start	end	text
0	6200	working in conjunction here with Daryl and team to produce some of these labs and whatnot.
6440	11440	And this particular one is going to be about logic analyzers. So, my name is Jonathan Sines.
11440	18720	I'm a pen tester on the Rapid7 team. And just to dive right in, what is the purpose of a logic
18720	26310	analyzer? So, in essence, developers use logic analyzers pretty heavily for doing things such as
27990	31310	debugging protocols. So, if they're doing something like what we see in the picture
31310	37330	here that has probably some form of interchip communication, maybe there's like SPI or I2C,
37330	43230	logic analyzers enable you to dig down and see underneath the hood what's actually going on.
43230	48210	Works fantastically for troubleshooting. Just think like Wireshark for hardware analysis.
48790	53810	Like I was mentioning, it could also be used to debug. So, it's used to troubleshoot maybe
53810	60030	why is my software not working? Why is this embedded firmware not talking from the SPI
60030	65070	flash chip to my MCU? A logic analyzer can kind of help troubleshoot that.
65070	72670	So, that's the sort of developer-y perspective of using a logic analyzer. Now,
72670	79950	how would we use them in IoT? So, of course, we have the pizza delivery, pizza doom guy,
79950	88870	with the ski mask underneath. We use them in IoT. Our goal is to dump the firmware. So,
89390	94590	once the firmware is dumped, it's oftentimes mostly dumped through serial interfaces,
94590	98450	unless we're doing something like removing a chip. So, whenever we're talking about this,
98450	103150	it's going to be more so focused on from the perspective of doing something like dumping
103150	109930	firmware from some type of interface, whether that be UART, whether that be SPI, whether that be I2C.
109950	115510	Also, it's to interact with the device. I know that if you've attended any of our other talks
116990	122250	from today with regard to U-Boot or any of the talks yesterday, we've talked a lot about UART.
122250	127250	So, UART will be the serial, I guess, mechanism that we would use to interact with some of these
127250	134170	devices. So, what we want to do is identify what is the pinout of some of these devices. And we'll
134170	140090	talk a little bit more about that later on in the slides here. But a lot of times, the pins,
140090	147630	they're not labeled. So, we need to figure out, okay, A, what type of protocol is being used for
147630	152750	these pins? And B, which individual channel is being sent or what kind of data is being
152750	161090	transported over those pins? So, things such as you can check things on a simple serial bus,
161090	166730	like SPI, I2S, I2C, UART, things like that using a logic analyzer.
168970	173070	What are the types of logic analyzers? Again, I know we're kind of talking about maybe some
173070	177310	boring stuff, but just to kind of take you a little bit back in time here, the bottom left
177310	181410	corner is a desktop logic analyzer. You don't really see those that much these days. That looks
181410	186290	more like an oscilloscope, but it's, in fact, a logic analyzer. If you kind of take a closer look,
186290	190950	you can see that it's actually measuring digital frequencies, something that an oscilloscope does
190950	196430	not do, which we'll talk about more later. What we will be talking about and looking at in our
196430	202950	demos is going to be USB logic analyzers, and those look more like the things you see on the
202950	207570	right side of the screen. So, the Saley is like one of the more popular ones, and you have a couple
207570	213790	of the others, like Travelogic in this particular case. The USB analyzers tend to be cheap,
213790	219570	and they tend to be small. Desktop analyzers tend to be large, and they tend to be expensive.
219570	226870	We'll talk also a little bit about oscilloscopes later, but the logic analyzer has a small amount
226870	231990	of memory, but a large number of channels. That's pretty important, because we'll kind of compare
231990	236830	and contrast what might be right for you. If you're wanting to get started with some of this stuff,
236830	241350	what would be best for you with what you're doing with whatever it is that your goal is.
241750	246490	Logic analyzer is a visual representation of the data that it processes as well. So,
246490	252290	when I say that it's a visual representation, it's making the calculation and representing
252290	257390	what it thinks is what that data looks like, rather than oscilloscope, which is the actual
257390	263270	analog signals that's traversing over the voltages of the chip.
264630	269030	These logic analyzers, we'll talk about price later, but like I was mentioning earlier,
269030	277170	USB logic analyzers tend to be very cheap. Okay, a logic analyzer is not an oscilloscope.
277170	283910	So, all these snippets I stole off the Salie website. The oscilloscope,
283910	288910	it measures... the idea in general is that it's measuring constantly. It's not like...
289630	301800	This is quite possibly the most boring slide I've had, so it sucks to be y'all.
302780	312440	I'm just kidding. They're all equally bad. So anyways, oscilloscope is not a logic analyzer.
312440	319900	Oscilloscope measures analog, whereas logic analyzers measure digital. I'm actually glad
319900	326880	we went back to this one, because some logic analyzers can actually measure analog. We'll
326880	330280	talk about that a little bit later. I'll kind of show you. We'll go over a few different logic
330280	336980	analyzers, just to kind of see what... but I probably shouldn't just use like the blanket
336980	344600	statement and say that logic analyzers cannot measure analog, because that's not a true
344600	348860	statement. They can to a certain extent, but many of them do not.
351630	359090	So as I was mentioning, they are not used for any type of like UART connection. So you get data
359090	365030	being transmitted over UART, but you can't actually set up like, okay, hey, I want to
365030	370710	toss in like, you know, let's connect to this using 8-bit, you know, parity, and then we'll
370710	376890	of course do like a quadrate of like 11200 and interact with this device. That's not what you
376890	381890	can do with a logic analyzer. Logic analyzer is more of just a passive listener. It's something
381890	391830	like Wireshark or hardware. It's not an oscilloscope. So from an oscilloscope perspective,
392530	400950	basically you're looking at voltages over a period of time. So it uses memory. So it's using,
400950	495710	say, for OCD. So we have the Sabley, right? So the Sabley is, I don't want to say de facto,
495710	505030	but it kind of is de facto. It's also some software and a pretty large online community
505400	512350	and support that is available that goes hand in hand with this particular logic analyzer.
512350	518250	There are other logic analyzers, of course, that exist and we'll look a little bit more
518250	523910	about the prices. What did we pay for these? Between like 5 and 15, 20 bucks.
523910	528430	I think it was like 12 for one and 24 for the other one.
528430	535650	Very cheap, you know, like go sell like a garbage bag full of, you know, aluminum cans and then buy
535650	543050	this stuff because you can just, it's just outrageously cheap. So anyways, we'll do some
543050	547830	pros and cons between all these guys, but we're going to kind of just, let's just go ahead and
547830	553730	hook something up with it. What we're actually going to look at with it is going to be Raspberry
553730	564550	Pi. What we're going to look at also with it is Raspberry Pi has a UART interface. I'm sure as
564550	573810	many of you guys know. And I'm going to try to just take the examples just to kind of give you
573810	582250	an idea. But here is the Raspberry Pi like sort of coming out and hopefully everyone can see that.
582250	588630	Daryl, is this showing up on the screen? Yes. Okay, perfect. So whenever you're looking at it,
588630	602390	it's basically how it's laid out. So just be aware that it looks good. Cool. So as you can see
602390	613690	on the screen, we have ground, several grounds. And then right here on these two, we have Rx and Tx.
613690	620950	So Rx and Tx are the two interfaces that we're going to target for UART. So if we count down
620950	628090	one, two, three, four, it is Rx or Tx rather. And then one, two, three, four, five, it's Rx.
628570	632590	And then we'll have a ground down here in the bottom left-hand corner. So let's get this
632590	641010	hooked up. I'm going to start this off with you guys with the, I guess just the matter in this
641010	647250	particular case. But whenever you look at the actual like logic analyzer, you can see that
647250	655710	there's like a mapping of the pins on it as well. So it's basically like channel zero through seven.
655710	662110	And then there's two grounds. And what that's based off of is the actual like layout of the
662110	668350	pins on the thing, and then you have the actual pins. So what we'll do is we'll take these three
668350	675410	jumper wires here, and we're going to actually get rid of the old Raspberry Pi pinout graph.
