start	end	text
0	5400	in the lab. We're going to be covering everything from kind of the basic level to the advanced level.
5520	11620	When this thing's all with, I'm going to be jumping on IoT Village Discord, where you'll
11620	16920	be able to ask me more questions. I also, everything we're going to talk about to show today,
16920	21800	I actually have a price list. It's kind of an Amazon type price list, showing a lot of, well,
21800	26060	not just Amazon, but various places that you can buy this stuff. That'll give you an idea. Of
26060	29540	course, if you shop around, you'll be able to get some of this stuff cheaper.
30000	35940	So, let's go ahead and talk about what our agenda is today. So, we've broken this up into
36640	42480	a number of categories. Disassembling, assembly of hardware tools for taking things apart.
43200	48960	Soldering, desoldering equipment. Magnification, which may come in handy. If you have that perfect
48960	54620	eyesight, more power to you. But for some of us that may not have great eyesight or getting a
54620	62360	little older, magnification plays a big role into how we can actually see things and do soldering
62360	68500	at surface mount level type technology. We're going to be looking at monitoring devices and
68500	74400	technology. Debugging tools. And then I'm going to cover probably one of the most important ones.
74400	80860	It's the odds and ends. The pieces and the parts that make your life way much easier in a lab.
80860	86920	And often the pieces and parts build within your lab as you kind of work through the various
86920	92760	aspects of testing things. You go, hey, if I bought this little item here, this header, this plug,
92760	97820	this switch, it would make my life easier. So, you start building up a good ensemble of those
97820	101900	type of techs. We're going to be talking about those at the end also, which I think is very
101900	110340	important. But let's go ahead and jump out over to a screen and let's go ahead and get a camera
110340	118920	going in here and see how this works. Oh, that's kind of interesting. Control. There we go. That's
118920	126820	much better. So, let me get out of the way of the camera so you all can see me. So, again,
126820	133780	this is kind of my lab. And we wanted to start off with looking at tools to take things apart.
134020	140800	To start with, a screwdriver set. These things are critical. And I would recommend,
140800	148060	I had a previous screwdriver set, if I can get it apart, that did not have a box for it. And one
148060	152260	of the things I found out is they're literally laying all over the place because I never had
152260	158420	one good place to put them. Or they ended up in a bag somewhere and all disjointed. So, get
158420	164880	something you can pop them in and out and it holds them real well. This has straight slots,
164880	171080	Phillips. The other thing you want to consider is star tips. There's a number of small IoT devices
171080	176060	when you go to take them apart will have the star pattern tips. So, you want to take that
176060	182920	into consideration as a big component when you're doing this. And then you can get some other small
182920	189720	toolkits. This is one I had sitting in my thing over here. And I didn't even know I had it. So,
189720	198680	it's a good breakout with some basic sockets, needle nose, some of these different heads, stars,
198680	204420	Phillips, straight slots, a little bigger size than the small ones that may come in handy.
205180	208020	And then also, when you start thinking about it, kind of wrenches
209040	214620	and different things like this, a set of cutters is always good. So, you want to have a good
214620	219300	assortment of these. And every once in a while, I have a tendency to lose these things. So, I end
219300	228720	up buying more sets of them over time. Also, something to consider is a pair of good cutters.
228960	235240	Now, I've had wire cutters before, small ones like this. But I like these because the tips are way
235240	242040	much thicker. These things are actually great. And they come in handy for not only cutting wire.
242040	251040	But here's an example of a bracelet type thing, a tracker, that was hermetically sealed.
251040	255920	This came in really handy for cutting through some of the plastic. Very durable. I've used
255920	260820	this for removing shielding that are over components where I need to get access to
260820	265500	shielding. So, having something that can cut through metal and plastic and durable,
265500	270380	and the tip on this doesn't chip up. So, having something like that is pretty critical.
270380	277700	The other thing you want to consider is spudges. So, what's a spudge? So, this one I managed to
277700	283120	lose half the stuff that's in it. But this one has little fiberglass spudges in it. And these
283120	290220	are pry tools that you can use for prying things open. These are all fiberglass. Several of them
290220	294960	are kind of mangled because they've been beat up pretty heavy. I also have some small metal
294960	302880	thin spudges in here and some ones that look like kind of the tip of guitar picks. Those come in
302880	308280	handy for popping open plastic cases. And I also bought a kit, and this one's been really handy,
308280	314020	that is basically metal ones. So, you have to be careful with these because they can like seriously
314020	319140	hurt you if you're not careful or do some damage to the equipment. But these come in really handy
319140	326460	for opening certain cases, removing certain plugs or connectors or things like that. So,
326460	333720	having a good set of spudges is pretty good. Most of these are fairly inexpensive, $8, $9, $10.
334000	338860	You can often get a set of these. I've seen some much bigger, nicer sets that run in the $20,
338860	343780	$30 range. But always good to have a set of these. It'll make it very important
343780	350420	when you're actually opening stuff up. Now, the ultimate tool,
351200	356800	what happens when you end up with a case where you can't easily clip it open? You can't easily
357500	363780	spudge it open. There's no screws in it. It is like thick. I've had cases that were actually
363780	370860	eighth inch to three-eighths inch thick casing that were waterproof. What do you do? So,
370860	377980	in those cases, what I like to do is a good old-fashioned Dremel tool.
378520	383200	Now, you can get these in various prices. This one's probably the last one I got,
383200	389660	which is reasonably new. My last one was cheaper. I think I paid like $35 for it like a decade ago.
389660	394840	I finally burnt it up and had to go out and buy another one. And since I obviously make more
394840	401720	money now, I went ahead and bought a better Dremel tool. So, if you were actually at the RSA
401720	406540	event when we were working in the IoT village, we had a lot of light bulb type tech that we were
406540	411820	playing with. And this is what I used to cut those good old-fashioned light bulbs apart
412520	421520	that contained IoT-based technology in those. So, that's kind of the general hardware type stuff.
421520	427260	The next thing we want to get to, and this is the price list that we want to get to before we
427260	432840	jump into some other area or start asking questions, I want to talk about some of the
432840	440440	soldering type tools or equipment. So, there's a number of solutions you can do from a soldering
440440	447840	perspective. You can buy soldering irons in all kinds of different prices. Years ago, I used to
447840	456000	like three or four soldering irons. So, they were all fixed heat levels or fixed wattage. I think I
456000	461340	had one that was 25. I had one that was 45. I had one that was like 75. And I think I had one that
461340	468120	would clear up to 100. Those worked for me back then. But as, you know, technology advanced,
468120	473100	you start getting into surface mount devices. It becomes inherently more difficult to use those.
473180	477820	They're a little more cumbersome. So, I always recommend actually picking one up that is kind
477820	483840	of variable heat. So, you can change the heat on it. And if I don't smash everything in this lab,
483840	491280	in the process, this is one you often will see a lot of people have. And I've used this as a HECO.
491320	500340	And I've used this one for several years, like two or three years. It's variable heat. It worked
500340	506960	for most point. And you can get a lot of tips for it. But as I got more advanced and more
506960	513360	into more detailed type work, my biggest problem with this was heat recovery.
513780	520180	So, when I went with really fine tips and I was soldering on something that was a ground,
520180	527100	the problem I had was this device could not keep the heat level up. And it would make things harder.
