1
00:00:00,660 --> 00:00:03,450
- So SickCodes here is proving the point

2
00:00:03,450 --> 00:00:05,377
when you ask the question,

3
00:00:05,377 --> 00:00:07,920
"Who thinks your tractor's sexy?"

4
00:00:07,920 --> 00:00:09,183
This is the man.

5
00:00:14,379 --> 00:00:15,212
- All right.

6
00:00:15,212 --> 00:00:16,045
How do I get on the...

7
00:00:16,045 --> 00:00:16,893
Oh, there we go. Cool.

8
00:00:18,660 --> 00:00:19,493
All right.

9
00:00:19,493 --> 00:00:20,326
Good afternoon, everyone.

10
00:00:21,270 --> 00:00:22,260
My name's Sick Codes.

11
00:00:22,260 --> 00:00:23,550
Just had an issue with the slides

12
00:00:23,550 --> 00:00:24,690
where the font didn't come across,

13
00:00:24,690 --> 00:00:26,340
'cause I was using LibreOffice,

14
00:00:26,340 --> 00:00:27,940
for those Gentoo fans out there.

15
00:00:29,400 --> 00:00:32,250
My presentation here is
called Hacking The Farm.

16
00:00:32,250 --> 00:00:35,073
It's about breaking into
agriculture security devices.

17
00:00:36,210 --> 00:00:39,840
So yeah, the prime focus
areas today are food security.

18
00:00:39,840 --> 00:00:43,170
And what I mean by that
is the food supply chain.

19
00:00:43,170 --> 00:00:45,150
One of the biggest parts of that...

20
00:00:45,150 --> 00:00:48,250
One of the biggest parts of
the GDP of the entire country

21
00:00:49,219 --> 00:00:52,860
is food and agriculture,
which accounts for about 20%.

22
00:00:52,860 --> 00:00:57,860
So one fifth of the U.S. GDP
is literally just agriculture

23
00:00:59,940 --> 00:01:03,060
and I want it to kind of be a
little bit of a wake up call

24
00:01:03,060 --> 00:01:04,610
'cause it's kind of a big deal.

25
00:01:05,700 --> 00:01:07,980
And the main takeaways,

26
00:01:07,980 --> 00:01:09,997
I want you to feel like this
is super easy and be like,

27
00:01:09,997 --> 00:01:12,720
"Oh wow, that's like one of
the easiest things ever."

28
00:01:12,720 --> 00:01:14,700
And I want you to feel
like you can also do it.

29
00:01:14,700 --> 00:01:16,860
That's one of the big takeaways.

30
00:01:16,860 --> 00:01:18,000
You want be able to do it to everything,

31
00:01:18,000 --> 00:01:21,560
your fridges, your watches, your smart...

32
00:01:23,010 --> 00:01:24,307
What would I say?

33
00:01:24,307 --> 00:01:25,530
Smart fridges. I already said that.

34
00:01:25,530 --> 00:01:28,803
And this talk's suitable
for anyone who eats food.

35
00:01:29,932 --> 00:01:30,765
(audience laughs)

36
00:01:30,765 --> 00:01:32,710
So I assume that's most of everyone here.

37
00:01:34,680 --> 00:01:38,493
Yeah. So sit back, relax and
just enjoy the presentation.

38
00:01:39,900 --> 00:01:43,314
Yeah. So this is the OVH data center;

39
00:01:43,314 --> 00:01:44,370
(Sick Codes laughs)

40
00:01:44,370 --> 00:01:46,020
some of you might remember this.

41
00:01:46,020 --> 00:01:49,380
And one of the big takeaways
from this data center fire,

42
00:01:49,380 --> 00:01:51,690
something that I picked
up pretty straightforward

43
00:01:51,690 --> 00:01:56,017
was this comment by the CEO of OVH saying,

44
00:01:56,017 --> 00:01:57,810
"I believe this incident will change

45
00:01:57,810 --> 00:02:00,030
the standards of the industry in relation

46
00:02:00,030 --> 00:02:02,910
to free backups for future
incidents like this."

47
00:02:02,910 --> 00:02:05,077
And my take on that is,

48
00:02:05,077 --> 00:02:08,790
"Newsflash, OVH. Everyone else
was already doing backups.

49
00:02:08,790 --> 00:02:10,832
You were the only company that wasn't."

50
00:02:10,832 --> 00:02:13,530
So it kind of sucks for the
customers that lost their data,

51
00:02:13,530 --> 00:02:17,760
but things have to happen before
you transition into a new,

52
00:02:17,760 --> 00:02:21,180
I guess, modus operandum and yeah,

53
00:02:21,180 --> 00:02:22,500
consider the risks before you jump

54
00:02:22,500 --> 00:02:24,483
onto the information superhighway.

55
00:02:25,800 --> 00:02:28,450
Big key here is, you wouldn't
upload the supply chain

56
00:02:29,820 --> 00:02:31,290
and John Deere...

57
00:02:31,290 --> 00:02:32,400
Oh sorry.

58
00:02:32,400 --> 00:02:34,833
Yeah, John Deere seems to think otherwise.

59
00:02:36,450 --> 00:02:38,790
Yeah, So John Deere, we
have a checkered history,

60
00:02:38,790 --> 00:02:40,530
myself and John Deere.

61
00:02:40,530 --> 00:02:43,590
I was the first researcher
in their program,

62
00:02:43,590 --> 00:02:45,270
that was about last
year, August last year,

63
00:02:45,270 --> 00:02:46,470
just before DEFCON last year,

64
00:02:46,470 --> 00:02:48,960
did a talk on that; little bit different.

65
00:02:48,960 --> 00:02:50,520
And that was supposed to
be a bit of a silver lining

66
00:02:50,520 --> 00:02:51,840
in the background.

67
00:02:51,840 --> 00:02:52,890
So they actually generated...

68
00:02:52,890 --> 00:02:54,570
They've got the program now

69
00:02:54,570 --> 00:02:56,670
and they've got some reports resolved;

70
00:02:56,670 --> 00:02:58,470
we've got 94 reports resolved.

71
00:02:58,470 --> 00:02:59,910
One of the key things
that I've tried to mention

72
00:02:59,910 --> 00:03:03,510
to John Deere is that they
don't have equipment in stock...

73
00:03:03,510 --> 00:03:04,706
Sorry,

74
00:03:04,706 --> 00:03:05,539
(Sick Codes laughs)

75
00:03:05,539 --> 00:03:06,372
in scope.

76
00:03:06,372 --> 00:03:08,332
And in stock either cuz
of the chip shortage.

77
00:03:08,332 --> 00:03:11,940
(audience laughs)

78
00:03:11,940 --> 00:03:13,230
They don't have equipment in scope,

79
00:03:13,230 --> 00:03:15,637
so I kind of took that like,

80
00:03:15,637 --> 00:03:17,580
"You don't have a bounty
program that pays money

81
00:03:17,580 --> 00:03:19,130
that I know about," by the way,

82
00:03:20,617 --> 00:03:22,660
"And you don't have a program that pays

83
00:03:24,560 --> 00:03:26,040
for hardware that's in scope."

84
00:03:26,040 --> 00:03:28,710
So who do I tell the vulnerabilities to?

85
00:03:28,710 --> 00:03:30,933
And are they actually vulnerabilities?

86
00:03:32,190 --> 00:03:34,470
So just reminding you to
have a good day today,

87
00:03:34,470 --> 00:03:36,180
want you to make it look easy

88
00:03:36,180 --> 00:03:38,100
and don't think that
you can drive a tractor

89
00:03:38,100 --> 00:03:40,410
after this talk either, but yeah.

90
00:03:40,410 --> 00:03:41,430
And never give up.

91
00:03:41,430 --> 00:03:43,380
So these are some of the issues that I had

92
00:03:43,380 --> 00:03:48,240
shearing; just mayhem and just
annoying things like that,

93
00:03:48,240 --> 00:03:50,970
breaking screwdrivers and
just shearing the only bit

94
00:03:50,970 --> 00:03:52,820
that fits in one of the nuts in here.

95
00:03:54,210 --> 00:03:55,043
This is another one.

96
00:03:55,043 --> 00:03:56,280
This is the previous
device that I looked at,

97
00:03:56,280 --> 00:03:58,440
the modular telematics gateway

98
00:03:58,440 --> 00:04:00,630
and actually broke that in half,

99
00:04:00,630 --> 00:04:01,779
which...

100
00:04:01,779 --> 00:04:02,612
(audience laughs)

101
00:04:02,612 --> 00:04:04,320
it's so annoying because
then you have to buy

102
00:04:04,320 --> 00:04:06,420
another entire unit just to get that chip

103
00:04:06,420 --> 00:04:08,493
which has the software on it.

104
00:04:09,350 --> 00:04:10,740
So that's the only chip
I wanted and I broke it.

105
00:04:10,740 --> 00:04:12,960
So looking back in hindsight,

106
00:04:12,960 --> 00:04:14,340
obviously there's way
better ways to do it,

107
00:04:14,340 --> 00:04:17,130
like low melt solder and things like that

108
00:04:17,130 --> 00:04:19,410
but there was a lot of epoxy underneath.

109
00:04:19,410 --> 00:04:21,180
They tend to use a lot
of epoxy on their stuff

110
00:04:21,180 --> 00:04:23,380
so it's kind of like
an extra layer of glue.

111
00:04:24,990 --> 00:04:26,280
But yeah, once you get that chip off,

112
00:04:26,280 --> 00:04:29,040
this is one of the most
common chip you'll see

113
00:04:29,040 --> 00:04:31,110
in most USB sticks and things like that.

114
00:04:31,110 --> 00:04:33,030
You can just take it off,
get one of these open source

115
00:04:33,030 --> 00:04:35,820
NandLite design boards
from a guy in Poland.

116
00:04:35,820 --> 00:04:39,510
Sorry, the design's open
source to an extent,

117
00:04:39,510 --> 00:04:41,190
or you can find it on
Alibaba and stuff like that

118
00:04:41,190 --> 00:04:42,023
for a dollar.

119
00:04:42,870 --> 00:04:43,703
And then yeah,

120
00:04:43,703 --> 00:04:44,640
you can actually basically read

121
00:04:44,640 --> 00:04:46,920
and write those chips straight firmware

122
00:04:46,920 --> 00:04:47,940
and things like that.

123
00:04:47,940 --> 00:04:49,860
And the software that it comes with

124
00:04:49,860 --> 00:04:50,820
is actually written in Polish,

125
00:04:50,820 --> 00:04:52,560
which is kind of tricky to use.

126
00:04:52,560 --> 00:04:53,760
And I actually ended up getting

127
00:04:53,760 --> 00:04:55,020
another one of those devices,

128
00:04:55,020 --> 00:04:56,250
the one that I snapped,

129
00:04:56,250 --> 00:04:58,241
and actually accidentally overwrote

130
00:04:58,241 --> 00:05:00,480
the chip instead of reading from it

131
00:05:00,480 --> 00:05:03,393
and I kind of put it to bed for a while.

132
00:05:05,400 --> 00:05:06,690
But yeah, kept going.

133
00:05:06,690 --> 00:05:08,490
So yeah, things like this,

134
00:05:08,490 --> 00:05:10,500
just shearing out screws and things.

135
00:05:10,500 --> 00:05:12,570
But here's a little thing
I just wanna mention

136
00:05:12,570 --> 00:05:13,860
just 'cause we're kind of near the start,

137
00:05:13,860 --> 00:05:16,560
but these companies will be in it.

138
00:05:16,560 --> 00:05:18,870
Companies have always emailed
me after things like this

139
00:05:18,870 --> 00:05:21,510
and gone, "Oh, we hope we're in the talk,"

140
00:05:21,510 --> 00:05:22,343
and things like that,

141
00:05:22,343 --> 00:05:23,490
so I put them at the start

142
00:05:23,490 --> 00:05:24,930
so they don't actually have
to look through the slides

143
00:05:24,930 --> 00:05:27,280
and have a look for themselves after.

144
00:05:27,280 --> 00:05:29,490
(audience laughs)

145
00:05:29,490 --> 00:05:30,960
None of the research today's paid for.

146
00:05:30,960 --> 00:05:32,880
All the research is in good faith.

147
00:05:32,880 --> 00:05:35,460
Nothing today represents me, et cetera.

148
00:05:35,460 --> 00:05:36,293
No gag orders.

149
00:05:36,293 --> 00:05:37,830
It's all CC0 and all the trademarks

150
00:05:37,830 --> 00:05:40,200
belong to the real people that own them.

151
00:05:40,200 --> 00:05:41,100
And there's all my socials.

152
00:05:41,100 --> 00:05:43,950
You can follow me on Twitter,
LinkedIn, GitHub, et cetera.

153
00:05:43,950 --> 00:05:46,410
If you wanna do some work, hit me up.

154
00:05:46,410 --> 00:05:47,700
And that's a tractor.

155
00:05:47,700 --> 00:05:50,400
Sorry, that's a chainsaw looking thing.

156
00:05:50,400 --> 00:05:51,963
It is a forage harvester.

157
00:05:53,670 --> 00:05:56,700
One of those autonomous ones
of those are pretty scary.

158
00:05:56,700 --> 00:06:01,650
So yeah, the thing on top is
actually the GPS dome on top,

159
00:06:01,650 --> 00:06:05,370
which is actually turns it into
a remote controlled device.

160
00:06:05,370 --> 00:06:08,130
And in the cabin, in the guy's seat,

161
00:06:08,130 --> 00:06:09,780
there's actually a
display that he's using.

