ian @ Dangerous Prototypes
@dangerousproto
Followers
49,638
Following
207
Media
1,186
Statuses
14,184
We do open hardware. Bus Pirate 5, Hacker Camp Shenzhen, DirtyPCBs. Once we anodized capacitors pink! @buspirate @mastodon .social
Joined October 2008
Don't wanna be here?
Send us removal request.
Explore trending content on Musk Viewer
WEIBO LIVE X FAYEYOKO
• 164010 Tweets
Sant Rampal Ji Maharaj
• 136911 Tweets
百鬼夜行
• 94285 Tweets
#HUEAreMyEverything
• 61154 Tweets
#휴닝카이가수놓은여름밤의은하수
• 57998 Tweets
#الهلال_الاهلي
• 55128 Tweets
Martes 13
• 49739 Tweets
ゴリラ審神者
• 38636 Tweets
#愛され天使ヒュニンカイ
• 37494 Tweets
D-14 TO CHANYEOL SOLO
• 34046 Tweets
OUR BAND LEADER HUENINGKAI
• 33321 Tweets
ガラスの仮面
• 30863 Tweets
サブスク解禁
• 28602 Tweets
CRAZY TRACK SAMPLER
• 21458 Tweets
LEAVE BLACKPINK ALONE
• 17760 Tweets
さんま御殿
• 16259 Tweets
警告試合
• 15959 Tweets
Colbert
• 14330 Tweets
高津監督
• 14282 Tweets
Jaime Garzón
• 11969 Tweets
チェンソーマン
• 11625 Tweets
横井さん
• 10672 Tweets
ポケモン赤緑
• 10612 Tweets
Mobile phone SIM cards and bank IC cards respond to an asynchronous Answer To Reset command over a half-duplex UART. Pump a continuous clock signal into the clock pin. Bring the reset pin low and then high. The ATR response comes out of the IO pin...
16
260
3K
Six years of Neoden4 and this is still "actually pretty good" for the machine. An absolute mess. Support suggested we "read the manual again", and just avoided us after that. Their CEO gifted us this machine and personally delivered it to our Shenzhen office, very frustrating.
33
20
255
Testing two IR receivers with an IR adapter DEV board. One from Vishay and one Chinese generic brand. Which one is which? The answer is surprising.
5
16
243
Half-duplex UART is like a PC serial port, but data goes both directions on a single wire. Speed is set by the continuous clock signal. 372 clock ticks output a single bit, for common 9600 baud output we need: 9600 * 372 = a 3.5712MHz clock signal...
2
3
202
W25Q64 SPI flash adds 8 megabytes of fast storage to your project. It's also the type of flash used by the raspberry pi RP2040 to store firmware.
@dreg
added a walk through to the Bus Pirate docs:
1
25
165
Bank cards tend to have a bit more info about how to access the contents. Here’s ATRs from a US Visa Card, an EU Master Card, and a Hong Kong Union Pay card. I think it’s really neat to look at data “hidden” in these cards that’s used by POS machines around the world.
2
1
169
Once a clock signal is applied to the chip we can get some descriptive info using the ATR: reset pin low, then reset pin high. The response starts with 0x3B, and includes some info such as max frequency (5MHz) and supported voltage range (5, 3, 1.8 volts)...
1
1
159
Bus Pirates were assembled last night. Next they go for testing, final assembly (taping the LCD, put into the case) and packaging. We usually do all that in-house, but there's too many that need to ship ASAP so we hired the PCBA and shrink wrap people to help move everything...
5
18
146
The ATR says it’s a “XLB.5G CTC Test Card” from XieLiBo in SZ. It's still not clear exactly what it does, but it's alive! Communicate with SIM cards using Bus Pirate 5 and the SIM/IC card adapter, available at
@dirtyboardspcbs
@blinkinlabs
@Lab_401
@hackerwarehouse
@'electrokit
1
0
148
We can look up the ATR in online databases such as smartcard-atr[dot]apdu[dot]fr. This chip is correctly identified as a Lycamobile Prepaid SIM card. Here’s the ATR from a SIM from Hong Kong, it looks pretty similar...
1
0
147
Late addition! A "4G SIM card for testing” just arrived. The supplier said it’s blank, but it could be for debugging phones or cell towers. Let’s hook it up to the Bus Pirate and see if we get an ATR response...