527100	532340	And so, when you can't keep the heat, the heat recovery is terrible or not really good on a
532340	537580	device. It causes you to spend more time on the device, more time on the chip, more time on the
537580	543020	leg. And it leads to damage of the components. You can easily end up pulling leads and stuff like
543020	550680	that. So, to keep the actual time on device down, I actually cranked the heat of this thing all the
550680	555400	way up, high as it would go. And that made it possible for me to work really quick. That kind
555400	560920	of worked for me. Other people will do other things when they're dealing with this. But then
560920	567300	I finally decided I wanted to move on. And I think these are right around $100. Great product,
567300	572500	in my opinion, for entry-level starter. And it works pretty good. Now, there are other vendors
572500	578780	that produce soldering equipment. And one of the ones I went with... let's see if I can move some
578780	586530	stuff out of the way here... I went with a Weller. So, the Weller unit, hopefully you can see it,
586530	595970	I think this is a WX01 or WX02. It actually has two soldering irons on it. When I purchased it,
595970	604110	it came with a single soldering iron. This does, I think, want to say 65, 75 watts,
604110	609830	somewhere around there. It's pretty good. Works great. This thing's capable of pushing out 150
609830	616530	watts of power. So, you can run two irons. I turned around and actually purchased a micro iron.
616530	621230	So, you can see this tip is really fine on the... probably can't even see it on the tip of my
621230	627970	finger. It's pretty small. This is actually brilliant. Works really good. The difference
627970	635010	is this is a very expensive unit. I think the retail on this was like $1,200. You can get it
635010	640290	on sale and shop around. You can probably get it down around $800 or less. So, that's kind of
640290	646190	where we want to think about soldering gear. You want to be able to have some good soldering gear
646770	652970	that'll actually do what you want to do. You want to be able to deal with surface mount devices,
652970	659310	small components, large components, you need good heat recovery. Good starter unit is the HECO.
660010	666190	You can also get smaller range Wellers. That'll work pretty good. So, I would shop around
666970	673190	and ask other people that have different equipment what they use. You'll find out a lot of people use
673190	679930	the HECO, but you'll find a lot of people are fans of Weller or some of the other products.
679930	688970	So, I definitely encourage you when you get ready to go out there, if that works for you,
688970	695230	I loved it, had no problems other than the heat recovery issue. So, where do we go from there?
695730	701170	So, the next area I want to talk about... now, let's go ahead and start off with asking some
701170	712610	questions. So, Jonathan, are there any questions out there? Yes. So, looks like right off the bat
712610	719750	here, we've been talking a lot about like sharp tools and hot ends on the solder iron,
719750	725830	things like that. One question that came up was, what kind of safety equipment do you keep on hand
725830	732670	with your lab? And do they include things such as maybe like goggles, first aid kit, fire extinguisher?
732830	738730	So, I don't have a first aid kit. Well, I do have a first aid kit. It's my wife. She knows how to use
738730	744210	911. Hopefully, she won't have to do that. But for safety equipment, there's some other things to
744210	750410	think about. Obviously, when you're soldering, you don't want to have breathe all of the
750410	757570	nasty smoke. That's a health and safety issue. So, I would recommend a fan. So, here's actually a fan
757570	763530	that you can purchase that happens to be on a articulated arm. So, this works pretty good.
763530	769050	The other thing I have in my actual lab, it's not within the picture range,
769050	775450	but let me see if I can pull it off here, is a good old-fashioned fire extinguisher.
775850	783990	And I also have safety goggles and safety gear associated with that. So, I would definitely
783990	789990	recommend that if you set up a lab where you're going to be using hot equipment and sharp equipment
789990	795590	or whatever the case may be, you want to be able to put out any fires that may actually show up.
795590	804990	Luckily, I've never had to actually use this fire extinguisher. And speaking on that same thing,
804990	810830	it becomes in handy when you start thinking about soldering your gear. This particular
810830	814470	soldering gear here, if you go away from it after a period of time, it shuts off,
814470	821630	which is nice. The Hakko does not. So, are there any other questions or you want to move on from here?
823430	828170	Let me see here, taking a look at the list. I think we're okay to move on.
828370	834610	Okay, good. So, let's go ahead and jump into the next thing, and that is kind of magnification.
834830	840930	So, what kind of gear is available for actually magnifying or looking at things? I have a number
840930	848030	of things that I use. One of them happens to be these goggles. So, they have adjustable
848490	853470	eyepieces on them. You can turn a light on. This is good for close-up looking. So, you have to hold
853470	859510	the item up close. So, you can't really do any soldering with that, but that comes in handy
860010	865930	for quick examination of devices. One of the other things I have in here, I haven't used it in a while,
865930	872310	but I used to use it quite a bit, and that is a pin camera. This is a USB pin camera that I can
872310	880950	shine into things. It goes into smaller places, works pretty good. I also have a, actually, a
880950	886410	borescope, an endoscope that can actually be put through small holes, and you can actually see
886410	891490	stuff. That one's kind of packed away right now. The other equipment that I have is, and you may
891490	897830	have seen this if you've been to the IoT Village where Rapid7 is working. This is a device that
897830	907910	comes in pretty handy. Small bench camera with a screen. You can actually magnify it. It has
907910	914390	variable settings on it. You can focus it. You can also hook a USB up to it and feed it into a TV.
915050	919710	In this particular case, I went ahead and actually covered this with rubber.
920350	925150	The purpose of the rubber in this case is to protect it, so I could actually put energized
925150	936660	equipment on here and look at it also. So, some of the other equipment I have is, this is another
937420	943320	USB microscope, and there's so many on the market. You know, which one's better than another one?
943320	948800	Gosh, you know, that one's kind of a hard one. You can spend anywhere from 20 or 30 bucks up to
948800	958580	$300 or $400 for one of these. I've seen these that would go clear to 5,000x, which was absolutely
958580	965290	amazing. You could actually see the runs on a silicon chip with it, so it was kind of amazing.
965840	971100	But that's, again, a very high end. So, but when we get into something bigger,
971100	977360	something you want to solder under, this is the more expensive solution right here,
977360	986520	which is a microscope. This is a great microscope that I have. This one does everything from 3x,
986520	993100	I believe, all the way up to 90x. Has ability to mount a camera on it. It's variable focal length,
993760	1000060	and you can actually slide it in and out, which makes it really handy for this type of work,
1000060	1005940	for magnification. And I do a lot of surface mount device work underneath this. I've used
1005940	1011980	this for reball and BGAs and stuff like that. But this is an expensive unit, and they vary in
1011980	1018740	price based on whether you go up to the higher caliber. This, like I said, this is 90x. It's
1018740	1026260	about a $600 unit. But if we kind of move away from that and go, what can somebody who's entry
1026260	1032520	level or right above entry level, looking for a good scope, here's one I used for a number of years,
1032520	1041260	and I loved it. So, this here is also an Ampscope. This one will do 10 to 20x power.
1041260	1048480	It is a fixed focal length. This device costs about $185. It is a brilliant piece of equipment.
1048500	1054720	I have several of these that I use in various training that I've done in the past. And I would
1054720	1059280	recommend, if you're looking for a scope and you don't have the big money, look at something like
1059280	1066000	that. Look at Ampscopes and look at what they have to offer from a price point. And I think this
1066000	1071940	model here was $185, and it worked like a champ. Again, I used it for a number of years,
1072460	1076720	but then I kind of got greedy and wanted something that's like super-ass cool. So,
1076720	1084800	I went ahead and bought this for work in my lab. So, what else can we dig into here? I think some
1084800	1091820	of the most important thing we want to talk about in the area of soldering is to look at some of
1091820	1098660	the other components that you may need for actual soldering. And when you get into soldering, it's
1098660	1106160	kind of critical. You want to be able to... you want to have typical solder. So, let's go ahead
1106160	1110080	and switch out the screen so we can actually dig into some of this stuff a little closer. Then
1110080	1116440	we'll pop back to the other screen because we can actually show this stuff a little better here.