162
00:06:09,780 --> 00:06:11,790
And I actually have one of
those displays here as well,

163
00:06:11,790 --> 00:06:13,290
so I'll get into that shortly.

164
00:06:15,060 --> 00:06:16,920
So there's three parts really to a tractor

165
00:06:16,920 --> 00:06:19,353
or a machine or an implement, et cetera.

166
00:06:20,207 --> 00:06:21,120
You've got the actual machine itself,

167
00:06:21,120 --> 00:06:23,100
which is the thing that you
can actually get parts for,

168
00:06:23,100 --> 00:06:24,420
which is another thing I'll mention today,

169
00:06:24,420 --> 00:06:25,383
is write to repair.

170
00:06:26,610 --> 00:06:30,243
The parts you can get for
hardware, like nuts, bolts,

171
00:06:31,320 --> 00:06:32,850
pieces of metal, really.

172
00:06:32,850 --> 00:06:34,710
But the things that you can't get

173
00:06:34,710 --> 00:06:36,960
are copies of the software
from the manufacturer

174
00:06:36,960 --> 00:06:39,150
and copies of the unlock codes

175
00:06:39,150 --> 00:06:43,380
and copies of the special
codes, copies of the source,

176
00:06:43,380 --> 00:06:46,200
things like that, source
code, which they might offer.

177
00:06:46,200 --> 00:06:48,500
And in particular, John
Deere does offer that.

178
00:06:50,524 --> 00:06:51,987
And just lastly on this,

179
00:06:51,987 --> 00:06:54,210
all three of those components
are interconnected.

180
00:06:54,210 --> 00:06:55,920
They all actually talk to each other.

181
00:06:55,920 --> 00:06:57,810
So you can actually control the device,

182
00:06:57,810 --> 00:07:00,840
the machine, from the gateway
and also from the display.

183
00:07:00,840 --> 00:07:02,880
And you can also update the
display from the gateway

184
00:07:02,880 --> 00:07:04,020
and the... Et cetera, et cetera.

185
00:07:04,020 --> 00:07:06,540
You can go all the way
around, over can-bus,

186
00:07:06,540 --> 00:07:09,540
automotive ethernet, and a
number of other different things

187
00:07:09,540 --> 00:07:12,360
to talk to the things; including wireless.

188
00:07:12,360 --> 00:07:14,040
And this is the last thing
I'll mentioned of the gateway

189
00:07:14,040 --> 00:07:16,410
before I jump into the cool
thing, which is the display,

190
00:07:16,410 --> 00:07:18,540
which is what I've been
working on for the last month;

191
00:07:18,540 --> 00:07:19,563
pardon me, one year.

192
00:07:21,030 --> 00:07:21,863
This is the gateway.

193
00:07:21,863 --> 00:07:22,696
And yeah, like I said,

194
00:07:22,696 --> 00:07:24,540
this is the only part of the
tractor that's controlled

195
00:07:24,540 --> 00:07:29,283
by the network; it's got
network controls connectivity.

196
00:07:30,300 --> 00:07:32,430
These are the four series of displays...

197
00:07:32,430 --> 00:07:34,050
Let's get some water.

198
00:07:34,050 --> 00:07:39,050
We got the 1800 Display, the
2600, the 2630 and the 4640.

199
00:07:39,300 --> 00:07:40,470
I actually have a 4240,

200
00:07:40,470 --> 00:07:42,960
which is the budget version of the 4640

201
00:07:42,960 --> 00:07:47,490
and it's actually the
flagship model of the series;

202
00:07:47,490 --> 00:07:49,890
it's actually the flagship
device at the moment.

203
00:07:51,480 --> 00:07:54,240
This is the previous one.
This is the brown box.

204
00:07:54,240 --> 00:07:55,650
Now, this actually still works

205
00:07:55,650 --> 00:07:57,390
and farmers actually have this tendency

206
00:07:57,390 --> 00:07:59,340
to stick with stuff that works.

207
00:07:59,340 --> 00:08:02,160
And a lot of people might think a farmer's

208
00:08:02,160 --> 00:08:06,030
actually less intelligent
for using the older stuff,

209
00:08:06,030 --> 00:08:08,760
the more traditional devices,
but the answer is no.

210
00:08:08,760 --> 00:08:11,010
They want stuff to work
when it's actually required.

211
00:08:11,010 --> 00:08:14,490
They want stuff to be
extremely reliable, on point,

212
00:08:14,490 --> 00:08:16,890
when it's reliable... They
don't want anything to go wrong.

213
00:08:16,890 --> 00:08:20,940
When stuff goes wrong during
planning and harvesting season,

214
00:08:20,940 --> 00:08:23,430
farmers get frustrated to say the least.

215
00:08:23,430 --> 00:08:27,000
And to think that things
like software and updates...

216
00:08:27,000 --> 00:08:28,470
Think about Windows updates.

217
00:08:28,470 --> 00:08:31,980
I like Windows, but think
about thinking about updates

218
00:08:31,980 --> 00:08:35,550
during planting season, you know,

219
00:08:35,550 --> 00:08:36,450
you can't use your tractor.

220
00:08:36,450 --> 00:08:37,350
And I'll get into that soon

221
00:08:37,350 --> 00:08:38,280
because that actually happened to me.

222
00:08:38,280 --> 00:08:41,160
Even though I'm not a planter or a farmer,

223
00:08:41,160 --> 00:08:41,993
it actually happened to me

224
00:08:41,993 --> 00:08:44,670
and I had an experience that
I'll enlighten you on shortly.

225
00:08:44,670 --> 00:08:48,130
So these devices are actually 25 years old

226
00:08:49,050 --> 00:08:50,010
and they still work, right?

227
00:08:50,010 --> 00:08:50,843
They still work.

228
00:08:50,843 --> 00:08:52,320
They're actually still in use.

229
00:08:52,320 --> 00:08:54,330
They sell for about 600 bucks still.

230
00:08:54,330 --> 00:08:57,300
So 25 year old devices, 600 bucks

231
00:08:57,300 --> 00:08:59,070
and they have lifetime unlocks.

232
00:08:59,070 --> 00:09:01,980
And what I mean by unlocks
is the devices themselves

233
00:09:01,980 --> 00:09:05,860
have certain codes that
let you use the device

234
00:09:07,650 --> 00:09:11,250
without restrictions in
terms of software packages,

235
00:09:11,250 --> 00:09:12,083
like an app store, right?

236
00:09:12,083 --> 00:09:14,040
They have an app store. It's
technically an app store.

237
00:09:14,040 --> 00:09:15,490
It's the John Deere app store

238
00:09:16,440 --> 00:09:18,540
and we're getting into
that shortly as well.

239
00:09:18,540 --> 00:09:21,150
So the 1800 was one that was rarely used.

240
00:09:21,150 --> 00:09:23,920
It was a Windows CE 6.0 device

241
00:09:24,930 --> 00:09:26,640
and they sell for about 800 bucks.

242
00:09:26,640 --> 00:09:27,750
So they're still getting used today.

243
00:09:27,750 --> 00:09:30,390
This is August this year,
so it's very recent;

244
00:09:30,390 --> 00:09:31,940
they still go for a full price.

245
00:09:34,050 --> 00:09:35,370
And then we have the Windows...

246
00:09:35,370 --> 00:09:38,550
Sorry, this one here I think was VXworks.

247
00:09:38,550 --> 00:09:41,520
The slide's gonna say Windows
CE, but it's actually VXworks

248
00:09:41,520 --> 00:09:43,380
and the other copy of
the slides said VXworks.

249
00:09:43,380 --> 00:09:47,940
But yeah, it's a different
version of its embedded system.

250
00:09:47,940 --> 00:09:49,920
It's practically Linux, so...

251
00:09:49,920 --> 00:09:52,110
2600, $5,600.

252
00:09:52,110 --> 00:09:54,900
This is almost 10, 15
years old now as well;

253
00:09:54,900 --> 00:09:57,180
still goes for a reasonable price.

254
00:09:57,180 --> 00:09:58,440
And then you've got the main one.

255
00:09:58,440 --> 00:10:00,690
This is the 2630. This is the
workhorse of the industry.

256
00:10:00,690 --> 00:10:04,893
Everyone uses this device and
it's running Windows CE 6.0.

257
00:10:06,120 --> 00:10:09,240
So Windows CE 6.0, if
you aren't aware is...

258
00:10:09,240 --> 00:10:11,970
Oh, just quickly, they're
about $8,000 roughly,

259
00:10:11,970 --> 00:10:14,670
at the moment, for a device
that's end of life, okay?

260
00:10:14,670 --> 00:10:16,503
So, Windows CE 6.0 is EOL.

261
00:10:17,550 --> 00:10:21,330
To think that a device
that's EOL or end of life

262
00:10:21,330 --> 00:10:24,333
does not get any updates,
running Windows embedded,

263
00:10:25,710 --> 00:10:27,570
and basically taking the brunt

264
00:10:27,570 --> 00:10:31,890
of the entire food supply chain
is quite concerning to me;

265
00:10:31,890 --> 00:10:33,063
I hope to you as well.

266
00:10:34,680 --> 00:10:36,930
But yeah, credit's due where credit is due

267
00:10:36,930 --> 00:10:39,753
and Windows CE 6.0 keeps the
food supply chain running;

268
00:10:41,760 --> 00:10:43,830
still works actually pretty good.

269
00:10:43,830 --> 00:10:44,663
And farmers...

270
00:10:44,663 --> 00:10:45,496
I'm gonna simplify it here,

271
00:10:45,496 --> 00:10:48,060
but farmers actually have a
pretty straightforward task,

272
00:10:48,060 --> 00:10:51,150
plant seeds, wait for them
to grow, pick them up,

273
00:10:51,150 --> 00:10:53,163
sell them and then buy more.

274
00:10:54,000 --> 00:10:55,440
And yeah, there's actually pretty much

275
00:10:55,440 --> 00:10:56,875
like Farming Simulator, but in real life.

276
00:10:56,875 --> 00:10:57,708
(audience laughs)

277
00:10:57,708 --> 00:11:01,500
So if anyone's played that game,

278
00:11:01,500 --> 00:11:02,910
it's actually very accurate.

279
00:11:02,910 --> 00:11:05,613
So yeah, it's quite interesting.

280
00:11:07,500 --> 00:11:09,510
This is just some of
the licensing agreements

281
00:11:09,510 --> 00:11:10,830
where you can actually ask John Deere

282
00:11:10,830 --> 00:11:12,330
for copies of the source code.

283
00:11:14,310 --> 00:11:15,143
There was actually a video here,

284
00:11:15,143 --> 00:11:18,480
but "You may obtain the complete
corresponding source code

285
00:11:18,480 --> 00:11:19,800
from us for a period of three years."

286
00:11:19,800 --> 00:11:22,680
So I've actually got a
copy of that from them.

287
00:11:22,680 --> 00:11:23,513
We'll talk about that later.

288
00:11:23,513 --> 00:11:27,180
But that code is actually
obviously allegedly open source,

289
00:11:27,180 --> 00:11:30,420
but that's another issue that
is currently being disputed

290
00:11:30,420 --> 00:11:34,020
by multiple parties, I guess.

291
00:11:34,020 --> 00:11:36,180
The 4240 is the one that I've got today.

292
00:11:36,180 --> 00:11:37,830
That's the one that I've got there.

293
00:11:37,830 --> 00:11:39,060
It's sitting there, it's all wired up.

294
00:11:39,060 --> 00:11:40,863
We've got RS232 up the back.

295
00:11:42,570 --> 00:11:43,740
Just a bunch of little cables around.

296
00:11:43,740 --> 00:11:44,880
I've just twisted them all up here.

297
00:11:44,880 --> 00:11:46,320
You probably can't see it,
but you can come up after

298
00:11:46,320 --> 00:11:48,660
and have a look and you'll be able

299
00:11:48,660 --> 00:11:49,530
to do something else as well.

300
00:11:49,530 --> 00:11:51,360
But yeah, these go for
about four and a half grand.

301
00:11:51,360 --> 00:11:52,710
They're a little bit
cheaper than the other ones

302
00:11:52,710 --> 00:11:55,680
because these ones actually
have non-lifetime unlocks;

303
00:11:55,680 --> 00:11:57,690
they have subscription based unlocks.

304
00:11:57,690 --> 00:11:58,523
So the ones that work...

305
00:11:58,523 --> 00:11:59,520
The ones that I showed you before,

306
00:11:59,520 --> 00:12:04,230
they have the same unlocks,
but they are lifetime unlocks.

307
00:12:04,230 --> 00:12:07,530
So farmers prefer reliability,
things that are proven,

308
00:12:07,530 --> 00:12:09,990
familiarity and less device restrictions.

309
00:12:09,990 --> 00:12:11,280
You don't want to be able to...

310
00:12:11,280 --> 00:12:13,830
You don't wanna go into harvesting season

311
00:12:13,830 --> 00:12:18,180
with no 100% reliability...

312
00:12:18,180 --> 00:12:19,440
You don't wanna be relying on something

313
00:12:19,440 --> 00:12:21,300
that is temperamental;

314
00:12:21,300 --> 00:12:25,740
as temperamental as a end
of life Window CE 6.0 device

315
00:12:25,740 --> 00:12:27,993
on the middle of a
barren farm in the heat.

316
00:12:30,480 --> 00:12:32,430
The second reason I'm packing this device

317
00:12:32,430 --> 00:12:33,510
and not one of the older ones

318
00:12:33,510 --> 00:12:34,530
is 'cause this one's actually used

319
00:12:34,530 --> 00:12:35,820
in the secondhand fleet market.