675410	681790	We're actually just going to move it over that way. And then we're going to just kind of hook
681790	685650	these suckers up. You know what I mean? So we'll take ground. We're just going to use black. We'll
685650	691990	try to be correct with our color usage here. Black for ground. So we'll hook that up to one
691990	701360	of the two grounds there. And we'll hook up white to channel zero. And we'll hook up this like
701360	707500	silver color to channel one. And if you guys think this is fun watching me do this, just wait
707500	715180	until we get to the SPI. So that's exciting. I'm looking forward to it. And then as we saw earlier
715180	720700	with the ground, this is the bottom left hand corner pointer here. Remember we hooked up white
721300	728960	to channel zero. We're going to hook white up to channel... it's the fourth pin, so we'll use the
728960	739580	TX here. And we'll hook up this little silver to RX. And that's it. So that is pretty much how
739580	746580	these hook up. And we'll look at several other devices, but I just wanted to give everyone an
746580	753360	idea so we're not kind of, you know, functioning in the dark here. So let's put a pin in this and
753360	761060	let's circle back to some of the slides here. So we now know what that looks like. Now I've done a
761060	768060	lot of talking here. I think we have a couple questions here. Let me look. There was one
768400	772780	question. You may have already covered it, but I want to make sure it's asked. It's in the channel.
772780	780420	Are there any equipment models that you can do experience to come across any models of devices
780420	789440	like that? Yeah, so some do have the capability of doing both analog and digital. Most of the cheaper
789440	797140	ones are only digital. Now the ones that support analog and digital are typically a little bit more
797140	804900	expensive. And a great example of that is the Salee. It supports both and a channel.
805800	811260	But yeah, so some models do support it. Typically you'll be paying a little bit more money for it.
811260	818180	So I would definitely ask yourself, is analog something I truly need for the type of
818180	824180	debugging, the type of troubleshooting, the type of development, or the type of hacking that I'll be
824180	835920	doing. One other question here. So where can somebody buy the cheaper logic analyzers that
835920	847920	you're demoing here? And would they work for newer to IoT versus having a larger investment?
847920	859760	That is a very well-timed question. This is a couple examples of where you can get some of
859760	866080	these logic analyzers. On the left side of the screen, I pulled this directly from the Salee
866080	872200	website. Again, these are the nicer models that support both analog and digital. I'll also show
872200	877740	everyone here on the call what it looks like and what it means to actually have a nicer one versus
877920	885860	not so nice one. So are you going to be spending, in this case, an example to have on screen, $13 to
885860	893600	$24? Or you can have a peek at that. But on the left side of the screen here, the pricing is from
893600	901820	Salee. You can buy them on Amazon. You can buy them on eBay. You can buy them on Spark. The
901820	909700	prices on the right, the two cheap ones below and above the dude whose wallet is on fire,
909700	915780	were off Amazon. I had this screenshot of that maybe like three or four days ago.
916100	922200	As far as the features between differences in between the cheaper one versus the more
922200	929820	expensive one, we'll take a peek at that in a couple of demos, a few slides down the road.
929820	932920	No more questions. I guess you can move on.
933340	941920	Sweet. So moving on here, as I talked about earlier, the signaling.
943060	949220	Analog signaling is just continuous changing values, whereas digital is defined values
949220	956600	based on a range of voltage that we're going to see with these USB logic analyzers.
957240	963160	Bear in mind, it's not 100% accurate. So if you're like needing to be like pinpoint accuracy
963160	969760	on voltages, the logic analyzer is going to be... I also want to share with you what those digital
969760	976120	versus analog signals look like. So whenever we dive into the software here pretty soon,
976120	980860	we can kind of see what those waveforms are and how they differ from one another.
981240	989420	The voltage above a certain threshold is... and digital signaling with logic analyzers
989420	996380	is binary. If it's going low, then that's considered a zero. If it's going high,
996380	1003540	it's considered a one. And that determination is based upon that particular threshold transistor
1003540	1011740	the technology is basically using. Logic analyzer will sample the voltages at various intervals and
1011740	1017540	reconstruct what that data looks like. So I just want to kind of just shine a little bit of context
1017540	1028580	as to analog versus digital. So there's two main types that I've used in my experience.
1028580	1035900	Your mileage may vary. I know there's a lot of different other software, I guess, vendors,
1035900	1042940	makers out there. I'm Mac-based, so I'm going to handcuff the Mac, fortunately, because it would
1044460	1052560	also be capable of running on Linux, too. So the top left corner is Sigrock's PulseView.
1052560	1057680	So Sigrock is a manufacturer of logic analyzer as well as software,
1057680	1064000	and PulseView is the actual software name. Now, what we're going to talk about actually has
1064000	1071340	Sigrock client, and I'll be honest with you, I love the fact that they're open source. I love
1071340	1077320	the fact that it's free. Actually, both the software here is free, but the PulseView,
1077320	1084640	the graphical interface, is just not the greatest. It's more robust, I guess you could say. So
1085240	1088800	unfortunately, I'm not going to go over it today because it would probably take a little bit too
1088800	1095560	much time. But to kind of dive in here, what I wanted to do was just kind of compare these two
1095560	1102980	software sets with you. So with that being said, let's just dive right in. Let's just take a look
1102980	1113640	here. Screw it. So what I want to do first is I want to continue with where we left off with
1113640	1119920	this particular logic analyzer and the more expensive stuff. How about that? We've got a
1119920	1127260	couple of wires here. We've got a power for the Raspberry Pi sitting right here. I have the USB
1127260	1132280	power stripped here. I'm just going to kind of power off the Pi real fast. And we'll go ahead
1132280	1140560	and grab the other cable for our logic analyzer. That's right there. Let's go ahead and plug this
1140560	1152160	up. Now, as we're doing this, again, this is going to power for the logic analyzer.
1152500	1163770	And what we're going to do next is let me... there we go. Okay, cool. We'll do that here.
1163770	1168450	So I'm going to bring up the software on the other side of the screen here for us.
1169570	1172590	And the first one we're going to look at is PulseView. So I just want to kind of
1172590	1179010	give you a quick little demo of what some of this looks like. So as you can see here,
1179530	1182790	shift that that way, we have everything hooked up on this side of the house.
1183270	1189950	Remember, we have UART. So RXTX hooked up to this based off the pinout that we found online. And,
1189950	1194570	of course, ground's hooked up as well. We followed the mappings here. So we're going to kind of take
1194690	1198550	a white box approach with this. And let's just assume that we know everything already. So let's
1198550	1201910	assume that we found the data sheet for the device that we're wanting to kind of probe and take a
1201910	1207370	look at. What we want to do next is from the software here, I'll give you a quick little run
1207370	1214430	through. So we'll go back to the full screen. This is the Sigrot PulseView. So with the PulseView,
1214430	1218050	you can select the device you have plugged into your computer. And this particular one,
1218050	1223890	the driver that we need is the FX2LAFW. So we'll select that from the dropdown,
1223890	1228070	and we'll click scan for devices using the driver above. And then we'll click OK. And
1228070	1234070	that basically has it hooked up. So what happens here is an airplane flying above here. So you'll
1234070	1239370	hear some background to that. What you see here is that there's eight channels starting at zero
1239370	1246750	and ending at seven. So that's representing the eight channels that the logic analyzer has.
1246750	1254170	Remember, it's zero through seven on the logic analyzer. What we can do is we can lower that
1254170	1258530	because we're only using RX and TX. Ground is assumed. You're always going to use ground. So
1258530	1263210	we want to select D0 and D1. So we're going to remove some of these other guys here.
1263590	1268690	Going back to the software here, you can change the amount of sampling that it does. In this
1268690	1277370	particular case, I have it set at one millisamples per second. So that's the setting for that. And
1277370	1281670	we'll talk about that a little bit more whenever we get into salient software. But the cheaper
1281670	1287050	logic analyzers can sample at a slower rate than the Salie. So there's a little bit of a
1287050	1291710	limitation here. And here's the speeds as well. So we're going to stick 20 kilohertz.
1291710	1296950	So let's just plug this sucker in. Let's just see what happens. So I'm going to hit the power
1296950	1301910	button. We're going to see the lights come on on the Raspberry Pi right here. And then I'm going
1301910	1306610	hit the run button. Whoopsie-daisy.
