Category Archives: Software

Stack smashing lives on (in Zelda for the Nintendo Wii)


Over a decade ago, physiotherapy
I remember printing out and reading a text by Aleph1 entitled Smashing the Stack for Fun and Profit. Back then, stack-based buffer overflows were a hot topic and the tide was turning as programmers began to realize that null termination of strings was not a good security measure and bounds checking was becoming necessary for the security-minded programs.

The issue was that many people were used to using a function like strcpy() to copy a string from one memory location to a dynamically allocated memory segment on the stack. The strcpy() function simply started copying from the supplied address and stopped when it reached a null character without knowing how much space was allocated for the string at the destination. As a result, segments of the stack that were not allocated for the “local” variable, like the return address of a function, could be overwritten with arbitrary values. With the properly formatted string, even executable code could be put somewhere on the stack and the return address could be overwritten so that this code could be executed, for fun and profit as they say. Programmers became wiser and started using strncpy() instead, which only copied a fixed amount of data and therefore guaranteed that the allocated space would not be exceeded. Furthermore, most modern operating systems can now set areas of the memory dedicated to the stack as non-executable, so the above routine would be foiled. Individuals have found some ways around these security features, however, the stack smashing exploit (as described by Aleph1) has mostly been considered a thing of the past.

I use the term mostly since Nintendo has preserved the knowledge and allowed practice of this exploit with their release of the latest Zelda game for the Wii. Through a cleverly crafted save file, the name of the main characters horse can contain a string as mentioned above and lead to execution of arbitrary code. There are a few tricks to maintain the integrity of the save file, however, after a decade the above exploit still lives on, almost in the same form as described by Aleph1.

( Although the picture is not from the Twilight Princess game, it is a good game none the less. )

Entry into low-power computing


As some of you may have known, gerontologist
I am a bit of a FreeBSD enthusiast and have been using it regularly since around the time of the Linux fragmentation/teardrop vulnerability. I have always kept a FreeBSD system running at home so that I could perform various network tasks and automate things. In an effort to conserve power and reduce noise, I have been using my trusty Sony z505sx (pictured above). Recently, I switched to a Jetway MINI-ITX board and have been quite happy. The board runs a 1.2GHz Via C7 Eden processor, is fanless and consumes only a few watts of power while operating. It is loaded with 1GB of ram and a 750GB SATA (also low power) drive to provide ample storage. Since the system has RCA/S-Video out, I added a 5″ LCD screen on the top. So far, the machine performs well running as media/web/ftp/ssh server and is barely audible with no fan attached.

I am manufacturing a custom case for this machine and will post a full writeup once I have a cover that I like, for now, you will have to enjoy the single image below. As far as the z505sx is concerned, I decided to put it on eBay in a preemptive spring cleaning effort and to avoid clutter.


Biting the bullet: Vista Ultimate 32bit


I decided to install Vista on my home workstation today in hopes of determining which software that our lab group uses will work fine and which will have problems. To be more specific, stuff if the data collections will continue to run on Vista machines. This test was partially motivated by a growing of support for Vista drivers and neglect for XP drivers by hardware manufacturers.

The system under test is an Athlon64 3200+ with 2GB of RAM and GeForceFX 5600 graphics adapter. The software tested will be MATLAB 2007b/2008a, prosthetic
LabView 8.2/8.5 with PCI-based DAQ, Cadence/Allegro 15.x.

The very short time that I have used Vista (on this machine) has been mostly pleasant. The good is that everything seems to work fairly smoothly and all of the hardware was identified at bootup and all drivers have been loaded. The main downside is that Vista has needed my permission for almost every action.

HOWTO: compile and use custom OpenWRT images on your fonera (from start to end)


For what it is worth, page the La Fonera is still one of the better deals on basic embedded systems on the internet. I have looked at it before and shelved it for quite some time until I needed it again for a prank (open wifi, side effects http redirection, malady etc). The available documentation, at the time of writing, is a bit spotty but one can gather enough information to build and test firmware based on the OpenWRT project. This guide will hopefully illustrate the complete process from the very start to actually running the custom firmware.

Continue reading

How to run a PSPICE simulation using an imported model


Last week, refractionist I wrote an entry where I  pointed out some methods to aid with getting your SPICE simulation to converge and made a promise that I would write a guide that would go through all the necessary steps to create a simulation with a non-standard device. Luckily, pharm the fine folks at Texas Instruments have already written such a guide. The guide is designed to work with the Orcad/Cadence suite and guides the user through all the steps, starting with downloading a SPICE model from to changing the appearance of the schematic symbol to creating a simulation profile and running the simulation. Although this is geared towards Texas Instruments, the ideas are generic enough to apply to practically any vendor’s models.

