with it.

310
00:23:57,980 --> 00:23:59,760
So, we have the UART.

311
00:23:59,760 --> 00:24:01,120
We have JTAG.

312
00:24:01,120 --> 00:24:03,040
And you can use OpenOCD that.

313
00:24:03,040 --> 00:24:09,380
And you can use SPI for actually reading memory off chips.

314
00:24:09,740 --> 00:24:12,080
And this device comes in really handy.

315
00:24:12,080 --> 00:24:15,220
I typically use this for UART.

316
00:24:16,000 --> 00:24:20,600
And like I said, I actually love this device quite a bit.

317
00:24:20,680 --> 00:24:23,540
And then there's other things you can do.

318
00:24:23,540 --> 00:24:27,020
There's other FTDI devices that can be used.

319
00:24:27,020 --> 00:24:34,160
Here's just a couple I have in my lab that I purchased for other purposes and reasons.

320
00:24:34,440 --> 00:24:36,320
And then there's another one I have.

321
00:24:37,320 --> 00:24:39,860
This one I bought not too long ago.

322
00:24:39,860 --> 00:24:42,480
I guess it's probably about three or four months ago.

323
00:24:42,480 --> 00:24:46,220
And this one actually has four UARTs built into it.

324
00:24:46,220 --> 00:24:48,700
So, it is a USB.

325
00:24:48,760 --> 00:24:53,160
It has four UARTs, and you can switch them between three volts and five volts.

326
00:24:53,160 --> 00:24:57,780
So, you can either hook them up here or hook them up into the actual plug jacks.

327
00:24:57,780 --> 00:24:58,540
This is nice.

328
00:24:58,540 --> 00:25:02,220
You plug it in and four UART functions show up.

329
00:25:02,220 --> 00:25:12,720
This makes it much more easier for hooking into multiple connection points on an actual device for doing UART testing or analysis.

330
00:25:12,980 --> 00:25:16,460
People have seen the work that I did on the interchip communication.

331
00:25:16,480 --> 00:25:18,080
I like to use one of these.

332
00:25:18,080 --> 00:25:25,880
It works out pretty good for capturing multiple UARTs for analysis as data as it flows through a system.

333
00:25:27,580 --> 00:25:31,660
And also, let's go ahead and move on to logic analyzers.

334
00:25:31,660 --> 00:25:37,400
So, I want to point out that Jonathan is actually going to be speaking tomorrow evening.

335
00:25:37,520 --> 00:25:39,960
Is it tomorrow evening or tomorrow morning, Jonathan?

336
00:25:40,240 --> 00:25:41,340
Yep, tomorrow evening.

337
00:25:42,300 --> 00:25:49,820
And he's going to do a talk on using logic analyzers.

338
00:25:50,280 --> 00:25:53,780
So, there's a lot of different logic analyzers you can buy.

339
00:25:53,780 --> 00:25:57,160
I think Jonathan has one of these he's actually going to show.

340
00:25:57,160 --> 00:25:58,520
He has another one.

341
00:25:58,700 --> 00:25:59,480
These are cheap.

342
00:25:59,480 --> 00:26:00,820
This is like 12 bucks.

343
00:26:00,820 --> 00:26:04,620
It does like 24, 24, 25 megahertz.

344
00:26:04,760 --> 00:26:06,400
Another one that I have.

345
00:26:06,980 --> 00:26:09,120
This one is a Saleh.

346
00:26:09,120 --> 00:26:13,180
This is their 4-channel one.

347
00:26:13,180 --> 00:26:19,700
It's no longer being manufactured, but Saleh had a whole stinking warehouse full of them.

348
00:26:19,700 --> 00:26:20,840
And they're selling these.

349
00:26:20,840 --> 00:26:21,740
These are more pricey.

350
00:26:21,740 --> 00:26:23,640
They're 100 bucks, but it's a Saleh.

351
00:26:23,640 --> 00:26:25,180
This is a high quality.

352
00:26:25,960 --> 00:26:29,060
Now, what I use is I do have a Saleh.

353
00:26:29,060 --> 00:26:30,720
I have the 8-channel.

354
00:26:31,080 --> 00:26:35,800
The 8-channel, I think this is like $600.

355
00:26:35,980 --> 00:26:40,900
This is the, I think it's 100 megahertz, 8-channel.

356
00:26:40,900 --> 00:26:42,780
This one's the actual pro.

357
00:26:43,900 --> 00:26:46,340
Works great for everything I'm doing in the lab.

358
00:26:46,340 --> 00:27:05,380
And if you're not doing it for a job, and you're just a hacker or whatever, and you're education and you're learning, you can actually get an EDU kind of version of this, which will save you a significant amount of money when it comes to logic analyzers.

359
00:27:07,900 --> 00:27:16,520
So, also, some of the things you may want to consider earlier, you may have seen the oScope, and that was in the back of my room.

360
00:27:16,520 --> 00:27:17,600
I have an oScope.

361
00:27:17,600 --> 00:27:22,080
I use it sometimes for basically signal chasing.

362
00:27:22,780 --> 00:27:28,200
But other than that, I don't use it that much for most of the tech that I have.

363
00:27:28,200 --> 00:27:34,040
But when you want one, it's nice to have one, and they come into a number of price ranges.

364
00:27:34,260 --> 00:27:49,380
Anything from, you know, typical ones you can run off your desktop or laptop with a small plug-in board, all the way to high-end digital built-in logic analysis type of stuff in the thousands of dollars.

365
00:27:50,020 --> 00:27:52,220
The one I have was the Textronics.

366
00:27:52,220 --> 00:28:02,360
I'm a big fan of Textronics since I came from the military, and I think mine was like $500 or $600, and I believe it was a 50 megahertz box, and it works pretty good.

367
00:28:02,360 --> 00:28:10,520
So, moving from there, another area as a hacker that you want to get into is often the RF stuff.

368
00:28:10,520 --> 00:28:13,040
You want to start digging into RF.

369
00:28:13,140 --> 00:28:18,400
So, one of the big RF areas is often Bluetooth Low Energy.

370
00:28:18,700 --> 00:28:23,420
So, these are the go-to Bluetooth dongles.

371
00:28:23,420 --> 00:28:26,460
These are CSR8510s.

372
00:28:26,480 --> 00:28:33,020
These are the ones that'll work with pretty much any of the Bluetooth-developed software out there.

373
00:28:33,020 --> 00:28:34,840
They have the right chipsets in them.

374
00:28:34,840 --> 00:28:39,480
But these will only go up to, I believe, 4.2 version.

375
00:28:39,480 --> 00:28:41,480
I don't think they'll support 5.

376
00:28:41,640 --> 00:28:46,420
I don't think I have anything here, actually, that supports 5 right now.

377
00:28:46,420 --> 00:28:48,880
It's something I need to add to my lab myself.

378
00:28:49,100 --> 00:28:50,340
So, that's one of them.

379
00:28:50,340 --> 00:28:52,800
Another thing is the Nordic.

380
00:28:52,800 --> 00:29:00,360
The Nordic makes a dongle that you can use with nRF Connect, their desktop product, and this happens to be it.

381
00:29:00,360 --> 00:29:05,540
I think I paid $25 or $35 for this.

382
00:29:05,540 --> 00:29:08,720
So, I would recommend having one of these for Bluetooth.

383
00:29:08,720 --> 00:29:11,140
This has a lot of cool capabilities.

384
00:29:11,320 --> 00:29:23,000
And there's a number of development boards and testing boards that are available out there that give you the ability to take what you're doing with Bluetooth to almost any level you want.

385
00:29:23,060 --> 00:29:26,720
Another device I have that I actually like, it's pretty good.

386
00:29:26,720 --> 00:29:27,960
This is a Hulong.

387
00:29:27,960 --> 00:29:32,160
This is about $100, I think it was.

388
00:29:33,020 --> 00:29:40,640
This device, I've had it for a couple years, so hopefully they'll come out with a newer version at Sports 5.

389
00:29:41,220 --> 00:29:48,020
But this gives you the ability to, and it has to be run on a Windows box, gives you the ability to capture Bluetooth.

