Next talk is from Ryan talking about the black pants are pants for your black hat.
Can you guys hear me?
Sweet.
How's it going?
So the black pants are pants for your black hat.
So this is me.
I'm just a normal guy that makes open source stuff.
I'm barely open source hardware.
I guess a lot of stuff I also do security and pen testing and then also privacy.
So you might remember me from such projects as I built a self-shocking USB drive or I put
a Linux router in a wall charger, various things I've talked about in the past.
Okay, so before I start talking about the black pants, I'm going to talk about the flipper
black hat.
So I think most people here probably know what a flipper zero is.
It's a small wireless device for the cute dolphin on it.
In my opinion, it's just a nice compact thing that you can carry around.
It has also two different radios on it.
I think it's a lot of different things to a lot of different people.
Definitely a good educational tool.
So a while back, let's see if I want to see it.
So a while back, I decided that I had one of these little flipper guys and I wanted to make
a module for it and since I do open hardware, so obviously be a complete open source thing.
So I have the community like what do you guys want, like what's cool.
And this one guy said a Wi-Fi board that does the current evil portal attack, but also
sends the user to the internet like the Wi-Fi pineapple from hack-5.
So those of you that don't know what evil portal attack is a fishing attack where you
put up a fake Wi-Fi and you try to fish people's credentials.
And this is all for educational and ethical purposes only, but I might as well mention
that.
And then this person is asking for a specific variant of that where after your target is fish,
they get pushed through the internet.
So implementing something like this on Linux is super easy.
You're basically just doing things with NF tables and networking and there's even Python
packages and tons of kits and stuff you can do this with.
Most of the Wi-Fi boards that existed for the Flip R0 are based on ESP32, which is super
cool because they're low power and they boot right away and have a whole bunch of advantages.
But implementing something like this on an ESP32 is probably possible, but yeah, I don't
know.
So what's the plan?
So are we actually going to put a Linux and able SSC on top of the Flip R0?
Yeah, why not?
So I'm just going to use a Raspberry Pi.
No, let's roll our own SPC.
Cool.
So the part I chose was an all-winner A33, it's a little bit long in the tooth now.
It's about 10 years old or something like that.
All-winners, the Chinese company that creates various parts super cheap for tablets and
stuff.
There's quite a few members of the Linux sun-seek community that come to Fauston, which
is the not affiliated with all-winner, but the people that actually merge the changes into
the Linux kernel.
So this is the chip I wanted to use.
It's a quad core 4a7s and then it has all kind of the standard stuff.
But I mean, for what I'm doing, I'm just interested in the cores.
Yeah, I guess more detailed specs.
Yeah, I don't have to go over all this.
I guess quad core, 1.5 gigahertz, DDR3 controller, so all-winner makes the A33 wants to get
into the details here.
The A33 wants five voltage rails and they sell a PMIC, where that actually just provides
all of this, but I didn't want to use that, I don't know, I guess I'm nervous about it going
out of stock.
I chose these TI-box supplies and each one of these guys needs to come up in a certain
sequence.
So there's a little capacitor, C8 down there that's connected to the SS pins, so that
all these things sequence up to the correct order.
For the Wi-Fi radio, I chose a RTL 88723, which I believe has talked about a few talks
ago, and yeah, this does, from a scarce mode, and all these things that people like
for pen testing.
This is connected over, this is actually, I've never used a Bluetooth on it before, but
this has, yeah, this is Bluetooth and Wi-Fi, and then Wi-Fi, use the STIO bus, whilst
Bluetooth uses the UART bus.
I think Bluetooth should work, I've just never tried it before.
