Here's some helpful links:
"2SE1T11" model coaxial switches on eBay https://www.ebay.com/sch/i.html?_nkw=2se1t11
blog post "Low-side vs. High-side Transistor Switch" https://www.baldengineer.com/low-side-vs-high-side-transistor-switch.html
see the third schematic on this page https://gammon.com.au/motors
Meteor Scatter QSO Party https://hamsci.org/article/save-dates-hamsci-meteor-scatter-qso-party
kwest_tech
#securityresearch, embedded #electronics, #amateurradio, #opensource etc.
So far I post a thread whenever I have time to work on a project, hashtags in the first post of the thread
This is part of a larger project to try to bring FT8 and MSK144 to analog FM transceivers (paired with an RTL-SDR), much like how MMDVM brought M17/DMR/D-Star/YSF/NXDN to analog FM transceivers. If successful, it should drive down the cost to set up a station for the #hamsci Meteor Scatter QSO Party (because it's now legal to use MSK144 on 10m!) that's coming up in August and December.
After some tinkering and realizing I needed to learn more about transistors, I figured out how to drive these coaxial switches that are available for cheap on eBay (thanks for the tip @k5em !) using 3.3v logic levels. tl;dr I needed a 2-stage high-side driver for each side instead of a single low-side transistor. The "click" sound is the switch changing positions and the green LED shows the actual pulse that is sent (100ms).
kwest_tech boosted:
Here is that dust devil in cross-eyed 3D:
#DustDevil #Mars2020 #Perseverance #SummerSolstice #NASA #Solarocks #Space
kwest_tech boosted:
for PNW SOTA ops looking for new hill combinations, here's my Three Corner Rock (W7W/LC-101) and Birkenfeld (W7W/LC-094) via the PCT trip report:
http://www.pnwsota.org/blog/k7wxw/2025-may-25/three-corner-rock-and-birkenfeld-pct-traverse
kwest_tech boosted:
You can now replace libfuzzer with #LibAFL on Windows, thanks to @novafacing
Grabbing a snack while Ghidra works its way through 43Mb of android Qualcomm modem HAL libraries
#reverseengineering #android
kwest_tech boosted:
Stand Up for NOAA Research — The Time to Act Is Now
April 17, 2025
A Statement of the American Meteorological Society in Partnership with the National Weather Association
The administration’s 2026 budget passback plan, currently under consideration, eliminates NOAA’s Oceanic and Atmospheric Research (OAR) Office and its 10 research laboratories and 16 affiliated Cooperative Institutes, and moves the few remaining research efforts to different NOAA departments. If enacted, the passback would close all of NOAA’s weather, climate, and ocean Laboratories and Cooperative Institutes.
The speed at which these decisions are being made translates into little to no opportunity for feedback or consideration of long-term impacts. Without NOAA research, National Weather Service (NWS) weather models and products will stagnate, observational data collection will be reduced, public outreach will decrease, undergraduate and graduate student support will drop, and NOAA funding for universities will plummet. In effect, the scientific backbone and workforce needed to keep weather forecasts, alerts, and warnings accurate and effective will be drastically undercut, with unknown — yet almost certainly disastrous — consequences for public safety and economic health. As key stakeholders, AMS and NWA stand ready to provide our expertise so that the U.S. can maintain its competitiveness in the years ahead.
https://blog.ametsoc.org/2025/04/17/stand-up-for-noaa-research-the-time-to-act-is-now/
it's 2am and I ran out of magnet wire, fuck
#electronics
kwest_tech boosted:
I've cracked open my broken machine (it's a waffle maker) and I've ascertained that one of the three heating elements is not receiving power. Probably a faulty relay. Or not. I don't really have much experience at this. I'm surprised that the guts are so complicated.
There's something on the control board that I haven't seen before. The four chunky traces here all carry AC mains current. The big long one is the common AC supply, domed over with a massive slug of solder for lower resistance. The smaller ones in the middle carry AC to the smaller heating elements. The odd one out, circled in red, is for the third, larger heating element. A good candidate for more solder enhancement. But no! That trace is covered with little dashes of solder that do not join, and seem to achieve nothing.