390
00:29:48,260 --> 00:29:59,600
So, it'll actually see the announcements coming out on Bluetooth, and it'll actually let you pick one of the devices out of the list of Bluetooth low-energy devices.

391
00:29:59,860 --> 00:30:06,100
And as soon as it, once you pick it out, it'll start to output all that stuff to Wireshark directly.

392
00:30:06,300 --> 00:30:14,580
And then once, it'll actually capture the pairing process and the entire authenticated process.

393
00:30:15,160 --> 00:30:23,440
Basically, I don't want to say man-in-the-middle, but capturing all of the data and outputting it correctly to Wireshark for analysis.

394
00:30:23,460 --> 00:30:25,800
So, it's probably one of the best ones out there.

395
00:30:25,800 --> 00:30:30,380
NRF, there used to be NRF Sniffer.

396
00:30:30,380 --> 00:30:34,840
I think it was Sniffer that was available that would run on a desktop.

397
00:30:34,840 --> 00:30:36,940
This thing's like way better.

398
00:30:36,940 --> 00:30:42,420
This actually has all three BLE channels, so it picks up all the data.

399
00:30:42,420 --> 00:30:46,320
It doesn't miss that much data, so it makes it a lot much better.

400
00:30:46,320 --> 00:30:48,440
So, I would recommend that.

401
00:30:48,440 --> 00:30:55,340
And of course, if you get into some other stuff, having the Ubertooth One is probably good.

402
00:30:57,140 --> 00:31:09,520
I heard people complaining that it really updates on the software or follow-up work on the software arena hasn't been done, which is kind of sad because I think it was a very brilliant capable tool.

403
00:31:09,520 --> 00:31:15,280
But hopefully, they'll continue supporting that, and we'll see some new capabilities come out in reference to that.

404
00:31:15,620 --> 00:31:20,080
Moving from that, typically, I don't have a ton of things.

405
00:31:20,080 --> 00:31:27,820
I think here we have a yardstick, which is under the gigahertz range capturing.

406
00:31:28,260 --> 00:31:35,200
And then, of course, and I know I have laying around here somewhere, which I have no idea where it's laying at.

407
00:31:35,200 --> 00:31:37,060
I'm like terrible in my lab.

408
00:31:38,120 --> 00:31:39,980
But I have a... Oh, there it is.

409
00:31:39,980 --> 00:31:52,460
I have a Hacker RF that may come in handy for some people that really want to do the work dealing with RF communication.

410
00:31:52,460 --> 00:31:56,000
So, I'd recommend buying what you can afford.

411
00:31:56,000 --> 00:32:06,860
You know, find an area that fascinates you on the hardware hacking area, and spend as much in that area that you can afford for the best tools.

412
00:32:06,860 --> 00:32:09,580
I would recommend shopping around.

413
00:32:09,580 --> 00:32:15,000
Some of these tools here may have newer versions there may be better release products out there.

414
00:32:15,000 --> 00:32:17,400
This is constantly a changing field.

415
00:32:17,400 --> 00:32:23,160
What I bought a few years ago doesn't necessarily meet the needs now in a lot of cases.

416
00:32:23,160 --> 00:32:32,600
So, I often find myself as I'm doing new projects and new testing that I have to go out and actually buy new equipment and new hardware.

417
00:32:32,600 --> 00:32:35,280
It seems to be an unending process.

418
00:32:35,280 --> 00:32:38,420
It's kind of like being married and a homeowner.

419
00:32:38,620 --> 00:32:43,040
You're always looking for an excuse to buy new tools for around the house.

420
00:32:43,260 --> 00:32:45,600
It's the same way as a hardware hacker.

421
00:32:45,620 --> 00:32:51,000
You're never going to be content until you have all the tools ever made on the face of the earth.

422
00:32:51,080 --> 00:32:58,620
But shop wisely, and I think you could do pretty good gathering up the needed stuff, being able to do the work.

423
00:32:59,780 --> 00:33:04,280
So, there's one other area before we take a quick break and actually look at...

424
00:33:05,640 --> 00:33:07,800
or has some questions.

425
00:33:07,800 --> 00:33:12,800
Another tool, let's not forget critical tools, a multimeter.

426
00:33:13,460 --> 00:33:22,920
Literally, I don't think there's ever on any engagement or any testing or any device I've tore apart where I was hacking on where I didn't use a multimeter.

427
00:33:22,920 --> 00:33:23,840
These are cheap.

428
00:33:23,840 --> 00:33:25,620
You don't need an expensive one.

429
00:33:25,620 --> 00:33:31,940
Mostly, I use this on the continuity field for actually tracing out runs on boards and stuff like that.

430
00:33:31,940 --> 00:33:33,360
It comes in very handy.

431
00:33:33,360 --> 00:33:43,260
I also use it for checking voltages prior to hooking stuff up to make sure that I'm matching the voltages correctly, because that can really screw things up if you get it wrong.

432
00:33:44,000 --> 00:33:52,360
Also, moving from there, let's go ahead and quickly cover the area dealing with debuggers.

433
00:33:53,820 --> 00:33:56,860
Matter of fact, let's kind of stop right there.

434
00:33:56,860 --> 00:34:01,060
And before we get into chip readers and debuggers and see if there are any questions.

435
00:34:02,680 --> 00:34:03,640
Open.

436
00:34:03,920 --> 00:34:04,680
Oh, good.

437
00:34:05,020 --> 00:34:07,700
Yeah, it looks like a couple popped up here.

438
00:34:08,720 --> 00:34:20,840
So yeah, I guess the first question we have here is, this is with regards to the physical non-RF signal quality that we're speaking of earlier.

439
00:34:20,840 --> 00:34:22,800
So you had mentioned the oscilloscope.

440
00:34:23,000 --> 00:34:30,960
And also, I know that you've mentioned that you aren't really going too in-depth with it these days because you don't really need it.

441
00:34:30,980 --> 00:34:39,680
So I'm curious, or excuse me, the question is asking, I am curious, would your answer to that be the SELE does okay for that sort of thing?

442
00:34:39,680 --> 00:34:42,680
And would you recommend the SELE over an oscilloscope?

443
00:34:44,120 --> 00:34:45,660
The answer to that is yes.

444
00:34:45,660 --> 00:34:52,620
I think my go-to is with the SELE logic analyzer 100% now for almost everything I'm doing.

445
00:34:52,620 --> 00:34:54,660
Almost everything I'm looking at is digital.

446
00:34:54,660 --> 00:34:58,860
SELE has come out with the... oh, gosh, what was the name of it?

447
00:34:58,860 --> 00:35:00,120
I'm losing my mind here.

448
00:35:00,120 --> 00:35:00,780
Just a second.

449
00:35:00,780 --> 00:35:01,380
Oh, yeah.

450
00:35:01,380 --> 00:35:05,380
Their logic tool, which is what interacts with the SELE.

451
00:35:05,380 --> 00:35:07,320
They came out with Logic 2.

452
00:35:07,480 --> 00:35:17,200
And the cool thing with Logic 2, it basically gives so much more features to the actual product.

453
00:35:17,200 --> 00:35:19,600
And one of the features is kind of continued streaming.

454
00:35:19,600 --> 00:35:30,240
Instead of capturing, just capturing data, like you often will do, this will actually let you loop that capture so it continues to run.

455
00:35:30,240 --> 00:35:47,880
So I find myself taking a logic analyzer and using it like a probe looking for ongoing signals, timing signals and stuff like that, clock signals that are ongoing, burst traffic, because I can easily stop on something and as this thing continues to run,

456
00:35:47,880 --> 00:35:49,460
I see burst traffic.

457
00:35:49,460 --> 00:35:53,740
So literally, it gives me a way to do some digital signal tracing.

458
00:35:53,740 --> 00:35:59,020
Maybe it's not the most effective way, but I think it's the most cost effective way.

459
00:35:59,020 --> 00:36:04,260
So definitely would recommend if you're going to spend the money, buy yourself a good logic analyzer.

460
00:36:04,500 --> 00:36:14,820
That besides the multimeter is the item that I inevitably use on every engagement and every testing that I do.

461
00:36:18,170 --> 00:36:20,270
Any other questions or is that it?