3
1
134
So pleased. I picked up a free SIM card in China town and read out the ATR info. Setup a continuous clock with a PWM, ~3.56mhz. Flip RST pin high to low. Data arrives asynchronously on the IO pin via serial 9600 baud, 8bits, Even parity, 2 stop bits. Worked on the first try.
2
12
133
A T210 compatible "instant heat" soldering station is probably the best cheap tool upgrade we've purchased in years. The default tips are a tad small if you're not doing 0402, but chunkier tips are available. Is there a hot air station evolutionary equivalent?
4
20
123
Bus Pirate 5 REV10 is ready!
Type simple commands in a terminal and talk to chips over 1-Wire, I2C, SPI, UART, and more. Figure out how a chip works before writing a line of code.
Hardware specs:
8
23
122
It's been a busy week building Bus Pirates!
5
6
112
1Gbit NAND flash test board. The SD card was limiting the maximum speed of the internal SPI bus shared with the LCD. I've already dead bugged a chip and tested it at low speed hanging off the Bus Pirate IO header. It works like a charm for both internal storage and as a USB disk.
3
12
111
Dyed DuPont crimp housings just arrived. These are white housings sent to a (clothing) button dye factory and color matched to our shrink tube samples. They look way better than I expected, and will go on the next revision of the Bus Pirate 5 aux cable (and some other stuff)...
8
7
97
There had to be a better way to connect a probe cable to a breadboard or pin header. Something better than probe hooks precariously clipped to the end of jumper wires...so we hired a pogo pin manufacturer to mill a custom pin.
1
8
91
Looks like we're on Hacker News! I started the day with high hopes to knock I2C into shape, but I got a little distracted making an update to the AUX cable. I have another hour to talk to factories, more on that later today. UART will probably be done though.
2
7
90
The latest Bus Pirate 5 auto build has several new 1-Wire features. Search ROM is implemented, and macro (2) queries a DS18B20 temperature sensor. While I was working on 1-Wire I added a simple tutorial to the docs as well. This week I'm going to port over the original...
4
12
77
UART mode is all cleaned up and usable. I2C, SPI, and LED modes are tweaked and tuned. After updating the help menu this will become firmware V0.1.0. I've done a lot of testing and it should be quite usable in real world conditions. If you have a Bus Pirate 5 please try the...
1
12
72
After Thursday our Shenzhen office will close for a 10 day national holiday. Today is the last day to get a Bus Pirate 5 preview board shipped before the the break. I'm going to use that time to push forward on firmware. Bus Pirate 5 preview here:
5
13
76
The latest Bus Pirate firmware has a new half-duplex UART mode. While similar to a serial UART, half-duplex mode uses a single shared open drain data wire and requires a pull-up resistor. TX/RX are handled by the RP2040 PIO module, so it's nice and accurate. Half-duplex mode is..
3
10
76
REV10 boards arrived. New buffer works, but the cheap Schottky diodes from my favo comp manuf are LEAKY. Bought the Diodes INC version. Installed one but the problem disappeared. Why? Cold morning. Roasted on the radiator a bit to enhance the leakiness. The genuine part on io6/7
4
9
73
I can't believe it. The crimp housings arrived - correct and in white. We don't have to do a custom run. Now they're off to a (clothing) button dye factory to be colored to match the probe cable. Just giddy this is going so well, what a lovely afternoon project.
4
5
75
Pico Probe is an ARM CMSIS 2-wire JTAG debugger for RP2040 supported by OpenOCD. It was an easy port to Bus Pirate 5 b/c a version of the PIO program already manages buffer Output Enable. I just had to make it bi-directional and invert the OE pin to work with BP5.
3
5
75
A little Sunday morning soldering. A small switch mode power supply to generate VPP for programming various chips.
2
3
75
NAND flash is up and running. Access from the terminal was a breeze, but there was some unpleasantness getting the USB MSC disk working. Spent a day debugging spin locks based on the debugger output, but turned out to be a simple buffer overflow due to NAND block size. Tomorrow..