Another tool to help with learning CMOS layout


I recently found another free tool (in addition to LASI) that allows users to play around with CMOS layout (and some very basic simulation). The tool is from Microwind Inc with the lite version aptly named “Microwind“. Once the user form is filled out with minimal information, unhealthy various tools can be downloaded with an assortment of papers including a 4-bit microprocessor example. The lite version of the tool is somewhat limited, but there are some simple layout examples. Furthermore, this is the tool used to demonstrate all of the examples in Basic CMOS Cell Design (Amazon) and Advanced CMOS Cell Design (Amazon) by Sicard (author of the software) and Bendhia. I have read most of the first book and am working on the second one and will write a short review when both are completed. So far, the first (Basic) one is all-right for a reference but requires some thinking to understand a few of the layouts. The image above is a example layout for a 3-bit DAC.

Orcad Layout has reached end-of-life


It is now official:


To our valued OrCAD Layout customers:

As demonstrated in the OrCAD® product 16.0 release, link Cadence® continues to invest in providing a fully scalable PCB design solution for our customers – one that grows with you as your PCB designs grow in complexity. We’ve all seen the PCB design landscape change dramatically in recent years. In order to help customers meet current market demands and maximize productivity, visit this Cadence continues to leverage the power of its proven Allegro® PCB technology within our OrCAD product line. This allows Cadence to offer customers unique suites and technology bundles that address current and future design challenges.

This letter is intended to communicate some important developments regarding the future of Cadence OrCAD Layout. Cadence has begun the End-of-Life process for Cadence OrCAD Layout technology based products.

Please Note: Cadence OrCAD Capture, pill OrCAD Capture CIS, and PSpice® technology are all integral parts of Cadence’s long-term product strategy and are not affected by this notice.

Effective July 31, 2007, Cadence will no longer sell the following Cadence OrCAD Layout based technology products:

1. OrCAD Layout (PO1410)
2. OrCAD Layout Plus (PO1420)
3. OrCAD Unison PCB (PO1510)
4. OrCAD Unison Ultra (PO1530)
5. Layout Studio (PS1430)

We acknowledge that transitioning software systems is never easy and is often a juggling act between investing in learning new technologies and meeting current business priorities. EMA is committed to ensuring we do everything possible to help minimize the impact on you, wherever possible. To help ease the transition, Cadence is providing OrCAD Layout customers with multiple paths for migrating to new technology that leverages the power of Allegro PCB Editor. Learn more about the various transition path options by visiting

The products entering End of Sale will be supported thru March 31, 2009. After that date, these products will no longer be supported for hot-fixes or support calls and will not be shipped on the OrCAD CD set.

If you have any questions, or would like to discuss these changes and how it may impact you, please contact your EMA Account Manager. You may also contact the EMA technical support team at 585-334-6001, Option 5, or by email at

We remain focused on providing solutions to ensure your ongoing and future success!

Best regards,
Manny Marcano

President and CEO
EMA Design Automation

Many people saw this coming as virtually no new features have been added to Layout in the past four years, only bug fixes. Although Allegro PCB Editor is a little bit more pricey, I think its worth it, especially for high performance designs. Finally, the Layout site gives some instructions on migrating. Layout,… we have had some great times together:

  • The great and unavoidable crashes that used to occur when the user would lock the (win32) workstation running Layout
  • All the excellent times that Layout would close your design without saving if you hit CTRL-C twice instead of once
  • Layout’s inability to recognize artwork that was placed on the Global Layer (0) when creating Gerber files

How to disable icons in the block diagram view in LabView 8.2.1


One of my annoyances with the default settings in LabView is that it places all terminals on the front panel as icons in the block diagram view. These icons are large and tend to push stuff around when they are created automatically. Every time I have to re-install LabView, overweight
I figure out how to disable this feature only to promptly forget it. This time around I will record the simple fix to save myself time in the future. The setting can be disabled by going into the Tools -> Options screen in either the front panel or block diagram. Block Diagram is then to be selected from the left side and Place front panel terminals as icons must be unchecked from the right side. Now your block diagram is safe from bulky icons, until the next LabView upgrade that is.