1309030	1316630	Try that again. And then we can click this button here, which makes us keep up with the timing of
1316630	1324750	the actual logic analysis that's taking place. So we'll see some spikes and voltages as things
1324750	1331270	happen. Again, this is over UART. So think of the TTY connection over some type of serial or
1331270	1335910	SSH interface. Imagine just a boot up of a Raspberry Pi. So it's just going to do its crap.
1335910	1340230	And then at the end, it's going to be like, okay, Raspberry login type stuff. So we'll go ahead and
1340230	1349250	stop it now that we're getting kind of closer towards the end here. Yeah, that's the last one.
1349250	1355470	So if we take a look here, this is basically the capture. I captured for, as you can see,
1355470	1361250	35 seconds. So the thing about this, let's go ahead and go back into full screen. We don't
1361250	1365850	really need the camera so much right now, but we'll go ahead and expand everything back out.
1365850	1370850	And let's just take a look over here because this is the, let's just pretend again, let's just assume
1370850	1374730	that we know the answer to this. This is basically where it's just prompting for a login to the UART
1374730	1383570	interface. So we'll go in here and we'll kind of scroll, scroll, scroll. And even if you were unsure
1384130	1390290	of which one was RX or TX, you could pretty well assume if you at least knew that these two
1390290	1395070	connections were UART, that this one's going to be TX and this one's going to be RX. How is that?
1395070	1401170	Because TX is sending us data and RX is literally a flat line. So a couple of things there that can
1401170	1407590	kind of help you out. And one other thing too, is that this particular software does have protocol
1407590	1414210	debuggers. So let's take a look at that and let's go ahead and remember we set TX to D0 and we set
1414210	1420650	RX to D1. So another thing too, we already have 11.5.200. We're going to keep everything else
1420650	1429730	basically default here. The least significant bit first is correct. We'll switch that to ASCII
1429730	1437570	and it will come in here and then it should do some decoding for us. Usually it takes a second.
1441000	1455970	Let's see if she works here. Yeah, so again, just a high-level example of the protocol decoding
1455970	1462010	available for this particular PulseView software and some of the stuff you can do. So it recognizes
1462010	1466850	stop bits, it recognizes frame errors, break conditions, things like that. Now what I want to
1466850	1472870	also do real quick, we'll just exit completely out of here. We don't want to save. Another thing
1472870	1478870	is it's pretty nifty. PulseView has SIGROC. They have their own proprietary format where you can
1478870	1484610	save your data and then import it into Saly or other. You can manipulate it also from the command
1484610	1493730	line. We want to now switch over to the Logic software from Saly. So Saly has their own set
1493730	1497770	of software. They actually have two sets of software that we're going to review. And what I
1497770	1511680	want to do is... let me open it up here. And what I want to do is show you guys both sets of
1511680	1519360	software to kind of show you the epicness of what it has the capability of doing. So on the left-hand
1519360	1528420	side here, we have the Saly Logic 1.0, 1.2.18 software, I guess, technically. And in this
1528420	1534860	case, it's very similar. So remember, here's all the eight channels. And that's pretty much the
1534860	1538700	situation that we're looking at. Mind you, remember, this is all digital signaling. So
1538700	1547400	there's no actual analog signals going on in this particular case. So very similar to the other
1547400	1553420	software, you can do the same protocol analysis. So we have, for instance, AsyncSerial, which is
1553420	1559840	UART. UART is an AsyncSerial communication protocol with I2C and SPI. So there's a whole
1559840	1565360	list of different protocols supported also by the Saly software. Your decoded protocols,
1565360	1569820	it can actually decode also. As we saw earlier with the other software, it decoded it, but it's
1569820	1573720	kind of limited on the amount of information that it can present to you. The command line is where
1573720	1579820	the SigRoc software is very strong compared to Saly. There's also annotations. So with the
1579820	1583500	annotations, you can kind of capture during periods of time. But the thing I want to show
1583500	1590000	you guys the most here is with logic analyzers. It's not specific to Saly, but let's just go ahead
1590000	1593420	and power this guy off. So as you can see on the right-hand side of the screen, the light's now
1593420	1600120	off on the Raspberry Pi. Let's go ahead and power it back on. But also, we're capturing for 30
1600120	1605440	seconds. Let's just stick to four mega samples per second. And then we'll go ahead and power
1605440	1612400	the sucker back on while it starts. So as you can see right here, the only sad panda part about the
1612400	1617260	Saly software is that it doesn't like live view show like the results of what's going on with
1617260	1622100	everything. So you're kind of like, you're kind of stuck with like, just this kind of boring screen
1622100	1625720	here. So you can't really see the sort of interactive like, oh, here's like, you know,
1625720	1633880	the waveforms and whatnot. But whatever, it's all good. We'll go over some, the 2.0 version of it
1633880	1641240	where it does offer some sexy or gooey stuff. So here's the output of our capture. So let's scroll
1641240	1648420	out, and we can see very similar to the pulse view, take this full screen, that there was actually some
1648420	1654320	data captured here, very similar to what we saw earlier. Now, let's scroll in. And as we talked
1654320	1659220	about earlier, remember, channel zero is the TX line of the Raspberry Pi. So of course, we're going to
1659220	1667520	see data. Now, a couple things is that let's say we want to add a protocol debugger, just like what
1667520	1672140	we did with the pulse view. Let's go ahead and add this. We'll say channel zero, the serial, that's
1672140	1677680	the TX channel. And let's click Autobot, right? So let's pretend for a second that we do not even
1677680	1681780	know the baud rate of this device. Let's pretend that we actually think that it's UR, but we
1681780	1686460	actually don't know if it's TX or RX. We've already actually kind of figured out that it's TX, because
1686460	1691860	remember, channel zero, we're seeing data. It's transmitting data to us. RX is a flat line because
1691860	1697020	we're not sending any data back. So we do not know the baud rate. Let's just pretend like we want to
1697020	1702500	open up like a screen session or some type of like a serial session with the device over TTY serial,
1702500	1708320	but we do not know the actual bit rate of that serial connection. So we'll just leave that
1708880	1713080	default, default 9600. We'll click this little checkbox here, Autobot. We'll keep everything
1713080	1717840	else default as well. This is all pretty standard for a normal serial interface on an embedded
1717840	1725360	system. We'll click save. We now see the async serial is here in this corner. And kind of a
1725360	1732040	cool little thing you can do also to help you figure out that baud rate. This is pretty neat.
1732040	1738080	Now earlier, I'm going to bring this up for you guys real quick. In the actual slide presentation,
1738080	1742720	I had this little table here that showed the actual microseconds as well as the baud rate
1742720	1750360	in this table. So if it's 833 microseconds, it's 1200. The bit rate is 1200. If it's 52
1750360	1758580	microseconds, it's 1,900. If it's 8 microseconds, it's 1,500. Now if we go back here, what we can
1758580	1766980	actually do is we see the actual, let's take a look here, the waveform. So from where the actual
1768180	1775300	rising edge to a falling edge of one complete uniform wave. Here we go. It's a good one.
1776640	1784820	It's super tiny, but I hope you guys can see that. 8.5 microseconds. It's pretty nifty because
1784820	1790020	that basically tells us what the baud rate is without us even having to measure the baud rate.
1790020	1796960	So if we go back to our table here, remember 8.5? 8.5 is what it measured as the baud rate.
1796980	1805940	We look here and 8 microseconds is 11,500. Remember, digital is never going to be 100%
1805940	1809500	accurate. It's going to do its best at that representation. Also, there's latency in the
1809500	1814420	cable. There's latency in USB 2.0. In this case, this is one of the cheaper logic analyzers using
1814420	1819220	USB 2.0. So either way, it's not going to be 100% accurate. It's going to be like slightly off,
1819220	1824240	but it's safe to assume that it's closest to that number than it is to any of these other numbers.
1824240	1829580	That being said, let's just do something a little wacky here and just enjoy the
1829580	1835900	luxurious features of the Saley software. I just lowered the sample time to five seconds.
1836140	1839620	Remember, if we go back here to the settings, we have it set. Let's just
1840140	1844220	see it automatically detect. It's already changed, but let's just put it back to 9600.
