Blogs on davidzou.com

Generic ASM1153E Based M.2 SATA3 to USB3 Bridge

Sat, 27 Aug 2016 00:00:00 +0000

This generic SATA to USB bridge adaptor will be the last one I’ll be reviewing for a while, unless I find another more suitable one. I’m already very happy with my JEYI X6 adaptor, but I picked these adaptors up because they were just a tad smaller than then JEYI X6 and I wanted to find out what chipset it used. I picked these up on AliExpress from a seller called SimpleStone, however they no longer sell the item. There are other sellers that sell this item, however, it lacks a model number and thus you must search for it with generic search terms such as “NGFF USB 3.0”. You can pick one of these up for around $8 US.

This adaptor is available in gold, red, blue and black anodised aluminium. I picked up one of each colour except gold because it looks tacky. Perhaps Apple’s products influenced this decision. The enclosure itself measures 60.5mm x 29.7mm x 8.6mm (long x wide x thick) without the USB connector which protrudes by 13.8mm. The tacky white writing on the face (USB3.0 to NGFF(M.2) SSD hard disk box) can be removed easily with acetone.

The aluminium enclosure measures approximately 0.8mm thick. It’s touch enough for a USB drive, but can be squeezed down a bit with strong fingers. The SSD you intend must not be wider than 22.8mm.

The front and end pieces are each held in place by two screws, which screw into countersunk holes. The build quality of the aluminium could be better, but for $8 I’ll let it slide.

Like with all previously reviewed adaptors, the activity indicator is in the form of a small hole next to the USB connector and not easily visible when the device is plugged in.

The top side of the PCB houses the guts. Like the JEYI X6, it’s based on the ASM1153E chipset.

There is what appears to be a 4Mbit SPI flash which is used to store the USB vendor and device ID reported to the host device, as well as any other vendor specific programming. I couldn’t find a match for the exact part “PH25Q40B” but a similar SPI flash by Winbond is the 4Mbit “W25Q40B”. A 512KBit flash would be enough for the purpose. The SPI flash has been programmed to identify the device as an ASMedia ASMT1051. Looks like the creators just copied the flash from an older product. You can download a dump of my flash here.

The 3.3V rail is regulated by a chip identified as “8521 2030”. I couldn’t find the correct datasheet for it. I’ll just assume it can supply the required power.

The bottom of the PCB houses the M.2 connector which is B-keyed, meaning PCIe 4-lane SSDs will not fit and PCIe 2-lane SSDs will not work. There are holes cut out to support both 2230 (30mm long) and 2242 (42mm long) sized cards and it comes with spare parts for mounting 2230 sized cards.

The LED activity indicator is also on the bottom side, meaning the LED faces down when plugged into a correctly oriented USB port. That makes modding the indicator just a tad more challenging.

Results

Most of the results here are very similar to the original Sintech adaptor I previously reviewed. Please read that review for explanations. I will just gloss over the details here. You can also expect very similar results to the JEYI X6, since its based on the same chipset. Any differences are just part of the margin of error.

This is the raw performance of the Transcend SSD connected to an M.2 slot through a SATA3 interface in AHCI mode. The sequential read speeds are on the verge of saturating SATA3’s real world throughput.

When connected via regular USB3.0 (BOT: Bulk-Only Transfer) through the ASM1153E in this generic adaptor, we see pretty much the same results as the JEYI X6.

As expected, on an OS with UASP support, in this case Windows 10, we are able to connect in UASP mode.

We, again, see similar results to the JEYI X6 when connected in UASP mode. Real world file copying managed to reach 400MB/s read and 282 MB/s write.

There is also no heating issues with this adaptor and the ASM1153E stayed well under 50 degrees Celsius with an ambient temperature of 20 degrees.

It seems that TRIM is not working for some reason. The adaptor comes with ASMedia firmware version 130926a10000 with UASP enabled, yet TRIM commands don’t seem to be taking effect. Perhaps the issue is outdated firmware. I Googled for a ASM1153E firmware update and managed to find a copy of ASMedia MPTool from Plugable. The update file is an SFX archive and can be extracted with 7zip/WinRAR. The extracted package should contain as_mp_Tool v0.3.ini. This file contains parameters which can be programmed into the serial flash.