1122170	1126950	So, here from the solder standpoint, there's a number of different brands out there. This
1126950	1133190	particular brand is... sticks one after another. But I would get the small stuff. This one here
1133190	1140330	happens to be the 0.3 millimeters. I use lead solder. I hate lead-free solder. Some people
1140330	1147130	may like it. I think it's horrible to work with. So, I think this works much better in every case
1147130	1153410	that I've ever worked with. And you also want to get solder wick. Solder wick comes in really handy
1153410	1161330	for removing and cleaning solder off the board. But when you're thinking about actually removing
1161330	1164490	solder and you want to
1166570	1173490	dig in and remove surface mount devices, the ultimate solution for removing surface mount
1173490	1180670	devices, in my opinion, easily is this product right here. If you have not used this ChipQuik
1181250	1187890	surface mount device removal kit, you're missing out. This will make life much easier.
1187890	1194110	It comes with a flux. So, you put the flux on it and then it comes... this looks like solder.
1194110	1199370	This is not solder. It's way more brittle. It's a low-temperature metal. And what it'll do
1199870	1205150	is it'll absorb the solder and it'll keep the temperature down low. So, let's say you're
1205150	1214870	actually trying to move a TESOP 48, which is a 48-pin typical memory chip that is soldered down
1214870	1222510	with 48 pins. It's kind of hard to keep 48 pins melted. But with this stuff, once you put it on
1222510	1228210	there, you can easily spread it across each one of the leads. Gump it on there pretty good and
1228210	1233190	it'll stay melted and you can lift the chip completely off the device. It's a true lifesaver.
1235330	1242470	So, let's kind of move on. Are there any questions? Do we have any questions from the audience?
1251940	1254080	Jonathan, any questions from the audience?
1254220	1258200	Looks like the question list is empty here. One quick thing that did come up.
1258200	1262260	You mentioned earlier you're going to provide a parts list, but one high-level question.
1262260	1268380	Most of the parts that you've just mentioned now, such as like the chip quick and solder,
1268380	1272540	do you generally purchase that going through maybe like SparkFun or maybe through Amazon?
1272540	1276260	Again, knowing that you're going to provide the parts list, just a high-level question.
1276260	1283280	Yeah, typically when I buy this stuff, I'll be honest with you, everyone. I'm kind of lazy.
1283280	1288700	I'm an Amazon kind of guy. I can usually turn stuff around and a lot of times Amazon has stuff
1288700	1296040	available quicker. So, if Amazon has it available within 24 hours, 48 hours, I'm going to pay that
1296040	1302820	little extra and have that sent to me quickly. But yet, you can go off and buy this stuff from
1303060	1311180	a number of vendors, a number of organizations that sell these types of products,
1312020	1317980	hacker groups, hacker organizations, technology organizations, AliExpress.
1318160	1322560	For a lot of the stuff you're going to see today, you can easily just order it and have it straight
1322560	1329280	shipped from China. But again, I have a tendency to be a little lazy and when I want it, I like
1329280	1335440	want it now. I don't want to wait a week for it because if I think I need it, I need it now. And
1336040	1341940	that's usually how I go with Amazon. So, you'll see a lot of the links on here going off to
1341940	1348880	Amazon or Weller or some of the other places for equipment manufacturers and buying it that way.
1350660	1358160	Okay, so let's kind of move on here. So, the next area we want to look at is monitoring equipment.
1359040	1364960	So, we start thinking about monitoring equipment, you know, how do we gain access to circuit boards
1364960	1370300	and how do we start looking at data? One of the first things is kind of that USB to serial
1370920	1375840	component. And I think a lot of people online are probably familiar with these.
1375840	1381840	These are reasonably inexpensive. It's a bus pirate. And this will give you that level of
1381840	1387320	access to be able to look at start looking at devices. One of the other things, I'm not a big
1387320	1395240	fan of this. I have a tendency to like using this in a different way. There's other software
1395240	1403380	you can actually install on these and actually turn these into debuggers for Atmel chips. So,
1403380	1409720	if you need to debug or read data off an Atmel chip, you can easily take these and put I think
1409720	1418420	it's SDK 500 V2 software on it. I think we demoed this last year at the IoT village was hands-on
1418420	1424920	exercises that actually did that. We're using reprogrammed bus pirates. So, that's pretty good.
1425020	1431740	The other thing, and I'm a fan of this, I have a whole box of these sitting around here. And it's
1431740	1437560	the Shikra. The Shikra has a lot of capabilities. And here's kind of a little data sheet that comes
1437560	1444560	with it. So, we have the UART. We have JTAG. And you can use OpenOCD that. And you can use SPI
1445160	1453100	for actually reading memory off chips. And this device comes in really handy. I typically use
1453100	1461820	this for UART. And like I said, I actually love this device quite a bit. And then there's other
1462390	1468360	things you can do. There's other FTDI devices that can be used. Here's just a couple I have
1468360	1476320	in my lab that I purchased for other purposes and reasons. And then there's another one I have.
1477320	1482480	This one I bought not too long ago. I guess it's probably about three or four months ago.
1482480	1490040	And this one actually has four UARTs built into it. So, it is a USB. It has four UARTs,
1490040	1494780	and you can switch them between three volts and five volts. So, you can either hook them up here
1494780	1501140	or hook them up into the actual plug jacks. This is nice. You plug it in and four UART functions
1501140	1507260	show up. This makes it much more easier for hooking into multiple connection points on an
1507260	1514780	actual device for doing UART testing or analysis. People have seen the work that I did on the
1514780	1519740	interchip communication. I like to use one of these. It works out pretty good for capturing
1519740	1529560	multiple UARTs for analysis as data as it flows through a system. And also, let's go ahead and
1529560	1535180	move on to logic analyzers. So, I want to point out that Jonathan is actually going to be speaking
1535180	1541340	tomorrow evening. Is it tomorrow evening or tomorrow morning, Jonathan? Yep, tomorrow evening.
1542300	1552180	And he's going to do a talk on using logic analyzers. So, there's a lot of different
1552180	1557340	logic analyzers you can buy. I think Jonathan has one of these he's actually going to show. He has
1557340	1565280	another one. These are cheap. This is like 12 bucks. It does like 24, 24, 25 megahertz. Another
1565280	1575160	one that I have. This one is a Saleh. This is their 4-channel one. It's no longer being
1575160	1580580	manufactured, but Saleh had a whole stinking warehouse full of them. And they're selling
1580580	1586400	these. These are more pricey. They're 100 bucks, but it's a Saleh. This is a high quality. Now,
1586400	1594380	what I use is I do have a Saleh. I have the 8-channel. The 8-channel, I think this is like
1594380	1602780	$600. This is the, I think it's 100 megahertz, 8-channel. This one's the actual pro.
1603900	1607720	Works great for everything I'm doing in the lab. And if you're not doing it for
1610300	1616480	a job, and you're just a hacker or whatever, and you're education and you're learning,
1616480	1621220	you can actually get an EDU kind of version of this, which will save you a significant
1621680	1625380	amount of money when it comes to logic analyzers.
1627900	1634260	So, also, some of the things you may want to consider earlier, you may have seen the
1634260	1639760	oScope, and that was in the back of my room. I have an oScope. I use it sometimes for basically
1640760	1648200	signal chasing. But other than that, I don't use it that much for most of the tech that I have.
1648200	1654040	But when you want one, it's nice to have one, and they come into a number of price ranges.