1844260	1847580	Imagine this is like a fresh scan. We'll power the device off
1849440	1854040	and then we'll power the sucker back on and then we'll go ahead and start sampling.
1854240	1860060	So based off of the sample rate, the Saley software is smart enough to realize what that
1860060	1865060	particular baud rate is. In this case, it already converted to us. Well, that is not the actual
1865060	1871620	bit rate, even though that would probably work. It's 11,500. It's close enough for what we're
1871620	1878800	trying to do here. So let's take it a step further and then let's switch this back over to 30 seconds
1881560	1888380	and let's power it off and then let's power it back on again. Now that we know our baud rate,
1888380	1896820	we'll just see what it can do. Let's make it full screen because you all know what a Raspberry Pi
1896820	1900800	looks like. I can't make it full screen. I'm going to sit here and just stare at this thing and boot
1900800	1917470	up. So while we're having a little break, let me ask you one of the questions. So I have a question
1917470	1928270	here. Is the Saley or the PulseView Logic Analyzer software free and open source? How would you go
1928270	1934910	about downloading or purchasing those? The Saley software, it is actually free.
1934930	1940850	It is not open source, however. It's free. You can download it straight from their website.
1941590	1946590	You can't compile it because, again, it's not open source, but it's 100% free. You don't have
1946590	1953450	to spend a dime for it. However, the Sigrock, so the PulseView software, I believe the GUI is open
1953450	1958550	source. I know the Sigrock CLI is open source because I just compiled it actually like two
1958550	1967790	hours ago. But yeah, so the Saley Logic, free, not open source. Sigrock PulseView, 100% free,
1967790	1972870	maybe open source. Sigrock CLI, free and open source.
1974530	1981850	And taking a peek here real quick, we can see in the decoded protocol section here that we actually
1981850	1989630	have the output of what we saw over the UART interface. So under voltage, it's kind of printed
1989630	1995090	funky here, but that's the actual output of what it's seeing. We had it set to the ASCII,
1995090	2001370	so the output is being displayed in ASCII format. So kind of neat. You can see all that kind of
2001370	2007310	stuff. Scrolling even further down here, we have detected, blah, blah, blah, but go to the very
2007310	2012590	bottom. Maybe we missed it, but it would even capture... Yeah, there we go, like Raspberry
2012590	2018950	Pi login. And that's basically on the UART connection waiting for the typical Pi password,
2018950	2023670	Raspberry, because no one ever changes their default on that. So anyways, as for that
2023670	2030370	particular demonstration, that's pretty much it. And kind of continuing on with that particular
2030370	2034610	question that was asked regarding the free and open source nature, are there any other questions,
2034610	2041790	I guess, up until now? Yeah, I have just one more for you. What is the
2041790	2047110	max number of logic analyzer channels needed for most IoT situations?
2047850	2055210	That's a good question. And I'll be perfectly honest, I rarely run into an instance,
2055210	2061310	I do this, you know, I'm not like hacking on IoT, like full time with my day job. Again,
2061310	2068010	I'm a pin tester. But I do it a lot, just kind of as a hobbyist, as well as just kind of as a
2068550	2074190	side type thing. There's very rare instances that I've run into a situation where I needed more than
2074190	2080550	eight channels. So in cases that I've ever used these logic analyzers, it's mostly been on three
2080550	2091710	different protocols, UART, SPI, and I2C. And none of those three, I guess, protocols really require
2091710	2096490	more than eight channels. Now, I don't want to say it wouldn't be necessary. But I would say that
2096490	2101970	it's kind of a low likelihood that if you're trying to get started as like a hobbyist,
2101970	2106390	that you'll actually need more than eight channels. And all of the devices that we're
2106390	2112910	working with here, support eight channels, you can buy them up to like, shoot, I don't even know,
2112910	2119130	I know, I know Morgan on our team has the big one, I think it's six, is it 16 channels? Is that
2119130	2128010	their biggest? Or is it the 16? Yeah, the big, the big boy. And I don't know that I would like
2128010	2133310	have a need. However, it would be super handy to have in case I ever did have that need.
2133310	2137510	But I would probably err on the side of saying that it's likely that eight
2137510	2144760	channels would be good enough for you. Okay, yeah, no more questions yet.
2146080	2152980	So speaking of which, UART, SPI, and I2C, how do they function? So as we saw earlier,
2152980	2156560	UART is an asynchronous connection. So what that actually means is that there's no
2156560	2163080	clock on either side of the connection, controlling the actual rate that data is being transferred.
2163080	2169460	It's an agreed upon number where you're supposed to actually know. So the bit rate
2169460	2175580	and the baud rate is important for that. How it determines the actual connection speeds also
2175580	2182120	is it uses parity bits. So there's basically another layer of overhead that's being sent
2182120	2186960	over the line of communication so that the negotiation and the actual transfer of data
2186960	2192420	can take place. With SPI and I2C, they're actually synchronous, meaning there is a clock
2192420	2199320	that's determining the communication time. So for instance, SPI operates on a slave master
2199860	2205820	model. So the master is the actual determination of the clock speed. That's the one with the actual
2205820	2210840	crystal that's going to determine how quickly data is going to be sent. The slave is going to
2210840	2217040	basically accept that at that particular rate. And that number is negotiated throughout the process.
2217040	2225420	I2C functions in a very similar way. Moving on to the actual interfaces associated with these
2225420	2230940	three different protocols. Again, UART has two channels. Again, the channels column here is
2230940	2236320	assuming that ground's hooked up. So disregard ground right now. This is only the data lines
2236320	2240680	and the information communication lines that's taken place that we're really concerned with here.
2240680	2248040	That's RX and TX for UART. SPI has four channels. That's going to be MISO, MOSI, CS, and CLOCK.
2248040	2253240	Chip select is enable. And CLOCK is, again, the determination of how quickly that data is going
2253240	2258520	to be sent and received. MISO and MOSI are a little bit interchangeable. It can just depend
2258520	2263220	on the situation that's going on. So with SPI specifically, remember there's master-slave.
2263440	2269960	The master will send out data to the slave over MOSI. That stands for master out, slave in.
2269960	2277200	The master will receive data from the slave over master in, slave out. The master will determine
2277200	2282980	the clock rate. And the chip select is the enable. So the chip select is only applicable whenever
2282980	2289420	there's multiple slaves communicating with a master. And then I2C is pretty simple. It's
2289420	2296460	SDA and SCL. SCL is the communication for the determination of how quickly data is to be sent
2296460	2302460	and received. And SDA is the actual data line. So moving on from that, I guess, are there any
2302460	2310200	questions maybe with regard to SPI, those two protocols, with how they apply maybe to logic
2310200	2321480	analyzers? Maybe not, because I know we just kind of just answered some questions.
2321480	2327140	I'm sorry. I was kind of muted. Currently, we don't have any questions specifically on this,
2327140	2331580	but I do want to encourage people that are in the actual channel as attendees,
2331580	2340060	please think of questions and post them into the Q&A session. Okay, you can move on, Jonathan.
2340440	2346540	Cool. Yeah, I think we had a disabled chat because we had some flattering comments earlier.
2346540	2352280	That was kind of awesome. I think Sam was mentioning it was one of the first issues
2352280	2357540	we ran into with something exciting here. But anyways, okay, so let's move on to the first
2357540	2364460	exercise. Yeah, so let's move on to the first exercise here. Actually, I'm going to skip the
2364460	2367980	first exercise. Let's move on to the second one, because we just looked at UI. Let's look at something
2367980	2375340	fun. Switch it over to SPI. Also, I want to show you the sexiness of this new Salie software as well.
