asciilifeform: prolly at some point i gotta write a 'NOBUS likbez' re the fundamental motivations ( they are not difficult to discern , but apparently entirely opaque to the herd , even when you exclude the willingly blind )

asciilifeform: it is probably impossible to educate the willingly thick, however, who ~actually~ see a box with NOBUS master keys as 'moar secure than with no keys'. these, will only wake up when they're sitting in kangaroo court , and confessing to 'child porn'

asciilifeform: 'bbbut i left box in hotel just for 10 min, and surely google would never..'

asciilifeform: and prolly they will sit in front of same judge who earlier nodded to 'tor devs would never', etc. ☟︎

asciilifeform: another interesting tidbit : cr50 vendor fw will conveniently checksum the ec and ap(bootloader) fw. BUT not without goldenkey. wouldn't want terrorists testing for fw modification, see.

asciilifeform: plebe wants to checksum the ec fw ? gotta solder a dozen probes under microscope.

asciilifeform: and this will work until they move the whole fw orchestra into cr50. which is on the planned 'feature' list already for next rev.

asciilifeform: meanwhile, in choice redditisms : 'I used to work as a security researcher - if I thought this subject was interesting I'd have to look for another source talking about the same thing because there's no way in hell it'd be acceptable to reference this level of unprofessionalism in a conference or to my superiors.'

asciilifeform: didjaknow.

asciilifeform: invitation to read the src -- already 'downvoted' into oblivion, unsurprisingly.

asciilifeform: http://btcbase.org/log/2018-06-10#1822087 << see also. i'd be surprised if there isn't already a boeck-style 'rebuttal' (perhaps from herr boeck himself) in the works. ☝︎

asciilifeform: as soon as it gets shat out, the links to the earlier heathenpit threads, will reroute to it -- just like in earlier phuctor case

asciilifeform: google already now returns some dna-related academitardism for 'h1', etc.

asciilifeform: http://btcbase.org/log/2018-06-10#1822079 << this is imho the lulziest case yet on record : google is pissing in their mouths, entirely overtly, and the universal response is 'mm, tasty, lemonade' ☝︎

asciilifeform: ( and betcha when mircea_popescu wakes up, he will add 'just like my gurls' ! )

asciilifeform: lol

asciilifeform: while this thread is alive -- there remains the (currently, hypothetical) puzzler of what-do when we find the jailbreak. i expect, buy N boxes, and cure'em ?

asciilifeform: (given as enemy will immediately patch when they get hold of the boojum, as crapple does)

asciilifeform: i suppose we will revisit this when we find the magic overflow etc.

asciilifeform: it's still 'admin', lol, just more along the vein of 'adminMAGICNSANOBUSSTRING'

asciilifeform: so it is only 'solution' in the sense of satisfying the 'childporn judge'.

asciilifeform: just like the credit card 'security' exists so banks can drop the bill for fraudulent mercedes onto the hapless card luser.

asciilifeform: http://btcbase.org/log/2015-10-17#1301302 << see also thread. ☝︎

asciilifeform: ( orig thread, http://btcbase.org/log/2014-10-19#883658 ) ☝︎

asciilifeform: the pretense with arrested diplomat et al stretches thin even to idjit public; thus they'll take all of the techno-help they can get, is the idea.

asciilifeform: 'the confession was on his chromebook, and no one (But US, but US Would Never!11) but his own hand, could have written' etc

asciilifeform: they've created this apparatus of 'pencildicks', and it will further the oddball rituals, or how else to justify existing.

asciilifeform: 'digital evidence'!

asciilifeform: picking from decerebrated muppets, satisfying ?

asciilifeform: i suppose.

asciilifeform: observe, the ~saner~ end of the heathenpit comments are along the lines of 'yes there's no escape, i sit and drink'

asciilifeform: ( speaking of which, hey Framedragger_ , how's it treating ya ? )

asciilifeform: theeere we go.

asciilifeform: !#s morarji cola

asciilifeform: orig unclealism

asciilifeform: morarji, 4th primeminister of india, famously drank glass of (supposedly, own, but whoknows) piss erry day

asciilifeform: https://archive.li/x3A3f << subj: >> '...his practice of drinking a glass of his own urine every day, and as veteran journalist M.V.Kamath, reporting for ToI, noted rather despairingly, the problem wasn’t just that Desai did this, but he was very eager to talk at length about it: “in a 15-minute appearance on a very popular Sunday TV show called ’60 Minutes’, Mr.Desai was seen taking practically half the time to commend urine

asciilifeform: therapy.”'

asciilifeform: aaaha

asciilifeform: india.

asciilifeform: y'know, the place where they have the magical shit river you drink 'to health' from.

asciilifeform: 'the secret, strange hole in his dubious pew!'(tm)(r)(trilema) !

asciilifeform: meanwhile, in moar recent preet india, https://archive.li/A1kOB

asciilifeform: they're getting less and less pronouncable. tejpal s. chawla -- srsly.

asciilifeform: i can only guess, that the pronounceable, brahmin folk, have run out

asciilifeform: time now for the ex-latrinecleaners

asciilifeform: mircea_popescu: ah i thought this was still about the reality winner lulz

asciilifeform: same flavour, neh.

asciilifeform: 'red'.usg demonstratively pillorying 'blue'.usg 'activists' etc.

asciilifeform: afaik chinese sit and 'wait for the corpse to float by' just like 1000yrs ago.

asciilifeform: virtue of patience, corpse reliably floats by.

asciilifeform: about same amt of shit as mircea_popescu gives about the fate of newly-ejected condom, aha

asciilifeform: wat's a fruit machine

asciilifeform: aa 1armedbandit

asciilifeform: i thought this was in jp

asciilifeform: where folx obsess , play'em

asciilifeform: or was that some local variant.

asciilifeform: (phunphakt -- 'sega' was originally usa/occupation-era co. that made 1armedbandits )

asciilifeform: 'nintendo'--meiji-era titan of playingcard manufacture.

asciilifeform: poor folx luuuuvvvv to pennyante gamble.