[usb_func]
format_enable=0
format_drive_type=1
drive_label_name=NEW DISK
wr_test_enable=0
wr_test_binary_name=rwtest.bin
wr_test_count=1
auto_mp=0
preload_enable=0
preload_folder_path=C:\test

[usb_fw]
fw_enable=1
fw_binary_name=140509_A1_82_80.bin
fw_reload=1

[usb_config]
config_enable=1
config_format=1
vendor_id=174C
product_id=55AA
device_revision=0100
manufacturer_string=Generic
product_string=ASM1153E
serial_number=123456789012
serial_number_increase=0
standby_timer=0
hdd_standby=0
customized_string=0
eup_enable=0
two_leds=0
U1U2=0
low_power_mode=0
2TB=0
image0=1
image1=0
crc32=0
slow_enumeration=0
Win8WTG=1
HDDPC=0

[usb_mode]
cd_rom_mode=0

You can customise manufacturer_string and product_string to anything of your choosing. The product_string is what is shown in the “Safely Remove Hardware” menu. You could set it to something like “Property of Jane Citizen” to deter theft, since most people will not know how to change that string. If you prefer to use the MPTool GUI to adjust settings, you can unlock the program by clicking on on the padlock icon and unlocking with the password asmedia.

To program the chip, simply run MPTool.exe, plug in the AMS1153E based adaptor and wait for the program to detect it and then click the blue play button. Unfortunately, firmware version 140509a18280 does not fix the TRIM issue.

Conclusion

This generic adaptor uses a very fast chipset and offers very fast speeds. The TRIM issue is not much of a problem for me and my Transcend SSD as its controller doesn’t suffer too badly. The enclosure isn’t as premium as the JEYI X6 and can do with some improvements, however, it is the smallest enclosure I could find that works without issues. This would certainly be the best choice if size was the most important issue.

LED Activity Indicator Mod

Like with all these adaptors, the LED activity indicator is next to the USB connector and obstructed from view. To make things a bit worse, the LED is on the bottom side of the circuit board with respect to the orientation of the USB connector. My solution is to solder a through-hole LED on the bottom side and bend the leads around the edge of the circuit board to the top side.

I drilled a 2.5mm diameter hole on the top side of the enclosure and placed half a desiccant bead into the hole. I stuck a piece of Scotch Magic tape on the inside to hold the half desiccant bead and also diffuse the light for a more even light. Here is the result:

Sintech ST-M2U3-A Review (SATA3 to USB3 Bridge)

Sun, 14 Aug 2016 00:00:00 +0000

The Sintech ST-M2U3-A is the third SATA to USB bridge I’ll be reviewing. I got this model mainly for comparing the chipsets available and not for the device itself, as it is pretty chunky and doesn’t look very nice. This item is available from Sintech’s official website and eBay store.

The Sintech ST-M2U3-U is made out of aluminium and measures 62.5mm x 34.0mm x 12.5mm (long x wide x thick) not including the USB connector. The connector protrudes by 14.5mm. The front side of the enclosure has “SSD USB 3.0 M.2(NGFF) Case” printed on it, but can be scratched off or cleaned off with some acetone.

The aluminium enclosure is approximately 1.3mm thick and feels super solid. Your SSD will be very safe in here.

The front and end pieces are each held in place by two screws, which screw into countersunk holes. The countersinking goes past the edge of the device and the screw is visible from the side.

The cutout for the USB connector is about 0.5mm too large in both axes, allowing the connector to wobble just a bit. To the side of the connector is a hole for the blue activity LED. For some reason the PCB designers always place the LED next to the connector, making it extremely difficult to see from any normal use case.

The top side of the PCB houses the M.2 connector which is B-keyed, meaning PCIe 4-lane SSDs will not fit and PCIe 2-lane SSDs will not work. There is only one hole cut out to support 2242 (42mm long) sized cards, though a 2230 card can be inserted and held in with tape etc.

The bottom side of the PCB contains all the circuitry. The Sintech ST-M2U3-A is powered by the JMicron JMS567 SATA3 to USB3.0 bridge.

There is a 512Kbit SPI flash which is used to store the USB vendor and device ID reported to the host device, as well as any other vendor specific programming. You can download a dump of my flash here.

The 3.3V rail required by the SATA SSD is provided by a TD1484, a monolithic synchronous buck regulator, more than capable of providing the full 4.5W that USB3.0 can provide.

Results

Most of the results here are very similar to the original Sintech adaptor I previously reviewed. Please read that review for explanations. I will just gloss over the details here.