2
7
63
Second logic analyzer added to Bus Pirate 5. This is a sample and dump LA with simple and complex hardware triggers in the RP2040 PIO. Max speed is 100MSPS with 138k samples and RP2040 overclocked to 200MHZ. Here, I'm using an old Bus Pirate to PWM one pin and trigger on another
1
11
63
Smart watch lacking actual freaking flames? Shenzhen innovates with integrated health tracker, wireless payment, bluetooth speaker, AI voice assistant … and Zippo-compatible lighter case. This is such a strange integration, some may say unnecessary.
2
10
63
This has been in development for a while, but finally seems ready. An adapter board for mini/micro/nano SIMs and IC cards such as the SLE4442 passcode card and 24C02 EEPROM cards. It took three revisions to nail the SIM socket footprints, the manufacturer's datasheets are a mess.
2
14
62
Shenzhen speed! The LCD people sent the wrong display for Bus Pirate 5, but sent the correct one by courier immediately. The assembler and LCD factory are both in Bao’an so production should resume within an hour. That’s Shenzhen speed, and it’s amazing when it all works out well
1
7
62
Replaced five BAT54 Schottky diodes with BAS40. The datasheet says they're 10x less leaky. Tossed it on the radiator to enhance leakiness. Indeed, even at abnormally high temps there's way less leakage.
I managed to damage the LCD flex connector trying to "protect" it from heat
4
8
61
Last night the next batch of Bus Pirate 5 arrived. We managed to push through about 50% extra boards in this batch. Testing and final assembly are done. ~6% failure rate, almost all stuck buffer pins on the 0402x4 resistor arrays (circled).
2
12
59
Through hole DIP flash chips are getting rare, but they're everywhere in vintage computers. These 16P aquamarine ZIF sockets are the universal programming solution. Pull up the little lever, drop in a chip, and push the level down to lock the chip in place. I sampled 6 versions..
3
3
60
Sinkscreen uncle just finished adding the Bus Pirate 5 pinout labels to KF141 quick connectors. We chose the highest quality connector we could source and had the pin labels printed in bright orange to match the release levers. Things were backed up a bit, but the result is nice.
6
7
57
Friday morning dead-bugging a 1GB SPI NAND flash chip. The Bus Pirate has a shared SPI bus with the LCD, IO expanders and SD card. The bus can run at 64MHz, but SD cards are limited to about 20MHz. Even if the SD card isn't selected, speeds above 30MHz cause most cards to...
2
8
59
Bus Pirate 5 reels headed to assembly! There's a few developer boards from the prototype run available in the dirtypcbs shop, but the first big batch should be done this week. We're working to get the docs updated and online in the next few days. It's been a beast of a project!
4
7
57
Hand soldering today. We set up programming and testing at the assembler. During a trial run, one board failed the self-test. Within 5 minutes the tech was able to located the issue. One of the resistor arrays next to the 10 pin connector had a short - it was bumped with a...
2
6
57
SPI Monday. Today I cleaned up SPI mode. Somewhere between revisions the new GPIO# didn't get pushed, so pinout was wrong. Easy fix, new firmware in the forum. Connected an EEPROM breakout header with the custom milled pins. REV 1 ends are different lengths and that was helpful..
1
9
55
Sample AUX cable with dyed crimp housings just arrived. Very pleased! Black housings are common, but the dyed-black version reflects light like the other dyed parts and seems to match a bit better. AUX doesn't have a power pin, so we didn't do red at first, but after seeing the..
5
4
56
TSL2561 is an I2C light sensor that measures visible and infrared light in LUX. It's used in mobile phones, laptops, etc to adjust screen brightness. While it's older, there are still a bunch around and someone requested a walk through last week. The fun thing about this demo...
1
6
55
Forum member
@dreg
wrote a walk through for the AT24C256 I2C EEPROM. This inexpensive chip adds 32K bytes of permanent storage to your project, and full featured breakout boards are around $2 on AliExpress.
0
9
52
Shipping has started! Thank you so much for your patience. We were well prepared to ship hundreds, but scaling immediately to thousands was surprisingly smooth. It takes a lot more time to do all the detail work though. I'm super thankful & proud of our...
3
1
50
KF141 quick connector adapter for Bus Pirate 5. It feels a bit chonkey, so I tried one with the PCB flipped vertical - but that's not very stable. For the final I'll reduce the space between the female connector and the KF141. We're also going to silkscreen pin names in orange...