asciilifeform: i don't precisely know why.

asciilifeform: it is not given to fish, to wonder or worry about the life of the fisherman.

asciilifeform: focus of fish, is the worm.

asciilifeform: delish and entirely 'phreee'

asciilifeform: i think 'professional' is tardcode for 'responsible disclosure' and general usg-fellatio

asciilifeform: somethinglikethat

asciilifeform: also witness the redditards, 'harping on tpm, that's SOOO rms from 1997' etc

asciilifeform: i'm surprised that nobody brought up the eating of toe fungus

asciilifeform: more or less.

asciilifeform: mircea_popescu: revisiting upstack -- i suspect that the decerebrated folx, are not aware of any such famine. google made the perfect fuffle for'em, the dildonic 'open comp' that offers 'fetish of power', go ahead and install linux etc.

asciilifeform: sleeker, moar satisfying anal filler than ye olde wintel's hamfisted offering

asciilifeform: 'it's open, have you looked at coreboot' -- commenter

asciilifeform: for the moar advanced fetishists, even lets you solder contacts and rewrite boot rom etc., 'Чем бы дитя не тешилось, лишь бы не вешалось'(tm)(r)

asciilifeform: 'it's just a tpm, what's yer problem'.

asciilifeform: re 'professionals', i can also picture 'you wrote it like a vuln reveal, but this is not a vuln, this is our masters getting jus primae noctis with our raw starfishes like god intended' irritation

asciilifeform: 'how dare you describe god's chosen as vulgar syphilitic rapists'.

asciilifeform: this is the leitmotif audible to asciilifeform , at any rate.

asciilifeform: i've met these folx in the flesh, show'em e.g. http://www.loper-os.org/pub/nobus.jpg and response is lordosis

asciilifeform: possibly because there is no possible counter-argument to the substance.

asciilifeform: starfish is getting broad daylight waltzing, no way to boeck around the fact.

asciilifeform: https://archive.li/A4vO1 << various lulz in re that famous octopus. ☟︎

asciilifeform: !Q later tell trinque might be worth testing whether koch's latest lul affects deedbot's gpg hose

asciilifeform: verify

asciilifeform: ( see top qntra )

asciilifeform: let's put in the l0gz :

asciilifeform: 'The OpenPGP protocol allows to include the file name of the original input file into a signed or encrypted message. During decryption and verification the GPG tool can display a notice with that file name. The displayed file name is not sanitized and as such may include line feeds or other control characters. This can be used inject terminal control sequences into the out and, worse, to fake the so-called status messages. These

asciilifeform: status messages are parsed by programs to get information from gpg about the validity of a signature and an other parameters. Status messages are created with the option "--status-fd N" where N is a file descriptor. Now if N is 2 the status messages and the regular diagnostic messages share the stderr output channel. By using a made up file name in the message it is possible to fake status messages.'

asciilifeform: ( from the horse's mouth )

asciilifeform: loox like you can stuff arbitrary crapola into the filename field, and it gets term-interpreted to stderr ( where result is shat )

asciilifeform: correct

asciilifeform: iirc errybody's gpg-using items, callout.

asciilifeform: e.g. vtrons.

asciilifeform: right but eucrypt is not a gpg-riding proggy.

asciilifeform: ( $nooseitem is not a gcrypt 0day, but gpg particular )

asciilifeform: meanwhile, in the entomological pit : https://en.wikipedia.org/wiki/Talk%3AFritz-chip >> 'I've deleted most of the article. The information here is already presented in a more up-to-date fashion at Trusted Computing, which is the correct title for the technology. "Fritz-chip" was never more than a moniker used by critics of the technology put forth by Sen. Hollings. The article now represents this fact. Warrens 23:24, 29 April 2006 ( ☟︎

asciilifeform: UTC)'

asciilifeform: see why not to link to pedowikia, esthlos ?

asciilifeform: meanwhile, reddit verdict : 'Are there any less tinfoiley sites that discuss this? All of the references circle back to him.' ☟︎

asciilifeform: didjaknow.

asciilifeform: heya mod6

asciilifeform: trinque: neato

asciilifeform: hey BingoBoingo : does your dental school chix have access to xray ?

asciilifeform: asciilifeform needs a bit of xrayin'

asciilifeform: ( well, not asciilifeform in person, but a 10 x 5 in. pcb )

asciilifeform: lol

asciilifeform: http://www.loper-os.org/pub/c101pa/h1.jpg << observe, cr50 has buncha test pads. i bet half a dozen of these, are used for factory fillup. ☟︎

asciilifeform: for completeness, http://www.loper-os.org/pub/c101pa/mb_top.jpg + http://www.loper-os.org/pub/c101pa/mb_btm.jpg ( apologies for the sad photos, they came out of a flatbed, evidently not ideal tool for this job ) ☟︎

asciilifeform: does, dunnit. cuz its a flatbed. gets the chip markings, mostly, but the pcb itself is out of focus by mm or 2.

asciilifeform: doubt that it's quite so trivial, typically you gotta find how to hold it in reset so it doesn't boot up to its current fritz contents

asciilifeform: one interesting observation, is that the update mechanism lets you flash in arbitrary crapola into 'rw' section ( it simply won't jump to it if it doesn't pass rsa(sha256(payload)) ) . so theoretically could put a nop sled there, ending with jump into the magic half of unlock routine. and then expose the thing to beta/gamma, and perhaps in a few months it will Do The Right Thing ☟︎☟︎☟︎

asciilifeform: but would prefer to find a purely softwaric pill (e.g. buffer overrun, or whatever means to get code exec)

asciilifeform: idea being, it would be a substantial help to have even one unlocked box to experiment with.

asciilifeform: not merely 'gandalf', but 'idle gandalf'!11

asciilifeform: the sheer cheek.

asciilifeform: mircea_popescu: a break of the rng would also do the job. ( admittedly , tall order , but listed for completeness. )

asciilifeform: ( the 'rma unlock' 32byte turd, is simply rng output )

asciilifeform: prolly it's the typical on-chip ring oscillator, plus bit of whitener.

