An internship is a process of gaining knowledge and experience. Our Raccoon Security team believes that increasing the level of information security of the devices and software around us is impossible without transferring this knowledge and experience to future generations of specialists. That is why we have been organizing individual internships for talented students and graduates for many years.
Security research is a skill that is not taught at university. It can be learned through concrete examples and under the guidance of experienced mentors. Every year, our interns solve complex technical problems, achieve their goals and move on, expanding their professional horizons and making the world a little safer. Each of them has their own story of becoming a specialist, and under the cut is the beginning of one of them.
Last October I started a technical internship at . My interest was directed to the field of reverse engineering. I knew what it was, I had already tried to research crackme on x86 on my own, but I understood that the most interesting thing lies precisely at the intersection of software and hardware. I had no experience in this area, but I had a desire to try my hand.
I didn’t have any specific expectations from this event - friends and acquaintances quite often talk about technical internships in various well-known companies. And when I was offered to try my hand at researching a USB-SATA adapter, I was simply glad for the new opportunity to learn something. The experience I gained and the results I achieved allowed me to be convinced that I had chosen the right internship place and future profession.
The research began with getting a regular USB-SATA adapter. Here's what I did next.
First you need to inspect the adapter board and determine the basic elements of the device. The figures below highlight the main component blocks that are important for the operation of the device. Photos taken after the study:
USB-SATA adapter. View from above
USB-SATA adapter. Bottom view
After spending some time on Google, I found out that there are two voltage converters on the board: one for 3.3 V, the other for 1.2 V. It was also very easy to determine the flash memory installed on the board. The ROM operates over the SPI interface, and the memory capacity is 512 Kbit.
It would seem that the circuit reconnaissance stage is almost complete, but a quick search on the Internet did not produce any results for the query “ASM1051”. We could not find any documents for the chip installed on the board. True, we still managed to find software that allows us to update it. In addition, there is a small datasheet for the older model ASM1053 .
When connected to a computer, the adapter appears as a USB storage device. I decided that a deeper knowledge of USB would probably be useful for my research, so I spent the next couple of hours studying the interface. In general, USB devices can be of different classes depending on their functionality. For example, flash drives are Mass Storage Devices, and keyboards and mice are Human Interface Devices (HID). And since my adapter is visible in the device manager as a storage device, it means it is defined as Mass Storage and should work with SCSI commands.
Basic literature on USB that was useful
- USB in a NutShell
- Universal Serial Bus Mass Storage Class
- USB Mass Storage Class on an Embedded Device
- SCSI Commands Reference Manual
Since nothing is known about the ASM1051 installed on the board, the most obvious action was to read the memory from ROM. I moved to the laboratory. Using a soldering gun, I separated the flash memory chip and connected it to the ChipProg-48 USB programmer. There were no problems reading, and I ended up with a binary file in my hands. At that time, I could not tell what was on the flash drive, and began analyzing the data received.
The first thing I did was open the memory dump from the ROM using WinHex, but you can use any HEX editor. I started looking closely at the bytes:
Beginning of memory dump read from ROM
The picture above is a screenshot from the editor. The line ASMT1051, which starts at address 0x44, immediately catches your eye. You can also see the asmedia line from address 0x18. For primary data analysis, I used the frequency analysis tool available in WinHex.
ROM memory frequency analysis histogram
The histogram shows the bytes that are most numerous in the file. In addition to the heap of 0x00 and 0xFF (the outermost bars on the histogram), the following bytes are often found in memory:
- 0x02;
- 0x74;
- 0x90;
- 0xA3;
- 0xE0;
- 0xF0.
It would be possible to confirm my assumption that the ROM contains the firmware. A simple way to do this is to try to compare opcodes of different architectures suitable for microcontrollers (hereinafter referred to as MCUs) with bytes that are often found in memory.
To roughly estimate, very often in any assembler code you should encounter commands such as:
- mov;
- jmp;
- call;
- ret.
Of course, these commands may have other variations in different architectures, but the general meaning is the same.
I had to go through several sets of instructions for different cores before I found the right ones. Comparison with the Intel 8051 architecture gave a very plausible result. The opcodes of some commands match popular bytes from the file, for example:
- 0x02 – LJMP addr16;
- 0x74 – MOV A, #immed;
- 0x90 – MOV DPTR, #immed;
- 0xA3 – INC DPTR;
- 0xE0 – MOVX A, @DPTR;
- 0xF0 – MOVX @DPTR, A.
