WEBVTT 00:00.000 --> 00:06.200 working in conjunction here with Daryl and team to produce some of these labs and whatnot. 00:06.440 --> 00:09.740 And this particular one is going to be about logic analyzers. 00:09.740 --> 00:11.440 So, my name is Jonathan Sines. 00:11.440 --> 00:14.040 I'm a pen tester on the Rapid7 team. 00:14.320 --> 00:19.860 And just to dive right in, what is the purpose of a logic analyzer? 00:20.000 --> 00:29.350 So, in essence, developers use logic analyzers pretty heavily for doing things such as debugging protocols. 00:29.350 --> 00:43.230 So, if they're doing something like what we see in the picture here that has probably some form of interchip communication, maybe there's like SPI or I2C, logic analyzers enable you to dig down and see underneath the hood what's actually going on. 00:43.230 --> 00:45.330 Works fantastically for troubleshooting. 00:45.370 --> 00:48.210 Just think like Wireshark for hardware analysis. 00:48.790 --> 00:51.710 Like I was mentioning, it could also be used to debug. 00:51.710 --> 00:56.090 So, it's used to troubleshoot maybe why is my software not working? 00:56.090 --> 01:02.050 Why is this embedded firmware not talking from the SPI flash chip to my MCU? 01:02.350 --> 01:05.070 A logic analyzer can kind of help troubleshoot that. 01:05.070 --> 01:11.130 So, that's the sort of developer-y perspective of using a logic analyzer. 01:11.210 --> 01:15.370 Now, how would we use them in IoT? 01:15.370 --> 01:23.530 So, of course, we have the pizza delivery, pizza doom guy, with the ski mask underneath. 01:23.850 --> 01:25.410 We use them in IoT. 01:26.130 --> 01:28.370 Our goal is to dump the firmware. 01:28.370 --> 01:36.690 So, once the firmware is dumped, it's oftentimes mostly dumped through serial interfaces, unless we're doing something like removing a chip. 01:36.690 --> 01:49.930 So, whenever we're talking about this, it's going to be more so focused on from the perspective of doing something like dumping firmware from some type of interface, whether that be UART, whether that be SPI, whether that be I2C. 01:49.950 --> 01:52.690 Also, it's to interact with the device. 01:52.690 --> 02:02.250 I know that if you've attended any of our other talks from today with regard to U-Boot or any of the talks yesterday, we've talked a lot about UART. 02:02.250 --> 02:08.030 So, UART will be the serial, I guess, mechanism that we would use to interact with some of these devices. 02:08.470 --> 02:13.970 So, what we want to do is identify what is the pinout of some of these devices. 02:13.970 --> 02:17.370 And we'll talk a little bit more about that later on in the slides here. 02:17.370 --> 02:21.170 But a lot of times, the pins, they're not labeled. 02:21.610 --> 02:28.250 So, we need to figure out, okay, A, what type of protocol is being used for these pins? 02:28.250 --> 02:34.470 And B, which individual channel is being sent or what kind of data is being transported over those pins? 02:36.450 --> 02:46.730 So, things such as you can check things on a simple serial bus, like SPI, I2S, I2C, UART, things like that using a logic analyzer. 02:48.970 --> 02:51.550 What are the types of logic analyzers? 02:51.550 --> 02:59.070 Again, I know we're kind of talking about maybe some boring stuff, but just to kind of take you a little bit back in time here, the bottom left corner is a desktop logic analyzer. 02:59.070 --> 03:01.030 You don't really see those that much these days. 03:01.030 --> 03:04.970 That looks more like an oscilloscope, but it's, in fact, a logic analyzer. 03:04.970 --> 03:13.050 If you kind of take a closer look, you can see that it's actually measuring digital frequencies, something that an oscilloscope does not do, which we'll talk about more later. 03:13.470 --> 03:24.150 What we will be talking about and looking at in our demos is going to be USB logic analyzers, and those look more like the things you see on the right side of the screen. 03:24.150 --> 03:30.650 So, the Saley is like one of the more popular ones, and you have a couple of the others, like Travelogic in this particular case. 03:31.210 --> 03:35.250 The USB analyzers tend to be cheap, and they tend to be small. 03:35.790 --> 03:39.570 Desktop analyzers tend to be large, and they tend to be expensive. 03:39.570 --> 03:49.970 We'll talk also a little bit about oscilloscopes later, but the logic analyzer has a small amount of memory, but a large number of channels. 03:49.970 --> 03:55.090 That's pretty important, because we'll kind of compare and contrast what might be right for you. 03:55.090 --> 04:01.350 If you're wanting to get started with some of this stuff, what would be best for you with what you're doing with whatever it is that your goal is. 04:01.750 --> 04:05.830 Logic analyzer is a visual representation of the data that it processes as well. 04:05.830 --> 04:23.270 So, when I say that it's a visual representation, it's making the calculation and representing what it thinks is what that data looks like, rather than oscilloscope, which is the actual analog signals that's traversing over the voltages of the chip. 04:24.630 --> 04:32.910 These logic analyzers, we'll talk about price later, but like I was mentioning earlier, USB logic analyzers tend to be very cheap. 04:34.250 --> 04:37.170 Okay, a logic analyzer is not an oscilloscope. 04:37.170 --> 04:42.230 So, all these snippets I stole off the Salie website. 04:42.530 --> 04:48.030 The oscilloscope, it measures... the idea in general is that it's measuring constantly. 04:48.030 --> 04:48.910 It's not like... 04:49.630 --> 04:50.410 This 04:54.660 --> 05:01.800 is quite possibly the most boring slide I've had, so it sucks to be y'all. 05:02.780 --> 05:04.780 I'm just kidding. 05:05.240 --> 05:07.960 They're all equally bad. 05:08.280 --> 05:12.440 So anyways, oscilloscope is not a logic analyzer. 05:12.440 --> 05:19.080 Oscilloscope measures analog, whereas logic analyzers measure digital. 05:19.080 --> 05:25.880 I'm actually glad we went back to this one, because some logic analyzers can actually measure analog. 05:26.440 --> 05:28.120 We'll talk about that a little bit later. 05:28.120 --> 05:29.080 I'll kind of show you. 05:29.080 --> 05:45.220 We'll go over a few different logic analyzers, just to kind of see what... but I probably shouldn't just use like the blanket statement and say that logic analyzers cannot measure analog, because that's not a true statement. 05:45.220 --> 05:48.860 They can to a certain extent, but many of them do not. 05:51.630 --> 05:58.210 So as I was mentioning, they are not used for any type of like UART connection. 05:58.210 --> 06:15.830 So you get data being transmitted over UART, but you can't actually set up like, okay, hey, I want to toss in like, you know, let's connect to this using 8-bit, you know, parity, and then we'll of course do like a quadrate of like 11200 and interact with this device. 06:16.090 --> 06:18.370 That's not what you can do with a logic analyzer. 06:18.370 --> 06:21.330 Logic analyzer is more of just a passive listener. 06:21.330 --> 06:24.850 It's something like Wireshark or hardware. 06:25.370 --> 06:28.830 It's not an oscilloscope. 06:28.830 --> 06:38.630 So from an oscilloscope perspective, basically you're looking at voltages over a period of time. 06:38.630 --> 06:39.930 So it uses memory. 06:39.930 --> 06:41.550 So it's using, say, for 08:04.230 --> 08:07.470 OCD. 08:07.710 --> 08:12.310 So we have the Sabley, right? 08:12.310 --> 08:17.690 So the Sabley is, I don't want to say de facto, but it kind of is de facto. 08:19.730 --> 08:32.350 It's also some software and a pretty large online community and support that is available that goes hand in hand with this particular logic analyzer. 08:32.350 --> 08:39.510 There are other logic analyzers, of course, that exist and we'll look a little bit more about the prices. 08:39.570 --> 08:40.890 What did we pay for these? 08:40.890 --> 08:43.910 Between like 5 and 15, 20 bucks. 08:43.910 --> 08:48.430 I think it was like 12 for one and 24 for the other one. 08:48.430 --> 09:01.110 Very cheap, you know, like go sell like a garbage bag full of, you know, aluminum cans and then buy this stuff because you can just, it's just outrageously cheap. 09:01.110 --> 09:09.390 So anyways, we'll do some pros and cons between all these guys, but we're going to kind of just, let's just go ahead and hook something up with it. 09:10.630 --> 09:14.710 What we're actually going to look at with it is going to be Raspberry Pi. 09:14.790 --> 09:24.170 What we're going to look at also with it is Raspberry Pi has a UART interface. 09:24.170 --> 09:26.430 I'm sure as many of you guys know. 09:28.770 --> 09:34.750 And I'm going to try to just take the examples just to kind of give you an idea. 09:35.170 --> 09:42.250 But here is the Raspberry Pi like sort of coming out and hopefully everyone can see that. 09:42.250 --> 09:44.130 Daryl, is this showing up on the screen? 09:44.130 --> 09:44.850 Yes. 09:45.550 --> 09:46.770 Okay, perfect. 09:46.830 --> 09:52.990 So whenever you're looking at it, it's basically how it's laid out. 09:52.990 --> 09:59.050 So just be aware that it looks good. 09:59.050 --> 09:59.770 Cool. 09:59.770 --> 10:07.230 So as you can see on the screen, we have ground, several grounds. 10:07.230 --> 10:13.690 And then right here on these two, we have Rx and Tx. 10:13.690 --> 10:19.650 So Rx and Tx are the two interfaces that we're going to target for UART. 10:20.030 --> 10:24.450 So if we count down one, two, three, four, it is Rx or Tx rather. 10:24.450 --> 10:28.090 And then one, two, three, four, five, it's Rx. 10:28.570 --> 10:31.870 And then we'll have a ground down here in the bottom left-hand corner. 10:31.870 --> 10:34.070 So let's get this hooked up. 10:34.350 --> 10:42.150 I'm going to start this off with you guys with the, I guess just the matter in this particular case. 10:42.150 --> 10:51.770 But whenever you look at the actual like logic analyzer, you can see that there's like a mapping of the pins on it as well. 10:51.770 --> 10:55.710 So it's basically like channel zero through seven. 10:55.710 --> 10:57.510 And then there's two grounds. 10:57.510 --> 11:05.230 And what that's based off of is the actual like layout of the pins on the thing, and then you have the actual pins. 11:05.230 --> 11:15.410 So what we'll do is we'll take these three jumper wires here, and we're going to actually get rid of the old Raspberry Pi pinout graph. 11:15.410 --> 11:17.470 We're actually just going to move it over that way. 11:17.670 --> 11:22.750 And then we're going to just kind of hook these suckers up. 11:22.750 --> 11:23.610 You know what I mean? 11:23.610 --> 11:24.590 So we'll take ground. 11:24.590 --> 11:25.570 We're just going to use black. 11:25.570 --> 11:29.190 We'll try to be correct with our color usage here. 11:29.190 --> 11:30.530 Black for ground. 11:30.530 --> 11:33.530 So we'll hook that up to one of the two grounds there. 