2
7
48
Bus Pirate 5 firmware v0.1.0 is here! The new command interface works more like a typical PC command line. Bus syntax (talking to chips) uses a three step compile-run-report process for extremely tight and precise timing. Next week I'll go through my big-ole-bag of breakout...
2
7
46
There's several impressive wave generator projects using RP2040 DMA & PIO, so I made an R2R resistor ladder with 0.1% resistors to try it out. First build a waveform in an array, currently triangle, sine or square. Then endlessly stream the array to the IO pins in a loop with DMA
2
10
46
Next week: let's talk about SPI flash chips!
4
4
47
Thank you so much for checking out Bus Pirate 5! The first production batch will be gone soon. A second batch is already in progress and should he assembled next week. Monday we will receive the rest of the color coded auxiliary cables and kit them up.
3
6
47
We ordered a second batch of silkscreened 10-pin connectors. Text is now left justified and slightly bigger, and IO0 correctly uses a zero instead of an 'O'. They look a bit nicer, so we're only using the new version in production. If your Bus Pirate hasn't shipped, you will...
1
8
47
The latest BP5 firmware has
@MoonbaseOtago
's oscilloscope. Capture analog signals on any IO pin and pan/zoom the trace on the LCD. Speed is limited to 500KSPS by the RP2040, but it's a great basis to look at audio and other slower signals. Grab the latest firmware in the forum,
3
6
44
Bus Pirate 5 has a "flash" command to read and write 8 pin flash chips that follow a loose standard. At first I soldered chips on breakouts for testing, but it got a bit wasteful. SOP 150mil and 208mil are the most common packages, so let's start there...
2
1
46
1-Wire is included in the latest auto build. Testing here with a DS18B20 temperature sensor in a breadboard. The Y splitter cable from the aux cable kit powers the Bus Pirate IO pins and the DS18B20 while I debug, all easily connected with the custom milled breadboard pins...
1
7
44
Bus Pirate firmware has some major updates in the last few weeks. A new command line parser enables global commands that work everywhere, and mode specific commands. Type ? or help for a list of available commands. Add a -h flag after a command for extended help. Source has...
1
7
45
Bus Pirate Ultra prototype v1d, all soldered up and half tested. Love the flex PCB connector! The updates to the programmable output power supply worked perfectly. Getting close to a beta!
3
9
42
Dumping EEPROMs and flash chips usually involves some hardware, and a dodgy script or unmaintained software. I added commands to load and dump flash from the Bus Pirate terminal using the SD card for storage. It's currently a proof of concept that supports a single chip, but...
2
3
41
Next batch of Bus Pirate is on the way! Since the PCBs are not in a hurry this time, we decided to go purple for the soldermask and had ENIG surface finish. These will start shipping very soon. We are sick of the pink bubble wrap that the factory uses, so...
2
5
43
24Cxx EEPROM IC cards have 128 bytes to 64K of memory and a simple I2C interface. It works like a typical I2C EEPROM, but on a smart card. There’s no read or write security. The Bus Pirate I2C scan command finds a 256byte 24C02 card at I2C address at 0x50 (0xa0 write, 0xa1 read).
2
8
42
2bit anti aliased font looks even better than expected. A few tweaks in Photoshop to control how the indexed colors are reduced to two bits will make it even better.
4
3
41
SLE4442 IC cards have 256 bytes of EEPROM memory and a write protect passcode. Three failed password attempts lock the card to discourage brute force guessing. Though disturbingly insecure, they’re still around as stored value cards (copy, laundry machines) and even hotel keys!..
1
10
42
Injection molded Bus Pirate cases were manufactured this week. We used a super cheap factory with no frills service and the experience has been painful. They're more than a month late and decided to skip the final color test. We just get what we get, but at least it's done..
4
2
39
16 RGB LEDs light the top and sides of Bus Pirate 5. They're used in the tutorial, party mode and some indicator eye candy. An homage to Shenzhen, my home for 7 years, a city bedazzled in LEDs. In real life the hot spots aren't obvious, it just has a magical glow.
3
3
38
Debugging with an active USB connection is a nightmare. Bus Pirate terminal IO can also be put on two UART pins and then connected to the Pico probe auxiliary USB to serial converter. This has been handy while I rework the command interface. Just activate it in bpconfig.bp...