2376880	2381680	And let's bring up the new hotness here. I had actually never... I didn't know that Salie
2381680	2387420	had released this new software. I think it was Morgan. So Morgan's our lab manager here at
2387420	2392980	Salie. It was either he or Daryl that had pointed this one out. But Daryl showed me some freaking sweet new features
2392980	2397640	that basically have to do with this new software. So just to give you the quick
2397640	2403280	rundown here, we still have... I'm sorry for shifting this screen around and stuff. But remember, we still
2403280	2408200	have the old school... not the old school, the cheaper end logic analyzer hooked up. We're about to
2408200	2412740	switch over to Salie though. I want to show you guys some other stuff. So this is the new Salie
2413200	2418100	Logic 2 software. So we're now at 2. And you can change the amount of channels, of course,
2418100	2422880	that are hooked up here. You can change the different protocol analyzers associated
2422880	2427300	with the connections that you're making. There's, of course, timing markers you can set. There's
2427300	2432160	measurements you can take. And this is the dopest part, is that there's an extension. It's like...
2432160	2436920	I don't know if you guys use Burp Suite that much, but this is the extender. The extender
2436920	2441860	to Burp Suite is what the extensions are to Logic 2. It's sick. You can create extensions and just
2441860	2447100	basically allows you to have a lot of plugins and stuff. So let's go ahead and swap this guy out.
2447100	2453340	And we're going to look at a completely different device. So this Raspberry Pi is going bye-bye.
2453440	2457820	I'm going to put it over there. Bunch of pile of other crap I got. And then we're going to switch
2457820	2464000	to the Salie logic analyzer. And then also we're going to look at this particular device here. So
2464000	2471440	I don't know if anyone on the call right now was at the Rapid7 IoT builds last year. If they were,
2471440	2477640	this will probably look super familiar. So a couple of things. As you can see, we have markings
2477640	2484540	for SPI connection. There you see MISO, MOSI, CS, enable, clock, that kind of stuff. There's also
2484540	2489220	some other stuff here. Disregard this. We're actually only going to use ground. This is for,
2489220	2493620	I believe, an ICSP connection. But we're not going to be doing anything with YATML today.
2493620	2499520	We're going to stick directly to the chip, the flash memory chip that we have on here.
2499520	2504800	Now, it's going to be an open book situation, but we're also going to pretend like we don't know the
2504800	2509240	pin out of this, just to kind of make it interesting. We do know it, but I'll show you
2509240	2513680	guys how you can probably make that determination. Because it's so common that, you know, maybe you'll
2513680	2519220	have like a header pins that are soldered onto the actual VIAs, or maybe they're only VIAs,
2519220	2524820	and you have to solder the header pins yourself, and you have no idea what they are. And maybe,
2524820	2531160	for instance, you have a WSAN 8. So, that means WSAN 8, it doesn't have legs. So, the flash memory
2531160	2535680	chip, it's like all the solder points on the bottom, or if it's BGA, those solder points on
2535680	2539780	the bottom, so you can take a multimeter to figure out what the actual pin out is, even if you found
2539780	2546180	the data sheet. So, kind of nifty here. I'll show what that kind of stuff looks like. So, with that
2546180	2549140	being said, let's just flip this sucker up. This is the part I was telling you guys about earlier,
2549140	2552660	where I'm just like, you're going to have a good time watching me do this, because there's actually
2552660	2557720	four cables. This is double the amount of cables as we looked at earlier. And another little pro
2557720	2563020	tip, actually all four of these cables are not required. For doing SPI, particularly if you only
2563020	2569920	have one slave connecting to master, you actually only need to connect master out slave in, and
2569920	2573960	clock in order to facilitate that connection. But just for shits and giggles, let's just connect
2573960	2579960	them all. Also, I'm going to mooch off the ground interface of this ICSP down here, just to have
2579960	2585400	something. So, anyways, very similar to what we saw with the other ones. The mappings of the
2585400	2589900	Salie are here at the bottom. You can kind of see a little blurry, but my camera's not the greatest
2589900	2596720	quality. Sorry, guys. It goes from zero to seven. And then the channels are on the top, the ground's
2596720	2600720	on the bottom. You can kind of see there how they're laid out. So, we're going to just kind of
2600720	2605380	start. I'm going to plug in ground here first. I'm going to put it in on the far end on this side.
2605380	2610320	And then we'll... I'm cheating a little bit. Remember, you're supposed to pretend. But
2611320	2616500	master out slave in, I'm going to make that zero. So, that's red. So, we're going to start red
2617440	2625320	at zero, and kind of work that way. You're kind of picking up what I'm throwing down here. So,
2626280	2644200	red, orange, yellow, green. And we need to plug this biatch in.
2649220	2657280	So, yeah, the Salie uses a micro USB. The other cheaper logic analyzers use the
2658660	2663140	mini USB, as you can see there. So, we'll grab the micro USB, again, hooked up to my computer.
2664660	2671000	Let's plug this biatch in. And you shouldn't see a light. It's totally normal to, like,
2671000	2676800	not see a light at first with this guy. And, yeah. So, let's continue on. So,
2676800	2682820	let's go ahead and shift the screen over to that side. And we should now see... so,
2682820	2687280	one beautiful thing is, I don't know if anyone on the call has dealt with Salie before,
2687280	2691480	but it's kind of a pain in the ass sometimes to deal with a logic analyzer and unplugging
2691480	2695900	it back in because you have to close the software and open it again. Well, Salie 2,
2695900	2698940	I have the software already open, as you can see here at the top. It's now connected,
2698940	2705980	the light's on. So, I think it's totally dope. But, anyways, the Salie
2708260	2713980	software here, going back to the actual device itself, as I'd mentioned earlier, it supports
2713980	2719880	both digital as well as analog. So, as you can see here, here's the digital. So, we want to put
2719880	2724660	in four. We have a total of four channels going on right now. And we'll just go ahead and do
2724660	2734060	analog and digital. We'll capture at 10 megasamples per second. And also, a couple other things. So,
2734060	2738580	there's three different ways of capturing with this particular one. There's looping. So, loop
2739340	2744320	after a predefined amount of time. There's the timer, where it will record for a period of time.
2744320	2749220	And there's a trigger. So, just to kind of demo some stuff, let's go ahead and do a trigger. So,
2749220	2754420	remember zero... actually, let's not trigger. Let's just do timer. Because we're trying to go
2754420	2759400	black box, right? So, let's assume we don't know which particular channel is which. And this is
2759400	2762840	just some blind device that we found online. And we don't know the data sheet. And it's using
2762840	2767700	something like a WSAN. So, we have no idea, like, which pin is which. So, we have all the channels
2767700	2772720	set up. We have the timer set up for three seconds of capture. Go down here. We're going to go ahead
2772720	2777460	and leave the analyzers blank. And we're pretty much ready to start capturing here. So, I'm going
2777460	2785400	grab the old power cable for this guy. And I'm set for three seconds. So, I kind of need to be
2785400	2794880	quick with my trigger finger here. There we go. So, we got full screen. All right. She's plugged
2794880	2804520	in. All right. So, we got it. Let's go ahead and zoom out here. Now, this is the capture that we
2804520	2809960	just got, right? And this is during the boot up process. So, what you see here is zero through
2809960	2816620	three channel. This is all digital. And on the bottom, it did its best at analog. And the analog,
2817960	2822640	it's not the greatest. Like, it's probably pretty accurate. And you can kind of see the comparison
2822640	2828320	between the two. Like, it tried its best at measuring those voltages, but probably didn't
2828320	2833500	quite do the greatest that it could. But either way, there's analog. I just want to show you guys
2833500	2838140	some of the analog. And it's cool to have and stuff like that, but it's not really the purpose
2838140	2842820	of what I'm wanting to show you guys right now. Now, say, for instance, that you don't know
2844160	2849720	the mechanism of... you know that it's SPI, but you don't know which pin's which, right?
2849820	2856960	So, whenever we're looking at this device, remember, the top here is MISO. The bottom's
2856960	2862120	MOSI. Channel zero is master-out-slave-in. As I mentioned earlier, master-out-slave-in
2863160	2869560	is the information that's basically being transmitted from the actual chip to us. And
2869560	2874260	it's probably going to be a little bit spontaneous. There's a lot of opcodes being set. There's a lot
2874260	2879180	of different various settings being aligned with the actual device. And typically, that's one of
2879180	2884880	the first things that'll start communicating, as we can see here. So, we zoom in. And a little bit
2884880	2889200	telltale thing is that we're starting to see some type of communication taking place right here.
2889200	2896000	A little sporadic. We also see right here channel one. Channel one, in this case, is clock.
