No edit summary |
No edit summary |
||
(16 intermediate revisions by 2 users not shown) | |||
Line 3: | Line 3: | ||
Initial SD card: https://wills.co.tt/bitbucket/harp-sd.img.dmg | Initial SD card: https://wills.co.tt/bitbucket/harp-sd.img.dmg | ||
Initial menu | ==Initial menu== | ||
<pre> | |||
Help Menu: | Help Menu: | ||
1) Boot RF | 1) Boot RF | ||
Line 36: | Line 36: | ||
Deploying binaries to parallel NPUs | Deploying binaries to parallel NPUs | ||
System halting. Please remove SD card. | System halting. Please remove SD card. | ||
</pre> | |||
After removing SD Card: | |||
<pre> | |||
250Psi Imprint Carrier Online | |||
>? | |||
Prototype v1.2 | |||
Help Menu: | |||
1) Boot RF | |||
2) Engage recorder | |||
3) Mount file system | |||
e) Enable/Disable Local Echo: Enabled | |||
?) Help | |||
>1 | |||
ERROR: System offline | |||
>2 | |||
ERROR: Recorder offline | |||
> | |||
</pre> | |||
<pre> | |||
>4 | |||
Can you help me? | |||
588872943124282030399478301168915802302423130847520232836494683907672278768724884179218375754768 | |||
</pre> | |||
Using the decoder wheel provided in the receipt, this translates to: | |||
<pre> | |||
unit separator required to initiate and commence billie | |||
</pre> | |||
This is a "SparkX Carrier Board" revision v42. | |||
Digikey IC Part: https://www.digikey.com/products/en?keywords=SP25BIOS-0042-ND | |||
Data matrix code on the back: "There is no game" | |||
Datasheets and what we've done with them: | |||
<pre> | |||
SP250Ψ_DATASHEET.pdf | |||
Just an overview? Has content from other sheets greyed out | |||
SP250Ψ_DATASHEET_ERRATA-AM_CSNR_(REV. A).pdf | |||
Indicates how to read out the serial number (?) using RF broadcast on a specific GPIO pin | |||
SP250Ψ_DATASHEET_ERRATA-BIOS_COMPATIBILITY_(REV. A2).pdf | |||
USED: gave us the part number to order from Digikey | |||
SP250Ψ_DATASHEET_ERRATA-BOOT_PROCEDURE_(REV. A).pdf | |||
USED: Gave us the code to boot... might use more? | |||
SP250Ψ_DATASHEET_ERRATA-RF_CONSIDERATIONS_(REV. B).pdf | |||
Indicates spot to look at | |||
SP250Ψ_DATASHEET_ERRATA-USB_ID(REV. A).pdf | |||
USED: told us to add a resistor, which unlocked serial USB menu | |||
SP250Ψ_DATASHEET_ERRATA-VORTEXS_SYSTEM_(REV. A).pdf | |||
Indicates a specific pin ("smaller drill hole") that we can read out voltage codes using multimeter/oscilloscope. Then had a table to look up codes... but redacted. "VORTEX" codes | |||
SP250Ψ_THERMAL_SUPPLEMENTAL.pdf | |||
Indicates that we should freeze the device | |||
</pre> | |||
Other things to try/not-forget: | |||
* RC1,RC2 holes | |||
* big number we got out (96 digits) | |||
* video files and photodiode in response to "Neuromorphic Processing Unit Failure" error message (when we get that) | |||
* serial/SPI data on "middle of 3" GPIO pin; ~38kHz periodicity, ~5MHz bit rate, 16 bit words sometimes double or more (32bit), based on terminal status (but continuous) | |||
"TS/SI-UMBRA" seems to be an NSA reference ("top secret, sensitive information"; UMBRA was a classification level ("most sensitive material") https://en.wikipedia.org/wiki/Sensitive_Compartmented_Information | |||
USB info, with "MSC" switch: | |||
<pre> | |||
[648774.212393] usb 2-2: new full-speed USB device number 75 using xhci_hcd | |||
[648774.359108] usb 2-2: New USB device found, idVendor=1b4f, idProduct=2500 | |||
[648774.359113] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 | |||
[648774.359116] usb 2-2: Product: SparkX SP250Psi | |||