320
00:12:35,820 --> 00:12:38,010
And what I mean by that is that big fleets

321
00:12:38,010 --> 00:12:39,270
that have farming equipment now,

322
00:12:39,270 --> 00:12:41,400
those devices are actually
gonna be passed down

323
00:12:41,400 --> 00:12:44,400
to the current generation
of farmers via secondhand

324
00:12:44,400 --> 00:12:47,970
because a lot of farmers,
mom and dad shops, et cetera,

325
00:12:47,970 --> 00:12:50,040
or family owned businesses,

326
00:12:50,040 --> 00:12:51,900
they can't afford brand new equipment

327
00:12:51,900 --> 00:12:54,900
that a lot of the big
farming operations can.

328
00:12:54,900 --> 00:12:57,030
And that equipment is
actually gonna be passed down,

329
00:12:57,030 --> 00:12:59,520
theoretically, through
auctions and things like that

330
00:12:59,520 --> 00:13:01,170
for second generation.

331
00:13:01,170 --> 00:13:02,730
That's why everyone has the 2630

332
00:13:02,730 --> 00:13:04,500
and that's why I have a 4240,

333
00:13:04,500 --> 00:13:06,477
because the previous
generation gave down the 2630

334
00:13:06,477 --> 00:13:08,850
and that's why all the
farmers all over America

335
00:13:08,850 --> 00:13:11,823
have the Windows CE 6.0 one.

336
00:13:13,710 --> 00:13:17,670
Agricultural tech adoption
is very unique in that,

337
00:13:17,670 --> 00:13:18,503
exactly what I just said,

338
00:13:18,503 --> 00:13:20,310
is people uptake things very, very slowly.

339
00:13:20,310 --> 00:13:23,790
They're very meticulous when
they come to purchasing things

340
00:13:23,790 --> 00:13:26,010
because they wanna make sure
that it's going to last,

341
00:13:26,010 --> 00:13:29,160
A, for a long time and B,
it's not as hard to understand

342
00:13:29,160 --> 00:13:31,460
as what they'd previous
previously been using.

343
00:13:32,940 --> 00:13:34,110
And just showing you the compatibility,

344
00:13:34,110 --> 00:13:37,890
they've got all sorts of
things like CAN, RS232, Analog,

345
00:13:37,890 --> 00:13:42,030
Digital, et cetera, GPS, NTRIP

346
00:13:42,030 --> 00:13:43,620
and I'll tell you other
few things shortly,

347
00:13:43,620 --> 00:13:44,453
but there's another one there.

348
00:13:44,453 --> 00:13:46,560
The second one there, ISOBus VT,

349
00:13:46,560 --> 00:13:49,500
that's a specific type of
application that you can run

350
00:13:49,500 --> 00:13:52,680
and it comes up as a popup
via Can-Bus in the app

351
00:13:52,680 --> 00:13:55,620
and I'm actually working on
some special stuff with that;

352
00:13:55,620 --> 00:13:56,670
Haven't actually completed that,

353
00:13:56,670 --> 00:13:57,600
but we'll get into that shortly.

354
00:13:57,600 --> 00:14:00,780
So the actual OS is Wind River Linux,

355
00:14:00,780 --> 00:14:04,690
and that's a ex Intel company
that now partner with Intel

356
00:14:05,910 --> 00:14:08,250
and they make specific
stuff that you'll find

357
00:14:08,250 --> 00:14:09,810
in things like F-16...

358
00:14:09,810 --> 00:14:14,810
It's the Linux that you'll
find in F-16s, 18s, 22s, 35s,

359
00:14:15,540 --> 00:14:18,900
all different types of
aircraft, Stinger missiles,

360
00:14:18,900 --> 00:14:20,073
Tomahawk missiles,

361
00:14:21,780 --> 00:14:22,983
and the Mars Rovers.

362
00:14:24,090 --> 00:14:24,923
I thought there was only one.

363
00:14:24,923 --> 00:14:28,320
But anyway, that's the
device that I've got today.

364
00:14:28,320 --> 00:14:30,330
Looks really nice like that, pristine.

365
00:14:30,330 --> 00:14:31,530
It looks a lot better than the brown one

366
00:14:31,530 --> 00:14:32,370
that I showed you, right?

367
00:14:32,370 --> 00:14:33,630
It's 3D.

368
00:14:33,630 --> 00:14:35,190
Actually, I'll tell you
about that 3D thing shortly,

369
00:14:35,190 --> 00:14:37,920
but you can actually
play with this online.

370
00:14:37,920 --> 00:14:40,077
So you can go on the displaysimulator
website by John Deere

371
00:14:40,077 --> 00:14:41,070
and actually have a go.

372
00:14:41,070 --> 00:14:44,130
You now need to log in via
Okta because they added Okta

373
00:14:44,130 --> 00:14:45,330
for a lot of different pages

374
00:14:45,330 --> 00:14:48,243
after I had a look into
their stuff last year,

375
00:14:49,207 --> 00:14:50,965
(audience laughs)

376
00:14:50,965 --> 00:14:52,800
but now they've got Okta
covering pretty much everything,

377
00:14:52,800 --> 00:14:53,850
so you've gotta sign up.

378
00:14:53,850 --> 00:14:55,020
You can sign up as a free developer.

379
00:14:55,020 --> 00:14:56,490
I'm not sure if they're giving
them away still, though.

380
00:14:56,490 --> 00:14:59,370
But yeah, I was able to sign
up as a developer last year,

381
00:14:59,370 --> 00:15:01,170
but I'm not gonna get into that 'cause...

382
00:15:01,170 --> 00:15:03,510
Yeah, it's not the point
of today's exercise.

383
00:15:03,510 --> 00:15:07,140
But yeah, that's what the
device looks like powered on.

384
00:15:07,140 --> 00:15:10,500
And that's my farm there,
covered in corn, obviously.

385
00:15:10,500 --> 00:15:12,150
It's actually someone else's farm

386
00:15:12,150 --> 00:15:14,900
because it's from some guy
in Italy that I got off eBay

387
00:15:15,930 --> 00:15:18,120
and his farm's still hooked into it,

388
00:15:18,120 --> 00:15:20,226
so I've just been using his data.

389
00:15:20,226 --> 00:15:23,010
(audience laughs)

390
00:15:23,010 --> 00:15:24,510
So he hasn't actually
used the demo as well.

391
00:15:24,510 --> 00:15:25,980
So there's actually demos.

392
00:15:25,980 --> 00:15:27,150
Could you believe this, right?

393
00:15:27,150 --> 00:15:28,200
Even though it's GPL,

394
00:15:28,200 --> 00:15:30,510
even though the GPL strictly says...

395
00:15:30,510 --> 00:15:31,830
Certain parts of the GPL.

396
00:15:31,830 --> 00:15:33,900
Even though the GPL
certainly specifically says

397
00:15:33,900 --> 00:15:35,640
that things such as subscriptions

398
00:15:35,640 --> 00:15:36,750
aren't allowed to stop working

399
00:15:36,750 --> 00:15:40,380
after you stop paying for them
in any version of the GPL,

400
00:15:40,380 --> 00:15:42,270
we've still got demos
here that stop working

401
00:15:42,270 --> 00:15:44,310
after 15 hours of machine time use.

402
00:15:44,310 --> 00:15:46,470
So I actually know a couple of guys

403
00:15:46,470 --> 00:15:48,450
that have actually built things
that stop the clock on these

404
00:15:48,450 --> 00:15:49,740
and actually roll it back every day,

405
00:15:49,740 --> 00:15:51,390
so you can keep getting the demo.

406
00:15:52,410 --> 00:15:55,080
And there's a couple guys
in Brazil that do that.

407
00:15:55,080 --> 00:15:56,220
But that's not what I'm
talking about right now.

408
00:15:56,220 --> 00:15:57,510
So I'm talking about some fun stuff.

409
00:15:57,510 --> 00:15:58,830
So yeah, dollar bills.

410
00:15:58,830 --> 00:16:00,270
This is how much those licenses are.

411
00:16:00,270 --> 00:16:03,450
So I've got a big, nice
price list here, for you.

412
00:16:03,450 --> 00:16:04,597
Some of the expensive stuff.

413
00:16:04,597 --> 00:16:07,653
$23,000 for an EOL 2630.

414
00:16:08,940 --> 00:16:10,200
That's not cheap, right?

415
00:16:10,200 --> 00:16:11,610
So that's $26.

416
00:16:11,610 --> 00:16:14,460
The most important things
are RTK activation.

417
00:16:14,460 --> 00:16:15,360
Three and a half grand...

418
00:16:15,360 --> 00:16:17,010
That's lifetime unlocked by the way.

419
00:16:17,010 --> 00:16:19,530
Three and a half grand for RTK activation.

420
00:16:19,530 --> 00:16:21,510
That lets you use radio, right?

421
00:16:21,510 --> 00:16:22,650
That's already there, right?

422
00:16:22,650 --> 00:16:24,330
That's already on the device.
It's already programmed.

423
00:16:24,330 --> 00:16:26,340
I've seen it on the device, right?

424
00:16:26,340 --> 00:16:27,480
That program's already there

425
00:16:27,480 --> 00:16:28,770
and all you're doing is
paying for the unlock,

426
00:16:28,770 --> 00:16:31,020
which I understand,
there's a point for that,

427
00:16:31,020 --> 00:16:33,220
but I'm just showing
the prices; that's all.

428
00:16:34,470 --> 00:16:36,090
So yeah, some more prices here.

429
00:16:36,090 --> 00:16:38,070
The new ones, a little bit
different, as you can see,

430
00:16:38,070 --> 00:16:40,593
subscriptions,
subscriptions, subscriptions.

431
00:16:42,480 --> 00:16:43,470
Yeah, if you look at this,

432
00:16:43,470 --> 00:16:45,330
these are just upgrades
between different versions

433
00:16:45,330 --> 00:16:46,163
of the 4600.

434
00:16:46,163 --> 00:16:48,150
So Gen IV is the Gen IV that I've got,

435
00:16:48,150 --> 00:16:50,150
the generation of devices I've got here.

436
00:16:52,560 --> 00:16:55,080
This is me having a crack at opening it.

437
00:16:55,080 --> 00:16:56,453
Yeah, it's got that...

438
00:16:56,453 --> 00:16:58,140
You know that glue between your
phone screen and the device?

439
00:16:58,140 --> 00:16:59,670
It's got that, but everywhere.

440
00:16:59,670 --> 00:17:01,220
It's a pain in the ass to open.

441
00:17:02,310 --> 00:17:06,243
It's running NXP i.MX6, so pretty old.

442
00:17:07,710 --> 00:17:08,830
Not necessarily pretty old.

443
00:17:08,830 --> 00:17:10,933
I think it's 2015, 2016;
round about that time.

444
00:17:10,933 --> 00:17:13,080
i.MX8's out. I think 9's out, actually.

445
00:17:13,080 --> 00:17:15,273
But someone from NXP is probably here.

446
00:17:16,950 --> 00:17:17,970
Yeah. You've got RAM, you know,

447
00:17:17,970 --> 00:17:19,980
your little RAM there,
covered in this yellow stuff.

448
00:17:19,980 --> 00:17:21,300
If anyone knows what the yellow stuff is,

449
00:17:21,300 --> 00:17:22,710
I've been trying to find
out for quite some time.

450
00:17:22,710 --> 00:17:23,700
It's actually really...

451
00:17:23,700 --> 00:17:26,744
I don't know if it's some
sort of fiberglass or...

452
00:17:26,744 --> 00:17:28,050
- [Spectator 1] (indistinct)

453
00:17:28,050 --> 00:17:30,120
- Yeah, I get that it's heating.

454
00:17:30,120 --> 00:17:33,030
I don't know what it's made
of 'cause it's like almost...

455
00:17:33,030 --> 00:17:35,141
It feels like you've got itchy stuff

456
00:17:35,141 --> 00:17:36,300
after you've touched it.

457
00:17:36,300 --> 00:17:38,040
But one of the devices they've got,

458
00:17:38,040 --> 00:17:41,580
they actually covered the entire
thing in that yellow stuff

459
00:17:41,580 --> 00:17:42,720
for heat sync purposes

460
00:17:42,720 --> 00:17:44,940
in terms of when you
actually took off the device,

461
00:17:44,940 --> 00:17:48,990
it would rip off the
NAND and irreparably...

462
00:17:48,990 --> 00:17:50,850
You wouldn't be able to put
that flash back on the thing

463
00:17:50,850 --> 00:17:52,140
just for opening the device.

464
00:17:52,140 --> 00:17:55,770
And yeah, it's happened
in more than one occasion

465
00:17:55,770 --> 00:17:56,670
on the same device.

466
00:17:56,670 --> 00:17:59,340
So just having a look at the other side,

467
00:17:59,340 --> 00:18:01,590
pretty bare board, it's by Continental.

468
00:18:01,590 --> 00:18:02,550
And I thought at the start of this

469
00:18:02,550 --> 00:18:03,810
they just made soups and tires,

470
00:18:03,810 --> 00:18:05,710
but they make more products than that.

471
00:18:07,560 --> 00:18:10,383
That's the proprietary
thing called HS AutoLink2.

472
00:18:10,383 --> 00:18:14,010
It's a Molex connector
that you can't get anywhere

473
00:18:14,010 --> 00:18:16,010
because it's, like, proprietary as hell.

474
00:18:17,130 --> 00:18:18,866
And that's what they look like.