2896900	2901140	Remember, clock is going to actually set the cadence for how it communicates. 1, 2, 3, 4,
2901140	2908640	5, 6, 7, 8. It's a full actual byte of data. That's pretty telltale. So, right here, of course,
2908640	2914300	channel zero, we have a little bit of some type of sporadic data being actually set. Channel one,
2914300	2921760	we have kind of a constant cadence of information being... of the waveform itself. And then enable,
2921760	2927640	what enable is, say, for instance, there's three slaves communicating with the actual master node.
2927780	2934260	The enable will tell... it'll flip the bit for when that device can communicate or not.
2934280	2938320	So, you'll oftentimes see... it might be a little bit of a mismatch in our timing, which we can also
2938320	2943300	fix. But you'll often see with the enable that, for instance, right here, there's basically like
2943840	2949000	a 1, 1, 1. There's three 1s right here. It's going to kind of encompass that entire
2950220	2958920	section, if that makes sense, or cycle. So, it's pretty easy to tell if you just kind of scan it,
2958920	2963840	as we just did, which one's MOSI, which one's clock, and then which one's going to be enable.
2963840	2968260	Again, enable, in our case, channel two and three is actually not even required.
2968900	2972680	So, taking a little bit of a deeper dive, let's take a look at the actual protocol in that
2972680	2979880	analyzer. We'll click SPI here. Remember, we have MOSI set on zero. We have MISO set on three.
2979880	2987160	We have clock set on one. And we have enable set on two. We'll leave everything else default,
2987160	2992680	and we'll click save. Kind of interesting, because you can actually find more deeper
2992680	2999760	information about the actual device and the settings that it's applying as it's booting up.
3000820	3010220	So, for instance, like right here, this is the actual decoded binary format. If we go here to
3010220	3014960	the settings, we can change whether it's in binary, decimal, hexadecimal ASCII, and then take a look
3014960	3019680	at the actual value. So, in this particular case, it's like one, one, zero, zero, one, zero, one,
3019680	3024660	zero. And that's the actual location where it made the determination. You can see it up here at the
3024660	3028720	top as well, where it's decoded. And what's kind of also interesting with this is you can take it
3028840	3035340	a step further, and you can pull up the data sheet of the device. In this particular case,
3035340	3043840	the model of this is the MRF49XA. It's a... I believe this one was a SOP8. I'm not 100% sure
3043840	3050300	on that, but either way, it's just an RF flash memory chip. So, let's take this code that we got
3050300	3056420	here, one, one, zero, zero, one, zero, one, zero, and let's just copy that. And then let's go back
3056420	3062500	here, and let's just paste that in. So, it's... I already had it pulled up, so I'm kind of cheating
3062500	3066960	right now. So, it's kind of interesting because you can take that, and this is exactly what a
3066960	3070860	developer would do as they're kind of producing these types of devices. They're going to, like,
3070860	3076620	set these codes, and this is going to sort of initiate the actual SPI flash storage of the chip.
3076620	3083100	In this particular case, what we saw was one, one, zero, zero, one, zero, one, zero. Let's paste that
3083100	3088600	in again. That's right here. So, we see the command code bit right there, and then we can see here
3088600	3096140	below that bit seven through four are the first in, first out, fill bit counts. We have bit three. So,
3096140	3102020	in this particular case, what you want to do is the immediate one below it is you match the next
3102020	3106080	three and then map it back over to bit seven through four. In this particular... they don't
3106080	3111480	always map, like, seven, like, in a range like that, but in bit three, for instance, like,
3113220	3120100	this guy is set to zero. Bit three, that basically says synchronous character length bit. It's set
3120100	3125980	to word long. So, I don't want to continue going down this rabbit hole here, but it's something
3125980	3130400	that's kind of cool to when, like, when you're debugging, you can kind of map it back to the
3130400	3135140	data sheet to actually figure out what's going on as far as settings being applied to the chip
3135140	3139380	itself. One other really cool thing I'm going to show everyone here real fast is we're going to
3139380	3144900	make some changes here. I'm going to go back to the actual mapping of the SPI interface.
3144960	3151040	Pretty sweet. I mentioned earlier we don't need MISO and we don't need enable. So, let's select
3151040	3156320	both of those to none. And let's do something else. This is kind of cool. This is actually a
3156320	3166200	plug-in that you can use with this. We're going to select SDMMC from SPI. So, this chip, it's not
3166200	3175400	either an SD nor is it an EMMC chip. It's just flash storage. It's not like an SD actual device
3175400	3182040	nor is it a multimedia controller. But let's just pretend like it is for a second. You select the
3182040	3191020	input to go into this particular plug-in and then we'll click finish. And if it were an SD
3191020	3196540	or if it were an EMMC, it'd be pretty sweet because up here, as you can see where I have
3196540	3200500	kind of hovering over, it'll kind of just show you the actual opcodes and the actual information
3200500	3205540	that it's presenting. It'll kind of interpret that for you. So, just kind of another sweet feature of
3206960	3214320	the logic analyzer software. I just want to kind of show you guys that real quick.
3215860	3221580	And I know we're running kind of low on time. Darrell, are we kind of towards the end right now?
3221720	3226180	No, we got time for some questions. I have a couple questions here before you move on.
3226460	3233040	So, this is kind of stepping back, but do you have to worry about sample rate with
3233040	3238980	cheaper analyzers, like missing data or misalignments and things like that?
3239640	3248300	Yeah, that's a good question. I'll try to answer that with a little demo of what that sample rate
3248300	3253920	actually means for the, like for instance, the Salie logic analyzer, which can have very high
3253920	3261600	sample rates. The quick and dirty, the TLDR I'll give you is that for the protocols that we're
3261600	3268880	looking at here, for the most part, the sample rates that these two cheaper guys support are
3268880	3274460	satisfactory for what we're needing. I mean, it's whenever you're diving into the really quick
3274460	3281480	protocols that it really makes a lot more of a difference. Because a lot of times with the
3281480	3287760	really quick sample rates, like say for instance, let's increase this to... well, I don't know if
3287760	3296760	I'll be able to, because I'll be honest, this logic analyzer can only go up to 50, but like,
3296760	3304720	screw it, let's do it anyway. Another question on there is similar to that same topic. Is there
3304960	3309800	a general rule on what samples per second selection that you actually make when you're
3309800	3316200	setting something up? There's not really a general rule. It's more of a... this is just
3316200	3320060	my own experience. Now, Daryl, you might have your own answer for this, but I would say I
3320060	3325440	typically use it for the default, just depending on what it is. And what I use this for is typically
3325440	3330020	for UART, SPI, and I2C. I would heavily be interested to hear what you have to say.
3330120	3339320	Typically, I'm pretty much the same way. What I will do is if the sample rate's not high enough,
3339320	3345860	I've actually had my Sele start throwing errors and tell me that it was missing data,
3345860	3352420	that it wasn't sampling quick enough. I had that just recently looking on some Dataflow.
3352660	3359360	As soon as I kick it off, it'd throw an error in telling me that it was a missample rate.
3359980	3368180	So, I was able to crank it up until the error went away. So, again, sometimes I'll also just
3368180	3374260	crank it up out of the blue if I know for a fact that it's a high-speed device that's going to be
3374260	3380580	generating a lot of fast traffic. Typically, when you're looking at UART, SPI, and stuff like that,
3380580	3388800	amazingly enough, the speed is often not used as even high as the chip can go. Like UART,
3388800	3394340	I've seen interchip comms on a UART that can literally... the chips are designed to drive at
3397460	3405160	what, over 3 million bits per second across there. But yet, the developers of the device
3405160	3414220	had it set up to communicate at 9600 bulb. That makes sense. Yeah. And I've also found that if
3414220	3419180	you go too high, this particular Sele does not support it. But you also don't want to go too
3419180	3423840	high because if you go too high, this, what you see right here, get out of the screen,
3424320	3429500	it'll just be a giant blob. It's just a mess. It's capturing too much sampling and it's kind
3429500	3435500	of just inaccurate at that point. So, it's a fine line between the two. And another quick point on
3435500	3441380	that also is, typically, the higher the sample rate, the more memory you're going to eat up to.