asciilifeform: the fact that h1 started life as fpga, suggests this.

asciilifeform: i got various things. problem is that i do not currently have a popped unit where i can see the effect of $manipulation on rng (or any other part, aside from general 'it crashed')

asciilifeform: the lulzy bit is that likely, a thousand or more unlocked units exist, in the hands of various derps

asciilifeform: an ounce of intel work would prolly beat ten pounds of lab wizardry in this case.

asciilifeform: ( recall kgb maslennikov ? 'we dun break keys, we buy'em' )

asciilifeform: and holy fuq the sheer militant uselessness of each new crop of i_came_via_reddit weevils.

asciilifeform: seems as if each set breaks new record.

asciilifeform: 'he will be a very well trained bear but never a world-class dancer' or how did it go.

asciilifeform: here's a historical lul that mircea_popescu might find stimulating. asciilifeform ( and his brother, and a whole generation of folx ) grew up with a certain orc '100 bytes of ram, but hey it's fucking programmable' little box, http://www.alfredklomp.com/technology/mk-61 . and the Official b00k for it ( http://publ.lib.ru/ARCHIVES/G/GAYSHTUT_Aleksandr_Grigor'evich/_Gayshtut_A.G..html ) had various games (typically you had to draw on g ☟︎

asciilifeform: rid paper, to work the labyrinths, tank battles, etc ) ;

asciilifeform: but as the '90s marched on, the thing did not, apparently, immediately fade away and die ( troo comps remained expensive, rare, until '93-'94ish ); so folx continued to write and circulate samizdat gamez : http://lordbss.pp.ru/pmk.html

asciilifeform: one of these was 'reactor control' , with realistic constants, you had to ramp up reactor, control the rods and the sodium pump etc, object was to get max power but avoid meltdown ☟︎

asciilifeform: so the hilarious bit, is that folx wrote variations on the theme, 'sim whore', 'bordello'

asciilifeform: that were in effect EXACTLY 'reactor control', but instead of sodium pump litres/sec, probability of runaway, etc. it was 'fucks per day', 'probability of VD', 'prob. of arrest', etc.

asciilifeform: ( and there were astonishing oddities of other kinds, for this humble machine, e.g. a 'tetris' where, lacking a graphical display, you had to instead pick a numeric column where the piece drops, and give another number representing rotation, and keep whole thing in yer head... )

asciilifeform: orlol had a hilarious essay on subj

asciilifeform: where he 'picture trying to hire world-class pianists, if occasionally grand piano exploded and took entire county with it'

asciilifeform: noshit.jpg

asciilifeform: it is sorta hilarious how a good 50-60% of the popular (they were hand-copied, and machine had no nonvolatile memory, you had to throw in the proggy each time you flipped the power on ) gamez, were based on the very soviet-flavoured diff. eqn. models the factory manual suggested

asciilifeform: 'land the capsule'

asciilifeform: ( legendarily, soyuz actually carried mk-52, reportedly, on board, a sort of mk-61 with i/o connector, as backup to main comp )

asciilifeform: compared to life with this orc box, mircea_popescu was tsar and god with his z80 . but , behold, even in 100bytes you can do things.

asciilifeform: all these calculators came with full schems btw

asciilifeform: 'centerfold' in manual

asciilifeform: complete with reference oscillograms. if yours dies (and not infrequently, it would) you were expected to repair.

asciilifeform: the calculators, bk0010 ( tiny little pdp clone ! ), etc. is a sunken atlantis. it was all forgotten almost immediately when imported pc was carted in in qty

asciilifeform: http://lordbss.pp.ru/pmk162.html << 'thief simulator'

asciilifeform: 'killer micro' was colonized by microshit, and almost immediately began the march towards death, 'how do we keep plebes from copying gamez', culminating in today's boxen.

asciilifeform: ye olde mk61 is moar of computer. even tho poor orcistan never even invented soldermask, pcb was bare, like if i made it here in my kitchen.

asciilifeform: cuz you could actually program! it.

asciilifeform: disqualifier?

asciilifeform: oh aa

asciilifeform: qualifier, then?

asciilifeform: aa then makes sense

asciilifeform realizes that he doesn't actually know anybody in meatspace, even elderly relatives, who does not own a desktop of ~some~ form

asciilifeform: of course orc owns pile of laptops. orc will never throw anything away.

asciilifeform: sure

asciilifeform: why shouldn't they work.

asciilifeform: ( often there'll be half a kg of dirt in the ductwork, but thing will still work, after a fashion )

asciilifeform: ( btw another reason c101pa would be a spiffy orc lappy -- it's got no fans/ducts )

asciilifeform: lol i recall that thing, it was, what, 3kg ?

asciilifeform: i recall when it was fashionable to make 'car comp'

asciilifeform: thing went in the boot , display on long cable , hanging somewhere near gearshift

asciilifeform: aha! them

asciilifeform: not whole globe needs ac, tho

asciilifeform: ( ac was ~unknown on asciilifeform's homeworld )

asciilifeform: http://lordbss.pp.ru/pmk149.html << 'escape from gulag'

asciilifeform: nah , moar of a 'wumpus'

asciilifeform: prolly there was a spicier ver. with bullocks, whole orchestra.

asciilifeform: interestingly, a major puzzler was 'how to rng'. most folx used some trigonometric crapola; it ~worked..

asciilifeform: laters.

asciilifeform: !!up loper_os_cr50

asciilifeform: loper_os_cr50: hello ?

asciilifeform: nope

asciilifeform: not unless BingoBoingo can find a c101pa in uy

asciilifeform: ( if he does, i'ma pay for it )

asciilifeform: !!up apt-get

asciilifeform: apt-get: hello ?

asciilifeform: what brings you to #trilema , apt-get ?

asciilifeform: apt-get: i recommend to read the logs

asciilifeform: beats the shit out of plain lurking

asciilifeform: apt-get: http://btcbase.org/log/

asciilifeform: apt-get: use the search box to find subjects that interest you

asciilifeform: and then get yerself a proper nick, and register gpg key with deedbot , and become a person

asciilifeform: well if you ~want~ to be known as apt-get...