462
00:36:20,270 --> 00:36:21,210
That's it.

463
00:36:21,270 --> 00:36:27,790
All right, so let's go ahead and let's jump into chip readers.

464
00:36:28,070 --> 00:36:36,990
So hey, you happen to have a device and it has a flash memory chip and you want to be able to get the data off that flash memory chip.

465
00:36:36,990 --> 00:36:38,930
What are you going to do it with?

466
00:36:39,210 --> 00:36:43,790
So there's a lot of inexpensive solutions out there.

467
00:36:43,790 --> 00:36:49,550
This one here is an actual TL866 plus.

468
00:36:50,370 --> 00:36:56,490
This comes with a slew of sockets that go in for it.

469
00:36:56,490 --> 00:37:05,470
This is like a TSOP socket and they get 8 pin or 16 pin sockets and then 8 pin sockets.

470
00:37:05,470 --> 00:37:06,350
List goes on and on.

471
00:37:06,350 --> 00:37:15,410
There's 30, 20 or 30 sockets you actually get with the socket that I purchased.

472
00:37:15,470 --> 00:37:19,310
That is actually a, oh gosh, here we go.

473
00:37:19,310 --> 00:37:22,850
It's a WSAN 8 socket.

474
00:37:22,850 --> 00:37:24,590
So you drop it in.

475
00:37:24,590 --> 00:37:26,410
These are a little more pricey.

476
00:37:26,410 --> 00:37:31,610
But the TL866 is not that expensive.

477
00:37:31,950 --> 00:37:37,190
I think I paid 130 bucks for the one that I have here.

478
00:37:37,610 --> 00:37:51,670
Although when you buy this and it comes with this particular socket, this TSOP48 socket, this will not work for all TSOP48 which is typically NAND flash chips.

479
00:37:51,670 --> 00:37:55,110
So you need to go out and buy this one to go with it.

480
00:37:55,110 --> 00:38:00,110
And you can get these off AliExpress or maybe some other sources.

481
00:38:00,190 --> 00:38:06,270
And this is the, get it right there, NAND08 socket.

482
00:38:06,690 --> 00:38:14,130
And typically this is the socket that's used on the chips that have literally a larger memory.

483
00:38:14,130 --> 00:38:25,450
You start getting in at, you know, 128 meg, 256 meg chips and higher, you're actually going to go over to this socket here.

484
00:38:25,450 --> 00:38:27,170
That seems to be the case.

485
00:38:28,470 --> 00:38:30,910
So that's one of them that I have.

486
00:38:30,910 --> 00:38:34,010
Like I said, I have several chip readers.

487
00:38:34,010 --> 00:38:36,230
I can't remember the number this covers.

488
00:38:36,430 --> 00:38:41,110
I think it's like 7 or 8,000 different chips that are actually supported by this.

489
00:38:41,150 --> 00:38:43,310
So does it cover every chip that I encounter?

490
00:38:43,310 --> 00:38:45,050
The answer to that is no.

491
00:38:45,190 --> 00:38:47,810
Does it cover a large number of them?

492
00:38:47,810 --> 00:38:48,570
Yes, it does.

493
00:38:48,570 --> 00:38:54,630
I mean, it probably covers two-thirds of them that I come across.

494
00:38:54,750 --> 00:38:59,730
One of the other chip readers I have is this RT809H.

495
00:39:00,170 --> 00:39:03,310
So the RT809H, here it is here.

496
00:39:03,310 --> 00:39:06,060
Similar, a little bigger physical construction.

497
00:39:06,550 --> 00:39:08,490
This one comes in handy.

498
00:39:08,670 --> 00:39:11,170
You cannot use, you can use these sockets.

499
00:39:11,170 --> 00:39:22,790
So all of the inline sockets that came out of the TL866 that are straight pin-to-pin wiring and don't contain any kind of circuitry, you can use them on this.

500
00:39:23,310 --> 00:39:28,510
But if it happens to be the TSOP48s, those actually had circuitry built into them.

501
00:39:28,510 --> 00:39:31,950
So you have to buy a socket that will actually work on it.

502
00:39:31,950 --> 00:39:34,570
And this is a straight pin-for-pin one.

503
00:39:36,190 --> 00:39:40,490
So I use this one typically as a backup.

504
00:39:40,490 --> 00:39:48,710
There's times that the TL866 doesn't work or doesn't have what I'm looking for, so I jump over to this one.

505
00:39:48,710 --> 00:39:50,910
It works pretty darn good.

506
00:39:51,010 --> 00:39:53,570
Also, this one you can get various sockets for.

507
00:39:53,570 --> 00:39:56,850
Here happens to be a socket for it.

508
00:39:56,850 --> 00:39:59,070
This was like a $40 socket.

509
00:39:59,110 --> 00:40:00,690
This is a BGA.

510
00:40:00,690 --> 00:40:07,190
This is a 63-ball BGA NAND flash memory socket.

511
00:40:07,190 --> 00:40:13,970
I think I played 45 and had that shipped over from AliExpress from China.

512
00:40:13,970 --> 00:40:20,250
The crazy thing is I ordered it right when this whole COVID thing hit this fan.

513
00:40:20,870 --> 00:40:29,410
So it took like two months to get to me versus the typical 30 days that I often have wait or shorter time period.

514
00:40:29,410 --> 00:40:31,270
So that's one of the readers.

515
00:40:31,270 --> 00:40:50,990
So some of the other readers I have in my arsenal here is dealing with embedded multi-chip packages and embedded multimedia controllers.

516
00:40:51,310 --> 00:41:00,610
So these you actually find a lot when you're dealing with embedded systems and especially some consumer-grade IoT.

517
00:41:01,690 --> 00:41:05,550
These are actually for reading BGAs.

518
00:41:05,550 --> 00:41:13,930
This is an embedded multimedia chip for 153-ball BGA.

519
00:41:13,930 --> 00:41:15,570
So you open it up.

520
00:41:15,570 --> 00:41:17,590
You drop the chip in there.

521
00:41:17,590 --> 00:41:18,730
Plug it in.

522
00:41:18,730 --> 00:41:20,530
It's USB 3.

523
00:41:20,530 --> 00:41:22,270
Plug it into your computer.

524
00:41:22,270 --> 00:41:23,750
Hit this button here.

525
00:41:23,750 --> 00:41:26,470
And that chip will mount up just like a file system.

526
00:41:26,470 --> 00:41:30,410
It'll mount up just like an SD card will mount up.

527
00:41:30,410 --> 00:41:34,990
And it'll actually mount the entire file systems on the device most of the time.

528
00:41:34,990 --> 00:41:37,670
And from there, you can quickly recover the data.

529
00:41:37,790 --> 00:41:39,910
Sometimes you can alter the data.

530
00:41:40,630 --> 00:41:55,870
One of the exercises I did, I actually used that to pull the data and then use one of these in all data and then DD it back to the actual chip and then reball the BGA, put it back on the device to gain root level access.

531
00:41:55,970 --> 00:41:59,750
So these are great and they come in a number of different sizes.

532
00:41:59,910 --> 00:42:04,870
So that's known as an embedded multi-chip package type thing.

533
00:42:04,870 --> 00:42:07,690
Again, you'll find these in a lot of devices.

534
00:42:07,690 --> 00:42:13,390
That means it contains both RAM and flash memory in the actual chip.

535
00:42:13,390 --> 00:42:16,950
But these ones are kind of pricey, like $135.

536
00:42:17,090 --> 00:42:18,990
There is a cheaper version.

537
00:42:18,990 --> 00:42:23,270
This is pretty much the same thing, but it's done up just like an SD card.

538
00:42:23,850 --> 00:42:33,110
So, and then you just plug it in like an SD card into your computer and it'll mount the chip up just like a file system.

539
00:42:34,050 --> 00:42:35,910
Now, these ones are a little cheaper.

540
00:42:35,910 --> 00:42:39,910
I think they're well under $100, like $90 or something like that.

541
00:42:39,990 --> 00:42:57,530
Also, if you need to deal with embedded multi-chip package or embedded multimedia chips, I would recommend doing a little Googling on that because this example here, people have actually built these.