3442220	3454310	That's a point. Are there any other questions? Not at this time. Cool. And quick question,
3454730	3458650	how much more time do we have here? Just to make sure. I don't want to go too far over time.
3459170	3463950	We've been at it for an hour. So, I think we got at least another 10 or 15 minutes.
3464730	3469490	Definitely. You can definitely go for another 15 minutes. The next talk starts at 8 PM.
3469870	3475370	Perfect. Okay, cool. I wasn't 100% sure on that, but that works out great because we have one more
3475370	3483970	demo as well. So, we've talked about... we did a little kind of a cheater exercise on Raspberry Pi.
3484950	3492350	We did... I showed you guys how to sort of blindly identify SPI as well.
3492850	3497290	And then next, let's switch back over to UR. It's more of a real world example.
3498810	3502870	So, let me go ahead and unplug these guys and plug the power first on this guy here.
3504210	3509430	Let's switch back here. Make sure I don't bust off any of these header pins live on camera
3509430	3513030	because this is Daryl's device and it would suck to break it right in front of him.
3513030	3520190	And let's pull over another device. That's going to be this guy.
3520930	3526990	So, we're going to stick to the theme with the Salee. So, Salee is still going to be used.
3527190	3531430	In this particular case, we're going to check out UR, but using the new Salee 2 software.
3531770	3539270	This particular device, it's a Z-Wave hub, I guess, so to speak. So, it's a hub used in
3539270	3544570	automation. I'm pretty heavy into home automation here at my place and that's something I've always
3544570	3551370	been fascinated with. But this particular device, it's a Z-Wave hub. And let's dig right in.
3551370	3558790	So, right off the bat, something that can easily be noticed, I guess, is that on this device,
3558790	3567770	there was these three header pins. I soldered the headers on, but previously it was just three
3567770	3575030	holes just kind of sitting there. And that's kind of telltale that maybe it might be kind of
3575030	3580890	interesting to kind of poke at. It can be anything. It can be I2C. Maybe there's an EEPROM chip on
3580890	3586510	here that's disclosed or it could be anywhere. It could also not be on here. And when I mentioned
3586510	3593990	WSAN earlier, actually, I can't quite tell if this is WSAN or actually a BGA, but either way,
3593990	3601010	same difference. Sometimes you can't actually see the legs of the device to where you map it out
3601010	3606970	to say, for instance, these headers, but rather sometimes you can, which is what you see right
3606970	3615170	here. This is a traditional TSOP8. So, TSOP8, it's got the legs. WSAN does not.
3616650	3620890	And I'm pretty sure it's WSAN. It might be BGA, but I'm pretty confident that it's WSAN. This one
3620890	3627870	for sure is a BGA microcontroller. But either way, sometimes you can't take a multimeter to check
3627870	3633950	that this pin right here connects to that pin right there. So, therefore, sometimes a logic
3633950	3638010	analyzer will come into play. And then that's where it's usually beneficial to do this type
3638010	3642030	of stuff. So, let's just move on. Let's plug this sucker in and see what we get.
3650240	3655760	So, we only need a couple of connections here. So, I'm going to borrow the cables that I was
3655760	3661780	using earlier for the UART. So, in this particular case, there's only three connections being made.
3662580	3670000	One thing you can do with this is basically take a multimeter to figure out which one's ground.
3670000	3673800	In that case, let's just assume that I did that because I know which one's ground. But like,
3673800	3677900	it's pretty easy to tell which one's ground with just a multimeter.
3678800	3683940	So, and the ground is actually going to be the pin on the far right in this particular case.
3683940	3691880	So, let's hook up black to ground. And let's just hook up, you know, white and like this silver one
3691880	3698360	to the other two, not knowing which one's which. So, again, using the handy dandy mappings that
3698360	3706840	we have on the Stanley, we plug that sucker right in to ground. And then we plug in the other two
3706840	3722930	to channels zero and one. Kind of easy. And next,
3722930	3731470	let's, you know what, let's do a trigger. We're kind of gambling right now.
3732050	3736770	We're supposed to be in Vegas right now. So, again, let's do some type of gambling, right?
3736770	3741270	We don't know which one's which one's transmit. But what we're betting on right now is that
3741270	3746010	channel zero is transmit. We have no idea. So, let's just figure out that's what it was. And
3746010	3752090	what we're triggering on is a rising edge. And what that says is that whenever you see a rising
3752090	3757690	edge in the transmission, in that waveform, that's when you start capturing. So, in memory,
3757690	3761930	it's capturing the whole time. But the actual capture that comes back and returns to you
3761930	3767870	is the actual, the trigger that you set here. You can trigger rising edge, falling edge,
3767870	3772370	high pulse, or low pulse. In this particular case, let's just say as soon as you see some
3772370	3776850	type of traffic going on on channel one, that's when we want you to capture. And we want you to
3776850	3781670	capture for three seconds. Delete everything else afterwards. And we only need two channels here.
3781670	3785450	So, let's get rid of those other two. We're going to leave it at 50 megasamples per second.
3785990	3792950	And that is that. We're not going to capture on analog. So, let's... actually,
3792950	3797110	what we're going to do next is we're going to close out of that. We're going to click start.
3797870	3801670	It's literally waiting for the trigger. So, you see down there in the bottom right-hand corner,
3801670	3810630	waiting for trigger. Let's plug this bastard in. Holy shit, we're correct. Yeah. So, we...
3810630	3818850	well, we still have the stupid... let me delete these... the decoders. This is my bad.
3820270	3825910	Let me get rid of that. And yeah, if we're in Vegas, we basically... we bet like 100 bucks on
3825910	3832790	red and it landed on red because it's exactly what happened here. So, go us, right? Channel zero
3832790	3838570	is TX, just as we were hoping for. So, that trigger was met and it recorded for three seconds. So,
3838570	3842950	scrolling into here, we can see some of the data. Of course, you know, this is like the zero one,
3842950	3849310	zero one. And this is the part, as I showed you earlier, with the OG logic analyzer... sorry,
3849310	3857570	the OG logic software. We'll put input channel. We're set to zero. 11.5200. We don't know what
3857570	3862290	the baud rate is for this guy. I believe it actually is 11.5200. Remember, we talked about
3862290	3867170	how to check that. But of course, here we go. We're seeing all the data as well as part of
3867170	3876270	the boot up. So, boot SPL 2017 and just various other information that it's printing out,
3876270	3882050	standard out as it's performing the boot sequence. So, anyways, just wanted to show
3882050	3888210	you guys another example of that on the new software here. It's pretty slick. It's totally
3888210	3894510	awesome. I like it a lot. You know, it's super useful. You can see like the parity bits. This
3894510	3900250	is basically the little white dots is kind of managing the communication timing whenever it's
3900250	3906550	sending data back and forth. In this case, it's transmitting. So, anyways, that being said,
3906550	3913510	that's kind of the end of the demo here. I just want to give another example of what it means to
3913510	3919850	communicate or what it looks like to communicate using the new Saly 2 software. Questions?
3921710	3926690	Yeah, let's go ahead. I think we have some questions. Let me look at this first.
3928370	3935210	If the Saly software works for any analyzer, what would be the consideration in purchasing
3935970	3947530	the more expensive offer over a cheaper hardware option shown? So, why would I want to buy a
3947530	3956490	expensive $600 logic analyzer when I can buy a $24 logic analyzer since I could use the software?
3957110	3962330	Yeah, that makes sense. So, as we talked about the speeds, I don't want to say they're negligible,
3962330	3970670	but you do get significantly higher recording speeds with the Saly than you would do with
3970670	3978330	these cheaper versions as well. Another thing, too, is that the actual accuracy of the protocol
3978330	3985290	decoding I've noticed is higher with the Saly than it is with either of these other two devices.
3986910	3995350	That being said, it really just depends on what your needs are. In my opinion, it's pretty good
3995350	4001130	quality. Like, for instance, I've had a couple of times where I was doing some type of logic,
4001130	4008170	I was doing basically decoding and actually live capture, and I had a crash with the software with
4008170	4013190	both of these devices. So, you'll notice that it's a little bit sluggish. It's a little bit
4013190	4018910	rough around the edges. Again, you kind of get what you pay for. The communication, again,
4018910	4025790	there's been kind of like lags and hiccups with these two. They get the job done, but I've noticed
4025790	4032670	that the accuracy for how close of how it captures is a little bit more specific with the Saly.