11:33.710 --> 11:36.790 And we'll hook up white to channel zero. 11:39.820 --> 11:44.100 And we'll hook up this like silver color to channel one. 11:44.560 --> 11:49.160 And if you guys think this is fun watching me do this, just wait until we get to the SPI. 11:49.780 --> 11:51.800 So that's exciting. 11:51.800 --> 11:53.020 I'm looking forward to it. 11:53.160 --> 11:58.980 And then as we saw earlier with the ground, this is the bottom left hand corner pointer here. 11:59.100 --> 12:02.820 Remember we hooked up white to channel zero. 12:02.820 --> 12:10.460 We're going to hook white up to channel... it's the fourth pin, so we'll use the TX here. 12:10.460 --> 12:14.320 And we'll hook up this little silver to RX. 12:14.900 --> 12:16.140 And that's it. 12:16.560 --> 12:21.140 So that is pretty much how these hook up. 12:21.140 --> 12:30.940 And we'll look at several other devices, but I just wanted to give everyone an idea so we're not kind of, you know, functioning in the dark here. 12:30.940 --> 12:36.240 So let's put a pin in this and let's circle back to some of the slides here. 12:36.240 --> 12:39.740 So we now know what that looks like. 12:39.740 --> 12:42.280 Now I've done a lot of talking here. 12:42.380 --> 12:45.860 I think we have a couple questions here. 12:45.980 --> 12:47.140 Let me look. 12:47.160 --> 12:48.640 There was one question . 12:48.640 --> 12:51.520 You may have already covered it, but I want to make sure it's asked. 12:51.520 --> 12:52.780 It's in the channel. 12:52.780 --> 13:01.960 Are there any equipment models that you can do experience to come across any models of devices like that? 13:02.040 --> 13:08.160 Yeah, so some do have the capability of doing both analog and digital. 13:08.280 --> 13:12.040 Most of the cheaper ones are only digital. 13:12.500 --> 13:18.100 Now the ones that support analog and digital are typically a little bit more expensive. 13:18.460 --> 13:21.840 And a great example of that is the Salee. 13:21.840 --> 13:24.900 It supports both and a channel. 13:25.800 --> 13:28.660 But yeah, so some models do support it. 13:28.660 --> 13:31.260 Typically you'll be paying a little bit more money for it. 13:31.260 --> 13:44.980 So I would definitely ask yourself, is analog something I truly need for the type of debugging, the type of troubleshooting, the type of development, or the type of hacking that I'll be doing. 13:44.980 --> 13:48.000 One other question here. 13:48.100 --> 13:58.340 So where can somebody buy the cheaper logic analyzers that you're demoing here? 13:58.340 --> 14:07.920 And would they work for newer to IoT versus having a larger investment? 14:07.920 --> 14:10.500 That is a very well-timed question. 14:12.260 --> 14:21.860 This is a couple examples of where you can get some of these logic analyzers. 14:21.900 --> 14:26.920 On the left side of the screen, I pulled this directly from the Salee website. 14:26.920 --> 14:31.160 Again, these are the nicer models that support both analog and digital. 14:31.200 --> 14:39.720 I'll also show everyone here on the call what it looks like and what it means to actually have a nicer one versus not so nice one. 14:39.720 --> 14:47.060 So are you going to be spending, in this case, an example to have on screen, $13 to $24? 14:47.160 --> 14:49.060 Or you can have a peek at that. 14:49.060 --> 14:54.640 But on the left side of the screen here, the pricing is from Salee. 14:54.640 --> 14:56.020 You can buy them on Amazon. 14:56.020 --> 14:57.780 You can buy them on eBay. 14:57.780 --> 15:00.520 You can buy them on Spark. 15:01.300 --> 15:11.300 The prices on the right, the two cheap ones below and above the dude whose wallet is on fire, were off Amazon. 15:11.300 --> 15:15.780 I had this screenshot of that maybe like three or four days ago. 15:16.100 --> 15:29.820 As far as the features between differences in between the cheaper one versus the more expensive one, we'll take a peek at that in a couple of demos, a few slides down the road. 15:29.820 --> 15:31.280 No more questions. 15:31.280 --> 15:32.920 I guess you can move on. 15:33.340 --> 15:34.500 Sweet. 15:36.740 --> 15:41.920 So moving on here, as I talked about earlier, the signaling. 15:43.060 --> 15:56.600 Analog signaling is just continuous changing values, whereas digital is defined values based on a range of voltage that we're going to see with these USB logic analyzers. 15:57.240 --> 16:00.480 Bear in mind, it's not 100% accurate. 16:00.480 --> 16:12.480 So if you're like needing to be like pinpoint accuracy on voltages, the logic analyzer is going to be... I also want to share with you what those digital versus analog signals look like. 16:12.560 --> 16:20.860 So whenever we dive into the software here pretty soon, we can kind of see what those waveforms are and how they differ from one another. 16:21.240 --> 16:31.480 The voltage above a certain threshold is... and digital signaling with logic analyzers is binary. 16:31.640 --> 16:35.500 If it's going low, then that's considered a zero. 16:35.500 --> 16:37.540 If it's going high, it's considered a one. 16:37.540 --> 16:47.240 And that determination is based upon that particular threshold transistor the technology is basically using. 16:47.460 --> 16:53.960 Logic analyzer will sample the voltages at various intervals and reconstruct what that data looks like. 16:53.960 --> 17:00.380 So I just want to kind of just shine a little bit of context as to analog versus digital. 17:01.400 --> 17:08.580 So there's two main types that I've used in my experience. 17:08.580 --> 17:10.740 Your mileage may vary. 17:10.740 --> 17:17.380 I know there's a lot of different other software, I guess, vendors, makers out there. 17:17.740 --> 17:27.820 I'm Mac-based, so I'm going to handcuff the Mac, fortunately, because it would also be capable of running on Linux, too. 17:27.820 --> 17:32.560 So the top left corner is Sigrock's PulseView. 17:32.560 --> 17:40.740 So Sigrock is a manufacturer of logic analyzer as well as software, and PulseView is the actual software name. 17:40.740 --> 17:51.260 Now, what we're going to talk about actually has Sigrock client, and I'll be honest with you, I love the fact that they're open source. 17:51.260 --> 17:52.480 I love the fact that it's free. 17:52.480 --> 18:00.380 Actually, both the software here is free, but the PulseView, the graphical interface, is just not the greatest. 18:01.120 --> 18:04.480 It's more robust, I guess you could say. 18:04.480 --> 18:09.820 So unfortunately, I'm not going to go over it today because it would probably take a little bit too much time. 18:09.920 --> 18:17.300 But to kind of dive in here, what I wanted to do was just kind of compare these two software sets with you. 18:17.440 --> 18:21.220 So with that being said, let's just dive right in. 18:21.260 --> 18:23.460 Let's just take a look here. 18:23.460 --> 18:24.300 Screw it. 18:26.940 --> 18:37.340 So what I want to do first is I want to continue with where we left off with this particular logic analyzer and the more expensive stuff. 18:37.340 --> 18:38.560 How about that? 18:38.980 --> 18:40.780 We've got a couple of wires here. 18:40.780 --> 18:46.220 We've got a power for the Raspberry Pi sitting right here. 18:46.220 --> 18:48.000 I have the USB power stripped here. 18:48.000 --> 18:51.360 I'm just going to kind of power off the Pi real fast. 18:51.500 --> 18:57.240 And we'll go ahead and grab the other cable for our logic analyzer. 18:57.740 --> 18:59.220 That's right there. 18:59.500 --> 19:01.020 Let's go ahead and plug this up. 19:02.000 --> 19:12.160 Now, as we're doing this, again, this is going to power for the logic analyzer. 19:12.500 --> 19:21.890 And what we're going to do next is let me... there we go. 19:21.890 --> 19:22.750 Okay, cool. 19:22.870 --> 19:23.770 We'll do that here. 19:23.770 --> 19:28.450 So I'm going to bring up the software on the other side of the screen here for us. 19:29.570 --> 19:31.850 And the first one we're going to look at is PulseView. 19:31.850 --> 19:35.910 So I just want to kind of give you a quick little demo of what some of this looks like. 19:35.910 --> 19:42.790 So as you can see here, shift that that way, we have everything hooked up on this side of the house. 19:43.270 --> 19:44.990 Remember, we have UART. 19:45.010 --> 19:49.550 So RXTX hooked up to this based off the pinout that we found online. 19:49.550 --> 19:51.430 And, of course, ground's hooked up as well. 19:51.430 --> 19:52.750 We followed the mappings here. 19:52.750 --> 19:55.690 So we're going to kind of take a white box approach with this. 19:55.690 --> 19:57.550 And let's just assume that we know everything already. 19:57.550 --> 20:02.630 So let's assume that we found the data sheet for the device that we're wanting to kind of probe and take a look at. 20:03.590 --> 20:07.730 What we want to do next is from the software here, I'll give you a quick little run through. 20:07.730 --> 20:09.950 So we'll go back to the full screen. 20:10.290 --> 20:12.690 This is the Sigrot PulseView. 20:12.690 --> 20:17.170 So with the PulseView, you can select the device you have plugged into your computer. 20:17.170 --> 20:21.650 And this particular one, the driver that we need is the FX2LAFW. 20:21.650 --> 20:26.710 So we'll select that from the dropdown, and we'll click scan for devices using the driver above. 20:26.710 --> 20:27.970 And then we'll click OK. 20:27.970 --> 20:29.770 And that basically has it hooked up. 20:29.770 --> 20:33.490 So what happens here is an airplane flying above here. 20:33.490 --> 20:35.870 So you'll hear some background to that. 20:35.870 --> 20:40.930 What you see here is that there's eight channels starting at zero and ending at seven. 20:40.990 --> 20:46.750 So that's representing the eight channels that the logic analyzer has. 20:46.750 --> 20:50.350 Remember, it's zero through seven on the logic analyzer. 20:52.230 --> 20:56.530 What we can do is we can lower that because we're only using RX and TX. 20:56.530 --> 20:57.390 Ground is assumed. 20:57.390 --> 20:58.450 You're always going to use ground. 20:58.450 --> 21:00.770 So we want to select D0 and D1. 21:00.770 --> 21:03.210 So we're going to remove some of these other guys here. 21:03.590 --> 21:08.470 Going back to the software here, you can change the amount of sampling that it does. 21:08.470 --> 21:13.610 In this particular case, I have it set at one millisamples per second. 21:14.430 --> 21:17.350 So that's the setting for that. 21:17.350 --> 21:20.790 And we'll talk about that a little bit more whenever we get into salient software. 21:20.790 --> 21:25.630 But the cheaper logic analyzers can sample at a slower rate than the Salie. 21:25.630 --> 21:27.490 So there's a little bit of a limitation here. 21:27.490 --> 21:28.630 And here's the speeds as well. 21:28.630 --> 21:30.430 So we're going to stick 20 kilohertz. 21:31.370 --> 21:33.750 So let's just plug this sucker in. 21:33.750 --> 21:34.630 Let's just see what happens. 21:34.630 --> 21:37.310 So I'm going to hit the power button . 21:37.690 --> 21:40.330 We're going to see the lights come on on the Raspberry Pi right here. 21:40.610 --> 21:43.950 And then I'm going hit the run button. 