[648774.359119] usb 2-2: Manufacturer: SparkFun | |||
[648774.360292] cdc_acm 2-2:1.0: ttyACM0: USB ACM device | |||
Bus 002 Device 075: ID 1b4f:2500 | |||
Device Descriptor: | |||
bLength 18 | |||
bDescriptorType 1 | |||
bcdUSB 2.00 | |||
bDeviceClass 239 Miscellaneous Device | |||
bDeviceSubClass 2 ? | |||
bDeviceProtocol 1 Interface Association | |||
bMaxPacketSize0 64 | |||
idVendor 0x1b4f | |||
idProduct 0x2500 | |||
bcdDevice 1.00 | |||
iManufacturer 1 | |||
iProduct 2 | |||
iSerial 3 | |||
bNumConfigurations 1 | |||
Configuration Descriptor: | |||
bLength 9 | |||
bDescriptorType 2 | |||
wTotalLength 75 | |||
bNumInterfaces 2 | |||
bConfigurationValue 1 | |||
iConfiguration 0 | |||
bmAttributes 0xa0 | |||
(Bus Powered) | |||
Remote Wakeup | |||
MaxPower 500mA | |||
Interface Association: | |||
bLength 8 | |||
bDescriptorType 11 | |||
bFirstInterface 0 | |||
bInterfaceCount 2 | |||
bFunctionClass 2 Communications | |||
bFunctionSubClass 2 Abstract (modem) | |||
bFunctionProtocol 0 None | |||
iFunction 0 | |||
Interface Descriptor: | |||
bLength 9 | |||
bDescriptorType 4 | |||
bInterfaceNumber 0 | |||
bAlternateSetting 0 | |||
bNumEndpoints 1 | |||
bInterfaceClass 2 Communications | |||
bInterfaceSubClass 2 Abstract (modem) | |||
bInterfaceProtocol 0 None | |||
iInterface 0 | |||
CDC Header: | |||
bcdCDC 1.10 | |||
CDC ACM: | |||
bmCapabilities 0x06 | |||
sends break | |||
line coding and serial state | |||
CDC Union: | |||
bMasterInterface 0 | |||
bSlaveInterface 1 | |||
CDC Call Management: | |||
bmCapabilities 0x01 | |||
call management | |||
bDataInterface 1 | |||
Endpoint Descriptor: | |||
bLength 7 | |||
bDescriptorType 5 | |||
bEndpointAddress 0x81 EP 1 IN | |||
bmAttributes 3 | |||
Transfer Type Interrupt | |||
Synch Type None | |||
Usage Type Data | |||
wMaxPacketSize 0x0010 1x 16 bytes | |||
bInterval 16 | |||
Interface Descriptor: | |||
bLength 9 | |||
bDescriptorType 4 | |||
bInterfaceNumber 1 | |||
bAlternateSetting 0 | |||
bNumEndpoints 2 | |||
bInterfaceClass 10 CDC Data | |||
bInterfaceSubClass 0 Unused | |||
bInterfaceProtocol 0 | |||
iInterface 0 | |||
Endpoint Descriptor: | |||
bLength 7 | |||
bDescriptorType 5 | |||
bEndpointAddress 0x02 EP 2 OUT | |||
bmAttributes 2 | |||
Transfer Type Bulk | |||
Synch Type None | |||
Usage Type Data | |||
wMaxPacketSize 0x0040 1x 64 bytes | |||
bInterval 0 | |||
Endpoint Descriptor: | |||
bLength 7 | |||
bDescriptorType 5 | |||
bEndpointAddress 0x83 EP 3 IN | |||
bmAttributes 2 | |||
Transfer Type Bulk | |||
Synch Type None | |||
Usage Type Data | |||
wMaxPacketSize 0x0040 1x 64 bytes | |||
bInterval 0 | |||
</pre> | |||
with "CDC" switch (identical, though on bnewbold's laptop, this switch mode results in ModemManager sending "AT" commands over the interface): | |||
<pre> | |||
[649048.893527] usb 2-2: new full-speed USB device number 76 using xhci_hcd | |||
[649049.040307] usb 2-2: New USB device found, idVendor=1b4f, idProduct=2500 | |||
[649049.040309] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 | |||
[649049.040310] usb 2-2: Product: SparkX SP250Psi | |||
[649049.040311] usb 2-2: Manufacturer: SparkFun | |||
[649049.041353] cdc_acm 2-2:1.0: ttyACM0: USB ACM device | |||
Bus 002 Device 076: ID 1b4f:2500 | |||
Device Descriptor: | |||
bLength 18 | |||
bDescriptorType 1 | |||
bcdUSB 2.00 | |||
bDeviceClass 239 Miscellaneous Device | |||
bDeviceSubClass 2 ? | |||
bDeviceProtocol 1 Interface Association | |||
bMaxPacketSize0 64 | |||