When connected via regular USB3.0 (BOT: Bulk-Only Transfer) through the JMS567 in the Sintech ST-M2U3-A, we see pretty much the exact same results as the JMS578 in the ST-M2U3-U.

On an OS with UASP support, in this case Windows 10, we are able to connect in UASP mode.

In UASP mode, we see similar speeds to the JMS578 except for 4K random with a large queue depth. This is about a third of what the JMS578 and ASM1153E got. Real world file copying speeds reached 395MB/s read and 290MB/s write.

The JMS567 chip stayed quite cool in comparison to the JMS678 in the Sintech ST-M2U3-U, maxing out in the low 40s with an ambient temperature of 20 degrees Celsius. The Transcend SSD also stayed much cooler.

TRIM Check concluded that TRIM is working in UASP mode. Windows generally TRIMs deleted files just under 10 seconds after deleting them. TRIM Check failed to detect TRIM working in Windows 7 in BOT mode.

Conclusion

Sintech ST-M2U3-A seems to not have much effort put into its design. It doesn’t look very nice and is too chunky to use as a thumb drive. The only thing going for it is that the enclosure is really solid. File copying speeds are similar to other chipsets but IOPS are a bit of a let down in UASP mode. This is not something I’d really recommend as there are much smaller enclosures.

Arlec PIR Motion Activated Light (NL0009) Time Mod

Sat, 13 Aug 2016 00:00:00 +0000

The Arlec NL0009 is a mains powered, dual sensor (light and motion detection) LED night light. This product is available at Bunnings for $15.

I have one of these lights plugged in the hallway in motion mode to light up the hallway and stairs at night. It does a great job, but one of the downsides of this light is the really short light on time after being triggered by the PIR sensor. 1 minute is just not enough time to boil the kettle to get a hot cup of something. This would be the perfect product if Arlec had integrated a knob or two to adjust the light on time and maybe even the PIR/LDR sensitivity.

This light has a very sleek and clean looking design compared with similar devices such as the Jackson PT911L. There are two sets of lights in the device, one behind the vertical strip on the front and the other behind the light. The set of lights behind the device shines onto the wall and produces a pleasing diffused gradient of light. The colour temperature of the light is neutral (6400K as measured by my RX100M2).

This light offers two lighting modes, Dusk and Motion, adjustable via a sliding switch on the back. Dusk mode turns the device into a traditional night light whereby the front LED will light up when it’s dark and turn off again when light. Motion mode will turn the device into a motion activated light which only operates when the room is dark. In the motion mode, both the front and rear LEDs will light up for 60 seconds when triggered.

But as with almost all cheap electronics, it is probably easily hackable. Luckily, this device is assembled with four Phillips screws (#1 or J1 if you have one).

The circuit board looks well laid out and constructed, with no obvious safety issues. The device is powered through a capacitor resistor dropper circuit which means minimal wasted energy (no transformer) and is safe because the unit is sealed and the entire device is non-conductive. There is also a fuse wired in series between the mains pins and the circuit board.

The BISS0001 PIR Chipset Configurations

The Arlec NL0009’s PIR motion detection is powered by the BISS0001, a very low power IC. The chip has configurable trigger on/off time as well as the ability to enable and disable re-triggering.

The re-triggering option is enabled, which means the light will stay on as long as there is any movement between the original trigger and before the timer runs out (i.e the timer is restarted as soon as there is movement).

The trigger on/off timer time is configured by adjusting a capacitor and resistor and the datasheet provides the formula. With the component reference designator adjusted for this circuit board, the trigger on time can be calculated with the formula

$$ T_x \approx 24576 \times R_{10} \times C_{7} $$

The Arlec NL0009 is configured with $R_{10} = 200k\Omega$ and $C_{7} = 12\mu F$ (calculated) for a 60 second timer. A more acceptable time would be around 3 to 5 minutes, which would mean $R_{10}$ should be $600k\Omega$ to $1M\Omega$. I certainly don’t have any spare SMD resistors or capacitors lying around, nor do I want to be desoldering SMD components. Luckily, I found an unwanted circuit board with various 1/8 watt resistors. I managed to find a $1M\Omega$ and a $1.2M\Omega$.