Yeah, so I want to add more radios, so I quite like the RTL 887C use, so this is cheap
little USB dual band, that also, again, you have supports, modern mode, primiscus, motor,
all these sorts of things, and I just put USB-A ports on the board, so users can plug in
like whatever USB devices they want, yes, radios, miceke, whatever, yeah, so there's USB
C port on the board, this, this just connects to one of these CH 340s, which is the USB
UART chip that everyone in the world seems to use, yeah, and this, so the way that I wanted
to talk to the Flip or Black Hat from the Flip or Zero is over UART, but I also want to
access to the same UART bus, so I basically just ended the TX pins, so you can either get
data from the Flip or you can plug into the USB-C and then you get the same thing, and
you'd also monitor what the Flip or Zero is sending to the device, yeah, DSI, so I was
never planning to use a screen with this device, like we'll get into that later and scope
creep everything, I just threw it on an FFC and a backlight, boost controller, and
that would potentially future holds put a screen on, so yeah, so I mentioned as DDR3, so I
think this was a little while ago, maybe this keycad 7 or 8 or something, but at the time
it had a trace length matching, which is needed, when you want to do a high-speed signaling
like DDR3, and this worked quite well, just shadowed to kayak pad is pretty impressive
what you can actually build now in some of this shit, yeah, so this is the layout for the
buck controllers, yeah, it's basically this times 4, that's the actual socket self,
so I was able to get away with a 4-layer board, I feel like if you're to fan out more
pins, you probably need to go for a 6-layer potentially, the nice thing about this part
is it's a 0.8 millimeter pin pitch, which is like it's either typically BJs can also
be like 0.65, and when you go to 0.65, you then need microveas, which is a little bit
more expensive, and I mean all winter makes these parts, so the boards can be cheap, like
you see there's missing pins and stuff, like they put those are intentionally put there,
so you can get away with cheap boards, that's the power distribution, we can see basically
all the buses there and how they're routed on internal layer, assembly, so this is a
different project using the same A33, but I just wanted to mention that, like you can actually
hand assemble these, so there's me and my garage reflong boards, yeah, so again different
projects, but yeah, there's similar A33 about the DDR3, I think X, everything, this was actually
the wall charger, I built a while ago, and I forked this, and then that's how the flip
of black hack came about, assembly, shit, this is, mass assembly, yeah, you should taste
on one to make them, and yeah, so this is the final device, so this is the flip of black
hack, yeah, pretty much everything, I just said, yeah, so I gave it a talk about this device
at Y-2025, and people, someone in audiences is like, why do I need a flipper, and I'm like
you're totally right, this is ridiculous, it's the STM32WB connected to like this giant
thing, so the black pants are pants for the black hat, so the idea was we can ditch the
slipper, and we can completely replace, we can replace the flipper with another device,
and then you don't need a slipper anymore, okay, yeah, so anyways, this was received pretty
well, yeah, people like it's going, I have some more details, so basically shout out to
build route, so this is what I first used to get it booting, so if you're not familiar
with embedded Linux devices, you need, there's a whole bunch of things you need to bring
together to get it to boot, you need a boot loader, you need a kernel, you need user space
applications, and it is to finally assemble all these things into one, binary that you
can then flash to NSD card, plug it in and boot, if you don't want to do that by hand,
you can use Builder, which is a great project, so I started off with Builder, and this
worked really well for a while, but the one issues that I don't have experience with
Builder, no, okay, so the one thing is Builder doesn't make binary packages, so Builder
everything is configured at BuildSmart, like when you're building on your host machine,
and it's going to do all the dependency resolution in the blah, and then it's going to just
drop all the files into the file system and give you a final route of S, but I had customers
like, I want to install this thing, I'm like, wow, okay, you can, like, SSH5, it worked
well for what it is, but it doesn't really build an OS, for say, it's literally in the
name what it does, it builds root file systems, so yeah, I recently moved to ARMBN, which
is a really cool project, so ARMBN is, I mean, two different schools of thought, right,
so you have BuildRoot where you're constantly recompiling the whole thing and making an
extremely lightweight image, a wealth ARMBN, a lot of people just grab an image flash into
their device and then configure from there, so yeah, so we have access to Debian packages,
and you just can just app get install, just like you would on them to, or whatever operating system
you want, and this worked really well, and I was able to basically take the stuff I did on BuildRoot
and implement, move a device tree files over, and then this just gives the image and it just
booted very well, super cool, a lot of presentations kind of all over the place, yeah, so yeah, I was