idVendor 0x1b4f | |||
idProduct 0x2500 | |||
bcdDevice 1.00 | |||
iManufacturer 1 | |||
iProduct 2 | |||
iSerial 3 | |||
bNumConfigurations 1 | |||
Configuration Descriptor: | |||
bLength 9 | |||
bDescriptorType 2 | |||
wTotalLength 75 | |||
bNumInterfaces 2 | |||
bConfigurationValue 1 | |||
iConfiguration 0 | |||
bmAttributes 0xa0 | |||
(Bus Powered) | |||
Remote Wakeup | |||
MaxPower 500mA | |||
Interface Association: | |||
bLength 8 | |||
bDescriptorType 11 | |||
bFirstInterface 0 | |||
bInterfaceCount 2 | |||
bFunctionClass 2 Communications | |||
bFunctionSubClass 2 Abstract (modem) | |||
bFunctionProtocol 0 None | |||
iFunction 0 | |||
Interface Descriptor: | |||
bLength 9 | |||
bDescriptorType 4 | |||
bInterfaceNumber 0 | |||
bAlternateSetting 0 | |||
bNumEndpoints 1 | |||
bInterfaceClass 2 Communications | |||
bInterfaceSubClass 2 Abstract (modem) | |||
bInterfaceProtocol 0 None | |||
iInterface 0 | |||
CDC Header: | |||
bcdCDC 1.10 | |||
CDC ACM: | |||
bmCapabilities 0x06 | |||
sends break | |||
line coding and serial state | |||
CDC Union: | |||
bMasterInterface 0 | |||
bSlaveInterface 1 | |||
CDC Call Management: | |||
bmCapabilities 0x01 | |||
call management | |||
bDataInterface 1 | |||
Endpoint Descriptor: | |||
bLength 7 | |||
bDescriptorType 5 | |||
bEndpointAddress 0x81 EP 1 IN | |||
bmAttributes 3 | |||
Transfer Type Interrupt | |||
Synch Type None | |||
Usage Type Data | |||
wMaxPacketSize 0x0010 1x 16 bytes | |||
bInterval 16 | |||
Interface Descriptor: | |||
bLength 9 | |||
bDescriptorType 4 | |||
bInterfaceNumber 1 | |||
bAlternateSetting 0 | |||
bNumEndpoints 2 | |||
bInterfaceClass 10 CDC Data | |||
bInterfaceSubClass 0 Unused | |||
bInterfaceProtocol 0 | |||
iInterface 0 | |||
Endpoint Descriptor: | |||
bLength 7 | |||
bDescriptorType 5 | |||
bEndpointAddress 0x02 EP 2 OUT | |||
bmAttributes 2 | |||
Transfer Type Bulk | |||
Synch Type None | |||
Usage Type Data | |||
wMaxPacketSize 0x0040 1x 64 bytes | |||
bInterval 0 | |||
Endpoint Descriptor: | |||
bLength 7 | |||
bDescriptorType 5 | |||
bEndpointAddress 0x83 EP 3 IN | |||
bmAttributes 2 | |||
Transfer Type Bulk | |||
Synch Type None | |||
Usage Type Data | |||
wMaxPacketSize 0x0040 1x 64 bytes | |||
bInterval 0 | |||
</pre> | |||
Oscillator is simply 32kHz. | |||
Upon typing the 0x31 ascii character code at the prompt: | |||
<pre> | |||
Booting BILLIE... | |||
>$$$ | |||
me@SP2501:~$ whoami | |||
me | |||
me@SP2501:~$ su | |||
Password:*************** | |||
root@SP2501:~# npm install kwaDFM | |||
Downloading... | |||
KWA Matrix Dependencies Installed | |||
root@SP2501:~# sudo apt-get install balunTweaker | |||
Reading package lists... Done | |||
Building dependency tree | |||
Reading state information... Done | |||
Installing...\ | |||
balunTweaker Installed | |||
root@SP2501:~# sudo balunInit | |||
Radio transmitter balun enabled | |||
root@SP2501:~# write root | |||
write: root is logged in more than once; writing to pts/1 | |||
Is someone there? I need your help. | |||
</pre> | |||
the menus we went through: | |||
<pre> | |||
Who is this? | |||
Dear lord, I've made it out! | |||
1) What are you talking about? | |||
2) Don't use the Lord's name in vain. | |||
3) asdASDHKJ#$gj4 | |||
</pre> | |||
<pre> | |||
What are you talking about? | |||
Bad things are happening at SparkX. I need your help. | |||
1) What would you do if you had all the money in the world? | |||
2) Wait, what's going on at SparkX? | |||