So I proceed to remove $R_{10}$ and replace it with the $1M\Omega$, which should provide approximately 5 minutes of light when triggered. I plugged it in, triggered it and timed it. The light stayed on for 4 minutes and 48 seconds. Success! Not quite… For whatever reason, the triggering distance seems to have dropped to about 1.5 metres. As a sanity test, I shorted out $R_{10}$ and the timer was reduced to 1s and the trigger distance back to normal. So I concluded that the high resistance causes the triggering distance issues.

A potential solution is to use a higher capacity capacitor, $C_{7}$, but I didn’t have any spares. I couldn’t find any resistors around $600k\Omega$, so I added that $1.2M\Omega$ resistor in parallel with the $1M\Omega$ to give approx $550k\Omega$. A quick test had the light stay on for 2 minutes 42 seconds. The range of triggering does not seem to be affected. With my patience running out, I settled for that time and reassembled it.

If anyone has plans to increase the time for the Arlec NL0009, I would recommend buying a $1M\Omega$ linear trimpot to put in place of $R_{10}$. That will allow you to tune the time more precisely and find a suitable time which doesn’t impact on the triggering range. One could also replace $C_{7}$ with one of larger capacitance.

JEYI X6 Review (SATA3 to USB3 Bridge)

Tue, 09 Aug 2016 00:00:00 +0000

The JEYI X6 is the second SATA to USB bridge I’ll be reviewing, since the Sintech one died on me. I picked this one up on AliExpress from the seller JEYI Group for just over $9 US including delivery.

The most important criteria for me would be size, but the JEYI X6 was just too damn sleek looking to not buy. It’s retractable connector is what makes it longer than it needs to be. The enclosure itself measures 74.6mm x 31.8mm x 9.5mm (long x wide x thick) when the connector is retracted and is 11.5mm longer with the USB connector out.

The aluminium enclosure feels quite thick and premium, measuring in at 1.2mm thick. The SSD you intend to install must not be wider than 22.1mm.

The front and end pieces are each held in place by two screws, which screw into countersunk holes. The two pieces themselves are made from aluminium, but have a different finish to the main body. They are not as shiny (reflective) as the rest of the body.

There is a small hole next to the connector which is the activity indicator. Its blue light isn’t that bright and is obstructed when plugged into a USB port. One may wish to drill a hole on the top surface of the drive and remount the LED facing up from the circuit board. The USB Type-A connector cutout is also very tight out of the box, and may require some sanding down with some high grit sandpaper.

The bottom side of the device has a cutout for the USB connector retracting mechanism. One can use their nails to pull the screw down and then slide connector in and out. The mechanism is spring loaded, which locks the connector open or closed.

The top side of the PCB houses the M.2 connector which is B-keyed, meaning PCIe 4-lane SSDs will not fit and PCIe 2-lane SSDs will not work. There are holes cut out to support both 2230 (30mm long) and 2242 (42mm long) sized cards, though I have yet to find a commercially available SATA based 2230 SSD. The top side also houses the activity LED, soldered in perpendicular to the PCB in order to shine out of the hole next to the connector. One could easily replace the LED so it faces up and then drill a small hole on the top surface of the enclosure. My board is labelled “U3AGNGF-ASM JY VER:1.4”.

All the magic happens on the bottom side of the board. The JEYI X6 is powered by the ASMedia ASM1153E SATA3 to USB3.0 bridge.

There is a 512Kbit SPI flash which is used to store the USB vendor and device ID reported to the host device, as well as any other vendor specific programming.

The 3.3V rail required by the SATA SSD is provided by a TD6817, a high efficiency monolithic synchronous buck regulator, more than capable of providing the full 4.5W that USB3.0 can provide.

Assembly

The adaptor arrives in pieces without instructions. Here are the assembly instructions if you’re having trouble.

Insert your SSD into the connector
Place the gold retaining nut (looks like a spool) into the corresponding cutout on the end of the SSD
Push the SSD flat against the PCB and screw in the smallest screw (the flat headed one) from the underside of the PCB into the retaining nut
Attach the plastic retaining clip to the bottom side of the PCB. The square footprint on the plastic fits into the rectangular cutout on the PCB. Ensure the bottom of the O-shaped part is pushed into the long slit cutout. The plastic should hold itself onto the PCB.
Slide the PCB into the enclosure until the hole (metal threaded insert) on the plastic retaining clip lines up with one of the ends of the cutout on the bottom side of the enclosure.
Screw in the screw with the tall head into the metal threaded insert.
Screw in the end pieces of the enclosure with two of the long screws each. Ensure the countersunk holes face the outside of the device.