It really looks like the ROM contains firmware for the MK. It would have been possible to immediately load the binary in the IDA Pro disassembler, but over lunch one of my colleagues asked:
“Are you sure that the code in memory starts at address zero?”
Indeed, you need to take into account that there may be some kind of “garbage” or data from address 0x00 in the memory.
In general, I was faced with the task of determining the starting address of the code. The best way to achieve this goal was to use the EM100 SPI emulator. The emulator replaces the memory chip on the board, with it there is no need to unsolder the ROM every time you flash the firmware; in addition, the EM100 can record a log of memory accesses. Considering that the firmware from the ROM has already been read, you can now load it into the SPI emulator. Next, you need to solder the emulator to the adapter board and record a log when connecting the adapter via USB to the PC.
The SPI emulator is soldered to the USB-SATA adapter board
I soldered the wires from the emulator to the contact pads from the flash memory and flashed the emulator with the firmware I read. Now it remains to see whether the MK accesses memory, and if so, at what addresses.
Log of ROM memory accesses (obtained using SPI emulator software)
The figure above shows that when power is connected to the adapter, the ASM1051 controller installed on the board sends several 0x03 (Read Data) commands.
First, the ASM1051 reads 0x80 bytes, starting at address 0x0000. Next are two bytes, starting from address 0x0080, then two more bytes from address 0x8082. Then it reads most of the memory from the ROM, starting at address 0x0082.
It can be assumed that the large number of bytes that are read from the ROM last, starting at address 0x0082, are probably the code. What and why is requested before this is not yet clear. What is known is that in response to the first request, the ASM1051 will receive from the flash memory the lines that are marked in the figure above. They were located in the first 0x80 bytes.
It's time to check the guess that the external memory on the board contains firmware for an MK with an 8051 core, and the code itself is located at address 0x0082. Open the memory dump in IDA Pro, specify Processor type Intel 8051 and offset for code 0x0082.
Binary file opened in IDA Pro at offset 0x82
There were no problems opening the binary in a disassembler.
Conclusions:
- The ASM1051 MCU has 8051 architecture.
- There is a code in the ROM that starts at address 0x82. There is something else besides the code.
- The first 0x80 bytes somehow attract attention.
Now that I have made sure that the code is loaded correctly into IDA, I can start analyzing it and commenting it in parallel.
While examining the code, I found simple functions such as subtracting 32-bit numbers, came across various handlers similar to switch() in S. Melkali, and very simple functions like saving a value from the R7 register to memory at some address. I will describe the most significant findings below.
Jun 06 How to make a sata ide adapter. Do it yourself
The hard drive is responsible for storing information on your personal computer. Progress, as we know, cannot stand still, so its speed and reliability are constantly improving. The change of generations also entails a change of interfaces. Today we’ll talk about sata ide adapters.
Content
What you need
Instructions
Let's not hide the fact that Sata connectors are a development of ide connections; the latest standard, however, is correctly called ATA. After the Sata interface appeared on the market, ATA was renamed PATA. As you may know, the bus on which ide runs boasts an operating frequency of 33MHz. If we return to the sata interface, the operation of its bus is determined by a frequency of 1.5 GHz. The difference, you see, is significant.
This immediately dismisses the possibility of the concept of “adapter”, because it is impossible to passively connect two devices operating at different frequencies - for this they use a special device called a converter. Its task is to convert the incoming signal of one protocol into another, understandable for the second device
1. Let us clearly show in the figure what a standard converter adapter for ide and sata consists of.
2. As you can see, the front part is responsible for connecting the ide cable, the rear is for sata. The microcircuit in the center of the board is the controller responsible for converting the incoming signal into the desired output signal. You may also notice the power connector - it is needed for the crystal oscillator (the shiny “bathtub”) and the controller.
3. Do-it-yourself work does not stand up to criticism after finding out the cost of the device in the store. The proof below should completely discourage you from wasting a lot of your time on a fairly easily accessible and cheap device.
Also find out if you can make an adapter from vga to tulip and sata usb with your own hands.