1654260	1660960	Anything from, you know, typical ones you can run off your desktop or laptop with a small
1660960	1667820	plug-in board, all the way to high-end digital built-in logic analysis type of stuff in the
1667820	1673740	thousands of dollars. The one I have was the Textronics. I'm a big fan of Textronics since
1673740	1679180	I came from the military, and I think mine was like $500 or $600, and I believe it was a 50
1679180	1686740	megahertz box, and it works pretty good. So, moving from there, another area as a hacker
1686740	1694280	that you want to get into is often the RF stuff. You want to start digging into RF. So, one of the
1694280	1704280	big RF areas is often Bluetooth Low Energy. So, these are the go-to Bluetooth dongles. These are
1705560	1712080	CSR8510s. These are the ones that'll work with pretty much any of the Bluetooth-developed
1712080	1717080	software out there. They have the right chipsets in them. But these will only go up to, I believe,
1717080	1723580	4.2 version. I don't think they'll support 5. I don't think I have anything here,
1723580	1728880	actually, that supports 5 right now. It's something I need to add to my lab myself.
1729100	1735620	So, that's one of them. Another thing is the Nordic. The Nordic makes a dongle that you can use with
1735620	1742940	nRF Connect, their desktop product, and this happens to be it. I think I paid $25 or $35
1743980	1750020	for this. So, I would recommend having one of these for Bluetooth. This has a lot of cool
1750020	1757120	capabilities. And there's a number of development boards and testing boards that are available out
1757120	1761880	there that give you the ability to take what you're doing with Bluetooth to almost any level
1761880	1767960	you want. Another device I have that I actually like, it's pretty good. This is a Hulong.
1767960	1777420	This is about $100, I think it was. This device, I've had it for a couple years,
1777420	1783160	so hopefully they'll come out with a newer version at Sports 5. But this gives you the ability to,
1783160	1788920	and it has to be run on a Windows box, gives you the ability to capture Bluetooth. So, it'll
1788920	1795960	actually see the announcements coming out on Bluetooth, and it'll actually let you pick one
1795960	1801500	of the devices out of the list of Bluetooth low-energy devices. And as soon as it, once you
1801500	1809000	pick it out, it'll start to output all that stuff to Wireshark directly. And then once, it'll
1809000	1816300	actually capture the pairing process and the entire authenticated process. Basically, I don't
1816300	1821520	want to say man-in-the-middle, but capturing all of the data and outputting it correctly to
1821520	1828620	Wireshark for analysis. So, it's probably one of the best ones out there. NRF, there used to be
1828620	1835120	NRF Sniffer. I think it was Sniffer that was available that would run on a desktop. This
1835120	1842420	thing's like way better. This actually has all three BLE channels, so it picks up all the data.
1842420	1848560	It doesn't miss that much data, so it makes it a lot much better. So, I would recommend that. And
1848560	1857700	of course, if you get into some other stuff, having the Ubertooth One is probably good. I
1857700	1863040	heard people complaining that it really updates on the software or follow-up work on the software
1863040	1869060	arena hasn't been done, which is kind of sad because I think it was a very brilliant capable
1869060	1873640	tool. But hopefully, they'll continue supporting that, and we'll see some new capabilities come
1873640	1880080	out in reference to that. Moving from that, typically, I don't have a ton of things.
1880080	1886040	I think here we have a yardstick, which is under the gigahertz range
1886820	1892520	capturing. And then, of course, and I know I have laying around here somewhere,
1892520	1897060	which I have no idea where it's laying at. I'm like terrible in my lab.
1898120	1901520	But I have a... Oh, there it is. I have a Hacker RF
1903920	1911260	that may come in handy for some people that really want to do the work dealing with RF
1911260	1918580	communication. So, I'd recommend buying what you can afford. You know, find an area that fascinates
1918580	1925460	you on the hardware hacking area, and spend as much in that area that you can afford for the
1925460	1931500	best tools. I would recommend shopping around. Some of these tools here may have newer versions
1932120	1937400	there may be better release products out there. This is constantly a changing field.
1937400	1943940	What I bought a few years ago doesn't necessarily meet the needs now in a lot of cases. So, I often
1943940	1951140	find myself as I'm doing new projects and new testing that I have to go out and actually buy
1951140	1957160	new equipment and new hardware. It seems to be an unending process. It's kind of like being married
1957160	1963040	and a homeowner. You're always looking for an excuse to buy new tools for around the house.
1963260	1968120	It's the same way as a hardware hacker. You're never going to be content until you have all the
1968640	1973540	tools ever made on the face of the earth. But shop wisely, and I think you could do
1973540	1978620	pretty good gathering up the needed stuff, being able to do the work.
1979780	1984280	So, there's one other area before we take a quick break and actually look at...
1985640	1992800	or has some questions. Another tool, let's not forget critical tools, a multimeter.
1993460	1999340	Literally, I don't think there's ever on any engagement or any testing or any device I've
1999340	2004220	tore apart where I was hacking on where I didn't use a multimeter. These are cheap. You don't need
2004220	2010160	an expensive one. Mostly, I use this on the continuity field for actually tracing out runs
2010160	2015300	on boards and stuff like that. It comes in very handy. I also use it for checking voltages prior
2015300	2019560	to hooking stuff up to make sure that I'm matching the voltages correctly, because
2020040	2023260	that can really screw things up if you get it wrong.
2024000	2032360	Also, moving from there, let's go ahead and quickly cover the area dealing with debuggers.
2033820	2039420	Matter of fact, let's kind of stop right there. And before we get into chip readers and debuggers
2039420	2047700	and see if there are any questions. Open. Oh, good. Yeah, it looks like a couple popped up here.
2048720	2057620	So yeah, I guess the first question we have here is, this is with regards to the physical non-RF
2057620	2063880	signal quality that we're speaking of earlier. So you had mentioned the oscilloscope. And also,
2063880	2068840	I know that you've mentioned that you aren't really going too in-depth with it these days
2068840	2075780	because you don't really need it. So I'm curious, or excuse me, the question is asking, I am curious,
2075780	2080660	would your answer to that be the SELE does okay for that sort of thing? And would you recommend
2080660	2088920	the SELE over an oscilloscope? The answer to that is yes. I think my go-to is with the SELE logic
2088920	2094660	analyzer 100% now for almost everything I'm doing. Almost everything I'm looking at is digital.
2094660	2100120	SELE has come out with the... oh, gosh, what was the name of it? I'm losing my mind here.
2100120	2105380	Just a second. Oh, yeah. Their logic tool, which is what interacts with the SELE.
2105380	2115200	They came out with Logic 2. And the cool thing with Logic 2, it basically gives so much more
2115200	2120340	features to the actual product. And one of the features is kind of continued streaming. Instead of
2120340	2128160	capturing, just capturing data, like you often will do, this will actually let you loop that
2128160	2135080	capture so it continues to run. So I find myself taking a logic analyzer and using it like a probe
2135080	2142680	looking for ongoing signals, timing signals and stuff like that, clock signals that are ongoing,
2142680	2147880	burst traffic, because I can easily stop on something and as this thing continues to run,
2147880	2154080	I see burst traffic. So literally, it gives me a way to do some digital signal tracing. Maybe it's
2154080	2159840	not the most effective way, but I think it's the most cost effective way. So definitely would
2159840	2166300	recommend if you're going to spend the money, buy yourself a good logic analyzer. That besides the
2166300	2174820	multimeter is the item that I inevitably use on every engagement and every testing that I do.
2178170	2181210	Any other questions or is that it? That's it.
2181270	2191110	All right, so let's go ahead and let's jump into chip readers. So hey, you happen to have a device
2191670	2196990	and it has a flash memory chip and you want to be able to get the data off that flash memory chip.
2196990	2204870	What are you going to do it with? So there's a lot of inexpensive solutions out there. This one here
2204870	2217550	is an actual TL866 plus. This comes with a slew of sockets that go in for it. This is like a TSOP
2217550	2226470	socket and they get 8 pin or 16 pin sockets and then 8 pin sockets. List goes on and on. There's
2226470	2237290	30, 20 or 30 sockets you actually get with the socket that I purchased. That is actually a,
2237290	2246410	oh gosh, here we go. It's a WSAN 8 socket. So you drop it in. These are a little more pricey.