What the heck is that about? Is that a manufacturing error, or is it supposed to be like that?
kwest_tech boosted:
Progress on mystery SoC in the kid cam (that's actually what the firmware calls it): The trace that had the non-cached reads was actually super-informative. It looks like the instruction size is indeed 4 bytes, so the SoC reads the instructions (and presumably data) straight from the SPI memory. That means my LA trace effectively documents the program flow until the cache is turned on! This is super-helpful as although the firmware has strings and stuff, I don't know what address the flash contents live at in the CPU so I can't find the instructions that refer to it,
However, with the trace I can find call and jump instructions, because the address that the CPU reads suddenly changes. They have one thing in common: one instruction before the last instruction (presumably because of pipelining), the MSB of the instruction is 6 or 7 and the rest is the relative address to call. I could also find the return instruction, as after that execution continued to the address after a call. Conditional jump instructions were also formatted like that, so I also found those. It's enough to create a very barebones Ghidra processor implementation that can show me bits of control flow at least.
Issue is that there just isn't that much code to be executed before the cache turns on. But I now know what subroutine turns on the cache, and I know how calls work... so I can re-write the flash with that subroutine call nerfed. As far as I can tell, there's no checksum or CRC over the XiP program (I don't see any reads anywhere before the CPU actually executes the code), so it should work.
So I flipped a few bytes, reprogrammed the flash... and now I have a huuuuuge trace file to sift through. (One of the reasons is that with the cache disabled, the camera takes about 5 seconds to start vs nearly instantaneous, so time-wise the LA dump is pretty long to start with.) Can share it if anyone still feels like looking along with me.
However, with the trace I can find call and jump instructions, because the address that the CPU reads suddenly changes. They have one thing in common: one instruction before the last instruction (presumably because of pipelining), the MSB of the instruction is 6 or 7 and the rest is the relative address to call. I could also find the return instruction, as after that execution continued to the address after a call. Conditional jump instructions were also formatted like that, so I also found those. It's enough to create a very barebones Ghidra processor implementation that can show me bits of control flow at least.
Issue is that there just isn't that much code to be executed before the cache turns on. But I now know what subroutine turns on the cache, and I know how calls work... so I can re-write the flash with that subroutine call nerfed. As far as I can tell, there's no checksum or CRC over the XiP program (I don't see any reads anywhere before the CPU actually executes the code), so it should work.
So I flipped a few bytes, reprogrammed the flash... and now I have a huuuuuge trace file to sift through. (One of the reasons is that with the cache disabled, the camera takes about 5 seconds to start vs nearly instantaneous, so time-wise the LA dump is pretty long to start with.) Can share it if anyone still feels like looking along with me.
kwest_tech boosted:
To help others progress, I’m going to award several Christmas test gear grants. If you’re interested, apply here: https://www.zerotoasiccourse.com/post/test-equipment-grant/
@azonenberg Just checked out LATENTRED for the first time on github, looks like the 1000 baseT PHYs are roughly $40 each, STM32 is ~$20, and the FPGA is at least $1500?
(Obviously if you're building a switch from scratch cost isn't your top priority, I'm just curious)
Foiled by SOIC16!
(I only have a SOIC8 clip, and I don't care enough about this target to individually attach pins)
kwest_tech boosted:
Found this fun video from "LAN Ranger" on youtube who purchased a CMTS and set up a DOCSIS network at home:
https://youtu.be/NKYaNczID2M?feature=shared
kwest_tech boosted:
If you're just joining this is DUMPTRUCK https://github.com/azonenberg/dumptruck, an open hardware flash dumping (and eventually programming) platform for embedded RE work.
It provides 50 GPIOs at each of 3.3, 2.5, 1.8, and 1.2V logic levels, power at the matching voltage, plus DUT core power muxable to any of the four voltages.
Programming/dumping algorithms are implemented in a combination of a Xiinx XC7S100 FPGA and a STM32H735 microcontroller, allowing the entire device to be controlled over SSH from a PC.
First prototype is assembled (aside from soldering some through hole connectors) and I'm starting the bringup process.
@darkghosthunter Makes sense, hope you find something!
Client Info
Server: https://mastodon.social
Version: 2025.04
Repository: https://github.com/cyevgeniy/lmst