1
7
38
Oscilloscope on the Bus Pirate LCD by
@MoonbaseOtago
capturing a 1ms 33% duty cycle PWM signal. The scope can monitor any IO pin. It has edge triggers and pan/zoom functions, with a max speed of 500KSPS. Check out the tutorial in Paul's git - he uses the pull-up resistors and...
5
9
38
Sweet! Printed on Prusa mini+.
Printing this Gridfinity compatible Bus Pirate 5 storage case by Matthias_1861847 right now! It has places for accessories and cables, and a cutout that holds the Bus Pirate at a pleasant viewing angle.
0
1
25
2
1
38
Do you have a favorite quick connector? I made a small PCB to use KF141 connectors with Bus Pirate 5. KF141 comes as single terminals that stack together with 2.54mm pitch between terminals. It comes in vertical and right angle versions. Very handy for quick bare wire hookups.
3
6
35
Left: One official Molex 1.25mm cable from Mouser. Right: 30 cables and 40 connectors from Taobao. Cost: about the same :D
2
4
37
A DIY 38mm x 38mm laser engraver build using CD-ROM/writer on ATmega328p by Davide Giron
http://t.co/0fCy1gB9Nh
0
16
31
Found the tiny antenna for the mini GPS. It's fun to open the UART and let the NMEA packets roll in, but with the RP2040s immense program space we can step it up a bit. I added minmea, a packet decoder at github, as UART mode macro (2). It decodes nine common GPS sentences...
2
4
34
The latest Bus Pirate firmware build has the first part of binary scripting mode: bitbang IO. This is a simple protocol for manipulating pins and peripherals from a script. I added new command 1F to print null terminated debug strings in the main terminal. A second UART...
2
10
33
Non-stop shipping day! Three batches of Bus Pirates are out the door today. We are still not half way there, so please bear with us. We will continue shipping the next few days and try to clear out the backlog from Spring Festival. Thank you so much for all your patience!
0
3
34
Ultimate Hardware Hacking Gear Guide is a free e-Zine that covers a broad section of the modern electronics scene. Tools, attack methods, RF, vintage computers, retro game systems, types of chips and dev boards - it's 177 pages of the hardware magazine you wanted as a kid.
🌟 Hey everyone! 🌟
I'm excited to share my latest project: The Ultimate Hardware Hacking Gear Guide! 🔧📖
It's a comprehensive e-zine packed with tools and tips for all hardware hacking enthusiasts. Check it out and let me know what you think!
5
81
271
3
4
32
New command line is coming along quickly now. ; && || allow chaining of multiple commands. Most syntax is implemented and the results look good. I need to safeguard against pin conflicts a bit better, and then I have an idea for a killer output parser. Bus Pirates are arriving...
1
4
30
I really don’t recommend it, but it seems possible to upgrade the Bus Pirate NAND flash. Bus Pirate 5 is mounted with a 1Gbit MT29F1G01ABAGDWB-IT:G that formats to approximately 100 megabytes. The page size is 2K, it has a single plane of flash. MT29F2G01ABAFDWB is 2Gbit, 2K...
2
3
31
Working on an SPI sniffer. This job calls for two Bus Pirates!
2
4
31
The latest Bus Pirate firmware supports scripting and a tutorial mode. Scripts run multiple commands, with the option to bail on errors. Tutorials have step-by-step instructions with interactive prompts. Both use sure simple text files. Lines that begin with # are comments...
1
5
31
I2C mode is wrapped up and seems solid. There's an auto build in the forum, but only I2C is implemented, other modes will be ported to the new framework tomorrow.
Big box of bubble mailers arrived, the case backlog will get mailed out today. If you'd like one too let me know
0
3
30
There's a bug in Pulseview (Windows version) that made developing the logic analyzer painful. So, this weekend I scratched an itch and added a simple logic analyzer interface to the Bus Pirate terminal. It will never replace proper software, but it helped with debugging and...
1
2
30
I absolutely can’t believe it, but we had to order another production of the case. Left side is the new production. The inside is smooth and free of tooling marks. Right side is the old production. The tooling marks are obvious, there’s no surface finish at all....