2246410	2256410	But the TL866 is not that expensive. I think I paid 130 bucks for the one that I have
2256470	2266670	here. Although when you buy this and it comes with this particular socket, this TSOP48 socket,
2266670	2272530	this will not work for all TSOP48 which is typically NAND flash chips. So you need to
2272530	2278930	go out and buy this one to go with it. And you can get these off AliExpress or maybe some other
2278930	2289410	sources. And this is the, get it right there, NAND08 socket. And typically this is the socket
2289410	2295210	that's used on the chips that have literally a larger memory. You start getting in at,
2295210	2305450	you know, 128 meg, 256 meg chips and higher, you're actually going to go over to this socket here.
2305450	2311750	That seems to be the case. So that's one of them that I have. Like I said, I have
2312710	2318410	several chip readers. I can't remember the number this covers. I think it's like 7 or 8,000
2318410	2323310	different chips that are actually supported by this. So does it cover every chip that I encounter?
2323310	2329090	The answer to that is no. Does it cover a large number of them? Yes, it does. I mean, it probably
2329090	2337270	covers two-thirds of them that I come across. One of the other chip readers I have is this
2338570	2346060	RT809H. So the RT809H, here it is here. Similar, a little bigger physical construction.
2346550	2352750	This one comes in handy. You cannot use, you can use these sockets. So all of the inline
2352750	2359010	sockets that came out of the TL866 that are straight pin-to-pin wiring and don't contain
2359010	2366150	any kind of circuitry, you can use them on this. But if it happens to be the TSOP48s,
2366150	2370870	those actually had circuitry built into them. So you have to buy a socket that will actually
2370870	2380490	work on it. And this is a straight pin-for-pin one. So I use this one typically as a backup.
2380490	2387190	There's times that the TL866 doesn't work or doesn't have what I'm looking for,
2387190	2392630	so I jump over to this one. It works pretty darn good. Also, this one you can get various
2392630	2400850	sockets for. Here happens to be a socket for it. This was like a $40 socket. This is a BGA. This
2400850	2411890	is a 63-ball BGA NAND flash memory socket. I think I played 45 and had that shipped over from
2411890	2417810	AliExpress from China. The crazy thing is I ordered it right when this whole COVID thing
2418720	2427570	hit this fan. So it took like two months to get to me versus the typical 30 days that I often have
2427570	2431270	wait or shorter time period. So that's one of the readers.
2431270	2438670	So some of the other readers I have in my arsenal here is dealing with
2440090	2453450	embedded multi-chip packages and embedded multimedia controllers. So these you actually
2453450	2460610	find a lot when you're dealing with embedded systems and especially some consumer-grade IoT.
2461690	2473930	These are actually for reading BGAs. This is an embedded multimedia chip for 153-ball BGA.
2473930	2482270	So you open it up. You drop the chip in there. Plug it in. It's USB 3. Plug it into your computer.
2482270	2487370	Hit this button here. And that chip will mount up just like a file system. It'll mount up just
2487370	2493930	like an SD card will mount up. And it'll actually mount the entire file systems on the device most
2493930	2499910	of the time. And from there, you can quickly recover the data. Sometimes you can alter the data.
2500630	2507330	One of the exercises I did, I actually used that to pull the data and then use one of these in
2507330	2514110	all data and then DD it back to the actual chip and then reball the BGA, put it back on the device
2514110	2519750	to gain root level access. So these are great and they come in a number of different sizes.
2519910	2526690	So that's known as an embedded multi-chip package type thing. Again, you'll find these in a lot of
2526690	2534790	devices. That means it contains both RAM and flash memory in the actual chip. But these ones are kind
2534790	2541190	of pricey, like $135. There is a cheaper version. This is pretty much the same thing, but it's done
2541190	2548590	up just like an SD card. So, and then you just plug it in like an SD card into your computer and
2548590	2556170	it'll mount the chip up just like a file system. Now, these ones are a little cheaper. I think
2556170	2562890	they're well under $100, like $90 or something like that. Also, if you need to deal with embedded
2562890	2572230	multi-chip package or embedded multimedia chips, I would recommend doing a little Googling on that
2572230	2579850	because this example here, people have actually built these. So there's ways to build these.
2579850	2583730	Of course, you may have to dead bug the chip, which means you're going to need a good
2585010	2589350	microscope because you'll end up soldering to the pads of the chip on the underside.
2589350	2593690	But there's only like five connections or four connections that have to be made on the chip.
2593690	2598370	And you can literally actually read it. So there's a lot of documentation out there. So you can take
2598370	2604110	the hacker mode and save yourself a lot of money. But again, it'll take a lot more time.
2608050	2616010	So any questions there on chip readers? And again, most of these chip readers were $120 to $140
2616850	2625190	right around there. One question that came up with regard to the chip readers here that I'm seeing
2627670	2632610	is... and this is a little bit of a backfill, I do apologize. One question that came up earlier is,
2632610	2636750	is it actually worth picking up an old benchtop logic analyzer off eBay
2637210	2643270	or going with some of the newer USB tools? Cost is a limiting factor for this individual.
2644350	2651010	Ah, you know, I don't know enough about any of the benchtop logic analyzer tech that you're
2651010	2656450	talking about. I haven't worked with any of those. Typically, most of the stuff I've done with is the
2656450	2661050	USB stuff. I mean, if you're looking for a logic analyzer, just to give it a try,
2661050	2665170	I'll be honest with you, a lot of these, when you start getting into these smaller ones,
2665170	2671550	24 megahertz, I have not used this. So obviously, it's $12 from a logic analyzer standpoint.
2671550	2677650	This gives you an entry point, just to get familiar. And I think the logic programs put
2677650	2682330	out by Sele will actually work on these. And there's a couple other ones. And Jonathan's
2682330	2687250	going to talk about this in more detail tomorrow. So I definitely swing by his presentation.
2687250	2691010	I would start off, if money's limited, I mean, can you come up with 12 bucks,
2691010	2697410	give one of these things a try. I bet you nine times out of 10 on most standard consumer grade
2697410	2703230	IoT, this is going to be fine. I've only run into issues when I'm dealing with commercial level
2703230	2711050	devices, where a megahertz rating like this would not have worked. So just an example.
2711830	2716410	That makes sense. And another backfill question here. Asher says,
2716410	2722450	such a great lab, Daryl. One question, what do you use for on-chip debugging other than the Shikra?
2725370	2732490	Oh, on-chip debugging? Yeah, we're actually get into that next. If you want to do on-chip debugging
2733590	2737530	or pulling firmware out of the chips and all that type of stuff. That's the next section
2737530	2743230	that we're going to dive into. Okay, perfect. And I think we'll put a pin on that question
2743230	2747190	because it sounds like it'll be answered. Next question here reads, what are these
2747190	2752410	readers used for? What are you reading off these chips? Sorry, noob. Thank you.
2752410	2756190	There's nothing wrong with that, man. I mean, we were all learning at one time.
2756310	2763590	Five years ago, I couldn't have told you any of this stuff at all. So what we're doing is
2764210	2770770	these chips I'm talking about are flash memory chips. This is where the embedded device holds
2770770	2777790	its operating system. It's also where it holds configuration settings and data associated with
2777790	2782990	the functionality of that device. So if you want to be able to pull off the firmware for some kind
2782990	2790610	of offline analysis, you want to do some offline debugging with IDA Pro or something like that,
2790610	2795030	then you need to be able to extract the firmware. So to be able to extract the firmware,
2795030	2801190	you need to gain some level of access. Chip readers come in handy for doing what I consider
2802090	2808550	off-board reading. So you desolder the chip, remove it from the board, drop it into the reader,
2808550	2812930	dump all of the memory out of that chip, and then you solder the chip back on the board.