asciilifeform: apt-get: do you speak ru ?

asciilifeform: damn

asciilifeform: in re 'rude', the starting point is http://btcbase.org/log/2016-09-07#1536618 ☝︎

asciilifeform: !!up |\n

asciilifeform: |\n: hello ?

asciilifeform: |\n: ideally, you go and register gpg key with deedbot. then , let's say i rate you, and then you can speak whenever you have something to say.

asciilifeform: alternatively , somebody might give you voice, such as now , and you can speak for 30min.

asciilifeform: |\n: recommend to read the logs, and make use of the search

asciilifeform: |\n: as trinque points out -- you will get much more enthusiastic audience if you introduce yourself, and register a key, establish as person

asciilifeform: |\n: i noticed today that there is 0 discussion of cr50/h1 in ru net

asciilifeform: |\n: how about you go and fix this

asciilifeform: the english people are clinically retarded. let's try the civilized world, how about.

asciilifeform: |\n: use what you have.

asciilifeform: !!up swiftgeek

asciilifeform: swiftgeek: hello ?

asciilifeform: swiftgeek: slightly better photo from today, http://btcbase.org/log/2018-06-11#1822393 ☝︎

asciilifeform: swiftgeek: if you want to talk to the cr50 in your unit, all you need is the simple cable in http://www.loper-os.org/?p=2415 article

asciilifeform: cr50 will appear on /dev/ttyUSB0

asciilifeform: you will get a (very limited, pretty much all you can do is to read version strings and gpio voltages) command prompt

asciilifeform: swiftgeek: i do not currently have a 201

asciilifeform: i am however accumulating a pile of c101pa boards

asciilifeform: and definitely interested in getting one xrayed. you got an xray machine, swiftgeek ?

asciilifeform: swiftgeek: even simple xray would give you basic info, such as the number of balls in the bga, and possibly the routes of the test pads (it ain't a very crowded pcb)

asciilifeform: but ideally yes, would strip it properly

asciilifeform: yes

asciilifeform: all i've been able to find is that 1) it is an arm cortex-m , prolly licensed 2) started life as fpga ( see google's src, comments repeatedly refer to earlier vers as 'fpga' , then , later, 'g-chip' )

asciilifeform: it also has onboard flash

asciilifeform: ( the cr50 rom is ~not~ kept in the winbond spi rom where the boot loader ( google's crippled coreboot ) lives )

asciilifeform: swiftgeek: in re cr50, i am specifically interested in whatever factory test pads exist , with which the thing may be filled up with initial fw on manufacture

asciilifeform: if these are found, and found to work, it is likely to be the shortest path to proper jailbreak

asciilifeform: black boxing ?

asciilifeform: unfortunately it is

asciilifeform: they moved power supply init into it

asciilifeform: swiftgeek: see https://chromium.googlesource.com/chromiumos/platform/ec/+/master/board/cr50/gpio.inc ( what is known of the pin functions )

asciilifeform: so far we know that it handles the power button signal; the reset magic combo on the kbd; and the 3.3v rail bringup. it also handles the usb debug functionality that you get with the cable linked earlier

asciilifeform: but conceivably you could , at some expense, come up with a pad-for-pad substitute, and lift the thing, then solder to the balls

asciilifeform: swiftgeek: the way it is connected now, the box won't actually power up without it

asciilifeform: not once, but for each unit

asciilifeform: swiftgeek: asciilifeform's orig plan was to sell cleansed c101pa machines. if this said cleansing requires lifting a bga, and attaching a manufactured replacement , we will be talking about considerably different cost than if the machines can be cleansed in 10min via software, via debug snake.

asciilifeform: makes sense ?

asciilifeform: sure, but i want 1000+ units, rather than 1 elaborately handcrafted.

asciilifeform: google's src already contains everything you need, in theory, to make a hypothetical benign replacement for cr50

asciilifeform: that ~only~ brings up 3v, etc

asciilifeform: however this approach is expensive, in manual labour, and its cost borders on that of simply making new machines from 0

asciilifeform: which makes it of secondary interest to us

asciilifeform: and as soon as we start doing it, they'll start pouring epoxy, and then cost goes up yet again

asciilifeform: swiftgeek: if you'd like to take a c101pa and deball the bga and try this, and post article, i promise to read

asciilifeform: sadly i am not currently equipped for such an experiment

asciilifeform: i have a very similar machine

asciilifeform: that's not the sticking point

asciilifeform: sticking point is to solder to the balls

asciilifeform: yes anybody can lift bga ( tricky to do without cracking the board, but doable if you are patient )

asciilifeform: soldering however many balls are under it, to bodge wires, and attaching logic analyzer etc, is the headache

asciilifeform: what you'd want, is to solder an interposer b/w the cr50 and the pcb

asciilifeform: and get a trace of all of the signals

asciilifeform: ( if you simply lift it, there'll be no signals, board doesn't come up )

asciilifeform: swiftgeek: out of curiosity, what's your interest in this particular box ? ☟︎

asciilifeform: coreboot dev ?

asciilifeform: aah

asciilifeform: !!up |\n

asciilifeform: swiftgeek: if you register a gpg key with deedbot, you will be able to voice yourself

asciilifeform: !!help

asciilifeform: ^ instructions

asciilifeform: swiftgeek: why do you need a dead unit, why not buy fresh one

asciilifeform: ultra-low budget project ?

asciilifeform: not really possible to thoroughly reverse things without creating a pile of rubbish, sadly

asciilifeform: i'm on my 2nd board..

asciilifeform: to be clear, asciilifeform is working with c101pa .

asciilifeform: ( i do not yet know what is in the 201pa )

asciilifeform: not currently

asciilifeform: |\n: best suspicion thus far is that it is a 'hardcopy fpga' (cheap, relatively, method for getting chip baked, they apply a custom metallization mask to a stock crystal)

asciilifeform: |\n: only chromebook. afaik all recently-rolledout units, have it

asciilifeform: swiftgeek: i definitely noticed the change.