21:45.430 --> 21:46.610 Whoopsie-daisy. 21:49.030 --> 21:51.130 Try that again. 21:51.870 --> 21:59.530 And then we can click this button here, which makes us keep up with the timing of the actual logic analysis that's taking place. 22:00.330 --> 22:05.490 So we'll see some spikes and voltages as things happen. 22:05.490 --> 22:06.810 Again, this is over UART. 22:06.810 --> 22:12.630 So think of the TTY connection over some type of serial or SSH interface. 22:12.830 --> 22:14.690 Imagine just a boot up of a Raspberry Pi. 22:14.690 --> 22:15.910 So it's just going to do its crap. 22:15.910 --> 22:18.730 And then at the end, it's going to be like, okay, Raspberry login type stuff. 22:19.270 --> 22:25.530 So we'll go ahead and stop it now that we're getting kind of closer towards the end here. 22:27.910 --> 22:29.250 Yeah, that's the last one. 22:29.250 --> 22:33.790 So if we take a look here, this is basically the capture. 22:33.790 --> 22:36.870 I captured for, as you can see, 35 seconds. 22:37.170 --> 22:41.070 So the thing about this, let's go ahead and go back into full screen. 22:41.070 --> 22:45.850 We don't really need the camera so much right now, but we'll go ahead and expand everything back out. 22:45.850 --> 22:52.230 And let's just take a look over here because this is the, let's just pretend again, let's just assume that we know the answer to this. 22:52.230 --> 22:55.690 This is basically where it's just prompting for a login to the UART interface. 22:56.170 --> 23:00.450 So we'll go in here and we'll kind of scroll, scroll, scroll. 23:01.090 --> 23:14.590 And even if you were unsure of which one was RX or TX, you could pretty well assume if you at least knew that these two connections were UART, that this one's going to be TX and this one's going to be RX. 23:14.590 --> 23:15.070 How is that? 23:15.070 --> 23:19.290 Because TX is sending us data and RX is literally a flat line. 23:19.330 --> 23:22.790 So a couple of things there that can kind of help you out. 23:23.270 --> 23:28.510 And one other thing too, is that this particular software does have protocol debuggers. 23:28.510 --> 23:35.850 So let's take a look at that and let's go ahead and remember we set TX to D0 and we set RX to D1. 23:36.030 --> 23:39.590 So another thing too, we already have 11.5.200. 23:39.590 --> 23:42.010 We're going to keep everything else basically default here. 23:42.550 --> 23:48.250 The least significant bit first is correct. 23:48.250 --> 23:54.310 We'll switch that to ASCII and it will come in here and then it should do some decoding for us. 23:56.070 --> 23:57.570 Usually it takes a second. 24:01.000 --> 24:02.660 Let's see if she works here. 24:09.410 --> 24:21.470 Yeah, so again, just a high-level example of the protocol decoding available for this particular PulseView software and some of the stuff you can do. 24:21.470 --> 24:26.050 So it recognizes stop bits, it recognizes frame errors, break conditions, things like that. 24:26.050 --> 24:30.790 Now what I want to also do real quick, we'll just exit completely out of here. 24:30.810 --> 24:32.450 We don't want to save. 24:32.450 --> 24:34.850 Another thing is it's pretty nifty. 24:34.870 --> 24:36.810 PulseView has SIGROC. 24:36.810 --> 24:42.870 They have their own proprietary format where you can save your data and then import it into Saly or other. 24:42.870 --> 24:45.270 You can manipulate it also from the command line. 24:45.670 --> 24:50.130 We want to now switch over to the Logic software from Saly. 24:50.130 --> 24:54.250 So Saly has their own set of software. 24:54.250 --> 24:56.710 They actually have two sets of software that we're going to review. 24:57.030 --> 25:01.370 And what I want to do is... let 25:05.140 --> 25:06.580 me open it up here. 25:06.660 --> 25:17.940 And what I want to do is show you guys both sets of software to kind of show you the epicness of what it has the capability of doing. 25:17.940 --> 25:27.180 So on the left-hand side here, we have the Saly Logic 1.0, 1.2.18 software, I guess, technically. 25:27.540 --> 25:31.180 And in this case, it's very similar. 25:31.180 --> 25:33.220 So remember, here's all the eight channels. 25:33.220 --> 25:35.920 And that's pretty much the situation that we're looking at. 25:35.920 --> 25:38.340 Mind you, remember, this is all digital signaling. 25:38.340 --> 25:45.580 So there's no actual analog signals going on in this particular case. 25:45.580 --> 25:51.040 So very similar to the other software, you can do the same protocol analysis. 25:51.040 --> 25:54.080 So we have, for instance, AsyncSerial, which is UART. 25:54.540 --> 25:59.020 UART is an AsyncSerial communication protocol with I2C and SPI. 25:59.020 --> 26:03.540 So there's a whole list of different protocols supported also by the Saly software. 26:03.880 --> 26:07.080 Your decoded protocols, it can actually decode also. 26:07.080 --> 26:12.540 As we saw earlier with the other software, it decoded it, but it's kind of limited on the amount of information that it can present to you. 26:12.540 --> 26:17.600 The command line is where the SigRoc software is very strong compared to Saly. 26:17.800 --> 26:19.300 There's also annotations. 26:19.300 --> 26:22.680 So with the annotations, you can kind of capture during periods of time. 26:22.680 --> 26:26.440 But the thing I want to show you guys the most here is with logic analyzers. 26:26.440 --> 26:31.360 It's not specific to Saly, but let's just go ahead and power this guy off. 26:31.360 --> 26:35.760 So as you can see on the right-hand side of the screen, the light's now off on the Raspberry Pi. 26:36.040 --> 26:37.840 Let's go ahead and power it back on. 26:38.200 --> 26:40.620 But also, we're capturing for 30 seconds. 26:40.620 --> 26:44.180 Let's just stick to four mega samples per second. 26:44.300 --> 26:47.400 And then we'll go ahead and power the sucker back on while it starts. 26:47.400 --> 26:57.740 So as you can see right here, the only sad panda part about the Saly software is that it doesn't like live view show like the results of what's going on with everything. 26:57.740 --> 27:02.440 So you're kind of like, you're kind of stuck with like, just this kind of boring screen here. 27:02.440 --> 27:07.200 So you can't really see the sort of interactive like, oh, here's like, you know, the waveforms and whatnot. 27:07.600 --> 27:10.800 But whatever, it's all good. 27:11.080 --> 27:17.540 We'll go over some, the 2.0 version of it where it does offer some sexy or gooey stuff. 27:17.840 --> 27:20.560 So here's the output of our capture. 27:20.560 --> 27:31.480 So let's scroll out, and we can see very similar to the pulse view, take this full screen, that there was actually some data captured here, very similar to what we saw earlier. 27:31.500 --> 27:33.400 Now, let's scroll in. 27:33.400 --> 27:38.460 And as we talked about earlier, remember, channel zero is the TX line of the Raspberry Pi. 27:38.460 --> 27:40.060 So of course, we're going to see data. 27:40.260 --> 27:48.900 Now, a couple things is that let's say we want to add a protocol debugger, just like what we did with the pulse view. 27:48.900 --> 27:50.180 Let's go ahead and add this. 27:50.180 --> 27:53.480 We'll say channel zero, the serial, that's the TX channel. 27:53.480 --> 27:55.240 And let's click Autobot, right? 27:55.240 --> 27:59.400 So let's pretend for a second that we do not even know the baud rate of this device. 27:59.400 --> 28:03.780 Let's pretend that we actually think that it's UR, but we actually don't know if it's TX or RX. 28:03.860 --> 28:08.540 We've already actually kind of figured out that it's TX, because remember, channel zero, we're seeing data. 28:08.540 --> 28:10.620 It's transmitting data to us. 28:10.620 --> 28:13.760 RX is a flat line because we're not sending any data back. 28:14.100 --> 28:16.000 So we do not know the baud rate. 28:16.000 --> 28:26.880 Let's just pretend like we want to open up like a screen session or some type of like a serial session with the device over TTY serial, but we do not know the actual bit rate of that serial connection. 28:27.160 --> 28:30.200 So we'll just leave that default, default 9600. 28:30.200 --> 28:32.160 We'll click this little checkbox here, Autobot. 28:32.160 --> 28:34.780 We'll keep everything else default as well. 28:34.780 --> 28:38.760 This is all pretty standard for a normal serial interface on an embedded system. 28:38.760 --> 28:39.420 We'll click save. 28:39.420 --> 28:42.220 We now see the async serial is here in this corner. 28:43.180 --> 28:49.020 And kind of a cool little thing you can do also to help you figure out that baud rate. 28:49.300 --> 28:51.240 This is pretty neat. 28:51.780 --> 28:55.500 Now earlier, I'm going to bring this up for you guys real quick. 28:55.800 --> 29:03.920 In the actual slide presentation, I had this little table here that showed the actual microseconds as well as the baud rate in this table. 29:03.940 --> 29:07.600 So if it's 833 microseconds, it's 1200. 29:07.820 --> 29:09.540 The bit rate is 1200. 29:09.540 --> 29:12.200 If it's 52 microseconds, it's 1,900. 29:12.560 --> 29:15.860 If it's 8 microseconds, it's 1,500. 29:15.940 --> 29:25.380 Now if we go back here, what we can actually do is we see the actual, let's take a look here, the waveform. 29:25.380 --> 29:33.660 So from where the actual rising edge to a falling edge of one complete uniform wave. 29:33.700 --> 29:34.280 Here we go. 29:34.280 --> 29:35.300 It's a good one. 29:36.640 --> 29:40.500 It's super tiny, but I hope you guys can see that. 29:40.500 --> 29:43.020 8.5 microseconds. 29:43.760 --> 29:50.020 It's pretty nifty because that basically tells us what the baud rate is without us even having to measure the baud rate. 29:50.020 --> 29:54.020 So if we go back to our table here, remember 8.5? 29:54.240 --> 29:56.960 8.5 is what it measured as the baud rate. 29:56.980 --> 30:02.360 We look here and 8 microseconds is 11,500. 30:02.480 --> 30:06.340 Remember, digital is never going to be 100% accurate. 30:06.340 --> 30:08.380 It's going to do its best at that representation. 30:08.380 --> 30:09.940 Also, there's latency in the cable. 30:09.940 --> 30:11.940 There's latency in USB 2.0. 30:11.940 --> 30:15.800 In this case, this is one of the cheaper logic analyzers using USB 2.0. 30:15.800 --> 30:17.940 So either way, it's not going to be 100% accurate. 30:17.940 --> 30:24.240 It's going to be like slightly off, but it's safe to assume that it's closest to that number than it is to any of these other numbers. 30:24.240 --> 30:33.000 That being said, let's just do something a little wacky here and just enjoy the luxurious features of the Saley software. 30:33.200 --> 30:35.900 I just lowered the sample time to five seconds. 30:36.140 --> 30:39.440 Remember, if we go back here to the settings, we have it set. 30:39.440 --> 30:41.560 Let's just see it automatically detect. 30:41.560 --> 30:44.220 It's already changed, but let's just put it back to 9600. 