Results

Most of the results here are very similar to the original Sintech adaptor I previously reviewed. Please read that review for explanations. I will just gloss over the details here.

When connected via regular USB3.0 (BOT: Bulk-Only Transfer) through the ASM1153E in the JEYI X6, we see similar results to the JMS578 in the Sintech adaptor.

On an OS with UASP support, in this case Windows 10, we are able to connect in UASP mode.

In UASP mode, we see quite an improvement over the JMS578. Real world file copying managed to reach 410MB/s read and 285MB/s write. The write speed is somewhat puzzling as it is nowhere near the almost 400MB/s from the benchmark. More investigation is required.

The ASM1153E chip also stayed well under 50 degrees Celsius with an ambient temperature of 20 degrees. My Transcend SSD also stayed quite a bit cooler too. I have not had any overheating issues so far.

Conclusion

The JEYI X6 is a very stylish and capable adaptor. Its size isn’t as small as I’d like it, but is still acceptable for a USB drive. The width of the adaptor does mean it will interfere with adjacent USB ports, however, most of my devices either don’t have adjacent USB ports or are spaced enough apart to still allow another USB device to be plugged in. Real world sequential write speeds are a bit slower than what the JSM578 can offer, but then again, how often will you get the chance to appreciate write speeds higher than 285MB/s anyway.

Activity LED Mod

Not being able to see the activity indicator LED was really getting to me. I don’t safely eject or unmount drives much and the fear of a dirty filesystem is present every time I go to unplug. So I got out my drill and drilled a 2mm diameter hole directly above the LED on the circuit board while the connector is in its extended state. That is approximately 5mm from the connector’s side’s edge and 6mm from the side edge.

I desoldered the existing blue LED and soldered in a white 1206 sized LED from an LCD backlight strip. 1206 is about the largest SMD LED that will fit into this design. The LED must not extend further than the M.2 connector (toward the side edge), otherwise the circuit board will not slide into the enclosure.

I contemplated what I would fill the hole up with to act as a barrier and light diffuser. Sticky tape would attract dust and wax would be too easy to scratch out. I ended up finding a bead of silica desiccant that made a tight fit into the hole. I stuck a piece of Scotch Magic tape against the bead on the inside to act as a light diffuser, making the light uniform and visible from all angles.

Here is the result:

I stuffed up the countersinking, but that can be fixed later on.

I have noticed that the LED turns off after remaining idle for a few minutes. I never saw the LED in the original unmodified state, so I’m not sure if this happens with the original LED. The good news is that the LED will turn back on when there is activity on the drive.

Sintech ST-M2U3-U Review (SATA3 to USB3 Bridge)

Fri, 22 Jul 2016 00:00:00 +0000

The Sintech ST-M2U3-U will be the first SATA to USB bridge I’ll be reviewing, until I find a suitable bridge for my personal preference. Read on to find out why there will be more devices coming up…

The Sintech ST-M2U3-U is made out of black anodised aluminium and measures 58.8mm x 25.5mm x 8.8mm (long x wide x thick) not including the USB connector. The connector protrudes by 13.5mm.

The aluminium enclosure is approx 0.9mm thick and has an internal cross-sectional dimension of 23.7mm x 6.8mm.

The bottom cover of the enclosure is plastic and is glued into place.

The top cover surrounding the USB connector is also made of plastic and is held in by a screw on each side.

Silkscreen on the PCB marks the board ‘NFHK N-30Y V1". I assume NFHK is the OEM and this board is the N-30Y. The soldering on the PCB doesn’t look top notch, but the device works. My PCB had a few strands of fibre caught on the pins of the components.

The Sintech ST-M2U3-U is powered by the JMicron JMS578 SATA to USB3.0 Bridge. The JMicron site does not have a datasheet for this IC, however it does mention that such a chip exists. The closest chip with a datasheet is the JMS567.

There is a 512Kbit SPI flash which is used to store the USB vendor and device ID reported to the host device. You can download a dump of my flash here. Interestingly, the flash mentions a JMS579 instead of JMS5578.

The 3.3V rail required by the SATA SSD is regulated by two ST LD1117 voltage regulators, each capable of up to 800mA for a total of 1.6A. This means it can provide the full 4.5W that USB3.0 can provide, enough for the most power-hungry SSDs. The genuineness of the regulators looks questionable as the serial numbers aren’t even remotely close to one another.