Adviсe
Remember that any electronics production at home cannot boast of proper safety. You will have no one to complain to if your hard drive and controllers on the motherboard burn out due to the connection of a foreign device.
Worth paying attention
You can clearly see another representative here.
Do it yourself
Most useful electronic devices can be assembled for just a few dollars with your own hands, without much electronics knowledge, but an IDE SATA adapter hardly falls into the category of easily reproducible devices. Ultimately, most likely, much more time and money will be spent than if you purchased a ready-made adapter, although it is easy to find many working diagrams on the Internet. But “technomonsters” should like this task.
The note outlines in an accessible form simple steps for adapting a USB-to-SATA converter to a form suitable for use using available tools.
Preamble
One day, for some (still unclear) reason, one of the onboard SATA nipples on a self-assembled NAS on miniITX (also an AoE server for diskless clients) failed, and since it was in the evening (and even on a long weekend ) then this imposed certain restrictions on the availability of the solution (although you can fly like a bullet to a convenience store, but laziness, as you know, is the engine of savvy minds).
So, the task is this: connect a SATA screw to a miniITX system in the absence of free SATA.
Part I
Having quickly carried out an audit of the junk around the computer, we discovered such an adapter, which had been collecting dust for many years without use, because it was ordered at the dawn of the popularity of foreign online stores:
As it turned out, the board is not just a USB-to-SATA converter, but is intended for devices such as laptop DVD drives , carrying on board the mating part of the slimSATA
(features an additional non-standard power supply). Thus, it was not possible to connect the adapter to ordinary SATA devices and it was thrown into a dark corner of the box for a long time.
So, the adapter contains a slimSATA connector, which includes a standard SATA 7pin female connector (as on connecting cables):
Even if you remove an additional non-standard slimSATA power connector from the board, when inserted into the HDD, the adapter will block access to the HDD power connector (SATA 15pin). There is only one way out - a SATA 7pin connector extension, for which we carefully cut off one of the ends of the standard SATA cable:
Now you can completely remove the slimSATA connector from the adapter board and solder the end of the SATA cable (without mixing up the RX - TX differential pairs!):
To impart mechanical strength to the joint between the cable and the board, it was decided to use PVC electrical tape (I abandoned the original idea of filling it with silicone sealant - it is unknown how “non-conductive” it is at 1.5 GHz):
Now let's move on to USB: since we need a replacement for internal SATA, a two-meter skein from USB-A to USB-B inside the case will obviously be superfluous. We get rid of USB-B - unsolder a piece of the board with connectors and electrolytes (they are only needed when powering a USB DVD drive).
We will connect the adapter to the internal USB connector on the motherboard. Why do we crimp/solder (for 480Mbit/s it is better to solder) the contacts of the PLS-4 connector (it is more convenient, of course, PLD-10, so that it covers the entire comb at once, but only PLS-4 is present in the household):
After checking the pinout of the comb on the motherboard and the pins of the USB converter chip SPIF225A
, we assemble:
So, after spending some time searching for the necessary pinouts, we quickly built this type of adapter, which allowed us to pick up a fallen HDD without rebooting and, as a result, thanks to its dimensions and getting rid of atavisms, it fit quite harmoniously into the interior of NASa:
Part II
After solving the problems with the NAS and its upgrade, the itching craving for perfectionism prompted me to modify the adapter. Why the necessary connectors were ordered: SATA 7pin male SMD
& . We mark the seat for the SATA connector, we do it in such a way that the holes for the holder pins do not go through the signal tracks on the back side of the board (as they say - try it on seven times, cut one drill):
We strip the copper and solder the holder pins on the back side of the board:
The pitch of the pins of the footprint on the board and the SATA connector is the same, as a result we get a neatly sealed connector:
Let's deal with the USB part. We mark and prepare a place on the board for landing miniUSB-B:
We solder the connector, showing virtuosity when working with a 0.65mm pitch of the miniUSB-B connector:
Some explanations are needed here, so here is the sequence of actions with miniUSB-B:
- We carefully bend the GND contact so that it does not interfere (the material of the legs is fragile - the leg of the first connector broke off when bent) and soldered it to the body - then we solder the body to the GND of the board;
- The ID pin is not used, so we simply pull it out of the connector with tweezers;
- Now it’s a little freer - there are three pins left - they need to be carefully moved apart with tweezers so that there is more space for maneuvering the soldering iron;
- We solder small extension conductors to the D- and Vbus pins, and slightly raise the inputs themselves so that they do not short-circuit to the board after installation;
- We leave pin D+ “as is” - physically, during installation, it falls on the corresponding polygon on the board;
- Now you can mount the connector on the board - we grab the case diagonally, then carefully deal with D- and Vbus.