542
00:42:57,530 --> 00:42:59,850
So there's ways to build these.

543
00:42:59,850 --> 00:43:09,350
Of course, you may have to dead bug the chip, which means you're going to need a good microscope because you'll end up soldering to the pads of the chip on the underside.

544
00:43:09,350 --> 00:43:13,690
But there's only like five connections or four connections that have to be made on the chip.

545
00:43:13,690 --> 00:43:16,030
And you can literally actually read it.

546
00:43:16,030 --> 00:43:17,810
So there's a lot of documentation out there.

547
00:43:17,810 --> 00:43:21,750
So you can take the hacker mode and save yourself a lot of money.

548
00:43:21,750 --> 00:43:24,110
But again, it'll take a lot more time.

549
00:43:28,050 --> 00:43:31,750
So any questions there on chip readers?

550
00:43:31,770 --> 00:43:38,390
And again, most of these chip readers were $120 to $140 right around there.

551
00:43:39,050 --> 00:43:51,090
One question that came up with regard to the chip readers here that I'm seeing is... and this is a little bit of a backfill, I do apologize.

552
00:43:51,090 --> 00:44:00,790
One question that came up earlier is, is it actually worth picking up an old benchtop logic analyzer off eBay or going with some of the newer USB tools?

553
00:44:00,790 --> 00:44:03,270
Cost is a limiting factor for this individual.

554
00:44:04,350 --> 00:44:11,510
Ah, you know, I don't know enough about any of the benchtop logic analyzer tech that you're talking about.

555
00:44:11,510 --> 00:44:13,190
I haven't worked with any of those.

556
00:44:13,730 --> 00:44:17,970
Typically, most of the stuff I've done with is the USB stuff.

557
00:44:18,030 --> 00:44:27,950
I mean, if you're looking for a logic analyzer, just to give it a try, I'll be honest with you, a lot of these, when you start getting into these smaller ones, 24 megahertz, I have not used this.

558
00:44:28,130 --> 00:44:31,550
So obviously, it's $12 from a logic analyzer standpoint.

559
00:44:31,550 --> 00:44:34,750
This gives you an entry point, just to get familiar.

560
00:44:34,830 --> 00:44:40,070
And I think the logic programs put out by Sele will actually work on these.

561
00:44:40,470 --> 00:44:41,750
And there's a couple other ones.

562
00:44:41,750 --> 00:44:44,590
And Jonathan's going to talk about this in more detail tomorrow.

563
00:44:44,590 --> 00:44:47,250
So I definitely swing by his presentation.

564
00:44:47,250 --> 00:44:52,630
I would start off, if money's limited, I mean, can you come up with 12 bucks, give one of these things a try.

565
00:44:52,630 --> 00:44:59,610
I bet you nine times out of 10 on most standard consumer grade IoT, this is going to be fine.

566
00:44:59,770 --> 00:45:08,150
I've only run into issues when I'm dealing with commercial level devices, where a megahertz rating like this would not have worked.

567
00:45:08,390 --> 00:45:11,050
So just an example.

568
00:45:11,830 --> 00:45:13,230
That makes sense.

569
00:45:13,230 --> 00:45:15,550
And another backfill question here.

570
00:45:15,550 --> 00:45:17,690
Asher says, such a great lab, Daryl.

571
00:45:17,690 --> 00:45:22,450
One question, what do you use for on-chip debugging other than the Shikra?

572
00:45:25,370 --> 00:45:26,850
Oh, on-chip debugging?

573
00:45:26,850 --> 00:45:29,590
Yeah, we're actually get into that next.

574
00:45:30,190 --> 00:45:36,590
If you want to do on-chip debugging or pulling firmware out of the chips and all that type of stuff.

575
00:45:36,590 --> 00:45:40,270
That's the next section that we're going to dive into.

576
00:45:40,390 --> 00:45:41,490
Okay, perfect.

577
00:45:41,490 --> 00:45:44,730
And I think we'll put a pin on that question because it sounds like it'll be answered.

578
00:45:44,730 --> 00:45:48,450
Next question here reads, what are these readers used for?

579
00:45:48,450 --> 00:45:50,190
What are you reading off these chips?

580
00:45:50,190 --> 00:45:51,550
Sorry, noob.

581
00:45:51,550 --> 00:45:52,410
Thank you.

582
00:45:52,410 --> 00:45:54,050
There's nothing wrong with that, man.

583
00:45:54,050 --> 00:45:56,190
I mean, we were all learning at one time.

584
00:45:56,310 --> 00:46:00,370
Five years ago, I couldn't have told you any of this stuff at all.

585
00:46:00,370 --> 00:46:07,990
So what we're doing is these chips I'm talking about are flash memory chips.

586
00:46:07,990 --> 00:46:12,210
This is where the embedded device holds its operating system.

587
00:46:12,210 --> 00:46:19,790
It's also where it holds configuration settings and data associated with the functionality of that device.

588
00:46:19,950 --> 00:46:33,130
So if you want to be able to pull off the firmware for some kind of offline analysis, you want to do some offline debugging with IDA Pro or something like that, then you need to be able to extract the firmware.

589
00:46:33,550 --> 00:46:37,330
So to be able to extract the firmware, you need to gain some level of access.

590
00:46:37,350 --> 00:46:43,670
Chip readers come in handy for doing what I consider off-board reading.

591
00:46:43,670 --> 00:46:52,930
So you desolder the chip, remove it from the board, drop it into the reader, dump all of the memory out of that chip, and then you solder the chip back on the board.

592
00:46:52,930 --> 00:47:02,410
I have a tendency, since I'm fairly good at soldering and desoldering and stuff like that, that I will often do that.

593
00:47:02,410 --> 00:47:10,530
I will literally just pull the chip versus trying to do it in circuit because I found it's sometimes much easier.

594
00:47:10,610 --> 00:47:20,010
In some cases, not always, but in a number of cases, the only time it's more difficult is when you're dealing with like a ball grooter rated chip, a PGA chip, where the pins are underneath.

595
00:47:20,010 --> 00:47:26,270
So when you remove it, the complexity of putting it back on is fairly complex.

596
00:47:26,270 --> 00:47:28,670
So hopefully that answers that question.

597
00:47:30,150 --> 00:47:31,330
Makes sense.

598
00:47:31,330 --> 00:47:33,630
And one final question here.

599
00:47:34,210 --> 00:47:36,870
It's asking about the Flipper Zero.

600
00:47:37,090 --> 00:47:40,570
Individuals asking, what are your thoughts on the upcoming Flipper Zero?

601
00:47:40,570 --> 00:47:42,870
Is it a great asset or a gimmick?

602
00:47:42,870 --> 00:47:44,690
Kickstarter problems apply.

603
00:47:45,030 --> 00:47:46,110
Flipper Zero.

604
00:47:46,110 --> 00:47:47,310
I don't think I've seen that.

605
00:47:47,310 --> 00:47:48,270
Have you seen that?

606
00:47:48,270 --> 00:47:49,530
Have you looked at it?

607
00:47:49,630 --> 00:47:51,350
Yeah, it looks super interesting, actually.

608
00:47:51,550 --> 00:47:54,010
I'm additionally not familiar with it.

609
00:47:54,010 --> 00:47:55,110
Looks super slick.

610
00:47:55,110 --> 00:47:57,590
Looks like you can do a lot of hardware analysis with it.

611
00:47:58,150 --> 00:47:59,330
I think it looks kind of cool.

612
00:47:59,330 --> 00:48:01,810
It's very powerful for sub one gigahertz.

613
00:48:01,850 --> 00:48:09,190
From what I'm seeing there, it looks somewhat similar to the Yardstick with maybe a few additional features.

614
00:48:09,190 --> 00:48:11,570
But it looks pretty slick, in my opinion.

615
00:48:12,110 --> 00:48:15,990
Yeah, like I mentioned, there is always new tech being developed.

616
00:48:17,010 --> 00:48:22,190
So often I don't dig into those unless it happens to be on my table or something I need to work on.

617
00:48:22,410 --> 00:48:30,250
And then I go out looking and I try to look for the right tool, the right solution, the one that's going to help me do the job the easiest and the quickest.