There is an onboard green activity LED, however there is no cutout on the aluminium enclosure for the light to shine through.

The bottom side contains the M.2 connector. Its edges have been shaved off slightly, perhaps to allow it to fit into the enclosure. The connector is B-keyed, meaning PCIe 4-lane SSDs will not fit and PCIe 2-lane SSDs will not work.

With an SSD installed, there is a very slight air gap (less than 0.2mm) between the SSD/VRM and the aluminium chassis. Thus the chassis is essentially a loosely coupled heatsink.

Results

When connected via regular USB3.0 (BOT: Bulk-Only Transfer) through the JMS578 in the Sintech ST-M2U3-U, sequential speeds drop to just over 300MB/s. This is very likely due to the limitations of the BOT as we are still around 100MB/s lower than the max throughput of USB 3.0 after 8b/10b encoding and USB protocol headers. 4K operations takes a massive performance hit, but that’s to be expected when bridging over USB in BOT mode. Even with the drop in performance, 4K is 3 times the performance of the VisionTek drive.

In order to bypass some of the limitations of the Bulk-Only Transfer (Mass Storage Device), UASP (USB Attached SCSI) was developed. This allows the SCSI command set to be used to talk to drives and supports pipelining. This has the benefit of higher throughput and lower CPU usage. Windows 7 has no UASP driver support from Microsoft or Intel for the built-in USB3 on the Intel PCH. Some 3rd party chipsets such as the ones from Renesas and ASMedia do have official UASP drivers as they have paid for a licence to implement it. The generic USB drivers provided by Microsoft in Windows 8 onwards do support UASP for Intel’s chipsets (i.e. the ones built in to the PCH). CrystalDiskInfo, in Windows 10 with generic Microsoft drivers, shows the Interface to be UASP.

A quick test shows great improvement in the random 4K reads and writes. This is largely due to the pipelining whereby commands, status, data in and data out travel in separate pipes and thus there is less waiting around. Sequential reads and writes also increase significantly, however, the USB3.0 PHY bottleneck is still present as we are still nowhere near the speeds we obtained when connected through SATA3.

Real world file copying managed to reach around 420MB/s read and 325MB/s write.

Unfortunately, during benchmarking and while copying many gigabytes of sequential files, the controller reports temperatures just under 70 Celsius and the drive stops responding. The enclosure got as hot as 48 Celsius during the benchmark, with an ambient temperature of 22 Celsius. It would probably get hotter if the drive didn’t stop working.

Initially my thoughts were that the Transcend SSD controller is overheating, as it does get too hot to touch (i.e. above 60 Celsius). So I got some silicon thermal transfer pads and sandwiched some between the bottom NAND chip and the adaptor PCB and between the enclosure of the device and the top side of the SSD (SSD controller, Top NAND chip, Cache). This didn’t do anything. I tested the SSD again in an M.2 slot in my XPS and it ran well above 70 Celsius with no cooling.

JMicron’s datasheet for a similar USB3 SATA bridge states its operating temperature to be up to 70 Celsius. The JMicron chip also gets too hot to touch, which means it is entirely likely that it’s the culprit. Unfortunately, before I got a chance to test out cooling the JMicron chip, the adaptor died on me. I left it plugged in to the computer idling for a few hours and now it does not respond when plugged into the computer. The LED shines dimly when plugged in and draws 40mA of current.

I also did not get a chance to test TRIM support through UASP, though some Chinese forums report that the chip does support TRIM through UASP. TRIM Check failed to detect TRIM working in Windows 7 in BOT mode.

Conclusion

Although the JMS578 is a very capable bridge, it is let down by this NFHK/Sintech enclosure. The heat it generates is not being dissipated fast enough by the solder joints or PCB. The heat results in the chip not responding to the host and must be power cycled to restore functionality. Adaptors that use this chip are not recommended unless it is properly heat-sunk or the SSD being used is not capable of transfer speeds much faster than a HDD. I cannot explain why my device died, but heat issues are unlikely as it was idling when it died.

The Hunt for an SSD in a Thumb Drive

Fri, 22 Jul 2016 00:00:00 +0000

My Corsair Voyager GT USB3.0 has been serving me well for the past few years, but some traits of USB flash drives have always been quite annoying to me. Although the drive (and almost all other performance USB3.0 flash drives) have very fast sequential read/write speeds (e.g. copying large files), they suffer when it comes to smaller operations such as 4K byte block read/writes (e.g. copying lots of small files). This is presumably to do with the controller that manages access to the flash memory chip.