475
00:18:18,866 --> 00:18:20,216
It's just a 12 pin, 2 rows.

476
00:18:21,330 --> 00:18:23,310
I think John Deere only uses
a couple of the pins anyway,

477
00:18:23,310 --> 00:18:26,430
so they just made it more abstract

478
00:18:26,430 --> 00:18:29,193
and more difficult to play with.

479
00:18:31,022 --> 00:18:31,855
Oh, that video is missing.

480
00:18:31,855 --> 00:18:32,817
But yeah, this is the pinout

481
00:18:32,817 --> 00:18:34,650
of that 26 pin connector on the back.

482
00:18:34,650 --> 00:18:36,510
What I'll point out to you here is,

483
00:18:36,510 --> 00:18:37,860
you just need three wires to turn it on.

484
00:18:37,860 --> 00:18:38,693
I've got three wires here.

485
00:18:38,693 --> 00:18:40,175
I'll just show you what it looks like.

486
00:18:40,175 --> 00:18:42,095
Even though you can't see 'cause...

487
00:18:42,095 --> 00:18:42,928
Even though you can't see,

488
00:18:42,928 --> 00:18:44,190
'cause you're probably in
the audience and everything,

489
00:18:44,190 --> 00:18:45,060
but you can come over a look after.

490
00:18:45,060 --> 00:18:47,610
But it's just running off
three wires at the moment

491
00:18:48,900 --> 00:18:51,000
and those three wires are connected.

492
00:18:51,000 --> 00:18:52,700
But then, there's two secret wires

493
00:18:53,705 --> 00:18:54,960
and I don't know if it's
John Deere's secret wise

494
00:18:54,960 --> 00:18:56,670
or there's just two secret wires there,

495
00:18:56,670 --> 00:18:58,770
but that's RS232 serial.

496
00:18:58,770 --> 00:19:00,720
So you can pop a shell with those ones.

497
00:19:02,430 --> 00:19:04,380
Yeah, the blue one and the yellow one

498
00:19:04,380 --> 00:19:08,325
correspond to the pin two
and pin three on RS232

499
00:19:08,325 --> 00:19:09,450
and you can just hook straight into it.

500
00:19:09,450 --> 00:19:11,610
So I actually burnt out...

501
00:19:11,610 --> 00:19:12,450
I'll tell about that in a sec.

502
00:19:12,450 --> 00:19:14,760
But yeah, this is the
same connector you'll find

503
00:19:14,760 --> 00:19:16,500
in your old printers and things like that.

504
00:19:16,500 --> 00:19:18,090
So you can probably find
these around the house

505
00:19:18,090 --> 00:19:20,223
and in cupboards and things like that.

506
00:19:21,510 --> 00:19:22,710
Everyone knows what it is anyway.

507
00:19:22,710 --> 00:19:23,700
Or the younger generation, yeah,

508
00:19:23,700 --> 00:19:24,690
you can go digging for them.

509
00:19:24,690 --> 00:19:26,250
But they're pretty easy to find.

510
00:19:26,250 --> 00:19:27,330
They're usually pretty old and dusty.

511
00:19:27,330 --> 00:19:29,340
But John Deere's got
its own pinout for that,

512
00:19:29,340 --> 00:19:30,900
like I said, two, three and five.

513
00:19:30,900 --> 00:19:33,840
It's just in, out and ground.

514
00:19:33,840 --> 00:19:36,900
And then, what happened was
I actually connected this up

515
00:19:36,900 --> 00:19:39,800
with the 12 Volt ground and
you're not supposed to do that

516
00:19:41,100 --> 00:19:43,500
and actually got into this state where...

517
00:19:43,500 --> 00:19:45,360
This is actually not because
of that error that I told you,

518
00:19:45,360 --> 00:19:47,520
but this is an error that happens

519
00:19:47,520 --> 00:19:51,240
when you reboot the device 10 times

520
00:19:51,240 --> 00:19:55,080
without actually letting it boot fully.

521
00:19:55,080 --> 00:19:58,710
So if it reboots 10 times,
you get to this error screen.

522
00:19:58,710 --> 00:20:00,517
So it says you must contact the dealer.

523
00:20:00,517 --> 00:20:02,250
"You absolutely must contact the dealer."

524
00:20:02,250 --> 00:20:03,083
And I thought, "Okay."

525
00:20:03,083 --> 00:20:04,380
So we jump in that serial

526
00:20:04,380 --> 00:20:05,400
that I was just talking about there.

527
00:20:05,400 --> 00:20:06,510
You probably can't read that,

528
00:20:06,510 --> 00:20:08,640
but it says file system check.

529
00:20:08,640 --> 00:20:11,497
We're having a look and I thought

530
00:20:11,497 --> 00:20:13,380
"Now's a good time to
desolder the NAND flash

531
00:20:13,380 --> 00:20:15,270
and have a look and change the boot count

532
00:20:15,270 --> 00:20:18,050
that they've got in there
from 10 to 1,000 or 10,000

533
00:20:18,050 --> 00:20:19,250
or something like that."

534
00:20:20,340 --> 00:20:22,350
So I desoldered it, right?
And changed this, here.

535
00:20:22,350 --> 00:20:25,190
So it's got max boot count
in this boot sector...

536
00:20:26,520 --> 00:20:27,660
Sorry, that's in the boot partition.

537
00:20:27,660 --> 00:20:29,070
It's literally just plain text.

538
00:20:29,070 --> 00:20:33,450
So that's max boot count
10, recovery boot count six.

539
00:20:33,450 --> 00:20:35,430
I believe it's a running tally.

540
00:20:35,430 --> 00:20:38,070
So what I did, this is
the terminal that pops up.

541
00:20:38,070 --> 00:20:40,230
I actually desolded it,

542
00:20:40,230 --> 00:20:43,650
chucked it into the flash reader
that I showed you earlier,

543
00:20:43,650 --> 00:20:46,020
mounted one of the partitions
that I working with,

544
00:20:46,020 --> 00:20:47,340
reballed it and this takes...

545
00:20:47,340 --> 00:20:48,940
This is a nightmare, by the way.

546
00:20:50,730 --> 00:20:51,930
I think Lewis Rossman was here earlier

547
00:20:51,930 --> 00:20:53,250
and he would think this is disgusting,

548
00:20:53,250 --> 00:20:55,531
this way I've treated this board.

549
00:20:55,531 --> 00:20:57,420
(audience laughs)

550
00:20:57,420 --> 00:20:59,310
But yeah, it looks
alright under, like that.

551
00:20:59,310 --> 00:21:01,410
And then you can rub
it on a piece of paper

552
00:21:01,410 --> 00:21:04,020
and get it to level the balls out.

553
00:21:04,020 --> 00:21:05,793
But yeah, that looks terrible.

554
00:21:07,770 --> 00:21:08,970
But anyway, when it goes back on,

555
00:21:08,970 --> 00:21:11,190
I'd actually set the max boot count...

556
00:21:11,190 --> 00:21:12,870
I think the max boot count to 10,

557
00:21:12,870 --> 00:21:16,500
but I'd changed the current
running number to 9999

558
00:21:16,500 --> 00:21:17,670
and obviously it was not gonna boot

559
00:21:17,670 --> 00:21:19,530
because it was already past 10.

560
00:21:19,530 --> 00:21:23,040
So then, I went into the manuals

561
00:21:23,040 --> 00:21:24,210
that I just got from the disc

562
00:21:24,210 --> 00:21:25,170
and there was instructions there

563
00:21:25,170 --> 00:21:26,820
about how to actually recover this, right?

564
00:21:26,820 --> 00:21:27,727
You have to contact the dealer.

565
00:21:27,727 --> 00:21:30,477
"Please contact your
local John Deere dealer."

566
00:21:33,150 --> 00:21:36,030
And what if I don't have a
dealer? What if I'm in Thailand?

567
00:21:36,030 --> 00:21:37,740
Which I do live in Thailand.

568
00:21:37,740 --> 00:21:38,850
What if I don't have a dealer?

569
00:21:38,850 --> 00:21:41,730
What if I don't have a
local dealer in Thailand?

570
00:21:41,730 --> 00:21:42,563
And I could...

571
00:21:42,563 --> 00:21:43,396
Oh, let's find one, right?

572
00:21:43,396 --> 00:21:45,480
We go the Virtual Asia Showroom.

573
00:21:45,480 --> 00:21:48,180
So we've got the virtual
John Deere Asia showroom

574
00:21:48,180 --> 00:21:49,380
and let's find a dealer.

575
00:21:51,420 --> 00:21:53,580
So this spins forever, by the way.

576
00:21:53,580 --> 00:21:54,413
There's no dealers.

577
00:21:54,413 --> 00:21:56,045
And I went and found some...

578
00:21:56,045 --> 00:21:57,570
(audience laughs)

579
00:21:57,570 --> 00:21:59,490
This is, like, a 20 day
walk or something like that,

580
00:21:59,490 --> 00:22:00,555
if you get there.

581
00:22:00,555 --> 00:22:04,269
So I thought I'll take
this into my own hands.

582
00:22:04,269 --> 00:22:06,510
(audience laughs)

583
00:22:06,510 --> 00:22:08,160
Yeah, I'll become the dealer now.

584
00:22:09,630 --> 00:22:10,890
So then, you get this thing called

585
00:22:10,890 --> 00:22:13,290
the Software Manager for John Deere.

586
00:22:13,290 --> 00:22:14,640
It's quite a... Yes.

587
00:22:14,640 --> 00:22:15,570
John Deere Software Manager.

588
00:22:15,570 --> 00:22:16,403
It's pretty, right?

589
00:22:16,403 --> 00:22:18,600
So this actually downloads...

590
00:22:18,600 --> 00:22:19,770
As you can see in the running tally,

591
00:22:19,770 --> 00:22:23,970
it downloads over 235 packages.

592
00:22:23,970 --> 00:22:25,020
And what do I mean by packages?

593
00:22:25,020 --> 00:22:26,310
I mean RPMs.

594
00:22:26,310 --> 00:22:28,500
It downloads the John Deere RPMs.

595
00:22:28,500 --> 00:22:30,660
So anyone who understands what an RPM is,

596
00:22:30,660 --> 00:22:34,650
it's literally just a .deb
for RedHat-based Linuxes.

597
00:22:35,600 --> 00:22:36,750
And would you happen to know

598
00:22:36,750 --> 00:22:38,730
that Wind River Linux is Red-based.

599
00:22:38,730 --> 00:22:43,380
So we can just install these
on any RedHat-based Linux,

600
00:22:43,380 --> 00:22:44,460
but I'll get into that shortly

601
00:22:44,460 --> 00:22:46,210
because John Deere's gonna love it.

602
00:22:47,280 --> 00:22:48,113
So, yeah.

603
00:22:48,113 --> 00:22:49,920
So you get 12 gigs when you
download that stuff as well.

604
00:22:49,920 --> 00:22:52,560
They give you 12 gigs, 12 huge gigs,

605
00:22:52,560 --> 00:22:54,090
and you don't actually need all of them.

606
00:22:54,090 --> 00:22:56,160
It actually downloads
multiple architectures

607
00:22:56,160 --> 00:23:00,063
and you actually get
armv7, atom, i7, armv7v2,

608
00:23:01,200 --> 00:23:03,270
I think it is, and then you've got noarch,

609
00:23:03,270 --> 00:23:04,680
which works on everything, by the way.

610
00:23:04,680 --> 00:23:06,423
So I thought to myself,

611
00:23:07,590 --> 00:23:09,420
let's have a look through
the files that I downloaded.

612
00:23:09,420 --> 00:23:10,620
So there's this thing in here,

613
00:23:10,620 --> 00:23:13,380
I think this is from the device
itself when I desoldered it

614
00:23:13,380 --> 00:23:15,240
or from the update stuff.

615
00:23:15,240 --> 00:23:16,410
But you can see this file here.

616
00:23:16,410 --> 00:23:17,857
If you can't read it, I'll read it out.

617
00:23:17,857 --> 00:23:20,520
"The reprogramming image check file."

618
00:23:20,520 --> 00:23:22,320
And if you don't know what a check file,

619
00:23:22,320 --> 00:23:24,210
I assume that it's a
file that would be there

620
00:23:24,210 --> 00:23:26,760
that would tell it that
it's going to do something.

621
00:23:26,760 --> 00:23:30,333
And then it says JDeereBootableUSBflag.

622
00:23:32,460 --> 00:23:33,900
So I thought, "Okay, what would that be?"

623
00:23:33,900 --> 00:23:36,720
So, "Oh, this might be
something that lets me pass

624
00:23:36,720 --> 00:23:38,920
that bloody black screen
that I had before."

625
00:23:39,990 --> 00:23:42,570
So I've got the John Deere
display updates here,

626
00:23:42,570 --> 00:23:44,880
the 22 gigs that it
downloads onto USB stick

627
00:23:44,880 --> 00:23:46,280
and that's my serial number.

628
00:23:47,280 --> 00:23:49,770
Yeah.

629
00:23:49,770 --> 00:23:53,010
So we upload that into the USB stick

630
00:23:53,010 --> 00:23:54,030
and this other one there,

631
00:23:54,030 --> 00:23:56,790
that was another one that
I found the 43434 one.

632
00:23:56,790 --> 00:23:57,623
So I chucked that in there

633
00:23:57,623 --> 00:23:59,610
and then it comes up with this now,

634
00:23:59,610 --> 00:24:00,450
when I reboot the device.

635
00:24:00,450 --> 00:24:01,500
It comes up with 1.0.