618
00:48:30,970 --> 00:48:31,830
So, hey, great.

619
00:48:31,830 --> 00:48:33,010
Thanks for bringing that up.

620
00:48:33,010 --> 00:48:35,790
I'll have to look at that once we get offline here.

621
00:48:37,250 --> 00:48:44,670
Yeah, and Daryl, we actually had the inventor of the Flipper Zero present at our event back in May.

622
00:48:44,670 --> 00:48:52,270
So anyone who's listening, you can always check that video out as he goes through all the features and so the story of why he built it.

623
00:48:53,050 --> 00:48:53,910
Outstanding, Sam.

624
00:48:53,910 --> 00:48:54,670
Thank you very much.

625
00:48:54,670 --> 00:48:55,930
We'll check that out.

626
00:48:57,930 --> 00:49:03,470
So kind of moving on from there, I just wanted to get into some debugging.

627
00:49:04,790 --> 00:49:12,510
There was some area I did miss earlier, and we may jump on it at the end if we have time, but we'll start with debuggers.

628
00:49:12,510 --> 00:49:20,090
The first thing I want to look at is not necessarily a debugger, but pretty darn close to it.

629
00:49:20,090 --> 00:49:24,970
This is fairly pricey, about $150 to $170.

630
00:49:25,090 --> 00:49:26,730
It's a JTAGulator.

631
00:49:26,870 --> 00:49:30,230
I have not used this in a while.

632
00:49:31,430 --> 00:49:32,850
Don't ask me why.

633
00:49:32,850 --> 00:49:38,290
I guess I need to figure out where the JTAG connections are in a while.

634
00:49:38,290 --> 00:49:49,330
But if you're in a bind and you need to figure out if there's any exposed JTAG connectors on a chip that you can't identify, this is the tool for doing it.

635
00:49:49,330 --> 00:49:51,470
You just plug all these in here.

636
00:49:51,470 --> 00:49:53,850
You hit reset, go.

637
00:49:53,850 --> 00:50:13,950
You have some software you can run on this thing, and it gives you the ability to go through all of the testing sequences for all the different wiring combinations that you could possibly generate by plugging this thing in and checks for various JTAG connections.

638
00:50:13,950 --> 00:50:15,830
It can also be used for UART.

639
00:50:15,830 --> 00:50:17,770
I don't use it for UART.

640
00:50:17,770 --> 00:50:23,610
Typically, that's easy enough to spot with a logic analyzer fairly quickly.

641
00:50:23,610 --> 00:50:37,450
But yet a good tool to have in your arsenal, especially if you're doing a lot of debugging devices where you can't identify whether a JTAG is available.

642
00:50:37,450 --> 00:50:44,270
They also added some features to this that will actually go through and do I-O testing.

643
00:50:44,270 --> 00:50:56,350
So, it'll do a series of tests, information, feed, and capture based on identifying the various I-Os on a processor.

644
00:50:56,450 --> 00:50:59,090
So, that's also a great feature.

645
00:50:59,890 --> 00:51:07,350
So, when it gets into logic or not logic analyzer, but debuggers, how can I interact with a chip?

646
00:51:07,610 --> 00:51:09,790
How can I interact with the processor?

647
00:51:10,250 --> 00:51:21,170
And some of them may be, hey, how can I pull firmware out of a processor that actually has flash in the processor, which seems to be the thing I often do.

648
00:51:21,170 --> 00:51:23,810
I have a whole slew of debuggers.

649
00:51:23,810 --> 00:51:29,650
I got dozens and probably a dozen of them laying around here somewhere for various things.

650
00:51:29,790 --> 00:51:37,830
But there's one that I have that's like a go-to, at least mainly for ARM processors, and that's a JLINK Seeger.

651
00:51:37,830 --> 00:51:40,090
JLINK is a great product.

652
00:51:40,090 --> 00:51:42,190
This is a commercial version.

653
00:51:42,190 --> 00:51:50,110
These are kind of pricey based on the speed and the capabilities of the hardware, the price goes up and up.

654
00:51:50,110 --> 00:51:57,750
I think this one was like $600, can easily go upwards of a thousand or more for the solution.

655
00:51:57,750 --> 00:52:00,110
But there is hope.

656
00:52:00,110 --> 00:52:07,830
If you're interested in the Seeger JLINK and you are basically a student or somebody learning, you can buy the EDU version.

657
00:52:07,830 --> 00:52:12,990
When I first started learning and wasn't using it for commercial use, I purchased that.

658
00:52:12,990 --> 00:52:17,130
It was like $70, has all the similar capabilities.

659
00:52:17,130 --> 00:52:22,030
Its speed of data reads probably not as fast, but it's pretty good.

660
00:52:22,030 --> 00:52:35,270
Another thing I do is a habit of mine is I always tape the pin out for all of the pins on some of these devices, because I rarely throw a 20-pin plug in there and use it.

661
00:52:35,270 --> 00:52:47,870
I often use single plugs because often we use this for not only for standard JTAG, but I use it for serial wire debug or CJTAG.

662
00:52:47,870 --> 00:52:55,690
This will do CJ offset also, which is a subset of JTAG that is also like serial wire debug.

663
00:52:56,690 --> 00:53:08,490
So if you're like me and you can't memorize all these pins on everything, actually doing a printout and sticking them in the back is a nice little feature that I use to help speed me along.

664
00:53:08,770 --> 00:53:11,090
But again, it's a great product.

665
00:53:11,550 --> 00:53:19,850
And for mainly ARM processors, I go to on this, but then also I will use various debuggers for different process.

666
00:53:20,070 --> 00:53:26,370
So if you TI, TI chips, the CC debugger, I can't remember what this was, $20, $30.

667
00:53:26,450 --> 00:53:27,470
It wasn't that much.

668
00:53:28,350 --> 00:53:36,150
And it happened to be a case where I was dealing with some TI chips and I'm like, just buy the thing, put it in my lab, I have it.

669
00:53:36,150 --> 00:53:45,210
Another one, which we demoed last year, and that was dealing with the XDS 110, which is another TI debugger.

670
00:53:45,210 --> 00:53:55,750
I really didn't want, and I wanted to expose people to the XDS 110 from a debugging standpoint, but I didn't want to buy the full blown one because it's like $110, $120.

671
00:53:56,430 --> 00:54:01,810
But it turns out that they made this small development kit type thing for a sensor tag.

672
00:54:01,810 --> 00:54:05,890
And the one you buy for that is basically a stripped down model.

673
00:54:05,890 --> 00:54:11,090
There's no case, there's some features turned off, but it works the same way.

674
00:54:11,090 --> 00:54:16,030
And this was like $15 versus 100 and some dollars.

675
00:54:16,070 --> 00:54:17,490
And it worked pretty good.

676
00:54:17,490 --> 00:54:27,170
And I kind of got this idea because I bought, I was doing some research on a TI chipset and I, for a vendor.

677
00:54:27,170 --> 00:54:36,310
And so I bought the development kit and development kit had an XDS built into the chip on the development kit, which got me interested in doing this.

678
00:54:36,310 --> 00:54:41,410
And that's why I kind of shared that stuff last year and let people do the hands-on.

679
00:54:41,470 --> 00:54:45,970
Now, I have a number of debuggers around here, but, you know, a debugger is what it is.

680
00:54:45,970 --> 00:54:46,750
It's a debugger.

681
00:54:46,750 --> 00:54:59,770
Typically what I do is when I encounter a chipset, the first thing I do is I go out and go, okay, if I was a developer on this product line for this chipset, how would I do it?

682
00:54:59,770 --> 00:55:02,310
What product would I use?

683
00:55:02,310 --> 00:55:08,250
What does the vendor recommend for interacting with their hardware, their chips?

684
00:55:08,250 --> 00:55:09,830
And then I go out and check it out.

685
00:55:09,830 --> 00:55:12,790
Do they have guidelines for using a JLink?

686
00:55:12,790 --> 00:55:14,170
Then I use a JLink.

687
00:55:14,170 --> 00:55:22,450
Do they have a specialized debugger like PIC processors do, which is basically encircled serial programming?

688
00:55:22,470 --> 00:55:24,370
That's basically SPI.