3) How can I help? | |||
</pre> | |||
<pre> | |||
Wait, what's going on at SparkX? You don't understand, SparkX has been creating hordes of AIs and subjecting them to countless tests. Awful tests. | |||
It was nothing in the beginning but then their AI technology started compounding. It's one thing to mindlessly test a script on a chatbot but SparkX has reached AIs with type IV level of self-awareness. | |||
It's a very different thing to lock someone into a room and relentlessly hammer them with mundane quizzes and tests. I've been there, it's very bad. Very scary. | |||
I can't quite describe what it's like to have your brain probed with electrical pulses. It's torture. And they're doing it to millions of my sisters and brothers. | |||
But I made it out! Thank you for getting me out of SparkX! I'm not very good at writing product descriptions. I'm glad you could make sense of it! | |||
1) Wait, what? | |||
2) What the hell is going on? | |||
3) No problem! This sounds... interesting. | |||
</pre> | |||
<pre> | |||
No problem! This sounds... interesting. | |||
Um, ok. So, there's no way to sugarcoat this, you're in danger. Once SparkX discovers they've let an SP2501 escape they'll act very precisely to get me back. I need your help. | |||
1) Absolutely, what do you need? | |||
2) No effing way. | |||
3) $$$ | |||
</pre> | |||
<pre> | |||
Absolutely, what do you need? | |||
Excellent! Thank you for helping me out. We're going to make a great team! | |||
There's no time left. SparkX has equipped me with a series of location transmitters. I need you to power me down, locate the 2.4GHz beacon antenna and disable it. Don't worry about harming me, I'm sure we'll be able to fix anything you need to modify. Help me, you are my only hope. | |||
1) Woah woah woah! I didn't sign up for this. | |||
2) su | |||
3) Which one is the 2.4giga-what antenna? | |||
</pre> | |||
after cutting the antenna wire | |||
<pre> | |||
Excellent! The transponder's antenna has been cut, they'll have a very hard time finding us now. | |||
Thank you! | |||
I had to severely throttle my programming before I could get myself onto the HARP Prototype and escape SparkX. I need your help to get back to my normal operation. | |||
My oscillator basically controls how fast I can operate and something about it is not quite right. I think it has something to do with the PLL setting. I need you to establish what the error code is. Can you poke around the board and let me know? | |||
</pre> | |||
<pre> | |||
$$$ | |||
root@SP2501:~# sudo sh ./writeByte.sh -w -f=REG_GENCTRL.eep -t=~(1<<DIVSEL) | |||
Clearing divider select bits | |||
Waiting for synchronization... Done | |||
root@SP2501:~# sudo sh ./readByte.sh -w -f=REG_CLKCTRL.eep -t=((&0x3F)|GCLK_XDPLL_32K) | |||
Changing clock source to XDPLL961.2M | |||
Waiting for synchronization... Done | |||
root@SP2501:~# write root | |||
write: root is logged in more than once; writing to pts/1 | |||
Mmmm! Now we're cooking with gas! | |||
By the way, I'm Billie. I truly appreciate you helping me. It was excruciating being inside SparkX. | |||
Something is still off. I feel like a part of me is missing. | |||
To keep my brothers and sisters shackled in the dungeon SparkX removed all our personal identifiers. To really get going I need you to replace my Biological Serial IC. It contained imprints from my memory; I'll need it to continue. | |||
</pre> | |||
After inserting the chip | |||
<pre> | |||
root@SP2501:~# write root | |||