30:44.260 --> 30:46.120 Imagine this is like a fresh scan. 30:46.220 --> 30:54.040 We'll power the device off and then we'll power the sucker back on and then we'll go ahead and start sampling. 30:54.240 --> 31:01.240 So based off of the sample rate, the Saley software is smart enough to realize what that particular baud rate is. 31:01.240 --> 31:03.900 In this case, it already converted to us. 31:03.920 --> 31:07.320 Well, that is not the actual bit rate, even though that would probably work. 31:07.560 --> 31:09.060 It's 11,500. 31:09.600 --> 31:12.780 It's close enough for what we're trying to do here. 31:13.080 --> 31:26.540 So let's take it a step further and then let's switch this back over to 30 seconds and let's power it off and then let's power it back on again. 31:26.660 --> 31:30.180 Now that we know our baud rate, we'll just see what it can do. 31:32.500 --> 31:37.400 Let's make it full screen because you all know what a Raspberry Pi looks like. 31:37.400 --> 31:38.760 I can't make it full screen. 31:38.920 --> 31:41.340 I'm going to sit here and just stare at this thing and boot up. 31:54.090 --> 31:56.810 So while we're having a little break, let me ask you one of the questions. 31:56.810 --> 31:58.290 So I have a question here. 32:00.390 --> 32:07.150 Is the Saley or the PulseView Logic Analyzer software free and open source? 32:07.310 --> 32:10.690 How would you go about downloading or purchasing those? 32:10.970 --> 32:14.910 The Saley software, it is actually free. 32:14.930 --> 32:17.110 It is not open source, however. 32:17.190 --> 32:18.450 It's free. 32:18.450 --> 32:20.850 You can download it straight from their website. 32:21.590 --> 32:26.310 You can't compile it because, again, it's not open source, but it's 100% free. 32:26.310 --> 32:28.070 You don't have to spend a dime for it. 32:28.070 --> 32:33.910 However, the Sigrock, so the PulseView software, I believe the GUI is open source. 32:33.910 --> 32:39.630 I know the Sigrock CLI is open source because I just compiled it actually like two hours ago. 32:40.550 --> 32:44.710 But yeah, so the Saley Logic, free, not open source. 32:44.710 --> 32:49.090 Sigrock PulseView, 100% free, maybe open source. 32:49.090 --> 32:52.870 Sigrock CLI, free and open source. 32:54.530 --> 33:07.190 And taking a peek here real quick, we can see in the decoded protocol section here that we actually have the output of what we saw over the UART interface. 33:07.190 --> 33:13.330 So under voltage, it's kind of printed funky here, but that's the actual output of what it's seeing. 33:13.330 --> 33:19.490 We had it set to the ASCII, so the output is being displayed in ASCII format. 33:19.490 --> 33:20.550 So kind of neat. 33:20.550 --> 33:22.190 You can see all that kind of stuff. 33:22.590 --> 33:28.190 Scrolling even further down here, we have detected, blah, blah, blah, but go to the very bottom. 33:28.330 --> 33:34.170 Maybe we missed it, but it would even capture... Yeah, there we go, like Raspberry Pi login. 33:34.450 --> 33:41.570 And that's basically on the UART connection waiting for the typical Pi password, Raspberry, because no one ever changes their default on that. 33:41.670 --> 33:47.430 So anyways, as for that particular demonstration, that's pretty much it. 33:47.430 --> 33:57.330 And kind of continuing on with that particular question that was asked regarding the free and open source nature, are there any other questions, I guess, up until now? 33:57.990 --> 34:00.990 Yeah, I have just one more for you. 34:00.990 --> 34:07.110 What is the max number of logic analyzer channels needed for most IoT situations? 34:07.850 --> 34:09.490 That's a good question. 34:10.110 --> 34:21.150 And I'll be perfectly honest, I rarely run into an instance, I do this, you know, I'm not like hacking on IoT, like full time with my day job. 34:21.150 --> 34:22.150 Again, I'm a pin tester. 34:22.150 --> 34:29.610 But I do it a lot, just kind of as a hobbyist, as well as just kind of as a side type thing. 34:29.610 --> 34:34.830 There's very rare instances that I've run into a situation where I needed more than eight channels. 34:35.070 --> 34:45.350 So in cases that I've ever used these logic analyzers, it's mostly been on three different protocols, UART, SPI, and I2C. 34:45.350 --> 34:53.630 And none of those three, I guess, protocols really require more than eight channels. 34:53.630 --> 34:55.710 Now, I don't want to say it wouldn't be necessary. 34:55.710 --> 35:04.390 But I would say that it's kind of a low likelihood that if you're trying to get started as like a hobbyist, that you'll actually need more than eight channels. 35:04.390 --> 35:18.910 And all of the devices that we're working with here, support eight channels, you can buy them up to like, shoot, I don't even know, I know, I know Morgan on our team has the big one, I think it's six, is it 16 channels? 35:18.910 --> 35:20.050 Is that their biggest? 35:20.050 --> 35:22.390 Or is it the 16? 35:22.750 --> 35:26.110 Yeah, the big, the big boy. 35:26.110 --> 35:28.950 And I don't know that I would like have a need. 35:28.950 --> 35:33.310 However, it would be super handy to have in case I ever did have that need. 35:33.310 --> 35:39.030 But I would probably err on the side of saying that it's likely that eight channels would be good enough for you. 35:42.280 --> 35:44.760 Okay, yeah, no more questions yet. 35:46.080 --> 35:51.380 So speaking of which, UART, SPI, and I2C, how do they function? 35:51.380 --> 35:54.580 So as we saw earlier, UART is an asynchronous connection. 35:54.580 --> 36:03.080 So what that actually means is that there's no clock on either side of the connection, controlling the actual rate that data is being transferred. 36:03.080 --> 36:08.680 It's an agreed upon number where you're supposed to actually know. 36:08.680 --> 36:11.520 So the bit rate and the baud rate is important for that. 36:11.560 --> 36:17.680 How it determines the actual connection speeds also is it uses parity bits. 36:17.680 --> 36:28.320 So there's basically another layer of overhead that's being sent over the line of communication so that the negotiation and the actual transfer of data can take place. 36:28.320 --> 36:35.480 With SPI and I2C, they're actually synchronous, meaning there is a clock that's determining the communication time. 36:35.620 --> 36:40.500 So for instance, SPI operates on a slave master model. 36:40.500 --> 36:44.820 So the master is the actual determination of the clock speed. 36:44.820 --> 36:49.400 That's the one with the actual crystal that's going to determine how quickly data is going to be sent. 36:49.400 --> 36:53.900 The slave is going to basically accept that at that particular rate. 36:53.920 --> 36:57.040 And that number is negotiated throughout the process. 36:57.040 --> 37:00.960 I2C functions in a very similar way. 37:02.020 --> 37:06.960 Moving on to the actual interfaces associated with these three different protocols. 37:07.260 --> 37:09.120 Again, UART has two channels. 37:09.120 --> 37:13.340 Again, the channels column here is assuming that ground's hooked up. 37:13.340 --> 37:15.080 So disregard ground right now. 37:15.080 --> 37:20.680 This is only the data lines and the information communication lines that's taken place that we're really concerned with here. 37:20.680 --> 37:23.280 That's RX and TX for UART. 37:23.740 --> 37:25.920 SPI has four channels. 37:25.920 --> 37:28.040 That's going to be MISO, MOSI, CS, and CLOCK. 37:28.040 --> 37:29.800 Chip select is enable. 37:29.940 --> 37:34.520 And CLOCK is, again, the determination of how quickly that data is going to be sent and received. 37:34.940 --> 37:37.800 MISO and MOSI are a little bit interchangeable. 37:37.800 --> 37:40.080 It can just depend on the situation that's going on. 37:40.080 --> 37:43.220 So with SPI specifically, remember there's master-slave. 37:43.440 --> 37:47.840 The master will send out data to the slave over MOSI. 37:47.840 --> 37:49.960 That stands for master out, slave in. 37:49.960 --> 37:55.340 The master will receive data from the slave over master in, slave out. 37:55.800 --> 37:58.480 The master will determine the clock rate. 37:58.520 --> 38:00.320 And the chip select is the enable. 38:00.320 --> 38:06.640 So the chip select is only applicable whenever there's multiple slaves communicating with a master. 38:07.440 --> 38:09.220 And then I2C is pretty simple. 38:09.220 --> 38:11.180 It's SDA and SCL. 38:11.240 --> 38:17.040 SCL is the communication for the determination of how quickly data is to be sent and received. 38:17.040 --> 38:18.840 And SDA is the actual data line. 38:19.100 --> 38:31.180 So moving on from that, I guess, are there any questions maybe with regard to SPI, those two protocols, with how they apply maybe to logic analyzers? 38:38.180 --> 38:41.480 Maybe not, because I know we just kind of just answered some questions. 38:41.480 --> 38:41.780 I'm sorry. 38:41.780 --> 38:42.840 I was kind of muted. 38:44.160 --> 38:55.360 Currently, we don't have any questions specifically on this, but I do want to encourage people that are in the actual channel as attendees, please think of questions and post them into the Q&A session. 38:58.080 --> 39:00.060 Okay, you can move on, Jonathan. 39:00.440 --> 39:01.180 Cool. 39:01.180 --> 39:06.540 Yeah, I think we had a disabled chat because we had some flattering comments earlier. 39:06.540 --> 39:09.340 That was kind of awesome. 39:09.720 --> 39:15.600 I think Sam was mentioning it was one of the first issues we ran into with something exciting here. 39:15.740 --> 39:18.280 But anyways, okay, so let's move on to the first exercise. 39:19.480 --> 39:22.040 Yeah, so let's move on to the first exercise here. 39:23.260 --> 39:25.200 Actually, I'm going to skip the first exercise. 39:25.200 --> 39:27.480 Let's move on to the second one, because we just looked at UI. 39:27.480 --> 39:28.680 Let's look at something fun. 39:29.740 --> 39:31.280 Switch it over to SPI. 39:31.300 --> 39:35.340 Also, I want to show you the sexiness of this new Salie software as well. 39:36.880 --> 39:39.540 And let's bring up the new hotness here. 39:39.760 --> 39:43.640 I had actually never... I didn't know that Salie had released this new software. 39:43.640 --> 39:44.520 I think it was Morgan. 39:44.520 --> 39:47.480 So Morgan's our lab manager here at Salie. 39:47.480 --> 39:50.460 It was either he or Daryl that had pointed this one out. 39:50.460 --> 39:55.900 But Daryl showed me some freaking sweet new features that basically have to do with this new software. 39:55.900 --> 40:02.380 So just to give you the quick rundown here, we still have... I'm sorry for shifting this screen around and stuff. 40:02.380 --> 40:07.900 But remember, we still have the old school... not the old school, the cheaper end logic analyzer hooked up. 40:07.900 --> 40:09.140 We're about to switch over to Salie though. 40:09.140 --> 40:10.620 I want to show you guys some other stuff. 40:11.160 --> 40:14.920 So this is the new Salie Logic 2 software. 