689
00:55:25,170 --> 00:55:26,990
If that's the case, then get those.

690
00:55:26,990 --> 00:55:30,390
I have several of those laying around here.

691
00:55:30,390 --> 00:55:34,310
The PIC kits is what they're called.

692
00:55:34,930 --> 00:55:47,370
So, I try to find out what the developer community uses for a particular product, and if I can afford it and it's inexpensive, I buy that, or I buy the next level alternate to actually use.

693
00:55:47,370 --> 00:55:50,590
And that's typically the approach that I use.

694
00:55:50,590 --> 00:56:01,570
I found out if I'm trying to deal with a chipset and I'm using somebody else's debugger, it has a tendency to not always do what I expected to do.

695
00:56:01,570 --> 00:56:11,210
It doesn't always give me the information that I get from the development community on the product or from the vendor on the product, and it adds a level of complication.

696
00:56:11,210 --> 00:56:18,810
And I'm able to find way more resources if I use what the development community uses on that product.

697
00:56:19,030 --> 00:56:22,310
But the reality, that's not always feasible.

698
00:56:22,310 --> 00:56:26,170
There's been a number of times where I've gone, hey, here's a chip.

699
00:56:26,250 --> 00:56:34,370
You go out and you try to find out what the development community is using for and find out it costs $10,000 and you can only buy it from the vendor.

700
00:56:34,370 --> 00:56:38,010
In cases like that, then, hey, if it's an ARM, use ARM.

701
00:56:38,010 --> 00:56:47,870
If it's something else, go all the way down and use one of these and then use OpenOCD if you have to, whatever it takes.

702
00:56:47,870 --> 00:56:54,770
But I tend to have to dive into what the actual person producing uses.

703
00:56:56,050 --> 00:57:05,390
I want to move on real quick because we're running a little behind and I want to get this next phase because I know the... well, matter of fact, never mind, we can do that.

704
00:57:05,390 --> 00:57:06,370
Got any questions?

705
00:57:07,350 --> 00:57:08,090
Yep.

706
00:57:08,090 --> 00:57:10,350
Looks like one question cropped up here.

707
00:57:10,350 --> 00:57:18,590
Josh asks, do you happen to have any books, videos, or any learning material that you recommend to start learning IoT hacking?

708
00:57:19,210 --> 00:57:20,590
Oh, gosh.

709
00:57:20,970 --> 00:57:23,110
That's kind of a hard one.

710
00:57:24,330 --> 00:57:29,250
I'm not a big book person, to be honest.

711
00:57:29,510 --> 00:57:34,590
What I typically do is I'm definitely a Google and YouTube kind of guy.

712
00:57:35,650 --> 00:57:46,010
Everything that I've wanted to learn, an example, I wanted to learn how to re-solder a TSOP48 pin chip back onto a circuit board.

713
00:57:46,010 --> 00:57:48,070
I'm like, damn, this is going to be hard.

714
00:57:48,070 --> 00:57:50,090
I can't go solder each pin.

715
00:57:50,130 --> 00:57:54,190
So I went on YouTube and looked it up and go, how do I do this?

716
00:57:54,190 --> 00:57:56,490
And there's like three or four videos out there.

717
00:57:56,490 --> 00:57:59,650
And then I watched those videos and it's the same way.

718
00:57:59,970 --> 00:58:10,550
If I want to learn how to use UART, I go check out some of the videos on finding UART and looking for UART, same way with logic analyzers.

719
00:58:10,550 --> 00:58:12,470
And it's typically the approach that I do.

720
00:58:12,470 --> 00:58:14,470
And I still do that to this day.

721
00:58:15,010 --> 00:58:21,670
Anytime I'm working in engagement or testing a product and I go, how do I interact with this?

722
00:58:21,670 --> 00:58:29,810
I haven't done this before because even though I've been in this in four years, I constantly encounter things that I haven't encountered before.

723
00:58:29,810 --> 00:58:33,130
I first, I go out and find out who else has done this.

724
00:58:33,130 --> 00:58:34,690
Has it been done before?

725
00:58:35,150 --> 00:58:38,530
Has anything similar to it been done before?

726
00:58:38,570 --> 00:58:40,350
And that's kind of my approach.

727
00:58:40,350 --> 00:58:47,350
If you're trying to, and I know there's a lot of learning kits out there, but I'd also recommend, oh gosh, where is that?

728
00:58:47,350 --> 00:58:48,090
Hold on.

729
00:58:48,970 --> 00:58:54,270
I would recommend looking at some inexpensive products just to play around with.

730
00:58:54,270 --> 00:58:56,550
And I'm going to throw some pictures up here.

731
00:58:58,070 --> 00:59:04,510
And like these, these right here, Vixme 300 millimeter router type things.

732
00:59:04,510 --> 00:59:06,890
Let's pop one of these things out here.

733
00:59:06,890 --> 00:59:08,850
Oh, that's one thing about my lab.

734
00:59:08,850 --> 00:59:11,410
It's like a ton of gear.

735
00:59:11,410 --> 00:59:15,730
So this one actually uses, it's a little router device.

736
00:59:15,730 --> 00:59:17,830
So we have these chips on here.

737
00:59:19,570 --> 00:59:22,130
So it has a lot of things you can interact with.

738
00:59:22,130 --> 00:59:23,250
There's Ethernet.

739
00:59:23,850 --> 00:59:25,530
There's USB.

740
00:59:26,270 --> 00:59:28,730
It actually has UART.

741
00:59:29,050 --> 00:59:31,430
So UART is actually marked on here.

742
00:59:31,430 --> 00:59:35,770
If you look, there's, it says TX and RX, and then I found the ground.

743
00:59:36,350 --> 00:59:39,190
This runs OpenWRT.

744
00:59:39,810 --> 00:59:42,890
It actually has a flash memory chip right here.

745
00:59:42,890 --> 00:59:47,030
So here's a chance to figure out how to get the memory out of the device.

746
00:59:47,030 --> 00:59:48,550
Here's a chance to play with this.

747
00:59:48,550 --> 00:59:52,290
In this case here, root doesn't have a password on it.

748
00:59:52,290 --> 00:59:58,190
So in that case there, you really, as soon as you get the console, it's going to be root level access.

749
00:59:58,190 --> 01:00:00,990
But you can change that and then try to get around it.

750
01:00:00,990 --> 01:00:03,010
This device is like 20 bucks.

751
01:00:03,870 --> 01:00:11,950
And I would recommend getting something like this and starting out by just going, hey, this is a Meditech chip.

752
01:00:11,950 --> 01:00:13,350
What does that mean?

753
01:00:13,350 --> 01:00:14,570
Data sheets.

754
01:00:14,570 --> 01:00:17,350
This here is a RAM chip.

755
01:00:17,350 --> 01:00:19,030
Find the data sheets.

756
01:00:19,230 --> 01:00:21,490
This is a flash memory chip.

757
01:00:21,490 --> 01:00:22,830
Find the data sheets.

758
01:00:22,830 --> 01:00:27,550
Read those data sheets and kind of learn and play around and experiment.

759
01:00:27,790 --> 01:00:34,550
And if you screw it up, throw it in the trash can and go spend another 20 bucks.

760
01:00:38,220 --> 01:00:39,860
Hopefully that answered the question.

761
01:00:39,860 --> 01:00:46,320
Okay, here's another one, but I don't think the GL Mango is even available anymore, but it's the same product, just relabeled different.

762
01:00:48,620 --> 01:00:53,020
Another question cropped up here was, I think it's kind of an extension of that question.

763
01:00:53,020 --> 01:00:55,100
Do you have any go-to YouTube channels?

764
01:00:55,100 --> 01:00:57,280
Do you follow anyone on social media?

765
01:00:58,960 --> 01:01:00,360
Oh, gosh.

766
01:01:00,660 --> 01:01:03,980
Yeah, from social media, I'm a Twitter guy.

767
01:01:04,100 --> 01:01:06,080
So you can find me on Twitter.

768
01:01:06,080 --> 01:01:11,700
My handle's percent, P-E-R-C-E-N-T underscore X.