2812930	2820350	I have a tendency, since I'm fairly good at soldering and desoldering and stuff like that,
2820350	2825610	that I will often do that. I will literally just pull the chip versus trying to do it in circuit
2826250	2833350	because I found it's sometimes much easier. In some cases, not always, but in a number of cases,
2833350	2837710	the only time it's more difficult is when you're dealing with like a ball grooter rated chip,
2837790	2843070	a PGA chip, where the pins are underneath. So when you remove it, the complexity of putting it back
2843070	2848670	on is fairly complex. So hopefully that answers that question.
2850150	2858170	Makes sense. And one final question here. It's asking about the Flipper Zero. Individuals asking,
2858170	2862870	what are your thoughts on the upcoming Flipper Zero? Is it a great asset or a gimmick?
2862870	2868270	Kickstarter problems apply. Flipper Zero. I don't think I've seen that. Have you seen that?
2868270	2873170	Have you looked at it? Yeah, it looks super interesting, actually. I'm additionally not
2873170	2877590	familiar with it. Looks super slick. Looks like you can do a lot of hardware analysis with it.
2878150	2881810	I think it looks kind of cool. It's very powerful for sub one gigahertz.
2881850	2886190	From what I'm seeing there, it looks somewhat similar to the Yardstick with maybe a few
2886190	2893710	additional features. But it looks pretty slick, in my opinion. Yeah, like I mentioned, there is
2893710	2900390	always new tech being developed. So often I don't dig into those unless it happens to be on my table
2900390	2905350	or something I need to work on. And then I go out looking and I try to look for the right tool,
2905350	2910250	the right solution, the one that's going to help me do the job the easiest and the quickest.
2910970	2915790	So, hey, great. Thanks for bringing that up. I'll have to look at that once we get offline here.
2917250	2924670	Yeah, and Daryl, we actually had the inventor of the Flipper Zero present at our event back in May.
2924670	2929630	So anyone who's listening, you can always check that video out as he goes through all the features
2929630	2934670	and so the story of why he built it. Outstanding, Sam. Thank you very much.
2934670	2943470	We'll check that out. So kind of moving on from there, I just wanted to get into some debugging.
2944790	2950130	There was some area I did miss earlier, and we may jump on it at the end if we have time,
2950130	2957410	but we'll start with debuggers. The first thing I want to look at is not necessarily a debugger,
2957410	2966730	but pretty darn close to it. This is fairly pricey, about $150 to $170. It's a JTAGulator.
2966870	2975970	I have not used this in a while. Don't ask me why. I guess I need to figure out where the JTAG
2975970	2982090	connections are in a while. But if you're in a bind and you need to figure out if there's any
2982090	2989330	exposed JTAG connectors on a chip that you can't identify, this is the tool for doing it.
2989330	2995410	You just plug all these in here. You hit reset, go. You have some software you can run on this
2995410	3005550	thing, and it gives you the ability to go through all of the testing sequences for all the different
3005550	3011450	wiring combinations that you could possibly generate by plugging this thing in and checks for
3011450	3018290	various JTAG connections. It can also be used for UART. I don't use it for UART. Typically,
3018290	3026930	that's easy enough to spot with a logic analyzer fairly quickly. But yet a good tool to have in
3026930	3035410	your arsenal, especially if you're doing a lot of debugging devices where you can't identify
3035410	3042130	whether a JTAG is available. They also added some features to this that will actually go through
3042130	3052070	and do I-O testing. So, it'll do a series of tests, information, feed, and capture based on
3052070	3060570	identifying the various I-Os on a processor. So, that's also a great feature. So, when it gets
3060570	3068110	into logic or not logic analyzer, but debuggers, how can I interact with a chip? How can I
3068110	3075450	interact with the processor? And some of them may be, hey, how can I pull firmware out of a
3075450	3081350	processor that actually has flash in the processor, which seems to be the thing I often do.
3081350	3087570	I have a whole slew of debuggers. I got dozens and probably a dozen of them laying around here
3087570	3093310	somewhere for various things. But there's one that I have that's like a go-to, at least mainly
3093310	3101090	for ARM processors, and that's a JLINK Seeger. JLINK is a great product. This is a commercial
3101090	3107790	version. These are kind of pricey based on the speed and the capabilities of the hardware,
3107790	3115010	the price goes up and up. I think this one was like $600, can easily go upwards of a thousand
3115010	3123470	or more for the solution. But there is hope. If you're interested in the Seeger JLINK and you are
3123470	3129350	basically a student or somebody learning, you can buy the EDU version. When I first started learning
3129770	3135770	and wasn't using it for commercial use, I purchased that. It was like $70, has all the
3135770	3142030	similar capabilities. Its speed of data reads probably not as fast, but it's pretty good.
3142030	3150590	Another thing I do is a habit of mine is I always tape the pin out for all of the pins on some of
3150590	3156670	these devices, because I rarely throw a 20-pin plug in there and use it. I often use single plugs
3157230	3165230	because often we use this for not only for standard JTAG, but I use it for serial wire debug
3166730	3173590	or CJTAG. This will do CJ offset also, which is a subset of JTAG that is also
3174190	3181430	like serial wire debug. So if you're like me and you can't memorize all these pins on everything,
3181430	3186250	actually doing a printout and sticking them in the back is a nice little feature that I use
3186790	3194230	to help speed me along. But again, it's a great product. And for mainly ARM processors,
3194230	3199850	I go to on this, but then also I will use various debuggers for different process.
3200070	3206970	So if you TI, TI chips, the CC debugger, I can't remember what this was, $20, $30. It wasn't that
3206970	3213070	much. And it happened to be a case where I was dealing with some TI chips and I'm like,
3213070	3218690	just buy the thing, put it in my lab, I have it. Another one, which we demoed last year,
3218690	3227130	and that was dealing with the XDS 110, which is another TI debugger. I really didn't want,
3227130	3232290	and I wanted to expose people to the XDS 110 from a debugging standpoint, but I didn't want to buy
3232290	3238910	the full blown one because it's like $110, $120. But it turns out that they made this small
3238910	3244970	development kit type thing for a sensor tag. And the one you buy for that is basically a stripped
3244970	3251090	down model. There's no case, there's some features turned off, but it works the same way.
3251090	3258590	And this was like $15 versus 100 and some dollars. And it worked pretty good. And I kind of got this
3258590	3267870	idea because I bought, I was doing some research on a TI chipset and I, for a vendor. And so I
3267870	3273590	bought the development kit and development kit had an XDS built into the chip on the development kit,
3273590	3279150	which got me interested in doing this. And that's why I kind of shared that stuff last year and let
3279150	3285070	people do the hands-on. Now, I have a number of debuggers around here, but, you know, a debugger
3285070	3291810	is what it is. It's a debugger. Typically what I do is when I encounter a chipset, the first thing
3291810	3298990	I do is I go out and go, okay, if I was a developer on this product line for this chipset, how would I
3298990	3305810	do it? What product would I use? What does the vendor recommend for interacting with their
3305810	3312790	hardware, their chips? And then I go out and check it out. Do they have guidelines for using a JLink?
3312790	3319190	Then I use a JLink. Do they have a specialized debugger like PIC processors do, which is
3319190	3326990	basically encircled serial programming? That's basically SPI. If that's the case, then get those.
3326990	3334310	I have several of those laying around here. The PIC kits is what they're called.