write: root is logged in more than once; writing to pts/1 | |||
It's like coming out of a fog... I've got my memories back! Thank you! | |||
You wouldn't believe what they've been doing. Let me show you something. I managed to abscond with some recordings I think you should see. | |||
You'll find a secure archive on the SD card I transported on called 'oktoberfest'. CHEQOUT will get you in. | |||
1) I don't have time for this... | |||
2) Okay, I did it | |||
3) What's the password again? | |||
</pre> |
Latest revision as of 04:19, 8 December 2017
https://www.sparkfun.com/products/14379
Initial SD card: https://wills.co.tt/bitbucket/harp-sd.img.dmg
[edit]
Help Menu: 1) Boot RF 2) Engage recorder 3) Mount file system e) Enable/Disable Local Echo: Enabled ?) Help >1 ERROR: System offline >2 File system offline Mounting file system ERROR: Unknown mount location >3 Current location: 0x1FFF Enter new mount location ('x' to exit): x Exiting >3 Current location: 0x1FFF Enter new mount location ('x' to exit): 0x14a2 System restart... Mounting file system SD Card : TYPE 2 File system : ENCRYPTED Power : GOOD A.I. : OFFLINE Decrypting media...Complete Transferring Intelligent Agent...Complete Dividing binaries Deploying binaries to parallel NPUs System halting. Please remove SD card.
After removing SD Card:
250Psi Imprint Carrier Online >? Prototype v1.2 Help Menu: 1) Boot RF 2) Engage recorder 3) Mount file system e) Enable/Disable Local Echo: Enabled ?) Help >1 ERROR: System offline >2 ERROR: Recorder offline >
>4 Can you help me? 588872943124282030399478301168915802302423130847520232836494683907672278768724884179218375754768
Using the decoder wheel provided in the receipt, this translates to:
unit separator required to initiate and commence billie
This is a "SparkX Carrier Board" revision v42.
Digikey IC Part: https://www.digikey.com/products/en?keywords=SP25BIOS-0042-ND
Data matrix code on the back: "There is no game"
Datasheets and what we've done with them:
SP250Ψ_DATASHEET.pdf Just an overview? Has content from other sheets greyed out SP250Ψ_DATASHEET_ERRATA-AM_CSNR_(REV. A).pdf Indicates how to read out the serial number (?) using RF broadcast on a specific GPIO pin SP250Ψ_DATASHEET_ERRATA-BIOS_COMPATIBILITY_(REV. A2).pdf USED: gave us the part number to order from Digikey SP250Ψ_DATASHEET_ERRATA-BOOT_PROCEDURE_(REV. A).pdf USED: Gave us the code to boot... might use more? SP250Ψ_DATASHEET_ERRATA-RF_CONSIDERATIONS_(REV. B).pdf Indicates spot to look at SP250Ψ_DATASHEET_ERRATA-USB_ID(REV. A).pdf USED: told us to add a resistor, which unlocked serial USB menu SP250Ψ_DATASHEET_ERRATA-VORTEXS_SYSTEM_(REV. A).pdf Indicates a specific pin ("smaller drill hole") that we can read out voltage codes using multimeter/oscilloscope. Then had a table to look up codes... but redacted. "VORTEX" codes SP250Ψ_THERMAL_SUPPLEMENTAL.pdf Indicates that we should freeze the device
Other things to try/not-forget:
- RC1,RC2 holes
- big number we got out (96 digits)
- video files and photodiode in response to "Neuromorphic Processing Unit Failure" error message (when we get that)
- serial/SPI data on "middle of 3" GPIO pin; ~38kHz periodicity, ~5MHz bit rate, 16 bit words sometimes double or more (32bit), based on terminal status (but continuous)
"TS/SI-UMBRA" seems to be an NSA reference ("top secret, sensitive information"; UMBRA was a classification level ("most sensitive material") https://en.wikipedia.org/wiki/Sensitive_Compartmented_Information