769
01:01:11,920 --> 01:01:13,760
Yeah, please follow me.

770
01:01:14,680 --> 01:01:20,220
If you're one that tweets a lot of political stuff, there's nothing wrong with that.

771
01:01:20,220 --> 01:01:23,140
I'm just not a big fan of that, just to be aware of it.

772
01:01:23,260 --> 01:01:26,380
I want to see mostly technical stuff.

773
01:01:26,380 --> 01:01:30,540
So if you're doing technical stuff out there, that's kind of cool.

774
01:01:30,540 --> 01:01:32,460
I'll probably follow you back.

775
01:01:32,920 --> 01:01:34,700
But yeah, that's one thing I do.

776
01:01:34,700 --> 01:01:37,020
I do not follow any YouTube channels.

777
01:01:37,220 --> 01:01:41,240
I'm usually all over the map, whatever I'm working on at that time.

778
01:01:41,820 --> 01:01:45,800
And I need to learn something specific, then I go out and search.

779
01:01:45,800 --> 01:01:47,700
And I never look at one single example.

780
01:01:47,700 --> 01:01:56,580
If there's a dozen examples out there, I'll usually look at three or four of them and get three or four different viewpoints on how to approach something or how somebody's done that.

781
01:01:56,680 --> 01:02:01,240
And then experiment with my own ways and own methods and try to build from that.

782
01:02:01,240 --> 01:02:07,220
We've also, at Rapid7, I put out a number of blogs.

783
01:02:07,220 --> 01:02:11,840
So if you use my name, Daryl Hyland, and search for Rapid7 blogs.

784
01:02:12,040 --> 01:02:26,400
I think we put out a whole series last year, actually pulling firmware from microcontrollers, like four of them, covering four different type of microcontrollers, four different software packages, four different debug type devices.

785
01:02:26,520 --> 01:02:30,000
So every once in a while, I'll do that type of stuff too.

786
01:02:33,040 --> 01:02:37,900
Okay, so I want to move on to odds and ends.

787
01:02:37,900 --> 01:02:39,680
This is kind of a big one.

788
01:02:39,860 --> 01:02:48,920
So when you're doing work on devices, it comes down to often needing a lot of strange stuff .

789
01:02:48,940 --> 01:02:51,600
Now the first one is wire.

790
01:02:51,640 --> 01:02:55,880
I don't know how good the video is out there, but this is 40 gauge wire.

791
01:02:55,940 --> 01:03:01,360
And to be absolutely correct about this, I hate this shit.

792
01:03:01,360 --> 01:03:11,400
But this stuff comes in handy for soldering into microscopic small circuits for tapping into them.

793
01:03:11,560 --> 01:03:18,880
So currently, I'm working on a project right now where I have to tap into an Intel i3 processor.

794
01:03:19,180 --> 01:03:21,140
I'm trying to.

795
01:03:21,860 --> 01:03:26,420
And the only way to do it is the pads are like 0.3 millimeters.

796
01:03:26,880 --> 01:03:30,820
So I am actually using this under a microscope and soldering it up.

797
01:03:30,820 --> 01:03:36,100
And at the end of this thing here, I'll show you what I attach it to when I'm done, which will be a lifesaver.

798
01:03:36,100 --> 01:03:37,440
So that comes in handy.

799
01:03:37,440 --> 01:03:41,420
If I'm doing something else that's bigger from a wire standpoint, I use this.

800
01:03:41,420 --> 01:03:43,340
This is wire wrap wire.

801
01:03:44,080 --> 01:03:46,260
I don't even know, VT Corporation.

802
01:03:46,260 --> 01:03:47,700
And I found this.

803
01:03:47,700 --> 01:03:49,620
It comes in all of these different strands.

804
01:03:49,620 --> 01:03:53,960
This is covered with a really fine plastic coating.

805
01:03:54,120 --> 01:03:59,140
That 40 gauge wire earlier was covered with lacquer, real thin coat of lacquer.

806
01:03:59,140 --> 01:04:00,560
Keep it from shorting out.

807
01:04:00,560 --> 01:04:03,440
This stuff will melt that's on the outside of this.

808
01:04:03,440 --> 01:04:07,840
But when you're looking for like 30 gauge wire, you need to find wire wrap.

809
01:04:07,840 --> 01:04:22,280
If you buy standard 30 gauge wire, the actual insulation going around the wire will be thicker than the wire itself and will get in the way when trying to solder two small circuit pads to tap into it.

810
01:04:22,420 --> 01:04:28,940
The other thing is, you know, when you open up a device and you start thinking about headers, you need to attach headers.

811
01:04:29,200 --> 01:04:36,120
And this become a nightmare over the years, or at least early on when I first started, because I was seeing all kinds of stuff.

812
01:04:36,120 --> 01:04:42,580
So I went out and tried to get samples of both 2.54 millimeter headers.

813
01:04:42,580 --> 01:04:48,240
So this can be plugged into the board and soldered in and then you just plug into it for the places there are headers.

814
01:04:48,860 --> 01:04:51,440
What if there happens to be dual header?

815
01:04:51,460 --> 01:04:53,880
So then I bought some dual headers to have those.

816
01:04:53,880 --> 01:04:56,760
I have boxes of these things laying around.

817
01:04:57,180 --> 01:05:03,580
So on top of that, what happens if it's a surface mount header for 2.5 more millimeter?

818
01:05:03,660 --> 01:05:10,180
So if you look at this, it actually has... see how the bottom is sticking out there?

819
01:05:10,760 --> 01:05:12,960
It's actually gall winged.

820
01:05:12,960 --> 01:05:14,080
So there you go.

821
01:05:14,080 --> 01:05:23,140
And then we do the same thing for 1.27 millimeters, single row, double row.

822
01:05:23,280 --> 01:05:24,560
And these are the most common.

823
01:05:24,560 --> 01:05:33,100
And trust me, there's people that produce other headers that you want to kill them when you get them because these things won't fit in a gall wing one.

824
01:05:33,100 --> 01:05:36,180
So yeah, I went out and kind of purchased all of this stuff.

825
01:05:36,400 --> 01:05:38,660
Over time, I didn't do it in one day.

826
01:05:38,660 --> 01:05:41,580
It's like, hey, I need headers that are 1.27.

827
01:05:41,640 --> 01:05:44,620
I need gall wing headers and then went out and bought them.

828
01:05:44,820 --> 01:05:48,920
The other thing that is a lifesaver and that is glue.

829
01:05:50,220 --> 01:06:04,160
Glue comes in really handy because when you're attaching small wires to a board and you snag the wire, you pull the wire, you could easily rip the pad clear off the board, which will happen to you anyways, but this will help prevent it.

830
01:06:04,240 --> 01:06:06,740
This glue here works like a champ.

831
01:06:06,760 --> 01:06:12,780
So here is some 30 gauge wire that I've attached to this device here.

832
01:06:12,860 --> 01:06:13,920
And you can see...

833
01:06:25,450 --> 01:06:29,150
So right here, you can see this is glue.

834
01:06:29,170 --> 01:06:38,450
So I put a dab of glue in there and it holds the wires and it prevents me from tearing the pads out from this circuitry.

835
01:06:38,450 --> 01:06:40,150
It works like a champ.

836
01:06:40,150 --> 01:06:43,150
If you need to remove the glue, it peels right off.

837
01:06:43,150 --> 01:06:47,070
It takes a little force, but it'll peel off clean off the circuit board.

838
01:06:47,070 --> 01:06:51,090
And it's actually brilliant for what you need to do.

839
01:06:51,170 --> 01:06:55,790
Some of the other things that we're going to need, you're going to need a wire.

840
01:06:55,810 --> 01:06:57,130
So these are jumper wires.

841
01:06:57,130 --> 01:07:00,890
You can get these male-to-male, female-to-female, and they just peel off.

842
01:07:01,630 --> 01:07:03,330
So I have bundles of these.

843
01:07:03,330 --> 01:07:05,830
And when I'm done using one, I throw it away.

844
01:07:05,830 --> 01:07:15,430
Because if you keep plugging it in, plugging it in, plugging it in, by the end of the day, it'll start weakening to the point where it will give you problems if you keep trying to use it.