636
00:24:03,299 --> 00:24:04,230
Deal authentication one...

637
00:24:04,230 --> 00:24:05,063
Oh, sorry.

638
00:24:05,063 --> 00:24:09,510
System recovery version 1.1, 1.2, 3.1

639
00:24:09,510 --> 00:24:11,310
and it's actually
bootlooped at the moment,

640
00:24:11,310 --> 00:24:13,230
because I'm actually trying to overload...

641
00:24:13,230 --> 00:24:15,810
I'm trying to run four
different system recovery images

642
00:24:15,810 --> 00:24:16,643
at once.

643
00:24:19,530 --> 00:24:22,299
And that was actually the genuine problem.

644
00:24:22,299 --> 00:24:23,520
All I to do was remove two of them

645
00:24:23,520 --> 00:24:27,392
and the ultimate solution
was dealerauth.txt,

646
00:24:27,392 --> 00:24:28,740
and that would actually
get us to this stage

647
00:24:28,740 --> 00:24:30,393
which bypasses that dealer page.

648
00:24:31,860 --> 00:24:34,560
Farmers can use that to
bypass that page in the field.

649
00:24:37,230 --> 00:24:38,063
Yeah, that's it.

650
00:24:38,063 --> 00:24:40,380
So that's the John Deere
dealer authentication bypass.

651
00:24:40,380 --> 00:24:41,556
You just put a txt file.

652
00:24:41,556 --> 00:24:43,413
(audience laughs)

653
00:24:43,413 --> 00:24:46,413
(audience applauds)

654
00:24:50,270 --> 00:24:52,830
So that's dealerAuth.txt.

655
00:24:52,830 --> 00:24:54,120
You can literally do it with your phone.

656
00:24:54,120 --> 00:24:58,080
You can OTP cable.

657
00:24:58,080 --> 00:25:00,300
You can do it out in the field,
you just chuck it on there.

658
00:25:00,300 --> 00:25:01,140
That's literally...

659
00:25:01,140 --> 00:25:03,600
If you boot the device 10
times in a row and it...

660
00:25:03,600 --> 00:25:04,433
I don't wanna do it right now

661
00:25:04,433 --> 00:25:05,310
'cause I won't be able to use this,

662
00:25:05,310 --> 00:25:07,200
but if you reboot it 10 times,

663
00:25:07,200 --> 00:25:08,550
you'll get stuck at that page

664
00:25:08,550 --> 00:25:10,560
and then you get that
reboot thing and then,

665
00:25:10,560 --> 00:25:11,793
it's just magic.

666
00:25:13,875 --> 00:25:14,708
Yeah.

667
00:25:14,708 --> 00:25:16,350
So then, it starts to
reinstall, starts to fix itself.

668
00:25:16,350 --> 00:25:18,750
I don't have to go for a
10 day walk to Bangkok.

669
00:25:21,180 --> 00:25:22,013
Then it comes here.

670
00:25:22,013 --> 00:25:23,010
So we've got the full...

671
00:25:23,010 --> 00:25:24,900
Yeah, we've got it back to the ULA

672
00:25:24,900 --> 00:25:26,850
and I'll talk about my ULA
in a little bit as well.

673
00:25:26,850 --> 00:25:29,880
So yeah, that fully worked

674
00:25:29,880 --> 00:25:30,840
and then we've got logs.

675
00:25:30,840 --> 00:25:33,930
It sent back logs back to the
USB stick that I plugged in.

676
00:25:33,930 --> 00:25:36,393
In fact, it sent back
1.6 gigabytes of logs.

677
00:25:37,847 --> 00:25:39,660
So it was actually logs, like full...

678
00:25:39,660 --> 00:25:41,640
They would just go like
CD slash and go find

679
00:25:41,640 --> 00:25:45,030
and get massive lists of all
the files that are in there,

680
00:25:45,030 --> 00:25:49,500
connected devices, all
of the system dlogs;

681
00:25:49,500 --> 00:25:50,670
just literally everything.

682
00:25:50,670 --> 00:25:52,695
And then I had this shellback.

683
00:25:52,695 --> 00:25:54,300
I had the shell and I could come back in

684
00:25:54,300 --> 00:25:56,280
and RS232 straight in.

685
00:25:56,280 --> 00:25:59,910
So what we're looking
at here is the fstab.

686
00:25:59,910 --> 00:26:00,743
I thought to myself,

687
00:26:00,743 --> 00:26:02,257
"Okay. So why would I
wanna edit the fstab?"

688
00:26:02,257 --> 00:26:04,560
"Okay. I wanna be able
to edit this stuff now.

689
00:26:04,560 --> 00:26:07,290
So I wanna modify the
device that I've got.

690
00:26:07,290 --> 00:26:08,610
This is my device. I own it.

691
00:26:08,610 --> 00:26:12,153
It's my tractor, allegedly,
and I want to edit it."

692
00:26:12,153 --> 00:26:12,986
So what I wanna do,

693
00:26:12,986 --> 00:26:14,550
I wanna change everything to read, write.

694
00:26:14,550 --> 00:26:16,860
So obviously, read-only discs,

695
00:26:16,860 --> 00:26:19,200
you can't muck around with them, but...

696
00:26:19,200 --> 00:26:20,700
So I took the disc off again

697
00:26:20,700 --> 00:26:22,260
and I wanna root the device now.

698
00:26:22,260 --> 00:26:23,093
I wanna root it.

699
00:26:23,093 --> 00:26:26,940
So these are just connected stuff

700
00:26:26,940 --> 00:26:29,130
on a white-listed devices
ePROM, which I've actually

701
00:26:29,130 --> 00:26:31,863
got a little bit of
information about shortly,

702
00:26:31,863 --> 00:26:32,880
that actually contains a serial number

703
00:26:32,880 --> 00:26:34,650
and I'll tell you a little
trick about that soon.

704
00:26:34,650 --> 00:26:36,030
But yeah, we've got a
couple of things here.

705
00:26:36,030 --> 00:26:37,410
We've got the real time clock,

706
00:26:37,410 --> 00:26:38,910
your i squared c, we've got the video

707
00:26:38,910 --> 00:26:41,160
and two frame buffers 'cause
its got two different types...

708
00:26:41,160 --> 00:26:41,993
(Sick Codes burps)

709
00:26:41,993 --> 00:26:42,990
You can have extended displays.

710
00:26:42,990 --> 00:26:43,823
Excuse me.

711
00:26:44,970 --> 00:26:46,560
Then you've got this
one here, read, write.

712
00:26:46,560 --> 00:26:48,300
So the SSH keys must be generated

713
00:26:48,300 --> 00:26:50,640
while the unit is in read, write mode.

714
00:26:50,640 --> 00:26:53,883
So an easy way to do this is
start and stop the SSH daemon.

715
00:26:54,810 --> 00:26:57,930
So this is in the John Deere
proprietary code allegedly

716
00:26:57,930 --> 00:27:01,020
and the SSH keys have to
be done in read, write.

717
00:27:01,020 --> 00:27:02,520
So how do we get to read, write mode?

718
00:27:02,520 --> 00:27:04,103
I'm thinking, "Okay. So I
have to generate fstab."

719
00:27:04,103 --> 00:27:05,337
And no, the only way you do it is,

720
00:27:05,337 --> 00:27:08,940
you just do mount -o remount, rewrite /

721
00:27:08,940 --> 00:27:11,163
and that's it, you're in read, write mode.

722
00:27:14,370 --> 00:27:15,277
So I thought to myself,

723
00:27:15,277 --> 00:27:17,910
"Well, every time you take
that disc off the board, right?

724
00:27:17,910 --> 00:27:19,530
It gets damaged. So it gets damaged.

725
00:27:19,530 --> 00:27:20,790
It gets, like, heat.

726
00:27:20,790 --> 00:27:23,220
You bring it up to 450
degrees or 400 or whatever,

727
00:27:23,220 --> 00:27:25,860
and then you take it off and
you get scratches everywhere,"

728
00:27:25,860 --> 00:27:28,590
like I did, if you're
a novice like myself.

729
00:27:28,590 --> 00:27:30,690
But if you go on the back of the board,

730
00:27:30,690 --> 00:27:32,637
you could hook up your
pins there and get MMC

731
00:27:32,637 --> 00:27:33,690
and that's actually wrong.

732
00:27:33,690 --> 00:27:35,160
And someone will point out
they're actually back to front,

733
00:27:35,160 --> 00:27:37,560
the two ones, and this
didn't work by the way.

734
00:27:37,560 --> 00:27:40,290
This is continuous and
continuous failures, okay?

735
00:27:40,290 --> 00:27:41,123
Continuous failures.

736
00:27:41,123 --> 00:27:44,081
And that's kind of where I'm
trying to get at is like,

737
00:27:44,081 --> 00:27:44,914
you just gotta keep going.

738
00:27:44,914 --> 00:27:45,747
You just gotta keep going.

739
00:27:45,747 --> 00:27:46,683
Just never give up.

740
00:27:47,730 --> 00:27:49,470
So yeah, the boot count failed.

741
00:27:49,470 --> 00:27:52,680
That 9999 boot count failed, obviously.

742
00:27:52,680 --> 00:27:55,590
But we bypassed that when
we reflashed the device

743
00:27:55,590 --> 00:27:57,240
through that dealer, blah, blah, blah.

744
00:27:57,240 --> 00:27:59,100
And we got to the stage where we've got

745
00:27:59,100 --> 00:28:01,800
this little thing now where
I can actually modify it

746
00:28:01,800 --> 00:28:03,060
and what I did....

747
00:28:03,060 --> 00:28:04,140
Oh, I'll show you in a second.

748
00:28:04,140 --> 00:28:05,400
There's actually a command
in there that I found

749
00:28:05,400 --> 00:28:09,030
when I was looking at the OS
called RebootClearBootCount,

750
00:28:09,030 --> 00:28:11,120
So I can actually reset
that 10 every time, now.

751
00:28:11,120 --> 00:28:13,170
So I've set it up now so
every time that it reboots,

752
00:28:13,170 --> 00:28:14,730
it clears the counter.

753
00:28:14,730 --> 00:28:16,710
So I don't have to worry about
the reboot counter anymore.

754
00:28:16,710 --> 00:28:18,110
So that's quite significant.

755
00:28:19,800 --> 00:28:20,633
And this is what happens

756
00:28:20,633 --> 00:28:22,590
when you don't solder it on properly.

757
00:28:22,590 --> 00:28:25,500
You can actually get these
second hand from Alibaba

758
00:28:25,500 --> 00:28:27,870
because these chips are
end of life as well.

759
00:28:27,870 --> 00:28:30,540
But you can actually
get these chips from...

760
00:28:30,540 --> 00:28:32,883
Just chopped, straight
out of a real board.

761
00:28:34,470 --> 00:28:35,370
They're actually end of life

762
00:28:35,370 --> 00:28:36,630
so you literally can't
buy them anywhere else

763
00:28:36,630 --> 00:28:38,160
except for these places or second hand.

764
00:28:38,160 --> 00:28:40,643
And usually, the second
hand ones have data on them.

765
00:28:43,505 --> 00:28:44,338
(audience laughs)

766
00:28:44,338 --> 00:28:46,110
Sometimes, you gotta improvise.

767
00:28:46,110 --> 00:28:49,350
This is actually piece of your hot plate

768
00:28:49,350 --> 00:28:50,580
that you can make from an iron.

769
00:28:50,580 --> 00:28:53,253
It's actually quite dangerous,
but gets the job done.

770
00:28:54,510 --> 00:28:55,343
This isn't mine.

771
00:28:55,343 --> 00:28:57,690
It's a guy that I was working
with in Eastern Europe.

772
00:28:57,690 --> 00:28:59,610
So, he's got this one.

773
00:28:59,610 --> 00:29:02,370
So this is what happens when
you muck around with libsdl

774
00:29:02,370 --> 00:29:04,200
and that might be a giveaway
for what's happening soon.

775
00:29:04,200 --> 00:29:08,370
But yeah, that's what
happens when you muck around

776
00:29:08,370 --> 00:29:09,390
with some of the graphic stuff

777
00:29:09,390 --> 00:29:11,040
and I'll get into the
graphic stuff shortly

778
00:29:11,040 --> 00:29:12,450
and why that happens.

779
00:29:12,450 --> 00:29:14,940
But what I did was I added some specific

780
00:29:14,940 --> 00:29:18,030
thing to the cron jobs
when I was playing with it

781
00:29:18,030 --> 00:29:22,413
so that when it was rebooted,
it would actually do this.

782
00:29:23,340 --> 00:29:26,490
And we get a terminal every two minutes.

783
00:29:26,490 --> 00:29:27,600
So then, we put a cron job

784
00:29:27,600 --> 00:29:29,280
and we get a root terminal
every two minutes.

785
00:29:29,280 --> 00:29:30,230
It's actually root.

786
00:29:33,150 --> 00:29:35,790
In addition, there was actually
a lot of binaries missing.

787
00:29:35,790 --> 00:29:36,900
So I'm thinking, "Okay..."

788
00:29:36,900 --> 00:29:37,987
When you Tab, Tab and it's like,

789
00:29:37,987 --> 00:29:41,040
"Display 1000 something
more combinations."

790
00:29:41,040 --> 00:29:42,270
I'm like, "Okay, there's extra ones."

791
00:29:42,270 --> 00:29:44,490
So I built a script that
just gets all the extra parts

792
00:29:44,490 --> 00:29:46,950
and lo and behold, there's
an extra 40 binaries.