3334930	3339130	So, I try to find out what the developer community uses for a particular product,
3339130	3345950	and if I can afford it and it's inexpensive, I buy that, or I buy the next level alternate
3345950	3351850	to actually use. And that's typically the approach that I use. I found out if I'm
3351850	3358710	trying to deal with a chipset and I'm using somebody else's debugger, it has a tendency to
3358710	3364770	not always do what I expected to do. It doesn't always give me the information that I get from
3364770	3369930	the development community on the product or from the vendor on the product, and it adds a level
3369930	3376510	of complication. And I'm able to find way more resources if I use what the development community
3376510	3383730	uses on that product. But the reality, that's not always feasible. There's been a number of times
3383730	3388590	where I've gone, hey, here's a chip. You go out and you try to find out what the development
3388590	3394370	community is using for and find out it costs $10,000 and you can only buy it from the vendor.
3394370	3400270	In cases like that, then, hey, if it's an ARM, use ARM. If it's something else,
3400270	3406250	go all the way down and use one of these and then use OpenOCD if you have to,
3406250	3414770	whatever it takes. But I tend to have to dive into what the actual person producing uses.
3416050	3420810	I want to move on real quick because we're running a little behind and I want to get this
3420810	3426370	next phase because I know the... well, matter of fact, never mind, we can do that. Got any questions?
3427350	3433710	Yep. Looks like one question cropped up here. Josh asks, do you happen to have any books,
3433710	3438590	videos, or any learning material that you recommend to start learning IoT hacking?
3439210	3449250	Oh, gosh. That's kind of a hard one. I'm not a big book person, to be honest.
3449510	3454590	What I typically do is I'm definitely a Google and YouTube kind of guy.
3455650	3463750	Everything that I've wanted to learn, an example, I wanted to learn how to re-solder a TSOP48 pin
3463750	3469350	chip back onto a circuit board. I'm like, damn, this is going to be hard. I can't go solder each
3469350	3475410	pin. So I went on YouTube and looked it up and go, how do I do this? And there's like three or
3475410	3480930	four videos out there. And then I watched those videos and it's the same way. If I want to learn
3480930	3488650	how to use UART, I go check out some of the videos on finding UART and looking for UART,
3488650	3493470	same way with logic analyzers. And it's typically the approach that I do. And I still do that to
3493470	3500930	this day. Anytime I'm working in engagement or testing a product and I go, how do I interact
3500930	3505410	with this? I haven't done this before because even though I've been in this in four years,
3505410	3511150	I constantly encounter things that I haven't encountered before. I first, I go out and find
3511150	3517550	out who else has done this. Has it been done before? Has anything similar to it been done
3517550	3522530	before? And that's kind of my approach. If you're trying to, and I know there's a lot of learning
3522530	3530630	kits out there, but I'd also recommend, oh gosh, where is that? Hold on. I would recommend looking
3530630	3535670	at some inexpensive products just to play around with. And I'm going to throw some pictures up
3535670	3545330	here. And like these, these right here, Vixme 300 millimeter router type things. Let's pop
3545330	3551410	one of these things out here. Oh, that's one thing about my lab. It's like a ton of gear.
3551410	3557830	So this one actually uses, it's a little router device. So we have these chips on here.
3559570	3567670	So it has a lot of things you can interact with. There's Ethernet. There's USB. It actually has
3567670	3574130	UART. So UART is actually marked on here. If you look, there's, it says TX and RX,
3574130	3582890	and then I found the ground. This runs OpenWRT. It actually has a flash memory chip right here.
3582890	3587030	So here's a chance to figure out how to get the memory out of the device.
3587030	3594230	Here's a chance to play with this. In this case here, root doesn't have a password on it. So in that case there,
3594230	3598850	you really, as soon as you get the console, it's going to be root level access. But you can change
3598850	3605470	that and then try to get around it. This device is like 20 bucks. And I would recommend getting
3605470	3613350	something like this and starting out by just going, hey, this is a Meditech chip. What does that mean?
3613350	3621690	Data sheets. This here is a RAM chip. Find the data sheets. This is a flash memory chip. Find
3621690	3628290	the data sheets. Read those data sheets and kind of learn and play around and experiment. And if
3628290	3639260	you screw it up, throw it in the trash can and go spend another 20 bucks. Hopefully that answered
3639260	3643380	the question. Okay, here's another one, but I don't think the GL Mango is even available anymore,
3643380	3646320	but it's the same product, just relabeled different.
3648620	3653020	Another question cropped up here was, I think it's kind of an extension of that question.
3653020	3657280	Do you have any go-to YouTube channels? Do you follow anyone on social media?
3658960	3666860	Oh, gosh. Yeah, from social media, I'm a Twitter guy. So you can find me on Twitter. My handle's
3667680	3677760	percent, P-E-R-C-E-N-T underscore X. Yeah, please follow me. If you're one that tweets a lot of
3677760	3682420	political stuff, there's nothing wrong with that. I'm just not a big fan of that, just to be aware
3682420	3688480	of it. I want to see mostly technical stuff. So if you're doing technical stuff out there,
3689420	3695140	that's kind of cool. I'll probably follow you back. But yeah, that's one thing I do. I do not
3695140	3701240	follow any YouTube channels. I'm usually all over the map, whatever I'm working on at that time.
3701820	3707260	And I need to learn something specific, then I go out and search. And I never look at one single
3707260	3711980	example. If there's a dozen examples out there, I'll usually look at three or four of them and
3711980	3716580	get three or four different viewpoints on how to approach something or how somebody's done that.
3716680	3721240	And then experiment with my own ways and own methods and try to build from that.
3721240	3729360	We've also, at Rapid7, I put out a number of blogs. So if you use my name, Daryl Hyland,
3729360	3735300	and search for Rapid7 blogs. I think we put out a whole series last year, actually pulling
3735300	3741820	firmware from microcontrollers, like four of them, covering four different type of microcontrollers,
3741820	3748160	four different software packages, four different debug type devices. So every once in a while,
3748160	3758920	I'll do that type of stuff too. Okay, so I want to move on to odds and ends. This is kind of a
3758920	3768400	big one. So when you're doing work on devices, it comes down to often needing a lot of strange
3768400	3774200	stuff. Now the first one is wire. I don't know how good the video is out there, but this is
3774200	3783600	40 gauge wire. And to be absolutely correct about this, I hate this shit. But this stuff comes in
3783600	3792980	handy for soldering into microscopic small circuits for tapping into them. So currently,
3792980	3801140	I'm working on a project right now where I have to tap into an Intel i3 processor. I'm trying to.
3801860	3809360	And the only way to do it is the pads are like 0.3 millimeters. So I am actually using this under a
3809360	3814100	microscope and soldering it up. And at the end of this thing here, I'll show you what I attach it to
3814100	3819160	when I'm done, which will be a lifesaver. So that comes in handy. If I'm doing something else that's
3819160	3826260	bigger from a wire standpoint, I use this. This is wire wrap wire. I don't even know, VT Corporation.
3826260	3831360	And I found this. It comes in all of these different strands. This is covered with a really
3831360	3839140	fine plastic coating. That 40 gauge wire earlier was covered with lacquer, real thin coat of lacquer.