mentioned the SunCee people earlier, so there, the people that basically merge changes into
Linux kernel, such that we have like, super, really good support for basically the all-winter
ships, so yeah, thank you to this team, and yeah, thanks to them, we have the most recent kernel,
we're not running some old 5.1 something crossed. Yeah, I guess it's just a random bit about
device tree, so if you're not familiar with device tree, it's basically a structured text file,
and this is going to describe your hardware, so I mentioned I had this RTL 8723 Wi-Fi chip earlier,
so basically you edit your device tree file, and you just nest that right in there, the MMC bus,
because as I said, it's connected to EMR, the MMC bus, and you basically fired up, and you have a
W-line zero device. Well, everyone's doomed, that's nice, that's normally the first question I
get. Yeah, this was an application I wrote, so it's basically just a big bash script, and
the idea was to drive this application, you can do it manually, but the idea was the
flip or black hat would then send these commands to the device to connect to our 550 minutes for
it cool. Connection, I got to beat up. Yeah, so the flip or, I don't, I don't know where this
is already, the flip or we'll talk to the black hat over Europe. Flip or app, so this is a small
C application that I wrote that actually runs on the flip or zero, this is merged into the momentum
firmware, so you can basically just grab that flash that you'll have the app, and this is going to
talk to the, talk to the black hat, and run your exploits, and run your scripts, so you can figure
everything. A script launcher, yeah, this is just some additional few things, so there's a way to run
run Python scripts on the black hat from the Flip or zero itself using this app, I was talking
about earlier, which is nice because you can run all sorts of whatever you want, basically.
Data loader data thief, so this was a pen testing thing I wrote basically, so if you're like
red teaming a building and you find a USB driver and plug it in and then steal the data on
off of it onto your device or potentially load malware, yeah, I'm not going to talk about that.
So there are a few cases that were built by the community, this is the Edgar case, it's called
the Edgar case, because Edgar rated, and then we decided to, yeah, go with the screen, because
everyone was talking about that, I'm like, okay, I guess this is something people want, so now
we have a giant screen connection with it. And yes, that's the R&B in build, and I actually
change the sources list thing you see, you can install whatever from Cali, and it runs
Debbie and Sid, which is like the most recent unstable distribution, and Cali's a really
rolling distro, so this kind of works. Yeah, okay, yeah, so this is what I'm talking about earlier
to what's pointed for, 0, I don't think it's necessary anymore, enter the black pants,
so I talk at Y 2025 about this device, was anyone else there? Y25? Ah cool, nice. So
someone in the audience asked what's the point of the puzzle, and I'm literally like have my Y25
badge, and I have my device, I'm like, man, okay, this is fully open source, so basically I forked this,
the kind of board of the design to the Y25 badge, it's open source, so yes, forky forky,
I removed everything except for the P-MIC and the battery charger, the key is the coupe super cool
project, so if you know the solder party potentially, he, they created with the first people to do
this stuff with the old blackberry keyboards, basically reverse engineer in the protocol, but then
the blackberry keyboards ran out, so he ended up developing the keyboard, his own keyboard,
and this is basically a membrane, so it can membrane, and then there's domes, which is under,
and you just got to put a certain layout on your PCB, and you have a full working keyboard,
basically, which is super cool. Yeah, getting into some of the details, so the keyboard controller
is an STM32 F-0-4 powered by QMK, the open source keyboard firmware project, I don't know what
stands for, quantum mechanical keyboard, initially, and now it's the STM there, and then you can see
on the flip side, that's where all the pads would be that the domes, which is activate. Okay,
that should not stay powered by QMK. There's USB-2 hub, and I'll talk about that's how that's
connected a little bit. Okay, hack number one, so if you notice the MIPI DSI can actually, that
FFC is totally in the wrong spot, because if we want to put the black hat in the black pants,
we then need to like, route DSI up and around, so this is like a, there's basically the screen,
we'll plug into one of these, and this does like a right angle adjustment, such that we can have
a small FFC jumper. Yeah, nice. So I never designed this thing to be plugged into anything
of the flip or zero, so we had to get creative. Hack number two, USB contacts, so I need to connect
the keyboard to basically to the USB port, and then I have these USB hub that I also need to connect
to that. So on this side, we see some spring contacts, it's really hard to see, sorry, but
yeah, it's okay, you can laugh this supposed to be funny. And basically, the spring contacts,
which are meant for like a RF shield or something, basically make contact to the, and actually
works pretty well. And then yeah, here you can see the, can you see my pointer? Oh, yeah, cool.