793
00:29:46,950 --> 00:29:49,170
So what would be in those binaries?

794
00:29:49,170 --> 00:29:52,050
Some really cool ones like chroot

795
00:29:52,050 --> 00:29:54,690
and reset boot count was in there as well,

796
00:29:54,690 --> 00:29:57,783
just the extra binaries;
all the good ones.

797
00:29:58,800 --> 00:30:00,547
So what I thought is,

798
00:30:00,547 --> 00:30:01,830
"Now that I've got this SDL problem..."

799
00:30:01,830 --> 00:30:03,090
I didn't know what the
problem was at the time.

800
00:30:03,090 --> 00:30:06,450
I thought, "Okay, let's reflash the device

801
00:30:06,450 --> 00:30:09,450
back to the semi-factory state,
change the root password,

802
00:30:09,450 --> 00:30:12,540
add login over SSH, read,
write the disc, add a terminal,

803
00:30:12,540 --> 00:30:14,397
like I just did, fix some udev rules."

804
00:30:14,397 --> 00:30:16,410
And this sounds like a lot
of work and it actually was

805
00:30:16,410 --> 00:30:18,923
and it didn't work, but I'll
tell you about that shortly.

806
00:30:18,923 --> 00:30:19,756
This is what happens when you try

807
00:30:19,756 --> 00:30:20,589
and change the root password.

808
00:30:20,589 --> 00:30:22,170
There's actually check sums
there in the bottom right.

809
00:30:22,170 --> 00:30:23,910
You won't be able to read
it, it's size two font,

810
00:30:23,910 --> 00:30:26,760
but it says check sums
and they just check sum

811
00:30:26,760 --> 00:30:28,260
all of the different passwords.

812
00:30:28,260 --> 00:30:29,760
And I'm like, "Okay, well
I don't wanna backtrack

813
00:30:29,760 --> 00:30:32,400
on someone else's brain
fart and try and figure out

814
00:30:32,400 --> 00:30:34,440
all these check sum mechanisms.

815
00:30:34,440 --> 00:30:36,540
I'd rather just change the root password."

816
00:30:37,440 --> 00:30:40,950
And you can just remove
the password from the...

817
00:30:40,950 --> 00:30:44,760
I think it's etc password
and just remove it

818
00:30:44,760 --> 00:30:45,900
and then it just logs in automatically

819
00:30:45,900 --> 00:30:48,750
but John Deere had something
in there that defeated that.

820
00:30:51,570 --> 00:30:53,880
Then we've got the fstab.

821
00:30:53,880 --> 00:30:56,580
So I actually edited the fstab
and would you believe it?

822
00:30:56,580 --> 00:30:59,670
It didn't work because
it was check summed.

823
00:30:59,670 --> 00:31:03,420
And this was the jailbreaker that I used.

824
00:31:03,420 --> 00:31:06,210
It was just add a route
terminal every two minutes.

825
00:31:06,210 --> 00:31:07,043
I changed it...

826
00:31:07,043 --> 00:31:08,637
I put flock in front of it later.

827
00:31:08,637 --> 00:31:10,020
And if you know what flock
does, it puts a fire lock on it

828
00:31:10,020 --> 00:31:11,850
so you can have one instead of having...

829
00:31:11,850 --> 00:31:14,820
'cause this would produce
50 terminals in a row

830
00:31:14,820 --> 00:31:16,917
and they just kept coming up

831
00:31:16,917 --> 00:31:18,360
and then you have to go and exit them all

832
00:31:18,360 --> 00:31:19,530
and it's touch screen, actually, as well

833
00:31:19,530 --> 00:31:22,230
so it's not fun after a while; but yeah.

834
00:31:22,230 --> 00:31:24,780
So I added that onto
just one of the cron jobs

835
00:31:24,780 --> 00:31:27,113
that were already there 'cause
I knew it was gonna execute.

836
00:31:28,286 --> 00:31:30,090
You've gotta go with the tools you've got.

837
00:31:30,090 --> 00:31:31,590
Worked out that they've
actually blacklisted

838
00:31:31,590 --> 00:31:32,635
a couple of things like...

839
00:31:32,635 --> 00:31:37,480
Not the Wi-Fi, but ethernet cables

840
00:31:37,480 --> 00:31:40,320
that are not Wi-Fi related
'cause I wanted to use

841
00:31:40,320 --> 00:31:42,570
an ethernet cable without Wi-Fi.

842
00:31:42,570 --> 00:31:44,190
Plug it in and actually hook up to it

843
00:31:44,190 --> 00:31:45,780
and connect it to my computer

844
00:31:45,780 --> 00:31:47,610
because I don't wanna connect to the Wi-Fi

845
00:31:47,610 --> 00:31:49,657
and have John Deere actually see that,

846
00:31:49,657 --> 00:31:51,474
"I'm connecting by the way."

847
00:31:51,474 --> 00:31:52,307
(Sick Codes laughs)

848
00:31:52,307 --> 00:31:54,623
from Thailand, 'cause it
wouldn't be hard to work it out.

849
00:31:56,100 --> 00:31:59,430
Didn't actually need to change
the udev rules in the end.

850
00:31:59,430 --> 00:32:03,090
There was a couple of little
administrative control pins.

851
00:32:03,090 --> 00:32:05,643
11111 was one of them.

852
00:32:06,600 --> 00:32:07,860
This was in a DB that was in there

853
00:32:07,860 --> 00:32:09,870
and this is actually the code

854
00:32:09,870 --> 00:32:11,673
that unlocks the stolen device.

855
00:32:12,570 --> 00:32:14,820
So that's one of the
negatives of having access

856
00:32:14,820 --> 00:32:17,820
to the unencrypted disc, which
is not encrypted, by the way.

857
00:32:18,810 --> 00:32:20,343
You could just read the pin.

858
00:32:21,666 --> 00:32:22,560
I thought, "Why don't I want...

859
00:32:22,560 --> 00:32:25,260
I wanna emulate this now. I
wanna emulate this device.

860
00:32:26,700 --> 00:32:27,990
I wanna have a crack at emulating it.

861
00:32:27,990 --> 00:32:30,000
John Deere's gonna love that."

862
00:32:30,000 --> 00:32:33,840
So this is me adding
the John Deere packages

863
00:32:33,840 --> 00:32:35,370
to my own Fedora.

864
00:32:35,370 --> 00:32:40,370
So I just added Fedora, Raspberry
Pi, same architecture...

865
00:32:40,830 --> 00:32:42,000
Close enough.

866
00:32:42,000 --> 00:32:43,140
And added John Deere's repo.

867
00:32:43,140 --> 00:32:44,130
They'll probably see my IP,

868
00:32:44,130 --> 00:32:46,780
but it's behind a VPN anyway,
guys, so it's all good.

869
00:32:47,700 --> 00:32:50,490
Thought, "Okay, well let's
try and emulate it, QEMU

870
00:32:50,490 --> 00:32:52,707
and get it started. i.MX6."

871
00:32:53,850 --> 00:32:56,580
Saw this package. Had
a crack at it myself.

872
00:32:56,580 --> 00:32:58,050
Couldn't get it to work.

873
00:32:58,050 --> 00:33:00,093
So I found this actually random project.

874
00:33:00,930 --> 00:33:02,610
It would get you to boot...

875
00:33:02,610 --> 00:33:04,720
It would actually boot an i.MX6

876
00:33:05,940 --> 00:33:08,730
and with the same sort of boot output

877
00:33:08,730 --> 00:33:09,563
and that's the beauty of GitHub,

878
00:33:09,563 --> 00:33:12,450
it's just random projects with 24 stars

879
00:33:12,450 --> 00:33:14,790
or just three forks; it's a tiny project.

880
00:33:14,790 --> 00:33:17,580
Exactly what I needed and
shout out to ryzenlover.

881
00:33:17,580 --> 00:33:18,707
I also love Ryzens.

882
00:33:20,490 --> 00:33:22,500
But yeah, this actually didn't work

883
00:33:22,500 --> 00:33:25,680
and I started to mix and match the...

884
00:33:25,680 --> 00:33:29,670
I was like, "Oh, maybe it works
with QEMU Old or QEMU 32 bit

885
00:33:29,670 --> 00:33:34,320
versus 64 bit," and ended
up getting kernel panics.

886
00:33:34,320 --> 00:33:36,660
So that actually led to
getting a CVE out of it.

887
00:33:36,660 --> 00:33:38,040
So I was like, "Oh yeah, sweet."

888
00:33:38,040 --> 00:33:40,440
But I sent that through
to the QEMU project

889
00:33:40,440 --> 00:33:41,273
and they were like,

890
00:33:41,273 --> 00:33:42,420
"We don't consider this a CVE 'cause

891
00:33:42,420 --> 00:33:45,300
it's in the TCG component."

892
00:33:45,300 --> 00:33:46,420
I go, "Okay."

893
00:33:48,150 --> 00:33:49,290
The email was from RedHat, right?

894
00:33:49,290 --> 00:33:51,004
I said, "I don't think
you understand that QEMU

895
00:33:51,004 --> 00:33:51,930
is not a RedHat project.

896
00:33:51,930 --> 00:33:53,700
It might be covered by RedHat engineers,

897
00:33:53,700 --> 00:33:54,900
but it's not actually owned by Red Hat

898
00:33:54,900 --> 00:33:57,510
and I think NXP might
have a different opinion

899
00:33:57,510 --> 00:34:02,183
about what you classify as
CVE versus MIDA, et cetera

900
00:34:04,393 --> 00:34:06,210
or the general community does.

901
00:34:06,210 --> 00:34:07,620
So yeah, so that actually went through.

902
00:34:07,620 --> 00:34:12,620
But yeah, the secure password
hash; that didn't work either.

903
00:34:13,560 --> 00:34:16,410
Yeah, this is just farting
around in the system;

904
00:34:16,410 --> 00:34:19,350
Just some random code
that they have there.

905
00:34:19,350 --> 00:34:20,703
Then I thought, "Okay, if
we're not gonna emulate it,"

906
00:34:20,703 --> 00:34:22,353
it's just crashing the PC,

907
00:34:24,037 --> 00:34:26,220
"Why don't I just try and
get a dev board and do it?"

908
00:34:26,220 --> 00:34:27,930
So dev boards are really helpful as well.

909
00:34:27,930 --> 00:34:30,270
You can get most dev boards
for most architectures,

910
00:34:30,270 --> 00:34:32,580
usually like 50 to a hundred bucks.

911
00:34:32,580 --> 00:34:34,530
This is like 99 or something like that.

912
00:34:35,610 --> 00:34:38,640
And it didn't work.

913
00:34:38,640 --> 00:34:39,570
So yeah.

914
00:34:39,570 --> 00:34:44,570
The reason why it didn't work
is because these devices...

915
00:34:44,850 --> 00:34:45,780
It's IO CITY right now.

916
00:34:45,780 --> 00:34:47,241
I'll get stuck on this one,

917
00:34:47,241 --> 00:34:48,074
but if it's IO CITY,

918
00:34:48,074 --> 00:34:49,020
it's got all these different connectors,

919
00:34:49,020 --> 00:34:50,880
you can do all these different extra stuff

920
00:34:50,880 --> 00:34:53,190
that you can't deal with the real i.MX6.

921
00:34:53,190 --> 00:34:55,890
But the reason that it wasn't working

922
00:34:55,890 --> 00:34:59,010
was because it doesn't support graphics

923
00:34:59,010 --> 00:35:01,023
on the small version that I got.

924
00:35:01,950 --> 00:35:05,280
But I want to talk about
now is the stuff that...

925
00:35:05,280 --> 00:35:06,780
I don't know if anyone's
dealt with NXP before,

926
00:35:06,780 --> 00:35:10,563
but they have this strange
tendency to extrapolate.

927
00:35:12,210 --> 00:35:14,883
That's just me hooking up a serial to it

928
00:35:14,883 --> 00:35:15,716
and it worked as well, by the way,

929
00:35:15,716 --> 00:35:17,070
booted up perfectly naturally.

930
00:35:17,070 --> 00:35:17,910
And there's this weird thing,

931
00:35:17,910 --> 00:35:19,440
and this is coming into
what I'm just about to say,

932
00:35:19,440 --> 00:35:22,001
the Universal Update Utility, UUU.

933
00:35:22,001 --> 00:35:25,740
And this is where NXP's on the
abstraction computer graph;

934
00:35:25,740 --> 00:35:27,870
right at the end 'cause everything they do

935
00:35:27,870 --> 00:35:29,340
does not make much sense, actually,

936
00:35:29,340 --> 00:35:31,113
from what I've tried to understand.

937
00:35:33,090 --> 00:35:36,180
For example, this is a Universal Utility.

938
00:35:36,180 --> 00:35:38,260
It only works on Linux and Windows

939
00:35:40,290 --> 00:35:43,010
and it just doesn't work properly.

940
00:35:43,010 --> 00:35:45,966
So you need Windows 7 and
you need to use the winusb

941
00:35:45,966 --> 00:35:48,720
and Windows 10 will install
the drivers automatically

942
00:35:48,720 --> 00:35:50,070
and no information about Linux,

943
00:35:50,070 --> 00:35:51,330
but this is apparently universal.

944
00:35:51,330 --> 00:35:56,310
So that's just what I
found with the NXP system

945
00:35:56,310 --> 00:36:00,030
or I would say the word
would be atmosphere...

946
00:36:00,030 --> 00:36:00,863
What's the word for it?

947
00:36:00,863 --> 00:36:01,696
Environment.