4032710	4037310	So, if what you're looking to do is going to require you to know those voltages at more of
4037310	4041690	an accurate level, then maybe consider the Saly versus these guys. I mean, if you're just doing
4041690	4047810	some general debugging, things like that, I think these are not a bad choice. That's just my
4047810	4052690	opinion. Daryl, do you have anything to add to that? Yeah, I think accuracy is probably one of
4052690	4060750	the bigger things and the ability to process at a higher speed, I think, are the value. And that's
4060750	4067830	why I went with a higher value product. Because I personally often encounter things that those
4067830	4074410	would not work on at all, just from the fact that it's higher speed. I often get into more
4076050	4082690	interchip communication analysis, which is often at a much higher speed than external communication.
4083650	4091230	Makes sense. The other question here is a good question. Do you need special hardware for JTAG?
4091690	4101150	Yeah. You know, so if you look here, the capability exists for adding JTAG. Actually,
4101150	4104770	does it? I don't know if it does on this logic, too, or not. I'm still...
4104770	4106610	I think it does. I'm not sure.
4106610	4113050	Yeah, it does. Yeah, it sure does. Now, the question was, is there a specific hardware
4113050	4120250	needed for JTAG? In this case, if you're trying to, like, identify, you know, what is TMS,
4120670	4127350	if you're trying to identify with JTAG, what are those debug interfaces? You might have the
4127350	4132230	capability of doing it with a logic analyzer. Now, at that point, you're kind of... I don't
4132230	4137610	want to say you're putting a round peg in a square hole, but I don't know if you're necessarily using
4137610	4142710	the right tool. It has a capability of doing it like this, but you might consider using other
4142710	4147790	pieces of hardware for doing something like JTAG. Now, like, for JTAG, say, for instance, you don't
4147790	4152510	know what the pinouts are, and you're trying to identify that. That's where you would use something
4152510	4156910	like, for me personally, I would go after a multimeter first, and I would try to ring it
4156910	4162230	out with the MCU. So, I'd try to find the data sheet and use that data sheet to identify where
4162230	4168390	on the MCU, based off those pins of the MCU, where does that fall out, and use that to identify the
4168390	4173170	pinouts of the JTAG. If you don't have the data sheet, or maybe you don't know where the MCU is,
4173170	4178810	or maybe it's a BGA MCU, then you'd maybe use some type of boundary scanner. A great example of that
4178810	4184430	is the JTAGulator. Another thing that you could kind of use the Salee for is a boundary scanner,
4184430	4191410	sort of. In that particular instance, it could help you, yes. Now, if you're wanting to do something
4191410	4198250	like program an MCU, or program the device or upload the device to a flash memory to program
4198250	4203370	an MCU, then you would need some type of programmer, and that's going to be vendor-specific.
4203370	4211050	So, say for instance, it's a STM32, you could use something like a ST-Link device. J-Link supports
4211050	4216250	OpenOCD in a lot of cases, so it can support multi-manufacturers. If it's like an Atmel,
4216250	4221490	you'll want to use like a Pickett. So, if you're wanting to either dump or flash some firmware onto
4221490	4226150	an MCU or flash memory, you'd use whatever programmer is assigned to that particular
4226150	4233290	chipset. Outside that, you can use a logic analyzer for doing some like limited boundary
4233290	4238850	scanning, but that's kind of not really why it's designed, but the capability exists.
4240030	4245550	Yep, and on conclusion, there was one comment, there are a couple comments in here I thought
4245550	4251730	were funny. One was, it would be funny if someone designed a board with a honeypot header that had
4251730	4260950	50 volts on it. So, Jonathan would hook up his $300 logic analyzer and watch it burst into flames.
4261470	4264810	Dear God, yeah, that would fry the man bun right off my head.
4265830	4272830	So, I thought that was a funny comment, which is definitely the level of evil I would expect from
4273250	4279910	DEF CON, so thank you for that. And then a couple comments saying you did a good job,
4279910	4285850	so that was pretty good. So, are there any more questions from anyone as we're getting ready to
4285850	4292330	conclude? Wait, I think there's one more. One was asking more like model numbers on those cheaper
4292330	4300210	ones. Do you have that information? I think those are so generic in nature. You know what I'm talking
4300210	4304950	about, the two cheap logic analyzers. Is there any kind of information on there for acquisition? I
4304950	4313710	think you had a page that actually showed the link or information to the actual Amazon site.
4313710	4322050	Yeah, let me see here. I'll actually just real quickly do one even better for whoever asked
4322050	4329630	the question about that. Amazon.com, if you just search logic analyzer. I mean,
4329630	4333030	one of the ones we're using is like... I think it was the first one in the
4333030	4337750	list showed up there at the top. Yeah, that's one of them. If you go up to the top, I think the first
4337750	4344410	one in the list was one of them we purchased right there. That's one of them. That's the I let go USB
4344410	4351650	one. I actually have the other one too. It's kind of funny because it came with the
4351650	4360850	Edify toolkit or whatever. It's got like a red face to it. You may have called any number of
4360850	4369030	different names. Oh, it's SparkFun. Yeah, SparkFun. Yeah, SparkFun relabels that Chinese one.
4369910	4376130	Yeah, it's this one. So I mean, just go online really. It's kind of like here's one of them
4376130	4382530	and here's the other. And it's just you just Google or not Google Amazon search those two.
4382830	4389570	I'm pretty sure this is exactly both of them. Yeah, perfect. Thanks a lot. Let's see
4390230	4398610	any more questions. Are hand tech any good? Have you messed with a hand tech before?
4398830	4404990	I'm not too sure. Hand tech logic.
4411250	4417350	Oh, oscilloscope or the logic analyzer? Probably logic analyzer since this is a logic analyzer.
4417350	4422810	I have not. Well, you were there a minute ago before you checked on the
4423410	4431130	oscilloscope. There was one showing up there as a logic analyzer. I'm sure. And then EK, TEK.
4433270	4435510	Because we're quickly running out of time here, but...
4437950	4440190	Oh, I've seen pictures of these guys.
4442970	4446470	It looks... I mean, it's got two gigs of DDR2 memory. I mean,
4447490	4451330	it's hella better than I think what any of the Salies have. So,
4451730	4455350	they're quick and dirty real quick. But that one, that's a very high sample rate,
4455350	4458190	and that's a lot of memory. So, higher the memory, the higher the sample rate,
4458190	4462970	the longer you can capture, and the more pinpoint accuracy you can get in those captures.
4463790	4467670	That's probably, I guess, my two cents on that particular one. And it looks cool. Looks dope as
4467670	4475990	hell. Yeah, I haven't messed with one, so... Okay, I think that pretty much concludes it.
4475990	4480550	Hopefully, the people that wanted to ask questions were able to ask questions.
4480930	4490470	Feel free to reach out to any one of us. Jonathan, you can reach out to him anytime.
4490470	4496070	He's available. I think he's on Twitter. Do you get your Twitter ID out there, man?
4496430	4501050	Yeah, Twitter ID, frankensteiner. There you go. Good luck remembering that.
4501050	4507950	So, if you ever want to ask him any questions or harassing, there you go.
4508670	4512990	Yeah, if you want to figure out what my address is, I'll honestly just give it to you,
4512990	4517190	if you're really that curious. You don't have to do whatever, Google it or whatever,
4517190	4522130	like the person did at the beginning. Well, hey, thank you so much. I think
4522130	4526950	there might be a few extra questions. So, if either of you have time to jump into the
4526950	4533310	IOTV Talk, Questions, Text Discord channel, there's definitely people that were pretty
4533310	4539190	engaged with this talk. Despite the technical difficulties, this was our first and only live
4539190	4547210	presentation that had any issues. So, I mean, what are the chances of that? It's like getting a bird
4547210	4552630	pooping on your head. Maybe it's good luck. Nice. It is good luck.