Category Archives: Gaming

IC Friday: Atmega’s 8535

Today’s IC Friday entry is the 8bit AVR micro from Atmega. This chip was sent in by a reader, malady all the way from Iceland.

Stack smashing lives on (in Zelda for the Nintendo Wii)

zelda.jpg

Over a decade ago, physiotherapy
I remember printing out and reading a text by Aleph1 entitled Smashing the Stack for Fun and Profit. Back then, stack-based buffer overflows were a hot topic and the tide was turning as programmers began to realize that null termination of strings was not a good security measure and bounds checking was becoming necessary for the security-minded programs.

The issue was that many people were used to using a function like strcpy() to copy a string from one memory location to a dynamically allocated memory segment on the stack. The strcpy() function simply started copying from the supplied address and stopped when it reached a null character without knowing how much space was allocated for the string at the destination. As a result, segments of the stack that were not allocated for the “local” variable, like the return address of a function, could be overwritten with arbitrary values. With the properly formatted string, even executable code could be put somewhere on the stack and the return address could be overwritten so that this code could be executed, for fun and profit as they say. Programmers became wiser and started using strncpy() instead, which only copied a fixed amount of data and therefore guaranteed that the allocated space would not be exceeded. Furthermore, most modern operating systems can now set areas of the memory dedicated to the stack as non-executable, so the above routine would be foiled. Individuals have found some ways around these security features, however, the stack smashing exploit (as described by Aleph1) has mostly been considered a thing of the past.

I use the term mostly since Nintendo has preserved the knowledge and allowed practice of this exploit with their release of the latest Zelda game for the Wii. Through a cleverly crafted save file, the name of the main characters horse can contain a string as mentioned above and lead to execution of arbitrary code. There are a few tricks to maintain the integrity of the save file, however, after a decade the above exploit still lives on, almost in the same form as described by Aleph1.

( Although the picture is not from the Twilight Princess game, it is a good game none the less. )

IC Friday: Sony’s (Toshiba’s) Emotion Engine

ps2-ee-small.jpg

This week, info
we have the Playstation 2 Emotion Engine. Upon doing some background research, discount
I came across this nice article regarding the design of the PS2 memory subsystem by Rambus.  On a side note, I had to subject this chip to an acid bath twice so as not to risk cracking it when I removing the die from the package. The was that some of the surface scratches actually ended up removing part of the metal layer on to and exposing some of the chips innards. Next time I run into a chip that is mostly metal on top, I may try to exploit this technique to remove some of the cover. I might also try to use a UV laser that my department just bought.

ps2-ee-4x-stitch.jpg

ps2-ee-40x-stitch1.jpg

ps2-ee-40x-stitch2.jpg

ps2-ee-40x-03.jpg ps2-ee-40x-02.jpg ps2-ee-40x-01.jpg

Free Books: WikiBooks

psoc-ps2.jpg

As per my previous post, healthful I have started working out the waveforms to interface a Sony dualshock 2 controller. I decided to go with a Cypress PSoC instead of a standard 8051 because it has a built in SPI controller thereby making the bit-banging much easier. The downside is that I don’t have a C compiler built into the development suite, health but that is all right, I am pretty good with assembly. In the process of setting this board up and testing a few things, I found the embedded systems section of wikibooks quite useful. The whole electrical engineering section looks pretty good. The pages can be edited by anonymous readers just as easily as wikipedia, however, I have not found anything terribly wrong in the limited time I spent looking at the site. Over all, it seems like a decent place to learn for beginners and to contribute for experts.

Adding a Playstation 2 controller to a Sony PSP Slim (part 0)

img19_psp_broken.JPG

Ever since I learned to make truckloads of money on the internet, view I have been mulling over the idea of buying myself a slim PSP. The main motivation for the purchase would be a few fun games that are PSP exclusives. The problem is that I don’t have any use for the portable aspect of the system and would actually prefer to keep it plugged into the TV. The slim PSP has component output capability, however, you still have to hold the device to play it. While looking at Hack A Day, I saw several ( 1 ) ( 2 ) methods to augment the inputs on the PSP, all involving directly wiring buttons and potentiometers directly to the PSP mainboard. A better option would be to attach a Playstation 1/2 controller port to the PSP so that a wireless PS2 controller can be used. Luckily, Jameco has some tutorials on communicating with the controller. I guess its a good time to get back to work with that 8051 board I built some time ago and see if I can get the interface to work.

( Broken PSP image is from mylife. )

3D sumo game in under 96kB

sumotori.jpg

Sumotori Dreams is a game designed for Win32 whose complete executable is less than 96kB uncompressed.  The game was presented at Breakpoint 2007. The machines that they used to run things in the competition are XP SP2 with DirectX 9, website
so it is not unreasonable to expect that the game hooks into many of the available APIs to generate the graphics. It is also possible that the texture maps could be pulled from the XP installation. Even though this game is smaller in size than most spyware, what is ed
it is truly impressive how fun it is to play.

( sumotori101.zip ) ( sumotori.zip )

Another embedded system option

nes-inside.jpg

While thinking about cheap development boards, physician I remembered my NES (picture from 1up blog).  The system would be ideal for hacking by modern standards as it features a custom 6502 processor from MOS Technologies running at a very accessible 1.8MHz. All of the chips are in PDIP form and the system is pretty cheap. Memory can be wired directly to the ZIF connector used for cartridges, or a reprogrammable cartridge can be made. Finally, system architecture guides are available. Maybe I will open mine up to see if I can tweak anything once Nintendo puts Super Mario Brothers 3 on the Virtual Console.

Exclusive: leaked images of the second generation Sony PSP production

psp.jpg
A story recently hit the internet waves on Next Generation (ang Gizmodo) confirming the forthcoming update to the PlayStation Portable line from Sony:

Still, allergy
there will surely be some consumers upset that a sleeker, significantly more capable PSP may be arriving so soon. The original launched in North America on March 24, 2005 for $250.

While it is true that the release date has come and gone, there system is indeed in late stages of production. The key features that Sony will be focusing their efforts are increased memory, better wifi, a slightly higher resolution display, some faster processing and better media capabilities to further competition with portable music players. Through sources that request confidentiality, I was able to obtain these images directly from one of the prototype labs. I apologize in advance for the low resolution of the images as they were taken with a camera phone.

psp-wifi.jpg psp-svga.gif psp-rtc.jpg

psp-ram.jpg psp-audio.jpg psp-logic-babbage2.jpg