asciilifeform: having used ~every thinkpad made.

asciilifeform: swiftgeek: if you are a thinkpad aficionado, there is a patched x60 bios in the logs, iirc 2015

asciilifeform: we have several people here, using it

asciilifeform: aa

asciilifeform: swiftgeek: i actually started with attempt to port generic coreboot to c101pa, and ended up finding the cr50 by accident

asciilifeform: neato

asciilifeform: c101pa also includes a trackpad with flashable blob fw

asciilifeform: thus far i know nothing about it aside from the update/reflash mechanism (it is done via the ec)

asciilifeform: i also have a sample fw blob

asciilifeform: but this is for much later.

asciilifeform: personally, i'd consider a box with no trackpad function, to be usable ☟︎

asciilifeform: but perhaps that's just me

asciilifeform: swiftgeek: to complete the picture, my initial interest in cr50 was in the debug functionality; the thing can override #WP signal and rewrite the EC and boot roms , via usb snake. so it'd be quite convenient to have access. however the factory firmware locks it.

asciilifeform: it is not an infineon, this is more or less certain

asciilifeform: google baked it as a replacement for the infineon.

asciilifeform: ( i cannot rule out the possibility that it was built in cooperation with, or at the facility of , infineon; it is stamped 'TWN' so this is at least theoretically hinted )

asciilifeform: swiftgeek: 2018

asciilifeform: i uncrated it in end of april

asciilifeform: !!up swiftgeek

asciilifeform: that winbond's been in production since early 2000s

asciilifeform: ( it's the bootloader fw, btw )

asciilifeform: the c101pa itself was introduced in '17

asciilifeform: the h1 is the item in the right hand side of the photo

asciilifeform: marked in purple

asciilifeform: 'H1B2C'

asciilifeform: aa

asciilifeform: nope

asciilifeform: http://www.loper-os.org/pub/c101pa_open.jpg << machine

asciilifeform: swiftgeek: here's a flatbed scan of the board, http://btcbase.org/log/2018-06-11#1822396 ☝︎

asciilifeform: this one is 'bob'

asciilifeform: also apparently was known as 'gru' in early in-house versions

asciilifeform: ( according to amstan , a fella from #linux-rockchip who introduced himself as one of the designers, but is rather tight-lipped )

asciilifeform: wifi is soldered down on these

asciilifeform: but in theory you can plug in usb wifi etc

asciilifeform: swiftgeek: the wifi ? on this one ? seems to be on pci bus

asciilifeform: with reballing etc. lol.

asciilifeform: there's no socket on the pcb

asciilifeform: the module is soldered on

asciilifeform: swiftgeek: you can infer exact dimension from the usbc jack

asciilifeform: ( or the plain usb3 )

asciilifeform: yep looks like the same footprint

asciilifeform: how would you go about lifting it without ending up reflowing the internals?

asciilifeform: prolly would need ir preheater for the underside ?

asciilifeform: aha

asciilifeform: swiftgeek: if you end up doing it, plz consider publishing the procedure

asciilifeform: like anatomical practice on corpses, the approach has its obvious limits

asciilifeform: ( waste pcb won't tell you that you have not reflowed/mutilated/stress-fractured something )

asciilifeform: at any rate i am not presently concerned with the 80211 card

asciilifeform: thus far i know how to cut power to it, and this suffices for my purpose ☟︎

asciilifeform: ( its rail is controlled via EC )

asciilifeform: currently i am not very interested in intel iron

asciilifeform: hence investigation of c101pa and similar

asciilifeform: https://osmocom.org/projects/baseband/wiki/MotorolaC123 << these ?

asciilifeform: swiftgeek: given your introduction ( http://btcbase.org/log/2018-06-11#1822589 ) i assume you may be interested in verifying fact that cr50 is not a subfunctionality of the ordinary (i.e. kept in winbond spi ) bootrom or the EC controller ('nuvoton' arm , visible in right hand of photo ). this is very simple to do: ☝︎☟︎☟︎

asciilifeform: disable the spi boot rom using the method shown in http://www.loper-os.org/?p=2382 article. then insert the 'suzyq' debug cable, shown in http://www.loper-os.org/?p=2415 ;

asciilifeform: you will observe that you are still able to communicate with the machine

asciilifeform: because you are talking to cr50, which is active at all times, even when 'off'

asciilifeform: and it does not rely on the cpu (referred to as 'AP' in google's srcs)

asciilifeform: or the EC

asciilifeform: it runs on the h1 device pictured in h1.jpg.

asciilifeform: in fact , if you are so fond of lifting bga, lift the cpu , the spi rom, and the ec, and you will find that you still get the /tty/USB0 shell

asciilifeform: !!up |\n

asciilifeform: btw you will get EC uart on /dev/ttyUSB1

asciilifeform: and cpu uart ( from the rk3399 ) on /dev/ttyUSB2

asciilifeform: the latter , you can get root shell on, on stock machine if it is in dev mode

asciilifeform: swiftgeek: i intend to send a unit to zeptobars in near future. i do not however expect any interesting result, afaik no 22nm or similar density device has ever been publicly reversed

asciilifeform: got example of a successful public reversing of any recent (i.e. post-1995) crystal ?

asciilifeform: i'd luvv to be proven wrong on this subj

asciilifeform: not clock crystal, lol

asciilifeform: i mean, asic die.

asciilifeform: sorry, ru world terminology

asciilifeform: lol i was not speaking of timing xtal

asciilifeform: given as it is a tpm/drm crock of shit, i fully expect false metal masks and the other joys of 'tamper resistence'

asciilifeform: swiftgeek: look in the src, it incorporates tpm

asciilifeform: i.e. 100% replacement of the old infineon they formerly used

asciilifeform: the sad bit is that it is many yrs of labour, to go from even a high quality die shot, to functionality

asciilifeform: it so happens that i know how decapping etc is done.

asciilifeform: swiftgeek: my specific interest is to get arbitrary code exec on the device. ☟︎

asciilifeform: rather than, say, to fill photo album with pretty pics.