948
00:36:02,760 --> 00:36:03,593
It worked, but yeah,

949
00:36:03,593 --> 00:36:06,090
no graphics on the i.MEX6 Ultra Light

950
00:36:06,090 --> 00:36:08,010
and I'll tell you why.

951
00:36:08,010 --> 00:36:09,480
This is the QT mailing list.

952
00:36:09,480 --> 00:36:12,033
Welcome to the hell that is 3D in QT.

953
00:36:16,392 --> 00:36:18,790
One of the reasons why in 2017 QT Co.

954
00:36:19,860 --> 00:36:23,130
went into a non-GPL style model,

955
00:36:23,130 --> 00:36:24,480
which I'm sure most people are aware of,

956
00:36:24,480 --> 00:36:26,820
is apparently because
they could make more money

957
00:36:26,820 --> 00:36:28,680
in the short term by locking in John Deere

958
00:36:28,680 --> 00:36:30,660
and others into subscription models.

959
00:36:30,660 --> 00:36:32,820
So I'm not sure if anyone's
blood is boiling at the moment,

960
00:36:32,820 --> 00:36:37,170
but I was quite surprised to read that

961
00:36:37,170 --> 00:36:38,670
'cause I thought QT just naturally

962
00:36:38,670 --> 00:36:40,520
went into a subscription-based model.

963
00:36:41,370 --> 00:36:42,930
And of course, John Deere was apparently

964
00:36:42,930 --> 00:36:44,700
allegedly involved with some of that.

965
00:36:44,700 --> 00:36:45,840
And the reason was that you could get

966
00:36:45,840 --> 00:36:47,733
tractor animations in 3D.

967
00:36:50,610 --> 00:36:52,560
That's literally one of the reasons

968
00:36:52,560 --> 00:36:55,053
why QT went private, per se.

969
00:36:55,980 --> 00:36:57,510
So another guy I was speaking to...

970
00:36:57,510 --> 00:36:58,440
Well, I couldn't get onto him actually,

971
00:36:58,440 --> 00:37:01,860
but he runs imx6rex project.

972
00:37:01,860 --> 00:37:03,750
Robert Feranec.

973
00:37:03,750 --> 00:37:04,740
Yeah, he's a cool guy.

974
00:37:04,740 --> 00:37:05,573
I think he does...

975
00:37:05,573 --> 00:37:08,493
He's an LTM hero.

976
00:37:09,660 --> 00:37:12,060
But yeah, he's an awesome YouTuber

977
00:37:12,060 --> 00:37:15,603
and he covers all sorts
of stuff that I fancy.

978
00:37:16,440 --> 00:37:17,273
I didn't actually know,

979
00:37:17,273 --> 00:37:19,730
but he actually started a
project called imx6rex.com

980
00:37:19,730 --> 00:37:20,563
or something like that.

981
00:37:20,563 --> 00:37:21,457
And he actually had one
there, but I thought,

982
00:37:21,457 --> 00:37:23,100
"Hang on, let's just pump the brakes here

983
00:37:23,100 --> 00:37:25,110
because I'm going a bit off topic."

984
00:37:25,110 --> 00:37:27,150
Why don't I just put the
freaking thing back on the board

985
00:37:27,150 --> 00:37:29,190
and try and root it
because all this emulation

986
00:37:29,190 --> 00:37:31,620
and dev board stuff, I was
barking up the wrong tree;

987
00:37:31,620 --> 00:37:32,670
nothing was working.

988
00:37:32,670 --> 00:37:34,080
And I've got a perfectly good device here.

989
00:37:34,080 --> 00:37:36,000
Why don't I play with that?"

990
00:37:36,000 --> 00:37:37,260
So if you have a look right there,

991
00:37:37,260 --> 00:37:38,580
see the little eight legged thing

992
00:37:38,580 --> 00:37:41,460
next to the chip that's
supposed to be there?

993
00:37:41,460 --> 00:37:42,360
That's the ePROM

994
00:37:42,360 --> 00:37:46,113
and it's actually an ST
MicroElectronics ePROM.

995
00:37:47,280 --> 00:37:49,110
And that's what it looks
like when you hook it up

996
00:37:49,110 --> 00:37:50,610
to a little dev board.

997
00:37:50,610 --> 00:37:53,080
Don't worry about those
labels, this is just me...

998
00:37:54,120 --> 00:37:56,073
I guess the word is just yoloing it.

999
00:37:57,480 --> 00:37:59,310
When you run out of things,

1000
00:37:59,310 --> 00:38:00,840
you just hook it up to
whatever you've got.

1001
00:38:00,840 --> 00:38:02,520
And that's kind of what
hardware hacking is all about.

1002
00:38:02,520 --> 00:38:04,320
It's just picking up stuff that you've got

1003
00:38:04,320 --> 00:38:06,090
and just using staples sometimes

1004
00:38:06,090 --> 00:38:09,430
and cutting wires out
of remotes instead of...

1005
00:38:09,430 --> 00:38:10,853
Just chopping up shit in the house.

1006
00:38:13,950 --> 00:38:15,750
This is what the pinout looked like

1007
00:38:15,750 --> 00:38:16,830
and they use all these weird characters.

1008
00:38:16,830 --> 00:38:18,240
But anyway, I found
this really cool project

1009
00:38:18,240 --> 00:38:20,700
by this guy, really tiny project,

1010
00:38:20,700 --> 00:38:22,733
but it actually lets you
read from that ePROM.

1011
00:38:23,790 --> 00:38:25,140
Don't worry about that,

1012
00:38:25,140 --> 00:38:26,940
that was me working on that thing.

1013
00:38:26,940 --> 00:38:31,140
But yeah, it sort of manually
read out each line of memory

1014
00:38:31,140 --> 00:38:34,140
and worked out that it actually
reads out the serial number.

1015
00:38:35,460 --> 00:38:38,222
But I actually just realized
that if you put the device

1016
00:38:38,222 --> 00:38:39,390
in just sort of cat/dev prime,

1017
00:38:39,390 --> 00:38:41,003
it actually gives you that as well.

1018
00:38:41,850 --> 00:38:43,500
So I just did this for no reason.

1019
00:38:46,170 --> 00:38:48,570
So I thought, "Time to
chuck it back on the board,"

1020
00:38:48,570 --> 00:38:49,805
you get root terminal...

1021
00:38:49,805 --> 00:38:52,200
This is the home stretch by
the way, we're almost done.

1022
00:38:52,200 --> 00:38:53,033
Might go on overtime.

1023
00:38:53,033 --> 00:38:53,866
What's the time like?

1024
00:38:53,866 --> 00:38:54,699
Yeah, that's all right.

1025
00:38:54,699 --> 00:38:56,850
So yeah, the root terminal's sufficient.

1026
00:38:56,850 --> 00:38:59,880
And now it's time to remount the OS,

1027
00:38:59,880 --> 00:39:03,720
route the partition, get
rid of the fstab stuff,

1028
00:39:03,720 --> 00:39:05,460
make sure it's not checksum changed,

1029
00:39:05,460 --> 00:39:07,438
all this crap that they've put in there

1030
00:39:07,438 --> 00:39:09,138
to make it difficult to fuck with.

1031
00:39:10,050 --> 00:39:11,500
We just want a root terminal.

1032
00:39:12,480 --> 00:39:15,443
So that's what it looks like
when it's nice and just rooted.

1033
00:39:16,639 --> 00:39:17,993
And it should be rooted right now.

1034
00:39:21,757 --> 00:39:23,790
Yeah, that's rooted.

1035
00:39:23,790 --> 00:39:25,110
Yeah, there's a rooted
John Deere right there.

1036
00:39:25,110 --> 00:39:26,310
It's jailbroken.

1037
00:39:26,310 --> 00:39:28,740
You can edit files, you can
remount, you can delete stuff,

1038
00:39:28,740 --> 00:39:31,290
you can accidentally delete everything,

1039
00:39:31,290 --> 00:39:32,640
you can add stuff from USB,

1040
00:39:32,640 --> 00:39:36,660
you can plug Wi-Fi in as well.

1041
00:39:36,660 --> 00:39:37,800
You can put it like a...

1042
00:39:37,800 --> 00:39:38,633
you can do anything with it.

1043
00:39:38,633 --> 00:39:40,923
It's a full-blown Linux
computer. It's a beauty.

1044
00:39:42,780 --> 00:39:44,453
John Deere doesn't like it, though.

1045
00:39:46,560 --> 00:39:47,970
So yeah, you root as well, by the way.

1046
00:39:47,970 --> 00:39:50,183
So everything's running in
root, which is even better.

1047
00:39:51,150 --> 00:39:55,173
Yeah. Wind River 8, kernel 4.1, .21.

1048
00:39:55,173 --> 00:39:56,970
It's probably one of the long term ones;

1049
00:39:56,970 --> 00:39:59,190
hasn't been updated for a while.

1050
00:39:59,190 --> 00:40:02,740
I think that's local time, 20:22 UTC.

1051
00:40:02,740 --> 00:40:05,430
But I actually noticed that
actually John Deere was using...

1052
00:40:05,430 --> 00:40:06,630
I don't know if this
is common or something,

1053
00:40:06,630 --> 00:40:08,640
but they were using whatever time it was

1054
00:40:08,640 --> 00:40:09,863
the essential standard
time for all the things

1055
00:40:09,863 --> 00:40:11,580
so that everything in
the office would actually

1056
00:40:11,580 --> 00:40:14,523
be the same time as what
it was in the field.

1057
00:40:15,900 --> 00:40:17,070
So yeah, this is actually...

1058
00:40:17,070 --> 00:40:18,513
That's a rooted John Deere.

1059
00:40:19,500 --> 00:40:20,910
That's the flagship display, by the way.

1060
00:40:20,910 --> 00:40:24,090
Look here, just showing John Deere.

1061
00:40:24,090 --> 00:40:25,500
Yeah.

1062
00:40:25,500 --> 00:40:26,550
So how do we exploit this?

1063
00:40:26,550 --> 00:40:28,710
How do we get this done
without taking off the board?

1064
00:40:28,710 --> 00:40:31,053
How do I get this done repeatedly?

1065
00:40:32,790 --> 00:40:34,200
Well, you can just build a little clip

1066
00:40:34,200 --> 00:40:36,000
that just goes in the back
and touches those pins

1067
00:40:36,000 --> 00:40:36,833
that I showed you earlier

1068
00:40:36,833 --> 00:40:38,610
and it'll just like jailbreak it for you.

1069
00:40:38,610 --> 00:40:40,590
You actually just jailbreak
it without even using USB

1070
00:40:40,590 --> 00:40:42,380
because USB, when you think about it,

1071
00:40:42,380 --> 00:40:46,260
is just plus, negative or VCC and ground,

1072
00:40:46,260 --> 00:40:48,480
which is the same thing in some cases

1073
00:40:48,480 --> 00:40:49,860
and then you've got D plus and D minus.

1074
00:40:49,860 --> 00:40:51,090
That's all you've got in USB sticks;

1075
00:40:51,090 --> 00:40:53,580
you've got the four little
things in there, right?

1076
00:40:53,580 --> 00:40:55,590
Well this is five pins.

1077
00:40:55,590 --> 00:40:57,090
We're not coming in over the port,

1078
00:40:57,090 --> 00:40:58,347
we're going in over the back of the chip.

1079
00:40:58,347 --> 00:40:59,970
You just have to take it off the board.

1080
00:40:59,970 --> 00:41:01,770
Same thing as touching it on the board.

1081
00:41:01,770 --> 00:41:04,710
But is there a difference
between coming in a USB exploit

1082
00:41:04,710 --> 00:41:08,070
versus just clipping it on with
a Pogo pin connecting thing

1083
00:41:08,070 --> 00:41:09,320
on the back of the board?

1084
00:41:10,530 --> 00:41:11,910
And that's what those
little things look like.

1085
00:41:11,910 --> 00:41:13,665
So you can get these little PCBs

1086
00:41:13,665 --> 00:41:15,030
that you can print out and just get them

1087
00:41:15,030 --> 00:41:16,470
toggled onto the board

1088
00:41:16,470 --> 00:41:18,210
and that's what it looks like hooked up

1089
00:41:18,210 --> 00:41:20,820
to one of their terminals
they've got on the board.

1090
00:41:20,820 --> 00:41:22,440
This is JTAG there,
but I think it was off.

1091
00:41:22,440 --> 00:41:24,267
I didn't actually go too hard into it

1092
00:41:24,267 --> 00:41:26,310
'cause it... I've had bad experiences

1093
00:41:26,310 --> 00:41:28,260
with that many pins and that many pads.

1094
00:41:30,030 --> 00:41:31,020
When you hook that up there,

1095
00:41:31,020 --> 00:41:34,890
you get, actually, this
weird boot loaded terminal.

1096
00:41:34,890 --> 00:41:36,030
It's not UbiD or anything,

1097
00:41:36,030 --> 00:41:38,670
it's just some weird diagnostic thing.

1098
00:41:38,670 --> 00:41:41,610
But yeah, there's not much
exciting stuff in there.

1099
00:41:41,610 --> 00:41:43,910
But it lets you know
that the device is alive.

1100
00:41:45,750 --> 00:41:47,340
These are cool little devices you can get.

1101
00:41:47,340 --> 00:41:51,960
They're not devices, they're
like expansion packs, I guess.

1102
00:41:51,960 --> 00:41:53,580
So that chip that I showed you earlier,

1103
00:41:53,580 --> 00:41:56,190
we're not gonna go back
to it, but it's 100 balls.