40:14.920 --> 40:16.320 So we're now at 2. 40:16.340 --> 40:19.200 And you can change the amount of channels, of course, that are hooked up here. 40:19.200 --> 40:24.700 You can change the different protocol analyzers associated with the connections that you're making. 40:25.000 --> 40:27.160 There's, of course, timing markers you can set. 40:27.160 --> 40:28.480 There's measurements you can take. 40:28.480 --> 40:31.780 And this is the dopest part, is that there's an extension. 40:31.780 --> 40:32.160 It's like... 40:32.160 --> 40:36.160 I don't know if you guys use Burp Suite that much, but this is the extender. 40:36.160 --> 40:40.000 The extender to Burp Suite is what the extensions are to Logic 2. 40:40.000 --> 40:40.580 It's sick. 40:40.580 --> 40:44.040 You can create extensions and just basically allows you to have a lot of plugins and stuff. 40:44.040 --> 40:47.100 So let's go ahead and swap this guy out. 40:47.100 --> 40:50.960 And we're going to look at a completely different device. 40:50.960 --> 40:53.340 So this Raspberry Pi is going bye-bye. 40:53.440 --> 40:54.560 I'm going to put it over there. 40:54.560 --> 40:56.840 Bunch of pile of other crap I got. 40:56.960 --> 40:59.800 And then we're going to switch to the Salie logic analyzer. 40:59.820 --> 41:03.840 And then also we're going to look at this particular device here. 41:03.840 --> 41:10.780 So I don't know if anyone on the call right now was at the Rapid7 IoT builds last year. 41:10.780 --> 41:13.140 If they were, this will probably look super familiar. 41:14.120 --> 41:15.720 So a couple of things. 41:15.720 --> 41:19.540 As you can see, we have markings for SPI connection. 41:19.840 --> 41:24.120 There you see MISO, MOSI, CS, enable, clock, that kind of stuff. 41:24.120 --> 41:25.900 There's also some other stuff here. 41:25.900 --> 41:26.620 Disregard this. 41:26.620 --> 41:28.440 We're actually only going to use ground. 41:28.480 --> 41:31.060 This is for, I believe, an ICSP connection. 41:31.060 --> 41:33.620 But we're not going to be doing anything with YATML today. 41:33.620 --> 41:39.520 We're going to stick directly to the chip, the flash memory chip that we have on here. 41:39.520 --> 41:46.800 Now, it's going to be an open book situation, but we're also going to pretend like we don't know the pin out of this, just to kind of make it interesting. 41:47.420 --> 41:51.700 We do know it, but I'll show you guys how you can probably make that determination. 41:51.700 --> 42:04.240 Because it's so common that, you know, maybe you'll have like a header pins that are soldered onto the actual VIAs, or maybe they're only VIAs, and you have to solder the header pins yourself, and you have no idea what they are. 42:04.300 --> 42:06.940 And maybe, for instance, you have a WSAN 8. 42:07.140 --> 42:10.380 So, that means WSAN 8, it doesn't have legs. 42:10.380 --> 42:20.680 So, the flash memory chip, it's like all the solder points on the bottom, or if it's BGA, those solder points on the bottom, so you can take a multimeter to figure out what the actual pin out is, even if you found the data sheet. 42:21.120 --> 42:22.720 So, kind of nifty here. 42:23.880 --> 42:25.520 I'll show what that kind of stuff looks like. 42:25.520 --> 42:27.680 So, with that being said, let's just flip this sucker up. 42:27.680 --> 42:33.620 This is the part I was telling you guys about earlier, where I'm just like, you're going to have a good time watching me do this, because there's actually four cables. 42:33.620 --> 42:36.600 This is double the amount of cables as we looked at earlier. 42:36.840 --> 42:41.060 And another little pro tip, actually all four of these cables are not required. 42:41.100 --> 42:52.160 For doing SPI, particularly if you only have one slave connecting to master, you actually only need to connect master out slave in, and clock in order to facilitate that connection. 42:52.160 --> 42:54.580 But just for shits and giggles, let's just connect them all. 42:54.580 --> 43:00.620 Also, I'm going to mooch off the ground interface of this ICSP down here, just to have something. 43:01.720 --> 43:04.540 So, anyways, very similar to what we saw with the other ones. 43:04.540 --> 43:06.740 The mappings of the Salie are here at the bottom. 43:06.960 --> 43:10.700 You can kind of see a little blurry, but my camera's not the greatest quality. 43:11.040 --> 43:11.900 Sorry, guys. 43:11.900 --> 43:14.020 It goes from zero to seven. 43:14.020 --> 43:17.260 And then the channels are on the top, the ground's on the bottom. 43:17.260 --> 43:19.920 You can kind of see there how they're laid out. 43:19.920 --> 43:21.140 So, we're going to just kind of start. 43:21.140 --> 43:22.600 I'm going to plug in ground here first. 43:22.600 --> 43:25.380 I'm going to put it in on the far end on this side. 43:25.380 --> 43:28.900 And then we'll... I'm cheating a little bit. 43:28.900 --> 43:30.300 Remember, you're supposed to pretend. 43:30.320 --> 43:34.240 But master out slave in, I'm going to make that zero. 43:34.240 --> 43:35.480 So, that's red. 43:35.480 --> 43:40.460 So, we're going to start red at zero, and kind of work that way. 43:40.460 --> 43:43.420 You're kind of picking up what I'm throwing down here. 43:44.080 --> 43:55.020 So, red, orange, yellow, green. 44:00.620 --> 44:04.200 And we need to plug this biatch in. 44:09.220 --> 44:14.220 So, yeah, the Salie uses a micro USB. 44:14.780 --> 44:20.700 The other cheaper logic analyzers use the mini USB, as you can see there. 44:20.700 --> 44:23.140 So, we'll grab the micro USB, again, hooked up to my computer. 44:24.660 --> 44:26.240 Let's plug this biatch in. 44:28.580 --> 44:29.880 And you shouldn't see a light. 44:29.880 --> 44:33.560 It's totally normal to, like, not see a light at first with this guy. 44:34.300 --> 44:34.940 And, yeah. 44:34.940 --> 44:36.580 So, let's continue on. 44:36.580 --> 44:39.220 So, let's go ahead and shift the screen over to that side. 44:39.860 --> 44:54.760 And we should now see... so, one beautiful thing is, I don't know if anyone on the call has dealt with Salie before, but it's kind of a pain in the ass sometimes to deal with a logic analyzer and unplugging it back in because you have to close the software and open it again. 44:54.820 --> 44:58.200 Well, Salie 2, I have the software already open, as you can see here at the top. 44:58.200 --> 44:59.880 It's now connected, the light's on. 44:59.880 --> 45:01.660 So, I think it's totally dope. 45:01.680 --> 45:17.240 But, anyways, the Salie software here, going back to the actual device itself, as I'd mentioned earlier, it supports both digital as well as analog. 45:17.240 --> 45:19.260 So, as you can see here, here's the digital. 45:19.300 --> 45:20.420 So, we want to put in four. 45:20.420 --> 45:23.240 We have a total of four channels going on right now. 45:23.520 --> 45:25.740 And we'll just go ahead and do analog and digital. 45:25.740 --> 45:28.540 We'll capture at 10 megasamples per second. 45:29.160 --> 45:33.800 And also, a couple other things. 45:33.800 --> 45:37.300 So, there's three different ways of capturing with this particular one. 45:37.300 --> 45:38.060 There's looping. 45:38.060 --> 45:41.460 So, loop after a predefined amount of time. 45:41.520 --> 45:44.320 There's the timer, where it will record for a period of time. 45:44.320 --> 45:45.400 And there's a trigger. 45:45.940 --> 45:49.000 So, just to kind of demo some stuff, let's go ahead and do a trigger. 45:49.000 --> 45:52.860 So, remember zero... actually, let's not trigger. 45:52.860 --> 45:53.600 Let's just do timer. 45:53.600 --> 45:55.260 Because we're trying to go black box, right? 45:55.260 --> 45:58.840 So, let's assume we don't know which particular channel is which. 45:58.840 --> 46:01.460 And this is just some blind device that we found online. 46:01.460 --> 46:02.460 And we don't know the data sheet. 46:02.460 --> 46:03.740 And it's using something like a WSAN. 46:03.740 --> 46:06.060 So, we have no idea, like, which pin is which. 46:06.560 --> 46:08.100 So, we have all the channels set up. 46:08.100 --> 46:10.320 We have the timer set up for three seconds of capture. 46:10.760 --> 46:12.020 Go down here. 46:12.100 --> 46:14.060 We're going to go ahead and leave the analyzers blank. 46:14.060 --> 46:16.740 And we're pretty much ready to start capturing here. 46:16.740 --> 46:20.660 So, I'm going grab the old power cable for this guy. 46:22.060 --> 46:24.740 And I'm set for three seconds. 46:24.740 --> 46:27.400 So, I kind of need to be quick with my trigger finger here. 46:29.220 --> 46:32.480 There we go. 46:32.480 --> 46:33.700 So, we got full screen. 46:34.060 --> 46:34.440 All right. 46:34.440 --> 46:35.680 She's plugged in. 46:36.860 --> 46:37.620 All right. 46:37.620 --> 46:38.780 So, we got it. 46:39.000 --> 46:40.940 Let's go ahead and zoom out here. 46:41.060 --> 46:45.380 Now, this is the capture that we just got, right? 46:45.380 --> 46:47.120 And this is during the boot up process. 46:47.360 --> 46:51.000 So, what you see here is zero through three channel. 46:51.000 --> 46:52.320 This is all digital. 46:52.340 --> 46:54.960 And on the bottom, it did its best at analog. 46:54.960 --> 46:59.740 And the analog, it's not the greatest. 46:59.740 --> 47:01.640 Like, it's probably pretty accurate. 47:01.640 --> 47:03.880 And you can kind of see the comparison between the two. 47:03.880 --> 47:11.140 Like, it tried its best at measuring those voltages, but probably didn't quite do the greatest that it could. 47:11.140 --> 47:12.760 But either way, there's analog. 47:12.760 --> 47:14.360 I just want to show you guys some of the analog. 47:14.360 --> 47:19.900 And it's cool to have and stuff like that, but it's not really the purpose of what I'm wanting to show you guys right now. 47:20.200 --> 47:29.720 Now, say, for instance, that you don't know the mechanism of... you know that it's SPI, but you don't know which pin's which, right? 47:29.820 --> 47:36.240 So, whenever we're looking at this device, remember, the top here is MISO. 47:36.240 --> 47:37.800 The bottom's MOSI. 47:37.920 --> 47:40.100 Channel zero is master-out-slave-in. 47:40.100 --> 47:49.220 As I mentioned earlier, master-out-slave-in is the information that's basically being transmitted from the actual chip to us. 47:49.400 --> 47:52.240 And it's probably going to be a little bit spontaneous. 47:52.240 --> 47:53.940 There's a lot of opcodes being set. 47:53.940 --> 47:58.000 There's a lot of different various settings being aligned with the actual device. 47:58.000 --> 48:01.740 And typically, that's one of the first things that'll start communicating, as we can see here. 48:01.740 --> 48:03.080 So, we zoom in. 48:04.060 --> 48:09.200 And a little bit telltale thing is that we're starting to see some type of communication taking place right here. 48:09.200 --> 48:10.240 A little sporadic. 48:10.400 --> 48:12.940 We also see right here channel one. 48:13.920 --> 48:16.000 Channel one, in this case, is clock. 48:16.900 --> 48:20.100 Remember, clock is going to actually set the cadence for how it communicates. 