Practice is the criterion of truth, so we check the correctness of the connections by actually turning them on:
The second version of the adapter turned out to be much more aesthetically pleasing:
Small touch
Everything is fine. Both functionality and aesthetics, but lacking zest. SPIF225A
bridge , I found it: “
pin 36 - HDD Activity LED output
”. Great:
We unsolder the 10K resistor (PullUp to suppress interference on the TriState-pin?) and solder in a chain of series-connected R and LED. A resistor with a value of hundreds of ohms (I took 1 kOhm), an LED cathode to pin 36 of the microcircuit (determined by testing or documentation):
Bottom line
Using the example of adapting a USB-to-SATA converter, a method for quick modification using a minimum of available materials was shown (quickly restoring the functionality of diskless clients), and also demonstrated an approach to a more thoughtful and elegant solution.
In the era of computer technology, the speed of development of ports for communication of the latter is also not slowing down. Another thing is that end users have no need for such a race. Before they had time to buy one device, it was no longer suitable. Today we will deal with sata-usb adapters.
- What you need
- Instructions
- Adviсe
- Worth paying attention
What you need
- Converter chip;
- Printed circuit board;
- Soldering Station;
- Programmer.
Instructions
In order not to bore busy visitors, we’ll say right away that it is much easier and cheaper to go to the nearest computer store, pay the equivalent of a couple of American dollars and get a device that is known to work, spending up to an hour of your time on it.
The following article is for people who cannot tolerate slippery beliefs, those who require proof, or who are simply inquisitive individuals.
1. You should start by getting a converter chip. Since the usb/sata operating protocols are fundamentally different, there is no way to “solder this conductor here, and this one here, and everything will work.” In this case, signal recoding is required, which can only be done by a chip designed specifically for the task of usb to sata recoding. The figure shows one of the varieties of such chips.
2. Now you will need a PCB. This is the “plate” on which the elements are attached. Considering that the board must have a completely custom layout for your device, it is impossible to buy one. How to make the board itself is a topic worthy of 10 more articles and equipment worth a tidy sum (if there is such a thing, great, you’re in luck).
3. To solder the chip onto the board and organize the wiring, you will need a soldering station.
4. Finally, if you are a magician, and you managed to complete all the previous instructions, your magic will continue to be needed. After receiving the finished board, you will need a programmer - a device designed specifically for your board in order to program it specifically for your specific needs.
If you have completed all the steps and are bored, can you try making a sata ide and vga to tulip adapter yourself? We read, find out, try, and report back on the results.
The cost of producing a device with your own hands, not taking into account all the equipment, will exceed the store price tag by 30-200 times. Is it worth it?
Clearly.
Worth paying attention
You will have to perform each step of this instruction 15 times, since the work involved is microscopic, and a stray speck of dust will negate all the work done. Perhaps, if you have nothing to occupy your inquisitive mind, you should make something simpler, for example, a homemade robot?
How to make a sata usb adapter with your own hands2.90 out of 50 based on 29 voters. Thank you for the article - like it. A simple click, and the author is very pleased.
IDE/SATA = USB adapter
My first purchase on DealExtreme. The parcel took a long time to travel (45 days), was opened at two customs offices (in China and in this country), but still arrived safe and sound. For those who are interested in what kind of wiring this is, welcome to cat.
Actually, this adapter is needed to connect IDE/SATA devices via USB. The maximum data transfer speed is 480 Mbps (depending on devices and USB version). The kit includes: the adapter itself, a power supply for devices, a SATA cable, an adapter from 4-pin to 15-pin power for SATA devices and brief instructions in English. All this came in a regular box.
Box with contents
The goals of this purchase were: 1. Connecting a CD/DVD drive from an old computer. The laptop has been dead for six months, I can’t burn my own discs, and my friends want nice discs (the drive supports LightScribe). 2. Connecting old HDDs. There is a lot of necessary information left on them, and I just want to delve into old files