1104
00:41:56,190 --> 00:41:57,236
I think the one that's flipped over,

1105
00:41:57,236 --> 00:41:58,069
(Sick Codes laughs)

1106
00:41:58,069 --> 00:41:58,902
actually has 100 balls.

1107
00:41:58,902 --> 00:42:01,977
But the third one across, eMMC 153,

1108
00:42:03,750 --> 00:42:05,370
that's actually found
in most mobile phones

1109
00:42:05,370 --> 00:42:09,570
and literally every device in
the current branded devices.

1110
00:42:09,570 --> 00:42:11,670
Some older Androids have the top left one.

1111
00:42:12,540 --> 00:42:14,600
And as you can see, the buses on the...

1112
00:42:15,510 --> 00:42:16,693
Where is it?

1113
00:42:16,693 --> 00:42:18,300
If you go to the second
one and see the bottom,

1114
00:42:18,300 --> 00:42:20,670
it's got D0, ground,
clock, VCC and command.

1115
00:42:20,670 --> 00:42:23,100
So you only need those 1, 2, 3, 4, 5 pins

1116
00:42:23,100 --> 00:42:26,400
to connect to the device.

1117
00:42:26,400 --> 00:42:28,980
And that's where that would come into play

1118
00:42:28,980 --> 00:42:30,510
if I was doing that to exploit it.

1119
00:42:30,510 --> 00:42:31,650
I'm actually working on that low key,

1120
00:42:31,650 --> 00:42:33,250
so don't tell John Deere though.

1121
00:42:35,490 --> 00:42:37,020
Yeah, it accepts this Wi-Fi stick.

1122
00:42:37,020 --> 00:42:40,920
We've got just the stock
standard WN, whatever it is,

1123
00:42:40,920 --> 00:42:44,340
725N; it's like literally everywhere.

1124
00:42:44,340 --> 00:42:45,300
You've probably got one in your pocket.

1125
00:42:45,300 --> 00:42:46,350
I think I do as well.

1126
00:42:47,460 --> 00:42:48,720
But yeah, that actually starts wireless.

1127
00:42:48,720 --> 00:42:50,880
People were telling me
while I was making it

1128
00:42:50,880 --> 00:42:52,470
that, "There's no wireless.
There's no wireless.

1129
00:42:52,470 --> 00:42:53,700
The wireless is off."

1130
00:42:53,700 --> 00:42:55,560
And I'm like, "Until you actually try it

1131
00:42:55,560 --> 00:42:57,180
and put a wireless thing in there

1132
00:42:57,180 --> 00:42:58,680
and look at the wireless settings,

1133
00:42:58,680 --> 00:43:00,390
it actually does have wireless."

1134
00:43:00,390 --> 00:43:01,670
So believe it or not...

1135
00:43:02,790 --> 00:43:05,694
Don't believe what people
tell you as well, sometimes.

1136
00:43:05,694 --> 00:43:06,953
Maybe I've told you
something that's wrong.

1137
00:43:08,490 --> 00:43:09,660
But just go with your gut.

1138
00:43:09,660 --> 00:43:13,710
So that was a fail 'cause
it wouldn't help...

1139
00:43:13,710 --> 00:43:15,120
But what I did found
out as well, by the way,

1140
00:43:15,120 --> 00:43:17,190
is over the automotive ethernet bus,

1141
00:43:17,190 --> 00:43:19,200
which I haven't gone into,

1142
00:43:19,200 --> 00:43:20,490
it actually starts a server on there.

1143
00:43:20,490 --> 00:43:22,290
But that's just the same as...

1144
00:43:22,290 --> 00:43:24,960
Yeah, that's the same as if
you were doing it via Wi-Fi.

1145
00:43:24,960 --> 00:43:26,490
Oh, so I think I've
got a few minutes here,

1146
00:43:26,490 --> 00:43:28,020
but these are some of the cool commands.

1147
00:43:28,020 --> 00:43:31,320
We got ResetBootCount, ReprograConfig.

1148
00:43:31,320 --> 00:43:33,780
By the way, this is 7,000 old display

1149
00:43:33,780 --> 00:43:35,310
when there's like 20
grand worth of licenses

1150
00:43:35,310 --> 00:43:36,143
when you get it running,

1151
00:43:36,143 --> 00:43:38,400
but you can just
reprogram it now yourself.

1152
00:43:38,400 --> 00:43:39,810
So we got CANDump.

1153
00:43:39,810 --> 00:43:41,580
We can play with some of
the CAN-bus addresses.

1154
00:43:41,580 --> 00:43:43,100
You can edit the config

1155
00:43:43,100 --> 00:43:44,280
and you can dump all the CAN coming in.

1156
00:43:44,280 --> 00:43:45,840
You can send CAN messages,

1157
00:43:45,840 --> 00:43:47,643
you can sequence CAN messages.

1158
00:43:48,660 --> 00:43:49,860
And some grand finale stuff.

1159
00:43:49,860 --> 00:43:54,860
So I wanna show a little bit of a demo.

1160
00:43:56,670 --> 00:43:59,607
So this is what happens
when you remount...

1161
00:44:00,720 --> 00:44:03,300
Let me just make sure. One sec.

1162
00:44:03,300 --> 00:44:04,620
Yeah. Sorry. I think I'm all right.

1163
00:44:04,620 --> 00:44:06,750
So mount -0 remount, whatever

1164
00:44:06,750 --> 00:44:09,330
and then bang, you've got read, write.

1165
00:44:09,330 --> 00:44:10,350
Actually, what I found out as well is

1166
00:44:10,350 --> 00:44:12,720
if you unplug the unplug the display,

1167
00:44:12,720 --> 00:44:14,340
it comes up with... boots
with the black screen,

1168
00:44:14,340 --> 00:44:16,740
but actually X is still running.

1169
00:44:16,740 --> 00:44:19,080
So the terminal still pops
up that I had there earlier,

1170
00:44:19,080 --> 00:44:21,780
but it comes up without the
beautiful green and yellow

1171
00:44:21,780 --> 00:44:23,247
Windows manager by John Deere.

1172
00:44:23,247 --> 00:44:24,450
And that's the jailbreak.

1173
00:44:24,450 --> 00:44:26,520
It's literally just add a terminal

1174
00:44:26,520 --> 00:44:29,967
to pop up every two minutes
and then set it to remount.

1175
00:44:29,967 --> 00:44:31,260
And the only way you know that though

1176
00:44:31,260 --> 00:44:32,670
is if you pulled the disc off

1177
00:44:32,670 --> 00:44:34,420
and had a look at it and edited it.

1178
00:44:35,336 --> 00:44:36,240
There's a demo video there.

1179
00:44:36,240 --> 00:44:38,670
I'm about to show you the demo video.

1180
00:44:38,670 --> 00:44:40,380
So gimme two...

1181
00:44:40,380 --> 00:44:41,230
What have we got?

1182
00:44:48,810 --> 00:44:50,060
May have just spoiled it.

1183
00:44:52,560 --> 00:44:54,658
Oh yeah, here we go.

1184
00:44:54,658 --> 00:44:56,190
Here we go, F11.

1185
00:44:56,190 --> 00:44:58,229
The fuck? Windows shit.

1186
00:44:58,229 --> 00:44:59,490
(Sick Codes laughs)

1187
00:44:59,490 --> 00:45:00,540
Double click, right?

1188
00:45:00,540 --> 00:45:01,620
No, there we go.

1189
00:45:01,620 --> 00:45:03,679
Yeah. This is a little demo.

1190
00:45:03,679 --> 00:45:04,512
I don't think the sound...

1191
00:45:04,512 --> 00:45:05,820
There's party music in the
background 'cause I just...

1192
00:45:05,820 --> 00:45:08,013
Yeah, a bit of suspense.

1193
00:45:15,977 --> 00:45:17,310
So, chroot was one of those commands

1194
00:45:17,310 --> 00:45:19,800
that was beautifully in the extra parts.

1195
00:45:19,800 --> 00:45:21,800
And you'll see what happens in a moment.

1196
00:45:29,014 --> 00:45:30,763
(audience laughs)

1197
00:45:30,763 --> 00:45:33,763
(audience clapping)

1198
00:45:40,830 --> 00:45:43,742
That's actually Tractor Edition Doom.

1199
00:45:43,742 --> 00:45:45,180
(audience laughs)

1200
00:45:45,180 --> 00:45:47,160
So you can actually mow corn.

1201
00:45:47,160 --> 00:45:47,993
It was a bit of overkill,

1202
00:45:47,993 --> 00:45:50,524
but we thought we'd have a crack at it.

1203
00:45:50,524 --> 00:45:51,540
It was actually a lady in New Zealand

1204
00:45:51,540 --> 00:45:54,510
that helped me design
this mod 'cause we...

1205
00:45:54,510 --> 00:45:55,980
Yeah, you can actually mow corn.

1206
00:45:55,980 --> 00:45:58,387
It counts as a health bonus.

1207
00:45:58,387 --> 00:46:00,480
(audience laughs)

1208
00:46:00,480 --> 00:46:02,940
And this one, I think,
is an armor bonus, corn.

1209
00:46:02,940 --> 00:46:03,900
The other one was wheat, whatever.

1210
00:46:03,900 --> 00:46:06,000
But yeah, you can hide down
the pinkies, the demons,

1211
00:46:06,000 --> 00:46:08,790
little piglets, the demon piglets.

1212
00:46:08,790 --> 00:46:09,990
So don't worry about it.

1213
00:46:10,950 --> 00:46:13,290
But yeah, we spent a
bit of time on this one.

1214
00:46:13,290 --> 00:46:17,100
Her name's Skelegant and
she's a mad Doom modder.

1215
00:46:17,100 --> 00:46:18,900
But yeah, that's Doom on the farm.

1216
00:46:18,900 --> 00:46:21,123
So yeah, it's actually epic.

1217
00:46:22,290 --> 00:46:23,430
So that's on a John Deere...

1218
00:46:23,430 --> 00:46:26,180
That's John Deere Doom on a
John Deere tractor display.

1219
00:46:28,146 --> 00:46:31,146
(audience clapping)

1220
00:46:37,477 --> 00:46:38,310
And I think that was it.

1221
00:46:38,310 --> 00:46:40,620
Yeah, that was the original
mod that we were gonna use.

1222
00:46:40,620 --> 00:46:42,390
And let me just see if
I can full screen this.

1223
00:46:42,390 --> 00:46:43,579
I'm not even gonna try...

1224
00:46:43,579 --> 00:46:44,412
Oh, there we go.

1225
00:46:44,412 --> 00:46:45,360
Yeah, that was the original
one that we were gonna use,

1226
00:46:45,360 --> 00:46:48,833
but it wouldn't run on non-GPU...

1227
00:46:48,833 --> 00:46:51,330
'cause that's Jeezy Doom, and
for any Doom people out there,

1228
00:46:51,330 --> 00:46:52,800
they'll know the difference
between Jeezy Doom,

1229
00:46:52,800 --> 00:46:56,097
Chocolate Doom, LQ Doom,
QZ Doom, whatever it is.

1230
00:46:56,097 --> 00:46:57,330
And there's so many
different types of Dooms,

1231
00:46:57,330 --> 00:46:59,160
but the one that actually
worked on this one...

1232
00:46:59,160 --> 00:47:00,510
You can come up and play
it, by the way, as well,

1233
00:47:00,510 --> 00:47:02,110
if you wanna come play it after.

1234
00:47:03,660 --> 00:47:06,180
Chocolate Doom worked
and this one's edited.

1235
00:47:06,180 --> 00:47:07,710
But I actually hadn't
asked if I could edit it

1236
00:47:07,710 --> 00:47:10,080
and then, Doom's a bit...

1237
00:47:10,080 --> 00:47:11,790
You wanna keep the spirit of the mod,

1238
00:47:11,790 --> 00:47:12,660
the WAD file, they're called.

1239
00:47:12,660 --> 00:47:15,270
But it wouldn't run without Jeezy Doom.

1240
00:47:15,270 --> 00:47:17,340
And then yeah, I reached out to...

1241
00:47:17,340 --> 00:47:18,570
Skelegant, her name is.

1242
00:47:18,570 --> 00:47:22,290
She's a cool chick from New Zealand

1243
00:47:22,290 --> 00:47:24,840
and she helped me make that awesome demo

1244
00:47:24,840 --> 00:47:25,673
that I just showed you.

1245
00:47:25,673 --> 00:47:27,630
So yeah, big thanks to her.

1246
00:47:27,630 --> 00:47:30,330
GUSETEC BRAZIL, Last
Person, Alex the kangaroo,

1247
00:47:30,330 --> 00:47:31,770
I'm not gonna comment who he is,

1248
00:47:31,770 --> 00:47:35,940
Kevin Kenney, Johannes from
Agra-GPS, Vlad, Alex, Mauro,

1249
00:47:35,940 --> 00:47:39,000
Dudas, Alex, Alex, Joe Grand...

1250
00:47:39,000 --> 00:47:39,833
What's his name?

1251
00:47:42,510 --> 00:47:43,343
What have I got?

1252
00:47:43,343 --> 00:47:44,220
Paul Robertson...

1253
00:47:44,220 --> 00:47:45,660
Paul Roberts from Security Ledger

1254
00:47:45,660 --> 00:47:46,493
and I think there's one other...

1255
00:47:46,493 --> 00:47:50,910
Carl Waynes, big ups; special ups.

1256
00:47:50,910 --> 00:47:51,743
Thanks.

1257
00:47:52,754 --> 00:47:55,754
(audience applauds)