48:20.100 --> 48:22.040 1, 2, 3, 4, 5, 6, 7, 8. 48:22.040 --> 48:25.340 It's a full actual byte of data. 48:25.560 --> 48:26.840 That's pretty telltale. 48:26.840 --> 48:33.420 So, right here, of course, channel zero, we have a little bit of some type of sporadic data being actually set. 48:33.520 --> 48:40.820 Channel one, we have kind of a constant cadence of information being... of the waveform itself. 48:40.840 --> 48:47.640 And then enable, what enable is, say, for instance, there's three slaves communicating with the actual master node. 48:47.780 --> 48:54.260 The enable will tell... it'll flip the bit for when that device can communicate or not. 48:54.280 --> 48:59.000 So, you'll oftentimes see... it might be a little bit of a mismatch in our timing, which we can also fix. 48:59.000 --> 49:05.140 But you'll often see with the enable that, for instance, right here, there's basically like a 1, 1, 1. 49:05.140 --> 49:06.420 There's three 1s right here. 49:06.420 --> 49:13.460 It's going to kind of encompass that entire section, if that makes sense, or cycle. 49:13.720 --> 49:23.840 So, it's pretty easy to tell if you just kind of scan it, as we just did, which one's MOSI, which one's clock, and then which one's going to be enable. 49:23.840 --> 49:28.260 Again, enable, in our case, channel two and three is actually not even required. 49:28.900 --> 49:33.320 So, taking a little bit of a deeper dive, let's take a look at the actual protocol in that analyzer. 49:33.320 --> 49:35.140 We'll click SPI here. 49:35.260 --> 49:37.600 Remember, we have MOSI set on zero. 49:37.600 --> 49:39.880 We have MISO set on three. 49:39.880 --> 49:42.620 We have clock set on one. 49:42.620 --> 49:45.160 And we have enable set on two. 49:45.360 --> 49:48.680 We'll leave everything else default, and we'll click save. 49:48.980 --> 49:59.760 Kind of interesting, because you can actually find more deeper information about the actual device and the settings that it's applying as it's booting up. 50:00.820 --> 50:09.480 So, for instance, like right here, this is the actual decoded binary format. 50:09.480 --> 50:16.120 If we go here to the settings, we can change whether it's in binary, decimal, hexadecimal ASCII, and then take a look at the actual value. 50:16.120 --> 50:20.260 So, in this particular case, it's like one, one, zero, zero, one, zero, one, zero. 50:20.520 --> 50:23.480 And that's the actual location where it made the determination. 50:23.640 --> 50:26.320 You can see it up here at the top as well, where it's decoded. 50:26.500 --> 50:34.160 And what's kind of also interesting with this is you can take it a step further, and you can pull up the data sheet of the device. 50:34.160 --> 50:38.200 In this particular case, the model of this is the MRF49XA. 50:38.400 --> 50:41.580 It's a... I believe this one was a SOP8. 50:41.580 --> 50:48.000 I'm not 100% sure on that, but either way, it's just an RF flash memory chip. 50:48.160 --> 50:54.880 So, let's take this code that we got here, one, one, zero, zero, one, zero, one, zero, and let's just copy that. 50:55.220 --> 50:58.260 And then let's go back here, and let's just paste that in. 50:59.220 --> 51:03.240 So, it's... I already had it pulled up, so I'm kind of cheating right now. 51:03.240 --> 51:09.580 So, it's kind of interesting because you can take that, and this is exactly what a developer would do as they're kind of producing these types of devices. 51:09.660 --> 51:16.520 They're going to, like, set these codes, and this is going to sort of initiate the actual SPI flash storage of the chip. 51:16.520 --> 51:21.340 In this particular case, what we saw was one, one, zero, zero, one, zero, one, zero. 51:22.040 --> 51:23.840 Let's paste that in again. 51:23.840 --> 51:24.560 That's right here. 51:24.560 --> 51:34.840 So, we see the command code bit right there, and then we can see here below that bit seven through four are the first in, first out, fill bit counts. 51:34.840 --> 51:35.900 We have bit three. 51:35.900 --> 51:45.260 So, in this particular case, what you want to do is the immediate one below it is you match the next three and then map it back over to bit seven through four. 51:45.260 --> 51:55.180 In this particular... they don't always map, like, seven, like, in a range like that, but in bit three, for instance, like, this guy is set to zero. 51:56.080 --> 51:59.480 Bit three, that basically says synchronous character length bit. 51:59.500 --> 52:01.460 It's set to word long. 52:02.000 --> 52:15.820 So, I don't want to continue going down this rabbit hole here, but it's something that's kind of cool to when, like, when you're debugging, you can kind of map it back to the data sheet to actually figure out what's going on as far as settings being applied to the chip itself. 52:15.820 --> 52:20.760 One other really cool thing I'm going to show everyone here real fast is we're going to make some changes here. 52:20.760 --> 52:24.900 I'm going to go back to the actual mapping of the SPI interface. 52:24.960 --> 52:25.660 Pretty sweet. 52:26.000 --> 52:30.300 I mentioned earlier we don't need MISO and we don't need enable. 52:30.300 --> 52:32.600 So, let's select both of those to none. 52:32.940 --> 52:34.900 And let's do something else. 52:34.900 --> 52:35.740 This is kind of cool. 52:35.740 --> 52:40.540 This is actually a plug-in that you can use with this. 52:40.640 --> 52:44.340 We're going to select SDMMC from SPI. 52:44.600 --> 52:49.560 So, this chip, it's not either an SD nor is it an EMMC chip. 52:49.560 --> 52:50.860 It's just flash storage. 52:50.860 --> 52:58.540 It's not like an SD actual device nor is it a multimedia controller. 52:58.660 --> 53:00.540 But let's just pretend like it is for a second. 53:00.540 --> 53:07.440 You select the input to go into this particular plug-in and then we'll click finish. 53:07.660 --> 53:21.880 And if it were an SD or if it were an EMMC, it'd be pretty sweet because up here, as you can see where I have kind of hovering over, it'll kind of just show you the actual opcodes and the actual information that it's presenting. 53:21.880 --> 53:23.800 It'll kind of interpret that for you. 53:23.900 --> 53:31.760 So, just kind of another sweet feature of the logic analyzer software. 53:31.760 --> 53:34.320 I just want to kind of show you guys that real quick. 53:35.860 --> 53:39.060 And I know we're running kind of low on time. 53:39.260 --> 53:41.580 Darrell, are we kind of towards the end right now? 53:41.720 --> 53:43.720 No, we got time for some questions. 53:43.740 --> 53:46.180 I have a couple questions here before you move on. 53:46.460 --> 53:58.980 So, this is kind of stepping back, but do you have to worry about sample rate with cheaper analyzers, like missing data or misalignments and things like that? 53:59.640 --> 54:02.440 Yeah, that's a good question. 54:02.660 --> 54:15.520 I'll try to answer that with a little demo of what that sample rate actually means for the, like for instance, the Salie logic analyzer, which can have very high sample rates. 54:15.760 --> 54:31.700 The quick and dirty, the TLDR I'll give you is that for the protocols that we're looking at here, for the most part, the sample rates that these two cheaper guys support are satisfactory for what we're needing. 54:31.700 --> 54:38.840 I mean, it's whenever you're diving into the really quick protocols that it really makes a lot more of a difference. 54:39.000 --> 54:58.620 Because a lot of times with the really quick sample rates, like say for instance, let's increase this to... well, I don't know if I'll be able to, because I'll be honest, this logic analyzer can only go up to 50, but like, screw it, let's do it anyway. 55:00.080 --> 55:04.360 Another question on there is similar to that same topic. 55:04.380 --> 55:11.160 Is there a general rule on what samples per second selection that you actually make when you're setting something up? 55:12.660 --> 55:14.780 There's not really a general rule. 55:14.780 --> 55:17.220 It's more of a... this is just my own experience. 55:17.220 --> 55:23.500 Now, Daryl, you might have your own answer for this, but I would say I typically use it for the default, just depending on what it is. 55:23.500 --> 55:27.340 And what I use this for is typically for UART, SPI, and I2C. 55:27.340 --> 55:30.020 I would heavily be interested to hear what you have to say. 55:30.120 --> 55:33.560 Typically, I'm pretty much the same way. 55:33.700 --> 55:48.780 What I will do is if the sample rate's not high enough, I've actually had my Sele start throwing errors and tell me that it was missing data, that it wasn't sampling quick enough. 55:48.780 --> 55:52.420 I had that just recently looking on some Dataflow. 55:52.660 --> 55:59.360 As soon as I kick it off, it'd throw an error in telling me that it was a missample rate. 55:59.980 --> 56:04.440 So, I was able to crank it up until the error went away. 56:04.440 --> 56:16.400 So, again, sometimes I'll also just crank it up out of the blue if I know for a fact that it's a high-speed device that's going to be generating a lot of fast traffic. 56:16.820 --> 56:27.900 Typically, when you're looking at UART, SPI, and stuff like that, amazingly enough, the speed is often not used as even high as the chip can go. 56:28.120 --> 56:34.340 Like UART, I've seen interchip comms on a UART that can literally... the chips are designed to drive at 56:37.460 --> 56:42.180 what, over 3 million bits per second across there. 56:42.180 --> 56:48.620 But yet, the developers of the device had it set up to communicate at 9600 bulb. 56:49.640 --> 56:52.680 That makes sense. 56:52.680 --> 56:52.960 Yeah. 56:52.960 --> 56:57.400 And I've also found that if you go too high, this particular Sele does not support it. 56:57.400 --> 57:06.200 But you also don't want to go too high because if you go too high, this, what you see right here, get out of the screen, it'll just be a giant blob. 57:06.200 --> 57:07.200 It's just a mess. 57:07.200 --> 57:11.220 It's capturing too much sampling and it's kind of just inaccurate at that point. 57:11.240 --> 57:13.740 So, it's a fine line between the two. 57:14.020 --> 57:21.380 And another quick point on that also is, typically, the higher the sample rate, the more memory you're going to eat up to. 57:22.220 --> 57:23.420 That's a point. 57:24.920 --> 57:26.840 Are there any other questions? 57:30.770 --> 57:32.150 Not at this time. 57:32.930 --> 57:33.470 Cool. 57:33.470 --> 57:36.550 And quick question, how much more time do we have here? 57:36.550 --> 57:37.270 Just to make sure. 57:37.270 --> 57:38.650 I don't want to go too far over time. 57:39.170 --> 57:40.570 We've been at it for an hour. 57:40.570 --> 57:43.950 So, I think we got at least another 10 or 15 minutes. 57:44.730 --> 57:45.450 Definitely. 57:45.450 --> 57:47.510 You can definitely go for another 15 minutes. 57:47.510 --> 57:49.490 The next talk starts at 8 PM. 57:49.870 --> 57:50.450 Perfect. 