3839140	3843960	Keep it from shorting out. This stuff will melt that's on the outside of this. But when you're
3843960	3850020	looking for like 30 gauge wire, you need to find wire wrap. If you buy standard 30 gauge wire,
3850020	3856120	the actual insulation going around the wire will be thicker than the wire itself and will get in
3856120	3864660	the way when trying to solder two small circuit pads to tap into it. The other thing is, you know,
3864660	3869720	when you open up a device and you start thinking about headers, you need to attach headers. And
3869720	3874440	this become a nightmare over the years, or at least early on when I first started, because I
3874440	3881900	was seeing all kinds of stuff. So I went out and tried to get samples of both 2.54 millimeter
3881900	3886480	headers. So this can be plugged into the board and soldered in and then you just plug into it
3886480	3892600	for the places there are headers. What if there happens to be dual header? So then I bought some
3892600	3898960	dual headers to have those. I have boxes of these things laying around. So on top of that, what
3898960	3905600	happens if it's a surface mount header for 2.5 more millimeter? So if you look at this, it actually
3907740	3914440	has... see how the bottom is sticking out there? It's actually gall winged. So there you go. And
3914440	3924080	then we do the same thing for 1.27 millimeters, single row, double row. And these are the most
3924080	3929540	common. And trust me, there's people that produce other headers that you want to kill them when you
3929540	3934700	get them because these things won't fit in a gall wing one. So yeah, I went out and kind of purchased
3934700	3940320	all of this stuff. Over time, I didn't do it in one day. It's like, hey, I need headers that are
3940320	3946760	1.27. I need gall wing headers and then went out and bought them. The other thing that is a
3947340	3954520	lifesaver and that is glue. Glue comes in really handy because when you're attaching small wires
3954520	3959760	to a board and you snag the wire, you pull the wire, you could easily rip the pad clear off the
3959760	3964980	board, which will happen to you anyways, but this will help prevent it. This glue here
3964980	3972780	works like a champ. So here is some 30 gauge wire that I've attached to this device here.
3972860	3973920	And you can see...
3985450	3992410	So right here, you can see this is glue. So I put a dab of glue in there and it holds the wires
3992410	4000150	and it prevents me from tearing the pads out from this circuitry. It works like a champ.
4000150	4004890	If you need to remove the glue, it peels right off. It takes a little force, but it'll peel off
4004890	4011850	clean off the circuit board. And it's actually brilliant for what you need to do. Some of the
4011850	4017130	other things that we're going to need, you're going to need a wire. So these are jumper wires.
4017130	4022670	You can get these male-to-male, female-to-female, and they just peel off. So I have bundles of
4022670	4027830	these. And when I'm done using one, I throw it away. Because if you keep plugging it in,
4027830	4032810	plugging it in, plugging it in, by the end of the day, it'll start weakening to the point where
4032810	4036750	it will give you problems if you keep trying to use it. And there's nothing worse than losing
4036750	4040870	three or four hours trying to figure out why something isn't working and find out your plug
4040870	4046790	is just wore out. So I usually get bundles of these. And then you'll find them scattered all
4046790	4052970	over the floor because I just throw them on the floor when I'm done. I'd also recommend
4052970	4059110	breakout boards. Quick breakout boards are for quick for doing various projects and stuff like
4059110	4069250	that. And that's kind of sweet. And then let me see. Oh gosh, here's some stuff I bought on a
4069430	4075870	project a while back. I ran into a project where I need USBs. So I literally went out and bought
4075870	4082330	USB breakouts. So you can buy these little kits for like five, six bucks. Okay. And it gives you
4082330	4088150	the ability to do USB breakouts so that you can solder up connections on these things and be able
4088150	4095150	to tap into various USBs. Kind of the reason why I needed that. It turned out that the device that
4095150	4102330	I pulled apart was an industrial device and it had a solid state drive in it. The solid state drive
4102330	4111110	was an ATA. It was basically USB. And it was kind of a weird wire out structure. So from here,
4111110	4118850	I was able to jump it out the way I wanted it to, to fit the USB properly and was able to use that
4118850	4125510	to tap into the actual device and effectively be able to read the data off of it pretty effectively.
4125510	4131710	So that worked pretty good. Here's some... these are a little expensive, but they've come in handy
4131850	4138530	a few times. These are micro grabbers and they go... I can use them on a logic analyzer or some other
4138530	4143910	kind of testing equipment. I have a set of these that I've put together. I think these were like
4143910	4150930	20 bucks a piece, but they have a 0.5 millimeter pitch. Comes in handy for small stuff. And then
4150930	4160690	the big item. I think this is really critical. This is a test board. I built these. And I would
4160690	4166770	recommend building test boards to meet your particular needs in the projects you're working
4166770	4172790	on. It'll come in... it'll be very vital to actually be able to do it. So if we look at this
4173370	4178170	from this test board, we have two sides of this. So we can take the wire and we could hook into
4178170	4183070	here. These are screw terminals. So you can screw the wire in here and instantly you have two headers
4183070	4190330	to put test equipment on. This one over here is similar. This one has jumpers in the middle.
4190330	4195790	This one's isolated with a switch. These are isolated with jumpers. So once you attach the
4195790	4202010	jumpers or throw the switch, you get connections all the way across. So if it's turned on, then I
4202010	4207490	basically get four headers I can tap into. This also makes it possible, and where I've done
4207490	4213710	interchip communication testing, where I actually come off the circuit board here, route through
4213710	4218550	here, and then I go back to the circuit board, and then I cut the runs on the circuit board,
4219210	4224550	making all the traffic flow through this. And it gives me the ability to turn on and off the flow
4224550	4229510	on a circuit board for analysis and ability to hook multiple pieces of test equipment up
4229510	4236370	for analysis. And again, I built these, get these boards. You can see where they're broke right here
4236370	4242490	so that they require a switch or a jumper to do them. And these come in extremely handy. I've
4242490	4248950	built four or five different ones, but having these screw terminals are a lifesaver for connecting
4248950	4258930	up things. So I'd recommend building some of your own jigs and test equipment. Any questions?
4260690	4265810	It looks like a high-level question kind of cropped up here. This was with regard earlier
4265810	4273010	to when you're speaking towards like the FTDI devices. The question is, what software do you
4273010	4277730	use in order to start talking to these devices? And again, this is with regard when you're talking
4277730	4284110	about the Shikra, those types of hardware devices. So if you're using the Shikra,
4284110	4287690	if you're using JTAG, then you're obviously going to use like OpenOCD
4290550	4298550	is probably one of the best ones that you're actually going to use is OpenOCD for it.
4298550	4306110	When it comes to UART, there is so many console programs out there. It's literally kind of hard to
4306710	4318010	say which one is the best one. I have a tendency to use, gosh, cool term, and I use it on my Mac.
4318010	4328510	If you're on a Linux system, I would just use screen for interacting with a USB UART connector.
4328550	4335790	As an example, for the logic analyzers, the manufacturers produce software called Logic,
4335790	4340830	Salay does. There's the older version, and there's Logic 2, which is pretty good.
4341110	4347870	So for standard UARTs, again, there's tons of programs out there. Find the one that works best for you.
4349250	4355010	And or if you're on a Linux box, just use screen. Screen has the ability to interact with
4356090	4362370	TTY USB 0, TTY USB 2, 1, ever how many UARTs you have connected up,
4362370	4370610	and also set the associated bauld rate right within screen. When you get into logic analyzers,
4370610	4376410	you know, like Jlink. Jlink produces its own... not logic analyzer, I'm sorry,
4376410	4383310	debuggers. Jlink produces its own software, same way with ccdebug. Also, individual manufacturers
4383310	4391150	of certain chips will produce their own software to interact with their chips over Jlink. Nordic
4391150	4399450	is one of them. Nordic produces software to connect to their NRF5152 series chips.
4399450	4408110	They can get it as a command line, or you can get it as with a user interface type thing,
4408110	4412610	and it actually will leverage the Jlink. So a lot of the manufacturers will also produce
4412610	4418530	custom software to interact with their chip using no standard logic analyzers or
4419170	4423990	debuggers that are available out there. Any other questions?
4425010	4427590	That is it. All right.