asciilifeform: swiftgeek: out of curiosity, what would you look for in a die shot ?

asciilifeform: i, for instance, would like to know which fpga was their starting point. and where its factory test pads are.

asciilifeform: and whether there is any mechanism to inhibit them

asciilifeform: !!up swiftgeek

asciilifeform: ideally

asciilifeform: !!up loper_os_cr50

asciilifeform: swiftgeek: even more ideally, would learn this without waiting for decaps.

asciilifeform: but this is still in progress.

asciilifeform: loper_os_cr50: hello ?

asciilifeform: swiftgeek: you know how this usually ends, right ?

asciilifeform: the way it usually ends, is that we learn something useful just in time for the device to go out of print.

asciilifeform: which is what the designer was banking on when he put in the false metallization layers etc.

asciilifeform: sure

asciilifeform: at any rate, my current approach will be to do some fuzzing of the cr50 console and slave spi interfaces

asciilifeform: if i can exploitably crash the thing , my job is done

asciilifeform: see also http://btcbase.org/log/2018-06-11#1822402 . ☝︎

asciilifeform: what do you mean by 'name' ?

asciilifeform: google's product code is 'bob'

asciilifeform: dev version of same, was 'gru'

asciilifeform: https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices << see vendor's chart.

asciilifeform: September 1, 2017 Asus Chromebook Flip C101PA Bob rk3399 etc

asciilifeform: you will find the string in the boot rom fw also

asciilifeform: there is very little to be had in the search results, other than the src repo itself

asciilifeform: c101pa finds various retailers, and, if you dig persistently, asciilifeform's www, and that's currently more or less it.

asciilifeform: to be fair, it's a pretty recent box.

asciilifeform: swiftgeek: here, btw, is the factory boot rom (crippled coreboot) from that winbond : http://loper-os.org/pub/c101pa/factory_rom.bin

asciilifeform: you can extract strings from it, and see which bob rev etc

asciilifeform: repair guide only shows you how to get the box open, really

asciilifeform: not much use ( it is not difficult to open, and the c100pa published disassembly applies to this one, the screws are in same places )

asciilifeform: there is nothing usefully removable on the mb, aside from the heat sink

asciilifeform: so i'm not sure what you expect to find in a vendor repair book

asciilifeform: aa

asciilifeform: i have a pretty good idea of the power sequencing, from reading the ec and cr50 srcs

asciilifeform: but sure.

asciilifeform: lol what does 'repair shop' do aside from swapping mb

asciilifeform: ( i do it right here with 10min of work )

asciilifeform: yes in china there are repair shops that lift bga etc.

asciilifeform: but you will not find these in usa.

asciilifeform: nope

asciilifeform: that was |\n

asciilifeform: i don't see this as a productive line of probing

asciilifeform: board-swapping monkeys.

asciilifeform: srsly, try walking into repair with chromebook. 'we can reset this for you for $50', lol

asciilifeform: the schem, for instance, is not given to repair contractors. or i would already have found it.

asciilifeform: right

asciilifeform: and it ain't there.

asciilifeform: last i saw.

asciilifeform: fwiw i don't have any use for anything short of the schem

asciilifeform: i have already identified all of the major components

asciilifeform: well yes, the schem

asciilifeform: fwiw the only nonstandard chip is the h1.

asciilifeform: everything else, is off-the-shelf

asciilifeform: according to amstan , the fella claiming to be a designer of c101pa , everything connected with cr50 is deeply trade secret, and shared with no one outside of google.

asciilifeform: but i have no way to verify the truth of what he said, aside from noticing that there is 0 discussion anywhere on the net, aside from #trilema and my www, of the h1.

asciilifeform: ( if you know of a counter-example, please link )

asciilifeform: so far my only clue that h1 actually runs the given fw , is that i was able to flash in a vendor update : http://btcbase.org/log/2018-06-08#1821699 and ended up with a slightly different, in the ways suggested by the src, console ☝︎☟︎

asciilifeform: https://chromium.googlesource.com/chromiumos/platform/ec/+/master/chip/g/ << starting point re console functionality ( locked and unlocked )

asciilifeform: a chinese shop could, for instance, mount the http://www.loper-os.org/pub/c101pa_dbg.jpg ( 'google servo' ) connector, on to the vacant pads. BUT this does not give me anything that i do not already have via the 'suzyq'.

asciilifeform: not to mention that i do not have the 'servo' device, nor see anything to be won from building it ( it gives access to the consoles, which i already have, and spi, which i already have via soldered probes, and that's it. )

asciilifeform: the fella in #rockchip-linux ?

asciilifeform: paulk-gagarine ?

asciilifeform: seems that we have already spoken

asciilifeform: see the june 9 log.

asciilifeform: ( their chan's )

asciilifeform: https://irclog.whitequark.org/linux-rockchip/2018-06-09

asciilifeform: fella seemed quite surprised that h1 exists at all

asciilifeform: at any rate i encourage folx who think that i dreamed it all, to build the snake ( i posted schem ) and do the exact experiment suggested earlier in http://btcbase.org/log/2018-06-11#1822821 . ☝︎

asciilifeform: !!up swiftgeek

asciilifeform: !!up hl`

asciilifeform: hl`: hello ?

asciilifeform: what brings you to #trilema, hl` ?

asciilifeform: swiftgeek: as far as i'm concerned , all boxes not yet cured of fritz are 'ewaste'

asciilifeform: swiftgeek: as soon as they roll off the conveyor.

asciilifeform: hl`: please read the chan logs and make use of the search, before asking q, http://btcbase.org/log/

asciilifeform: swiftgeek: i personally am more annoyed at rubbish masquerading as computer, than by general-purpose rubbish

asciilifeform: ( and by the total unavailability, other than as antique, of actual computer )

asciilifeform: swiftgeek: UAY-W8997-M1216

asciilifeform: as printed on bottom of chassis

asciilifeform: doesn't give much .