3
0
30
Your e-Waste, coming back at ya!
SOP and WSON flash chips are widely available, but it seems nobody makes chips to include with the DIP adapter. Fortunately there's e-Waste! We located a supplier with a seemingly unending supply of recycled Winbond W25Q80 8Mbit chips.
1
2
30
The enclosures move during installation so the facory came up with a rig to help speed things up. This will be used for our next Batch of Bus Pirates, which is already in production. More Bus Pirates were shipped today. We are currently working on mid Feb orders.
1
3
30
This periodic glitch in the Bus Pirate logic analyzer output sent me into a panic. Had to do a quick scope check first to make sure there wasn't a hardware bug. Fortunately the hardware gets a clean bill of health, there's a pointer somewhere that's not rolling over correctly.
1
1
28
Bus Pirate "ultra" v1b fully assembled. Had to go out to FedEx at Schiphol to pick up the missing parts: 1.25mm molex connectors and cables for the IPS LCD daughter board.
0
5
29
What a great writeup! Thank you for your comments. I'm so glad that people are finding the Bus Pirate useful. :)
I spent some time with the Bus Pirate 5 and did a complete write-up up including instructions for UART and SPI flash reading (as well as some hardware recommendations).
1
2
9
2
4
29
Adding a new protocol to the Bus Pirate isn't difficult. Dummy mode is a template with examples and documentation. Most protocols use six main functions: setup, write, read, start, stop, cleanup. There's also a periodic service call for background work and a few other...
2
4
29
The latest Bus Pirate firmware has a 2-wire bi-directional open drain bus mode. 2-wire is driven by the hardware PIO, but we can still manipulate the clock and data pins with bitwise command (/\-_^.). In the past we could only do that with bitbang protocols-how cool is that? As..
2
6
29
Bus Pirate 5 packaging arrived. To go beyond the typical little box, we used "waists" that typically wrap bento takeout boxes. This kind of printing is cheap, fast and surprisingly good quality. The custom shape didn't even incur tooling fees.
5
3
29
Bus Pirate 5 has a metalized plastic button cap, but there's also a plain white version! We sent a bag to be dyed in red, yellow and blue.
We also found a hydrographic dipping service to coat them in carbon fiber, bamboo, and snakeskin patterns.
Any color or pattern requests?
4
4
27
A thread on Bus Pirate REV10 hardware changes:
Major: fix voltage sag on IO pins caused by analog mux switching inputs. Onboard NAND flash instead of removable storage.
Minor: swapped name brand parts for generic jellybean parts (cost, availability, supply)
Full log below
2
5
28
UART and I2C hump day! Cleaned up the last two modes, the build server will post a firmware in the forum. I2C is tricky because we need to figure out when to NACK the final byte in a read. I did not solve that yet because it would be a nasty hack. Instead, I'm moving to..
1
4
28
I2C address search got a bit of a makeover with suggestions from the forum. A simple search identifies write/read pairs clearly in alternating colors. A new 'verbose' search shows matching devices from the Adafruit I2C chip list...
2
2
28
Bus Pirate REV 10 passed FCC testing, and parts went to the assembler today. I've almost finished the updated docs.
Injection molding situation remains confusing, but a second run should begin soon. We convinced the factory the cases were unusable and they agreed to redo.
4
2
27
Flipped the Bus Pirate Ultra display 180 degrees in code so we can write characters left to right, instead of precalculating the end point based on the number of characters and writing backwards. The display will be physically flipped on the v1d display daughter board.
1
3
26
The latest Bus Pirate firmware has a user defined macros to speed up repetitive tasks. Macros and descriptions are saved in a simple text file format. The macro command with the -f flag loads a macro file, the -l flag lists the available macros. To run macros...
1
4
26
@matseng
Such a great time! I moved to Shenzhen and started a Chinese company
@DirtyBoardsPCBs
that automates buying some of the typical custom HuaQiangBei stuff. Just before the pandemic I moved back to Amsterdam.
@SMDprutser
and I have been working on a new project for about a year :)
2
1
26
Printing this Gridfinity compatible Bus Pirate 5 storage case by Matthias_1861847 right now! It has places for accessories and cables, and a cutout that holds the Bus Pirate at a pleasant viewing angle.
0
1
25