Flipper Zero: How it’s made and tested
blog.flipperzero.one
blog.flipperzero.one
It has a bunch of receiver/transmitter hardware and software. Definitely looks fun to play with!
I've never actually come across this interface. It's not common in Australia, I still really enjoyed the write up and seeing how they overcame the difficulties.
The epoxy jobs I often see anchoring iButtons to walls visibly aren't at the level of detail/engineering required to run invisible wiring (eg through concrete) etc, so I theorize that the iButtons themselves are completely passive (eg, they contain a resistor, or maybe a microcontroller), and the box is a transponder (unlikely) or that it records to internal storage and then gets dropped onto a sync cradle (more likely).
The gadgets the cleaners use are very literally about as featureful as a cigarette packet: a dark grey rectangle with an iButton connector on the back and a small LCD. I've not really ever had the impetus to go pin a cleaner down and politely ask for more details :D
If EEPROM:
Level 0: Determine that it's an EEPROM and dump the full contents
Level 1: Locate the undocumented vendor control string (which doesn't exist) and unlocks the EEPROM and makes it fully rewritable
Level 2: Rewrite the EEPROM to change the area code or label or whatnot to something funny
Level 3.14159265359: Rewrite the EEPROM such that its contents cause a buffer overflow in the handheld gadget and achieve remote code execution
Level 42: Rewrite the EEPROM such that the RCE achieved in the handheld gadget then causes nested RCE in the synchronization software, then use the opportunity to, say, open a popular YouTube video
If Java:
Level 0: Send data through the iButton link that breaks the Java sandbox and allows for general execution on the CPU
Level 1: Dump the full contents of the firmware
Level 2: Alter the firmware such that every time you tap the iButton it sends area information from shopping centres in entirely different states (counties) :D
Level 3.1e10: Alter the firmware to achieve RCE in the scanner gadget, then stream individual video frames through the iButton link onto the scanner LCD :D
I really can't wait to see if I can start replaying RFID fobs I use in my daily life with this.
I think Flipper0 it'll be fun for playing with garage door openers, or maybe some local havok on non-NIST cert'd NFC cards, but I don't really see much else. BLE has bonding and Wi-Fi has TLS1.3 for embedded (smaller ciphersuites), so no go there, and flash programmers already spoken for. Sooo.. what am I missing?
I have reader/writer that handles several RFID/NFC chip frequencies. When I replace a fob at the office my co-workers think I'm doing something legit - they have no idea that I have a cheap device from Asia that can clone them. And I could clone your fob silently just standing next to you in the lunch line, you wouldn't even know.
They've been more than transparent on the delays they've had to deal with, and they launched a product during a global pandemic and supply shortage. I'd cut them some slack.
I mean, if Nvidia and AMD can't get a graphics card into my hands over the course of a year then I can't imagine a super tiny group of engineers would have much luck bootstrapping the supply chain for their brand new product.
Producing anything to sell commercially requires work up front. That work has to get paid for. While that work is happening, the people involved need to eat and to keep their families fed. Is the universe a big ol' meanie for "requiring" people to keep eating? I guess.
Regardless, up-front money is required. Previously something like this could only happen if you managed to find somebody with millions of dollars sitting around and then managed to convince them to give you enough to get your product built. And then you had the problem of finding your buyers, which cost more money for marketing.
I have my issues with Kickstarter. But inviting the individuals who want your product to participate in financing it seems like a giant step forward to me. If you have a better idea, I'm all ears. If not, maybe just block Kickstarter in your browser? Then you'll be free of any perceived burdensome requirements.
You're phrasing this like they're GPUs. But those GPUs have general availability, at least on paper. There are no people, other than the Flipper devs, their friends, and perhaps selected reviewers, who have one of these in their hands to play with. It has not hit 1.0 yet.
It's only 5 months late, it's like you've never backed a Kickstarter before.
"If you can get one. They're behind schedule and haven't shipped any yet." would have been fine.