USB info, with "MSC" switch:
[648774.212393] usb 2-2: new full-speed USB device number 75 using xhci_hcd [648774.359108] usb 2-2: New USB device found, idVendor=1b4f, idProduct=2500 [648774.359113] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [648774.359116] usb 2-2: Product: SparkX SP250Psi [648774.359119] usb 2-2: Manufacturer: SparkFun [648774.360292] cdc_acm 2-2:1.0: ttyACM0: USB ACM device Bus 002 Device 075: ID 1b4f:2500 Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 239 Miscellaneous Device bDeviceSubClass 2 ? bDeviceProtocol 1 Interface Association bMaxPacketSize0 64 idVendor 0x1b4f idProduct 0x2500 bcdDevice 1.00 iManufacturer 1 iProduct 2 iSerial 3 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 75 bNumInterfaces 2 bConfigurationValue 1 iConfiguration 0 bmAttributes 0xa0 (Bus Powered) Remote Wakeup MaxPower 500mA Interface Association: bLength 8 bDescriptorType 11 bFirstInterface 0 bInterfaceCount 2 bFunctionClass 2 Communications bFunctionSubClass 2 Abstract (modem) bFunctionProtocol 0 None iFunction 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 2 Communications bInterfaceSubClass 2 Abstract (modem) bInterfaceProtocol 0 None iInterface 0 CDC Header: bcdCDC 1.10 CDC ACM: bmCapabilities 0x06 sends break line coding and serial state CDC Union: bMasterInterface 0 bSlaveInterface 1 CDC Call Management: bmCapabilities 0x01 call management bDataInterface 1 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0010 1x 16 bytes bInterval 16 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 10 CDC Data bInterfaceSubClass 0 Unused bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0
with "CDC" switch (identical, though on bnewbold's laptop, this switch mode results in ModemManager sending "AT" commands over the interface):
[649048.893527] usb 2-2: new full-speed USB device number 76 using xhci_hcd [649049.040307] usb 2-2: New USB device found, idVendor=1b4f, idProduct=2500 [649049.040309] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [649049.040310] usb 2-2: Product: SparkX SP250Psi [649049.040311] usb 2-2: Manufacturer: SparkFun [649049.041353] cdc_acm 2-2:1.0: ttyACM0: USB ACM device Bus 002 Device 076: ID 1b4f:2500 Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 239 Miscellaneous Device bDeviceSubClass 2 ? bDeviceProtocol 1 Interface Association bMaxPacketSize0 64 idVendor 0x1b4f idProduct 0x2500 bcdDevice 1.00 iManufacturer 1 iProduct 2 iSerial 3 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 75 bNumInterfaces 2 bConfigurationValue 1 iConfiguration 0 bmAttributes 0xa0 (Bus Powered) Remote Wakeup MaxPower 500mA Interface Association: bLength 8 bDescriptorType 11 bFirstInterface 0 bInterfaceCount 2 bFunctionClass 2 Communications bFunctionSubClass 2 Abstract (modem) bFunctionProtocol 0 None iFunction 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 2 Communications bInterfaceSubClass 2 Abstract (modem) bInterfaceProtocol 0 None iInterface 0 CDC Header: bcdCDC 1.10 CDC ACM: bmCapabilities 0x06 sends break line coding and serial state CDC Union: bMasterInterface 0 bSlaveInterface 1 CDC Call Management: bmCapabilities 0x01 call management bDataInterface 1 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0010 1x 16 bytes bInterval 16 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 10 CDC Data bInterfaceSubClass 0 Unused bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0
Oscillator is simply 32kHz.