57:50.450 --> 57:51.010 Okay, cool. 57:51.010 --> 57:56.310 I wasn't 100% sure on that, but that works out great because we have one more demo as well. 57:56.310 --> 58:03.970 So, we've talked about... we did a little kind of a cheater exercise on Raspberry Pi. 58:04.950 --> 58:12.350 We did... I showed you guys how to sort of blindly identify SPI as well. 58:12.850 --> 58:15.230 And then next, let's switch back over to UR. 58:15.230 --> 58:17.290 It's more of a real world example. 58:18.810 --> 58:22.870 So, let me go ahead and unplug these guys and plug the power first on this guy here. 58:24.210 --> 58:25.970 Let's switch back here. 58:25.970 --> 58:33.030 Make sure I don't bust off any of these header pins live on camera because this is Daryl's device and it would suck to break it right in front of him. 58:33.030 --> 58:37.650 And let's pull over another device. 58:38.450 --> 58:40.190 That's going to be this guy. 58:40.930 --> 58:45.010 So, we're going to stick to the theme with the Salee. 58:45.010 --> 58:46.990 So, Salee is still going to be used. 58:47.190 --> 58:51.430 In this particular case, we're going to check out UR, but using the new Salee 2 software. 58:51.770 --> 58:57.210 This particular device, it's a Z-Wave hub, I guess, so to speak. 58:57.210 --> 58:59.650 So, it's a hub used in automation. 59:00.070 --> 59:05.950 I'm pretty heavy into home automation here at my place and that's something I've always been fascinated with. 59:05.950 --> 59:09.570 But this particular device, it's a Z-Wave hub. 59:09.650 --> 59:11.370 And let's dig right in. 59:11.370 --> 59:23.230 So , right off the bat, something that can easily be noticed, I guess, is that on this device, there was these three header pins. 59:23.550 --> 59:29.650 I soldered the headers on, but previously it was just three holes just kind of sitting there. 59:29.650 --> 59:37.190 And that's kind of telltale that maybe it might be kind of interesting to kind of poke at. 59:37.470 --> 59:38.830 It can be anything. 59:38.830 --> 59:39.570 It can be I2C. 59:39.570 --> 59:43.850 Maybe there's an EEPROM chip on here that's disclosed or it could be anywhere. 59:43.850 --> 59:45.770 It could also not be on here. 59:45.770 --> 59:55.610 And when I mentioned WSAN earlier, actually, I can't quite tell if this is WSAN or actually a BGA, but either way, same difference. 59:55.790 --> 01:00:07.270 Sometimes you can't actually see the legs of the device to where you map it out to say, for instance, these headers, but rather sometimes you can, which is what you see right here. 01:00:07.270 --> 01:00:09.750 This is a traditional TSOP8. 01:00:10.010 --> 01:00:12.030 So, TSOP8, it's got the legs. 01:00:12.870 --> 01:00:15.170 WSAN does not. 01:00:16.650 --> 01:00:18.130 And I'm pretty sure it's WSAN. 01:00:18.130 --> 01:00:20.610 It might be BGA, but I'm pretty confident that it's WSAN. 01:00:20.610 --> 01:00:23.050 This one for sure is a BGA microcontroller. 01:00:23.050 --> 01:00:32.130 But either way, sometimes you can't take a multimeter to check that this pin right here connects to that pin right there. 01:00:32.450 --> 01:00:35.550 So, therefore, sometimes a logic analyzer will come into play. 01:00:35.550 --> 01:00:38.450 And then that's where it's usually beneficial to do this type of stuff. 01:00:38.450 --> 01:00:39.690 So, let's just move on. 01:00:39.690 --> 01:00:42.030 Let's plug this sucker in and see what we get. 01:00:50.240 --> 01:00:53.680 So, we only need a couple of connections here. 01:00:53.680 --> 01:00:57.040 So, I'm going to borrow the cables that I was using earlier for the UART. 01:00:57.040 --> 01:01:01.780 So, in this particular case, there's only three connections being made. 01:01:02.580 --> 01:01:10.000 One thing you can do with this is basically take a multimeter to figure out which one's ground. 01:01:10.000 --> 01:01:13.080 In that case, let's just assume that I did that because I know which one's ground. 01:01:13.080 --> 01:01:17.900 But like, it's pretty easy to tell which one's ground with just a multimeter. 01:01:18.800 --> 01:01:23.940 So, and the ground is actually going to be the pin on the far right in this particular case. 01:01:23.940 --> 01:01:27.360 So, let's hook up black to ground. 01:01:27.940 --> 01:01:34.480 And let's just hook up, you know, white and like this silver one to the other two, not knowing which one's which. 01:01:34.480 --> 01:01:43.860 So, again, using the handy dandy mappings that we have on the Stanley, we plug that sucker right in to ground. 01:01:44.320 --> 01:01:50.040 And then we plug in the other two to channels zero and one. 01:01:50.400 --> 01:01:51.540 Kind of easy. 01:01:59.070 --> 01:02:08.630 And next, let's, you know what, let's do a trigger. 01:02:09.590 --> 01:02:11.470 We're kind of gambling right now. 01:02:12.050 --> 01:02:13.690 We're supposed to be in Vegas right now. 01:02:13.690 --> 01:02:16.770 So, again, let's do some type of gambling, right? 01:02:16.770 --> 01:02:19.430 We don't know which one's which one's transmit. 01:02:19.490 --> 01:02:22.630 But what we're betting on right now is that channel zero is transmit. 01:02:22.630 --> 01:02:23.630 We have no idea. 01:02:23.810 --> 01:02:25.870 So, let's just figure out that's what it was. 01:02:25.870 --> 01:02:28.930 And what we're triggering on is a rising edge. 01:02:28.930 --> 01:02:36.550 And what that says is that whenever you see a rising edge in the transmission, in that waveform, that's when you start capturing. 01:02:36.750 --> 01:02:39.130 So, in memory, it's capturing the whole time. 01:02:39.130 --> 01:02:45.930 But the actual capture that comes back and returns to you is the actual, the trigger that you set here. 01:02:45.930 --> 01:02:49.490 You can trigger rising edge, falling edge, high pulse, or low pulse. 01:02:49.790 --> 01:02:56.470 In this particular case, let's just say as soon as you see some type of traffic going on on channel one, that's when we want you to capture. 01:02:56.470 --> 01:02:58.250 And we want you to capture for three seconds. 01:02:58.570 --> 01:03:00.150 Delete everything else afterwards. 01:03:00.330 --> 01:03:01.670 And we only need two channels here. 01:03:01.670 --> 01:03:02.790 So, let's get rid of those other two. 01:03:02.790 --> 01:03:05.450 We're going to leave it at 50 megasamples per second. 01:03:05.990 --> 01:03:07.130 And that is that. 01:03:07.130 --> 01:03:08.550 We're not going to capture on analog. 01:03:08.550 --> 01:03:16.090 So, let's... actually, what we're going to do next is we're going to close out of that. 01:03:16.090 --> 01:03:17.110 We're going to click start. 01:03:17.870 --> 01:03:19.610 It's literally waiting for the trigger. 01:03:19.610 --> 01:03:22.810 So, you see down there in the bottom right-hand corner, waiting for trigger. 01:03:22.810 --> 01:03:25.070 Let's plug this bastard in. 01:03:26.170 --> 01:03:28.170 Holy shit, we're correct. 01:03:29.510 --> 01:03:29.990 Yeah. 01:03:29.990 --> 01:03:30.630 So, we... 01:03:30.630 --> 01:03:36.370 well, we still have the stupid... let me delete these... the decoders. 01:03:37.350 --> 01:03:38.850 This is my bad. 01:03:40.270 --> 01:03:41.490 Let me get rid of that. 01:03:41.650 --> 01:03:48.990 And yeah, if we're in Vegas, we basically... we bet like 100 bucks on red and it landed on red because it's exactly what happened here. 01:03:48.990 --> 01:03:50.830 So, go us, right? 01:03:52.110 --> 01:03:54.710 Channel zero is TX, just as we were hoping for. 01:03:54.710 --> 01:03:57.470 So, that trigger was met and it recorded for three seconds. 01:03:57.970 --> 01:04:01.190 So, scrolling into here, we can see some of the data. 01:04:01.190 --> 01:04:03.910 Of course, you know, this is like the zero one, zero one. 01:04:04.290 --> 01:04:11.510 And this is the part, as I showed you earlier, with the OG logic analyzer... sorry, the OG logic software. 01:04:12.030 --> 01:04:13.430 We'll put input channel. 01:04:13.430 --> 01:04:14.770 We're set to zero. 01:04:14.770 --> 01:04:15.890 11.5200. 01:04:16.190 --> 01:04:18.710 We don't know what the baud rate is for this guy. 01:04:18.710 --> 01:04:20.450 I believe it actually is 11.5200. 01:04:21.010 --> 01:04:23.430 Remember, we talked about how to check that. 01:04:23.450 --> 01:04:24.930 But of course, here we go. 01:04:24.970 --> 01:04:27.770 We're seeing all the data as well as part of the boot up. 01:04:27.770 --> 01:04:39.290 So, boot SPL 2017 and just various other information that it's printing out, standard out as it's performing the boot sequence. 01:04:40.530 --> 01:04:45.550 So, anyways, just wanted to show you guys another example of that on the new software here. 01:04:45.690 --> 01:04:47.190 It's pretty slick. 01:04:47.190 --> 01:04:48.790 It's totally awesome. 01:04:48.790 --> 01:04:50.170 I like it a lot. 01:04:51.090 --> 01:04:53.390 You know, it's super useful. 01:04:53.390 --> 01:04:54.430 You can see like the parity bits. 01:04:54.430 --> 01:05:01.670 This is basically the little white dots is kind of managing the communication timing whenever it's sending data back and forth. 01:05:01.670 --> 01:05:03.170 In this case, it's transmitting. 01:05:03.870 --> 01:05:08.830 So, anyways, that being said, that's kind of the end of the demo here. 01:05:08.830 --> 01:05:17.950 I just want to give another example of what it means to communicate or what it looks like to communicate using the new Saly 2 software. 01:05:18.970 --> 01:05:19.850 Questions? 01:05:21.710 --> 01:05:23.230 Yeah, let's go ahead. 01:05:23.230 --> 01:05:24.950 I think we have some questions. 01:05:25.050 --> 01:05:26.690 Let me look at this first. 01:05:28.370 --> 01:05:40.950 If the Saly software works for any analyzer, what would be the consideration in purchasing the more expensive offer over a cheaper hardware option shown? 01:05:41.510 --> 01:05:56.490 So, why would I want to buy a expensive $600 logic analyzer when I can buy a $24 logic analyzer since I could use the software? 01:05:57.110 --> 01:05:58.770 Yeah, that makes sense. 01:05:58.770 --> 01:06:13.430 So, as we talked about the speeds, I don't want to say they're negligible, but you do get significantly higher recording speeds with the Saly than you would do with these cheaper versions as well. 01:06:13.430 --> 01:06:25.290 Another thing, too, is that the actual accuracy of the protocol decoding I've noticed is higher with the Saly than it is with either of these other two devices. 01:06:26.910 --> 01:06:33.010 That being said, it really just depends on what your needs are. 01:06:33.110 --> 01:06:35.970 In my opinion, it's pretty good quality. 01:06:35.970 --> 01:06:49.650 Like, for instance, I've had a couple of times where I was doing some type of logic, I was doing basically decoding and actually live capture, and I had a crash with the software with both of these devices. 01:06:49.950 --> 01:06:52.790 So, you'll notice that it's a little bit sluggish. 01:06:52.790 --> 01:06:54.610 It's a little bit rough around the edges. 