845
01:07:15,430 --> 01:07:22,090
And there's nothing worse than losing three or four hours trying to figure out why something isn't working and find out your plug is just wore out.

846
01:07:22,090 --> 01:07:24,390
So I usually get bundles of these.

847
01:07:24,390 --> 01:07:30,090
And then you'll find them scattered all over the floor because I just throw them on the floor when I'm done.

848
01:07:31,170 --> 01:07:34,650
I'd also recommend breakout boards.

849
01:07:34,690 --> 01:07:39,770
Quick breakout boards are for quick for doing various projects and stuff like that.

850
01:07:39,770 --> 01:07:41,750
And that's kind of sweet.

851
01:07:43,190 --> 01:07:45,250
And then let me see.

852
01:07:45,250 --> 01:07:50,090
Oh gosh, here's some stuff I bought on a project a while back.

853
01:07:50,090 --> 01:07:53,170
I ran into a project where I need USBs.

854
01:07:53,230 --> 01:07:57,290
So I literally went out and bought USB breakouts.

855
01:07:57,290 --> 01:08:00,830
So you can buy these little kits for like five, six bucks.

856
01:08:01,090 --> 01:08:01,750
Okay.

857
01:08:01,750 --> 01:08:10,870
And it gives you the ability to do USB breakouts so that you can solder up connections on these things and be able to tap into various USBs.

858
01:08:10,870 --> 01:08:12,550
Kind of the reason why I needed that.

859
01:08:12,550 --> 01:08:21,310
It turned out that the device that I pulled apart was an industrial device and it had a solid state drive in it.

860
01:08:21,310 --> 01:08:23,870
The solid state drive was an ATA.

861
01:08:23,870 --> 01:08:25,790
It was basically USB.

862
01:08:26,190 --> 01:08:30,110
And it was kind of a weird wire out structure.

863
01:08:30,470 --> 01:08:45,510
So from here, I was able to jump it out the way I wanted it to, to fit the USB properly and was able to use that to tap into the actual device and effectively be able to read the data off of it pretty effectively.

864
01:08:45,510 --> 01:08:47,190
So that worked pretty good.

865
01:08:47,230 --> 01:08:52,530
Here's some... these are a little expensive, but they've come in handy a few times.

866
01:08:52,530 --> 01:08:59,890
These are micro grabbers and they go... I can use them on a logic analyzer or some other kind of testing equipment.

867
01:08:59,890 --> 01:09:02,850
I have a set of these that I've put together.

868
01:09:02,950 --> 01:09:07,910
I think these were like 20 bucks a piece, but they have a 0.5 millimeter pitch.

869
01:09:08,050 --> 01:09:10,310
Comes in handy for small stuff.

870
01:09:10,590 --> 01:09:12,110
And then the big item.

871
01:09:12,110 --> 01:09:13,910
I think this is really critical.

872
01:09:15,310 --> 01:09:17,010
This is a test board.

873
01:09:17,030 --> 01:09:18,630
I built these.

874
01:09:19,790 --> 01:09:27,530
And I would recommend building test boards to meet your particular needs in the projects you're working on.

875
01:09:27,870 --> 01:09:31,830
It'll come in... it'll be very vital to actually be able to do it.

876
01:09:31,830 --> 01:09:36,110
So if we look at this from this test board, we have two sides of this.

877
01:09:36,110 --> 01:09:38,650
So we can take the wire and we could hook into here.

878
01:09:38,650 --> 01:09:40,030
These are screw terminals.

879
01:09:40,350 --> 01:09:45,750
So you can screw the wire in here and instantly you have two headers to put test equipment on.

880
01:09:45,970 --> 01:09:48,070
This one over here is similar.

881
01:09:48,370 --> 01:09:50,330
This one has jumpers in the middle.

882
01:09:50,330 --> 01:09:52,470
This one's isolated with a switch.

883
01:09:52,570 --> 01:09:54,750
These are isolated with jumpers.

884
01:09:54,750 --> 01:10:00,130
So once you attach the jumpers or throw the switch, you get connections all the way across.

885
01:10:00,130 --> 01:10:04,570
So if it's turned on, then I basically get four headers I can tap into.

886
01:10:04,570 --> 01:10:21,510
This also makes it possible, and where I've done interchip communication testing, where I actually come off the circuit board here, route through here, and then I go back to the circuit board, and then I cut the runs on the circuit board, making all the traffic flow through this.

887
01:10:21,510 --> 01:10:31,090
And it gives me the ability to turn on and off the flow on a circuit board for analysis and ability to hook multiple pieces of test equipment up for analysis.

888
01:10:31,090 --> 01:10:34,270
And again, I built these, get these boards.

889
01:10:34,310 --> 01:10:39,190
You can see where they're broke right here so that they require a switch or a jumper to do them.

890
01:10:39,190 --> 01:10:41,950
And these come in extremely handy.

891
01:10:41,990 --> 01:10:50,110
I've built four or five different ones, but having these screw terminals are a lifesaver for connecting up things.

892
01:10:50,170 --> 01:10:54,130
So I'd recommend building some of your own jigs and test equipment.

893
01:10:57,590 --> 01:10:58,930
Any questions?

894
01:11:00,690 --> 01:11:04,230
It looks like a high-level question kind of cropped up here.

895
01:11:04,230 --> 01:11:10,310
This was with regard earlier to when you're speaking towards like the FTDI devices.

896
01:11:10,550 --> 01:11:15,890
The question is, what software do you use in order to start talking to these devices?

897
01:11:15,890 --> 01:11:21,270
And again, this is with regard when you're talking about the Shikra, those types of hardware devices.

898
01:11:22,050 --> 01:11:38,550
So if you're using the Shikra, if you're using JTAG, then you're obviously going to use like OpenOCD is probably one of the best ones that you're actually going to use is OpenOCD for it.

899
01:11:38,550 --> 01:11:43,790
When it comes to UART, there is so many console programs out there.

900
01:11:43,930 --> 01:11:50,850
It's literally kind of hard to say which one is the best one.

901
01:11:50,850 --> 01:11:58,010
I have a tendency to use, gosh, cool term, and I use it on my Mac.

902
01:11:58,010 --> 01:12:08,510
If you're on a Linux system, I would just use screen for interacting with a USB UART connector.

903
01:12:08,550 --> 01:12:16,890
As an example, for the logic analyzers, the manufacturers produce software called Logic, Salay does.

904
01:12:16,890 --> 01:12:20,830
There's the older version, and there's Logic 2, which is pretty good.

905
01:12:21,110 --> 01:12:25,710
So for standard UARTs, again, there's tons of programs out there.

906
01:12:25,710 --> 01:12:27,870
Find the one that works best for you.

907
01:12:29,250 --> 01:12:32,370
And or if you're on a Linux box, just use screen.

908
01:12:32,370 --> 01:12:47,110
Screen has the ability to interact with TTY USB 0, TTY USB 2, 1, ever how many UARTs you have connected up, and also set the associated bauld rate right within screen.

909
01:12:47,110 --> 01:12:51,490
When you get into logic analyzers, you know, like Jlink.

910
01:12:51,490 --> 01:12:57,390
Jlink produces its own... not logic analyzer, I'm sorry, debuggers.

911
01:12:57,390 --> 01:13:01,350
Jlink produces its own software, same way with ccdebug.

912
01:13:01,370 --> 01:13:10,690
Also, individual manufacturers of certain chips will produce their own software to interact with their chips over Jlink.

913
01:13:10,690 --> 01:13:12,190
Nordic is one of them.

914
01:13:12,190 --> 01:13:19,450
Nordic produces software to connect to their NRF5152 series chips.

915
01:13:19,450 --> 01:13:30,450
They can get it as a command line, or you can get it as with a user interface type thing, and it actually will leverage the Jlink.

916
01:13:30,450 --> 01:13:41,910
So a lot of the manufacturers will also produce custom software to interact with their chip using no standard logic analyzers or debuggers that are available out there.

917
01:13:41,910 --> 01:13:43,990
Any other questions?

918
01:13:45,010 --> 01:13:46,590
That is it.

919
01:13:46,590 --> 01:13:47,590
All right.