You can see the FFC hack, where there's just a small jumper that goes to the board,
10 minutes now, would you? Hack number three, the holder downer, so it's, yeah, you need something
to hold it down, so basically, build this little plastic thing that pushes the PCB down and
makes contact with the USB, those pat, those spring, spring contacts. So that's the final assembly.
So the, yeah, there's basically, I mean, you can see what it is, but it's a front panel,
and then the key goes in, the spring goes behind, and then this keyboard or the PCB is sandwiched
in the middle, and then there's a back, back thing, but back casing, which is going to cover up
your 18650 and kind of roll it in the final device. And you basically just plug your black hat
into your black pants and you have a fully functioning handheld Linux device. Here's some of the
glamor shots. You want to see some of these posted on Reddit or various social media.
Things that's at running router split, which is a pen testing kit for embedded or like IoT stuff,
because as we all know, the S and IoT stands for security. So, yeah, so that's the final device,
and here's the glow up from the board that plugs in the foot of zero throughout the cases,
and then the final device. I wanted to thank the Kai-Cad team, Linux and C community,
you can do Linux, Y2125 badge team, flip the black hat supporters, Edgar, for making the case,
son of party, and you guys are watching. I think that's it. That's the last slide. So I think I'm really
sorry.
Questions?
Cowards.
What's the sort of build cost for it?
So, yeah, it really depends how you do it. I get the whole things, so it's mechanical,
everything, it's all open source. So it's possible to 3D print the parts, and then hand
assemble the black pants board, but I think if you go into a shop to get the boards done,
you're looking at a bomb cost, or maybe 40 bucks, yeah, and components, and then plus the assembly
cost and everything, so something like that.
Number one.
Great talk. Thank you. Just leaving them for the last question is, I mean, is anybody planning to
sort of make them? Is that acceptable under the license also?
Oh, yeah, for sure. Yes, for anyone who's welcome to make them, I make them, so there's me,
and I have a small shop where I sell some of this stuff as well.
Yeah, I haven't found anyone in the wild that's made their own yet, but I mean, hopefully,
hopefully, there's a few people.
This device looks really cool. What's that screen? Where can I buy that screen?
So that screen is a 480, but 480, TFT screen.
I have a few of them in my shop, so it's possible by for me, or if you look around on LXpress,
you should be able to find them. Yeah, thank you.
All right.
All right, so there was a slide somewhere in there where it said something like,
pay a manufacturer to populate your board. So I just want to hear your experiences that
made you made that slide. Oh, yeah. I mean, I don't sell a lot of hardware, but if I was to actually
hand assemble these boards to sell, that would be basically a full-time job. So no pitfalls with
manufacturing in your own shop or anything. Oh, yeah. It's an all-wintered ship. It's pretty
and all the other stuff. Yeah. It's a difficult? Well, I mean, normally you build five and you
turn on one and that one catches on fire and then you have like one that works, type of thing.
But I mean, yeah, it is, I guess it would be the most complex board to hand assemble, but we are
talking about BJF packages, like 200 or something pins. So it's just like the probability of something
shorting or something going awry is quite high. But it is possible. There's a very good
blog, a person named Jay Carlson or Jay Carlton, and he made a blog that was Carlson, you want to build
unimbedded Linux device. And super good. He made like like five or six different boards,
always socks and ram and stuff like this. And that was the original thing that motivated me and he
talked in this tone that said, you know, there's a lot of, you know, professionals out there
that say like, like every time I tell a professional, like someone that I work with that I hand
populated a 250 pin BJF package, they don't even believe me. And I'm like, no, it's actually not that bad.
You can just do it. And this Jay Carlson person spoke to that same narrative that personally motivated
me to pursue this thing. Cool. Yeah, thank you. Yeah, thank you.
Clement. Anybody else in the front row? If you may as well, or in the middle, middle, the
middle. All right, thanks Ryan. Our next talk starts at 1 o'clock.