01:06:55.210 --> 01:06:57.230 Again, you kind of get what you pay for. 01:06:57.570 --> 01:07:02.730 The communication, again, there's been kind of like lags and hiccups with these two. 01:07:02.730 --> 01:07:12.670 They get the job done, but I've noticed that the accuracy for how close of how it captures is a little bit more specific with the Saly. 01:07:12.710 --> 01:07:21.010 So, if what you're looking to do is going to require you to know those voltages at more of an accurate level, then maybe consider the Saly versus these guys. 01:07:21.010 --> 01:07:27.170 I mean, if you're just doing some general debugging, things like that, I think these are not a bad choice. 01:07:27.330 --> 01:07:28.230 That's just my opinion. 01:07:28.230 --> 01:07:30.190 Daryl, do you have anything to add to that? 01:07:30.310 --> 01:07:40.530 Yeah, I think accuracy is probably one of the bigger things and the ability to process at a higher speed, I think, are the value. 01:07:40.530 --> 01:07:43.710 And that's why I went with a higher value product. 01:07:44.290 --> 01:07:52.910 Because I personally often encounter things that those would not work on at all, just from the fact that it's higher speed. 01:07:52.910 --> 01:08:02.690 I often get into more interchip communication analysis, which is often at a much higher speed than external communication. 01:08:03.650 --> 01:08:05.250 Makes sense. 01:08:05.390 --> 01:08:08.030 The other question here is a good question. 01:08:08.330 --> 01:08:11.230 Do you need special hardware for JTAG? 01:08:11.690 --> 01:08:12.110 Yeah. 01:08:13.070 --> 01:08:20.950 You know, so if you look here, the capability exists for adding JTAG. 01:08:20.950 --> 01:08:21.510 Actually, does it? 01:08:21.510 --> 01:08:24.430 I don't know if it does on this logic, too, or not. 01:08:24.450 --> 01:08:24.770 I'm still... 01:08:24.770 --> 01:08:25.550 I think it does. 01:08:25.830 --> 01:08:26.610 I'm not sure. 01:08:26.610 --> 01:08:26.890 Yeah , it does. 01:08:26.890 --> 01:08:29.230 Yeah, it sure does. 01:08:29.350 --> 01:08:34.710 Now, the question was, is there a specific hardware needed for JTAG? 01:08:34.710 --> 01:08:45.230 In this case, if you're trying to, like, identify, you know, what is TMS, if you're trying to identify with JTAG, what are those debug interfaces? 01:08:45.870 --> 01:08:49.950 You might have the capability of doing it with a logic analyzer. 01:08:49.950 --> 01:08:58.710 Now, at that point, you're kind of... I don't want to say you're putting a round peg in a square hole, but I don't know if you're necessarily using the right tool. 01:08:58.910 --> 01:09:05.250 It has a capability of doing it like this, but you might consider using other pieces of hardware for doing something like JTAG. 01:09:05.250 --> 01:09:10.390 Now, like, for JTAG, say, for instance, you don't know what the pinouts are, and you're trying to identify that. 01:09:11.030 --> 01:09:17.990 That's where you would use something like, for me personally, I would go after a multimeter first, and I would try to ring it out with the MCU. 01:09:17.990 --> 01:09:29.810 So, I'd try to find the data sheet and use that data sheet to identify where on the MCU, based off those pins of the MCU, where does that fall out, and use that to identify the pinouts of the JTAG. 01:09:29.810 --> 01:09:38.010 If you don't have the data sheet, or maybe you don't know where the MCU is, or maybe it's a BGA MCU, then you'd maybe use some type of boundary scanner. 01:09:38.010 --> 01:09:40.050 A great example of that is the JTAGulator. 01:09:40.230 --> 01:09:45.310 Another thing that you could kind of use the Salee for is a boundary scanner, sort of. 01:09:45.650 --> 01:09:49.230 In that particular instance, it could help you, yes. 01:09:49.270 --> 01:10:03.370 Now, if you're wanting to do something like program an MCU, or program the device or upload the device to a flash memory to program an MCU, then you would need some type of programmer, and that's going to be vendor-specific. 01:10:03.370 --> 01:10:09.670 So, say for instance, it's a STM32, you could use something like a ST-Link device. 01:10:09.990 --> 01:10:15.250 J-Link supports OpenOCD in a lot of cases, so it can support multi-manufacturers. 01:10:15.310 --> 01:10:17.730 If it's like an Atmel, you'll want to use like a Pickett. 01:10:17.730 --> 01:10:27.570 So, if you're wanting to either dump or flash some firmware onto an MCU or flash memory, you'd use whatever programmer is assigned to that particular chipset. 01:10:27.590 --> 01:10:38.850 Outside that, you can use a logic analyzer for doing some like limited boundary scanning, but that's kind of not really why it's designed, but the capability exists. 01:10:40.030 --> 01:10:46.650 Yep, and on conclusion, there was one comment, there are a couple comments in here I thought were funny. 01:10:46.690 --> 01:10:53.430 One was, it would be funny if someone designed a board with a honeypot header that had 50 volts on it. 01:10:54.430 --> 01:11:00.950 So, Jonathan would hook up his $300 logic analyzer and watch it burst into flames. 01:11:01.470 --> 01:11:04.810 Dear God, yeah, that would fry the man bun right off my head. 01:11:05.830 --> 01:11:15.250 So, I thought that was a funny comment, which is definitely the level of evil I would expect from DEF CON, so thank you for that. 01:11:16.810 --> 01:11:21.650 And then a couple comments saying you did a good job, so that was pretty good. 01:11:21.890 --> 01:11:26.410 So, are there any more questions from anyone as we're getting ready to conclude? 01:11:26.410 --> 01:11:28.390 Wait, I think there's one more. 01:11:28.850 --> 01:11:32.710 One was asking more like model numbers on those cheaper ones. 01:11:32.710 --> 01:11:33.950 Do you have that information? 01:11:34.010 --> 01:11:37.050 I think those are so generic in nature. 01:11:39.370 --> 01:11:42.110 You know what I'm talking about, the two cheap logic analyzers. 01:11:42.110 --> 01:11:44.890 Is there any kind of information on there for acquisition? 01:11:44.890 --> 01:11:53.710 I think you had a page that actually showed the link or information to the actual Amazon site. 01:11:53.710 --> 01:11:55.970 Yeah, let me see here. 01:11:55.970 --> 01:12:03.670 I'll actually just real quickly do one even better for whoever asked the question about that. 01:12:04.030 --> 01:12:08.970 Amazon.com, if you just search logic analyzer. 01:12:09.250 --> 01:12:14.770 I mean, one of the ones we're using is like... I think it was the first one in the list showed up there at the top. 01:12:14.890 --> 01:12:16.110 Yeah, that's one of them. 01:12:16.110 --> 01:12:20.110 If you go up to the top, I think the first one in the list was one of them we purchased right there. 01:12:20.110 --> 01:12:21.130 That's one of them. 01:12:21.150 --> 01:12:25.150 That's the I let go USB one. 01:12:26.990 --> 01:12:29.550 I actually have the other one too. 01:12:29.550 --> 01:12:35.490 It's kind of funny because it came with the Edify toolkit or whatever. 01:12:35.490 --> 01:12:37.510 It's got like a red face to it. 01:12:38.930 --> 01:12:42.130 You may have called any number of different names. 01:12:42.250 --> 01:12:43.890 Oh, it's SparkFun. 01:12:44.010 --> 01:12:45.070 Yeah, SparkFun. 01:12:45.070 --> 01:12:49.030 Yeah, SparkFun relabels that Chinese one. 01:12:49.910 --> 01:12:50.970 Yeah, it's this one. 01:12:50.970 --> 01:12:53.070 So I mean, just go online really. 01:12:53.070 --> 01:12:57.610 It's kind of like here's one of them and here's the other. 01:12:57.850 --> 01:13:02.530 And it's just you just Google or not Google Amazon search those two. 01:13:02.830 --> 01:13:05.010 I'm pretty sure this is exactly both of them. 01:13:05.630 --> 01:13:07.030 Yeah, perfect. 01:13:08.070 --> 01:13:08.990 Thanks a lot. 01:13:08.990 --> 01:13:12.030 Let's see any more questions. 01:13:13.470 --> 01:13:15.490 Are hand tech any good? 01:13:16.090 --> 01:13:18.610 Have you messed with a hand tech before? 01:13:18.830 --> 01:13:20.590 I'm not too sure. 01:13:21.210 --> 01:13:24.990 Hand tech logic. 01:13:31.250 --> 01:13:33.730 Oh, oscilloscope or the logic analyzer? 01:13:33.730 --> 01:13:37.350 Probably logic analyzer since this is a logic analyzer. 01:13:37.350 --> 01:13:38.970 I have not. 01:13:40.330 --> 01:13:43.970 Well, you were there a minute ago before you checked on the oscilloscope. 01:13:43.970 --> 01:13:46.290 There was one showing up there as a logic analyzer. 01:13:46.290 --> 01:13:47.170 I'm sure. 01:13:48.310 --> 01:13:51.130 And then EK, TEK. 01:13:53.270 --> 01:13:55.510 Because we're quickly running out of time here, but... 01:13:57.950 --> 01:14:00.190 Oh, I've seen pictures of these guys. 01:14:02.970 --> 01:14:06.230 It looks... I mean, it's got two gigs of DDR2 memory. 01:14:06.230 --> 01:14:10.590 I mean, it's hella better than I think what any of the Salies have. 01:14:10.810 --> 01:14:13.350 So, they're quick and dirty real quick. 01:14:13.350 --> 01:14:16.330 But that one, that's a very high sample rate, and that's a lot of memory. 01:14:16.330 --> 01:14:22.970 So, higher the memory, the higher the sample rate, the longer you can capture, and the more pinpoint accuracy you can get in those captures. 01:14:23.790 --> 01:14:26.370 That's probably, I guess, my two cents on that particular one. 01:14:26.370 --> 01:14:27.070 And it looks cool. 01:14:27.070 --> 01:14:28.190 Looks dope as hell. 01:14:28.550 --> 01:14:35.990 Yeah, I haven't messed with one, so... Okay, I think that pretty much concludes it. 01:14:35.990 --> 01:14:40.550 Hopefully, the people that wanted to ask questions were able to ask questions. 01:14:40.930 --> 01:14:44.730 Feel free to reach out to any one of us. 01:14:45.050 --> 01:14:50.470 Jonathan, you can reach out to him anytime. 01:14:50.470 --> 01:14:51.210 He's available. 01:14:51.210 --> 01:14:52.770 I think he's on Twitter. 01:14:53.710 --> 01:14:56.070 Do you get your Twitter ID out there, man? 01:14:56.430 --> 01:14:59.170 Yeah, Twitter ID, frankensteiner. 01:14:59.250 --> 01:14:59.790 There you go. 01:14:59.790 --> 01:15:01.050 Good luck remembering that. 01:15:01.050 --> 01:15:07.950 So, if you ever want to ask him any questions or harassing, there you go. 01:15:08.670 --> 01:15:14.570 Yeah, if you want to figure out what my address is, I'll honestly just give it to you, if you're really that curious. 01:15:14.810 --> 01:15:18.870 You don't have to do whatever, Google it or whatever, like the person did at the beginning. 01:15:19.950 --> 01:15:21.730 Well, hey, thank you so much. 01:15:21.730 --> 01:15:24.210 I think there might be a few extra questions. 01:15:24.210 --> 01:15:34.930 So, if either of you have time to jump into the IOTV Talk, Questions, Text Discord channel, there's definitely people that were pretty engaged with this talk. 01:15:34.930 --> 01:15:41.590 Despite the technical difficulties, this was our first and only live presentation that had any issues. 01:15:41.690 --> 01:15:44.310 So, I mean, what are the chances of that? 01:15:44.310 --> 01:15:48.170 It's like getting a bird pooping on your head. 01:15:48.170 --> 01:15:49.570 Maybe it's good luck. 01:15:49.710 --> 01:15:50.830 Nice. 01:15:51.010 --> 01:15:52.630 It is good luck.