asciilifeform: right

asciilifeform: swiftgeek: understand, i have a quite specific aim in re this machine, outlined in http://btcbase.org/log/2018-06-11#1822866 . i do not particularly care re the irrelevant details, e.g. the shape of the antennae in m2, or the exact diameters of the screw holes, etc. ☝︎

asciilifeform: i can also 'replace the card' by switching off its power rail via ec and inserting usb nic dongle.

asciilifeform: so this part is not so interesting imho.

asciilifeform: but i will add, cr50 also hangs from same vreg's enable line and can switch it... back on

asciilifeform: ( afaik strictly via the console, but this remains to be determined )

asciilifeform: i've established that cr50 ~will~ accept fw update if ver is incremented and rsa signature is valid. so anybody with google's rsa key and 10 seconds of physical access can insert new fw into cr50.

asciilifeform: ( this was possible because i purchased a unit having cr50.r0.0.10.w0.3.3 fw )

asciilifeform: swiftgeek: the typical x86 pc 'infineon' etc tpm, cannot do such interesting things as overriding bios write protect, accessing microphone, etc

asciilifeform: so 'it's a tpm' is not anything like whole story.

asciilifeform: i am not particularly interested in infineon, you can safely desolder it from any box that has it

asciilifeform: and render it harmless

asciilifeform: cr50 however is 'glued with broken glass'

asciilifeform: i fucking hate riscv

asciilifeform: !#s riscv

asciilifeform: it was designed by wreckers

asciilifeform: and pushed under false pretenses

asciilifeform: it is not difficult to design a usable cpu, if you don't need bincompatibility with anything

asciilifeform: fabrication, is the rub.

asciilifeform: other than as fpga softcore -- where ?

asciilifeform: ahahahaha

asciilifeform: no thx.

asciilifeform: it is no start.

asciilifeform: nvidia is on same shitlist as intel

asciilifeform: and for same reason.

asciilifeform: fuck riscv. it was deliberately designed with no arithmetical carry, to cripple cryptography. ☟︎

asciilifeform: j2 at least has the virtue of being small, and fitting in ice40 fpga.

asciilifeform: ( or maybe not quite fitting, but it's close )

asciilifeform: understand, i can have ice40 boards to fit lappy chassis roll off conveyor in 6mo, if i want.

asciilifeform: but would like to try cleansing commercial arm64 board, first.

asciilifeform: if none can be cleansed -- we make from scratch, yes.

asciilifeform: why the FUCK would you want 'open' manacles ?

asciilifeform: what does it even mean.

asciilifeform: how about NO manacles.

asciilifeform: hl`: nope.

asciilifeform: they're a nsa boobytrap, sold under the fraudulent pretense of 'security'

asciilifeform: over in the civilized world, we http://trilema.com/2013/how-to-airgap-a-practical-guide/ our crypto.

asciilifeform: no magic chips needed.

asciilifeform: whole concept of 'root of trust' is a crock of shit.

asciilifeform: we don't pki, and we don't ssl.

asciilifeform: hl`: i am not interested in buying iron that specifically protects against everybody-but-nsa physical attack.

asciilifeform: and i am definitely not interested in iron that protects against ~my~, the owner's, physical attack.

asciilifeform: my machine. i read or flip whatever fucking bits i want.

asciilifeform: tell me again why i would want 'tpm' if i have an airgapped 1990s machine for all computations on secrets.

asciilifeform: you don't resell crypto hardware, you thermite it

asciilifeform: in a barrel.

asciilifeform: http://trilema.com/2014/spy-stuff/ << like this.

asciilifeform: my 'root of trust' is iron that i assembled with own hands, out of soviet components, and sealed with glitter polish. fuck fritz tpm.

asciilifeform: hl`: how much do you like google's tpm, which opens in 3 seconds to 'evil maid' with the magic rsa key ?

asciilifeform: whole concept of 'tpm' is explicitly counter to owner control. starting from when it was called 'palladium' and pushed by ms.

asciilifeform: this is the fundamental fallacy that resulted in a market empty of honest iron.

asciilifeform: if i cannot audit the contents of the device, it is impossible to prove the nonexistence of magic key.

asciilifeform: crypto on single-die device of modern (i.e. past 25 yrs ) manufacture, is a losing proposition.

asciilifeform: no matter how you cut it.

asciilifeform: swiftgeek: go and maskrom-exploit my made-in-zelenograd-in-1985 cpu.

asciilifeform: !#s specificity of diddling

asciilifeform: ^ starting point for discussion.

asciilifeform: we were discussing 'hardware which you trust to do rsa exponentiation' , neh

asciilifeform: !!up swiftgeek

asciilifeform: which resolves to 1) i wrote the code 2) i know that the die was not built in advance to subvert the functionality of said code

asciilifeform: !!up hl`

asciilifeform: 'open' isn't worth a sparrow's fart, per se

asciilifeform: if you cannot determine via physical means that the proggy as-published is actually executing on the given device

asciilifeform: it, and no other

asciilifeform: this is physically ~impossible with e.g. 60nm

asciilifeform: speaking of all recent (sub-2uM , really) densities

asciilifeform: let's take an example of trustworthy iron : K573RF4 ( https://eandc.ru/pdf/mikroskhema/k573rf4.pdf ) ☟︎

asciilifeform: this is an eprom. and i've had them in physical possession long enuff to know that they weren't touched by fucking nato. and , on top of this, i can physically photo the crystal without decap.

asciilifeform: hl`: this is a perpetuum mobile.

asciilifeform: http://btcbase.org/log/2015-08-12#1236209 << see also thread ☝︎

asciilifeform: swiftgeek: yes, and it's snake oil.

asciilifeform: it exists strictly to slightly increase the headache for reversers, and is not interesting tech from my pov

asciilifeform: at any rate there does not currently exist ANY usable crypto algo, of any purpose, for which a complexity class reduction to any class is known.

asciilifeform: and in particular a reduction of ~every~ generated key, rather than avg case.

asciilifeform: there is not even a proof that the difficulty of rsa is equivalent to that of factoring.