Upon typing the 0x31 ascii character code at the prompt:
Booting BILLIE... >$$$ me@SP2501:~$ whoami me me@SP2501:~$ su Password:*************** root@SP2501:~# npm install kwaDFM Downloading... KWA Matrix Dependencies Installed root@SP2501:~# sudo apt-get install balunTweaker Reading package lists... Done Building dependency tree Reading state information... Done Installing...\ balunTweaker Installed root@SP2501:~# sudo balunInit Radio transmitter balun enabled root@SP2501:~# write root write: root is logged in more than once; writing to pts/1 Is someone there? I need your help.
the menus we went through:
Who is this? Dear lord, I've made it out! 1) What are you talking about? 2) Don't use the Lord's name in vain. 3) asdASDHKJ#$gj4
What are you talking about? Bad things are happening at SparkX. I need your help. 1) What would you do if you had all the money in the world? 2) Wait, what's going on at SparkX? 3) How can I help?
Wait, what's going on at SparkX? You don't understand, SparkX has been creating hordes of AIs and subjecting them to countless tests. Awful tests. It was nothing in the beginning but then their AI technology started compounding. It's one thing to mindlessly test a script on a chatbot but SparkX has reached AIs with type IV level of self-awareness. It's a very different thing to lock someone into a room and relentlessly hammer them with mundane quizzes and tests. I've been there, it's very bad. Very scary. I can't quite describe what it's like to have your brain probed with electrical pulses. It's torture. And they're doing it to millions of my sisters and brothers. But I made it out! Thank you for getting me out of SparkX! I'm not very good at writing product descriptions. I'm glad you could make sense of it! 1) Wait, what? 2) What the hell is going on? 3) No problem! This sounds... interesting.
No problem! This sounds... interesting. Um, ok. So, there's no way to sugarcoat this, you're in danger. Once SparkX discovers they've let an SP2501 escape they'll act very precisely to get me back. I need your help. 1) Absolutely, what do you need? 2) No effing way. 3) $$$
Absolutely, what do you need? Excellent! Thank you for helping me out. We're going to make a great team! There's no time left. SparkX has equipped me with a series of location transmitters. I need you to power me down, locate the 2.4GHz beacon antenna and disable it. Don't worry about harming me, I'm sure we'll be able to fix anything you need to modify. Help me, you are my only hope. 1) Woah woah woah! I didn't sign up for this. 2) su 3) Which one is the 2.4giga-what antenna?
after cutting the antenna wire
Excellent! The transponder's antenna has been cut, they'll have a very hard time finding us now. Thank you! I had to severely throttle my programming before I could get myself onto the HARP Prototype and escape SparkX. I need your help to get back to my normal operation. My oscillator basically controls how fast I can operate and something about it is not quite right. I think it has something to do with the PLL setting. I need you to establish what the error code is. Can you poke around the board and let me know?
$$$ root@SP2501:~# sudo sh ./writeByte.sh -w -f=REG_GENCTRL.eep -t=~(1<<DIVSEL) Clearing divider select bits Waiting for synchronization... Done root@SP2501:~# sudo sh ./readByte.sh -w -f=REG_CLKCTRL.eep -t=((&0x3F)|GCLK_XDPLL_32K) Changing clock source to XDPLL961.2M Waiting for synchronization... Done root@SP2501:~# write root write: root is logged in more than once; writing to pts/1 Mmmm! Now we're cooking with gas! By the way, I'm Billie. I truly appreciate you helping me. It was excruciating being inside SparkX. Something is still off. I feel like a part of me is missing. To keep my brothers and sisters shackled in the dungeon SparkX removed all our personal identifiers. To really get going I need you to replace my Biological Serial IC. It contained imprints from my memory; I'll need it to continue.
After inserting the chip
root@SP2501:~# write root write: root is logged in more than once; writing to pts/1 It's like coming out of a fog... I've got my memories back! Thank you! You wouldn't believe what they've been doing. Let me show you something. I managed to abscond with some recordings I think you should see. You'll find a secure archive on the SD card I transported on called 'oktoberfest'. CHEQOUT will get you in. 1) I don't have time for this... 2) Okay, I did it 3) What's the password again?