asciilifeform: ( and there is no known complexity class pindown of factoring. )

asciilifeform: if anybody told you otherwise, he is a dirty liar, and probably selling snake oil.

asciilifeform: back upthread -- discussion of 'roots of trust' WILL start with , at the very MINIMUM, iron where i can fucking see the transistors through optical microscope. and never with anything else.

asciilifeform: any other notion of 'root of trust' is fritzian.

asciilifeform brb, teatime

asciilifeform: in one ear and out the other, apparently . ☟︎

asciilifeform apologizes to log reader for having allowed this waste of time to clutter the chan.

asciilifeform: if anyone was puzzle re naggum's remark concerning 'read only brains' -- here they are!

asciilifeform: *puzzled

asciilifeform: BingoBoingo: somehow the derps obsess with 'wife replaced while you sleep' scenario. aaaand then go on to advocate elaborate tpmdildo that makes this scenario actually workable.

asciilifeform: via nobus.

asciilifeform: rotten old fungus man rms, you can say whatever about, but he was exactly on target re how this particular item will go, back in '97. first, 'it only stores keys, harmless!' ( and won't give'em up to usg Because Reasons ... ) then 'ok now it can rewrite fw' 'yer lying, they Would Never!11!!' '...'

asciilifeform: lol

asciilifeform: BingoBoingo: it isn't clear to me, what, if anything, these folx wanted, other than to waste our time.

asciilifeform: 'go to repair shop!' the cheek.

asciilifeform: it isn't clear that all of their derpery has to date added up to any 'gets done'

asciilifeform: considering e.g. libreboot

asciilifeform: and its continued derping with intel

asciilifeform: !#s libreboot

asciilifeform: ^ dun forget what they're famous for..

asciilifeform: aaha

asciilifeform: http://btcbase.org/log/2018-06-11#1823179 << phunphakt, asciilifeform ( in ascii_butugychag period ) was a slave in precisely that bit of idiocy, sat in the peanut gallery at the derp committee, etc ☝︎

asciilifeform: ( http://btcbase.org/log/2017-09-15#1714991 << see also. ) ☝︎

asciilifeform: afaik boneh et al are still there, still pushing the same lulzoil

asciilifeform: in darpa land they do what in civilized world is called 'освоение бюджета'.

asciilifeform: (i.e. snarfing up that delish printolade like there's no tomorrow )

asciilifeform: each wunderwaffen has a seekrit committee , with nsa-vetted gentry, and a larger nonseekrit ('commercial'), for ladling out grantolade to academics and quasiacademics

asciilifeform: seekrit committee generally concerned with specifics of applications (i.e. anything where you gotta know the identity of intended victim, say)

asciilifeform: the nonseekrit -- with the bulk of the implementation detail.

asciilifeform: upstack, observe the lulzfest, where http://btcbase.org/log/2018-06-11#1823026 and then http://btcbase.org/log/2018-06-11#1823205 demands fritz on-die in cpu ! for 'security!' ☝︎☝︎

asciilifeform: 'pleeeze, pleeeeeze make it secure from MY OWN HANDS!!!'

asciilifeform: 'pleeeze make it so only obama can read with nobus key!!'

asciilifeform: the very notion that anything whatsoever happening on a nato-produced 22nm die is 'owner controlled'...

asciilifeform: they dun make tards, apparently even, like they used to. i swear , the tards from 10y ago were not this thick.

asciilifeform: http://btcbase.org/log/2018-06-11#1823242 << naaah BingoBoingo , see, different thing. the crack smokers for the most part only burn ~own~ time. ~these~ folx, they want to burn yours, and mine. ☝︎

asciilifeform: it'd be one thing if, say, google dev showed up and 'yes i'ma pgp to mircea_popescu the magic key', or even 'here's the schem'. but nooo, instead they come to 'explain' to us how 'tpm can be used to benefit you' . ☟︎

asciilifeform: because somehow this is not insulting to the intelligence of the fucking fruit fly stuck to my display. not even speaking of the l1 lordship.

asciilifeform: certainly.

asciilifeform: trinque: ever meet these folx in the flesh ?

asciilifeform: they're exactly like eichmann, perfect little marvels of industrious compartmental schizoid ☟︎

asciilifeform: usg cultivates these, from childhood

asciilifeform: see e.g. http://btcbase.org/log/2018-06-11#1822328 re their public end. ☝︎

asciilifeform: one autist sqeals in delight designing shutter for the drone camera, another -- the rocket proximity cap, another -- likes to draw cute little octopi; etc

asciilifeform: not 1 would be caught dead giving half a shit re what it all adds up to

asciilifeform: http://btcbase.org/log/2016-12-16#1584061 << see also. ☝︎

asciilifeform: BingoBoingo ( and other awake folx ) , plz to point future 'fact checker' i_came_from_reddit folx, to http://btcbase.org/log/2018-06-11#1822821 + http://btcbase.org/log/2018-06-11#1822990 etc, if i'm off in meatland ☝︎☝︎

asciilifeform: or better yet, if they dun show signs of a half-working brain, just !!down , dun hesitate, 'ваше слово, товарищ маузер!'(tm)(r)

asciilifeform: BingoBoingo: i still find it lulzy how google apparently banked on nobody outside of their heathen pit getting hold of the fucking debug hose. ☟︎

asciilifeform: with which in 10 minutes you can verify that, yes, independent fucking fritz chip

asciilifeform: !!up oda

asciilifeform: oda: hello ?

asciilifeform: mircea_popescu: sounds versatile

asciilifeform: oda: you will definitely want to read the log ( http://btcbase.org/log/ ) and use the search box.

asciilifeform: oda: you can start with today's , let's say from http://btcbase.org/log/2018-06-11#1822562 point, the last set of cr50 people ☝︎

asciilifeform: more or less!11

asciilifeform: mircea_popescu: i'm picturing the archaetypical baba yaga scoop

asciilifeform: http://volshebstvo.in.ua/wp-content/uploads/2015/12/baba-yaga-pech.jpg << for ref.

asciilifeform bbl,meat