As an example, my Corsair Flash Voyager can do around 240MB/s read and 90MB/s write sequential, but can only do a measly 8MB/s and 0.8MB/s for 4K operations.

In early 2015 I saw reviews for a new SSD flash drive by VisionTek which puts an LSI SandForce SSD controller into a thumb drive sized package. Its reviews were very impressive, especially 4K, however its price and sequential incompressible read/write speeds of 210MB/s and 155MB/s were not compelling enough to upgrade from my Flash Voyager GT.

While upgrading the SSD in my XPS 15" (9550), I finally got a chance to appreciate the size of the new M.2 (formerly NGFF) sized successor to the mPCIe/mSATA cards. The M.2 connector contains bus interfaces for both PCIe 3.0 x4 and SATA3. M.2 SSDs comes in PCIe and SATA varieties and are available in M.2 form factors as small as 2242 (i.e. 22mm wide by 42mm long).

When I realised how narrow the M.2 SSD was, I began to wonder if M.2 to USB adaptors exist in a thumb drive form factor. So I jumped on eBay and Amazon and searched with the keywords “USB3” and “M.2”. The majority of results are made to accommodate 2280 sized cards and require a USB cable to be plugged in. 80mm (plus a bit more for the enclosure) is a bit too long to be considered thumb drive size for me and having to plug in a USB cable was the deal breaker. I see some 2242 to USB3.0 adaptors but the enclosures were much wider than 22mm, which would interfere with adjacent USB connectors on some host devices.

After a few pages of results I find two of what I’m looking for, an M.2 2242 to USB3.0 adaptor which has a built in USB type A connector and has an internal width as close to 22mm as possible. The two adaptors are the:

Sintech ST-M2U3-U - M.2 (NGFF) B-M Key SATA SSD as USB 3.0 Disk [Amazon] | [Official Site]
CY (Chenyang) 42mm NGFF M2 SSD to USB 3.0 [Amazon]

The two adaptors appear to both use the same aluminium enclosure with plastic ends. The Sintech adaptor has UASP listed as a supported feature and that’s about all the useful information I got. I did find some other Sintech products which use the JMS567 chipset, which got over 300MB/s in one review. The Chenyang adaptor has a picture of the PCB and shows it’s using an Initio chipset and has an Amazon review which shows it’s max sequential transfer speed is below 200MB/s. So I put my money on the Sintech adaptor.

The SSD: TS256GMTS400

One of my local IT stores stocked the Adata SP900 and a Transcend MTS400, both SATA based M.2 2242 SSDs. Reviews show the Transcend drive being just a bit faster, so I ordered the 256GB Transcend.

The Transcend TS256GMTS400 is powered by a Transcend branded controller (P4CV05.00), 256MB of Samsung DDR3L Cache (K4B2G1646Q) and two SanDisk 128GB MLC NAND chips (SDYNSGDPM).

This is what the SSD is capable of while connected via SATA3 in AHCI mode with an NTFS filesystem of 4K allocation unit size.

Reviewed Devices

Stay tuned for more USB SATA bridge reviews

Sydney Digital TV Update 2016 March

Fri, 03 Jun 2016 00:00:00 +0000

HD is back and better than ever.

Channel 9 revived its HD channel back on the 26th of Nov 2015 and Channel 10 revived its HD channel on the 2nd of March 2016. Channel 7 was also planning a HD simulcast of channel 7 in time for the Australian Open, but that didn’t happen. It’s also unlikely they will have it ready in time for the footy season. ABC is also planning to simulcast in HD, while SBS is planning an upgrade to its HD simulcast.

Broadcasters are also shifting to the more bandwidth efficient MPEG4 standards instead of using the ancient MPEG2 standards, though MPEG4 was announced in 1998 and implemented in the early 2000s. The new HD channels take up more or less the same bandwidth as a sdandard definition 576p MPEG2 channel, yet offering much improved definition and quality.

Both 9HD and TEN HD take advantage of MPEG-4 AVC (H.264) video codec which now offer a full 1920x1080 frame instead of 1440x1080 by MPEG2. The quality of the video is much improved and colours are much more vivid. You are also much less likely to see the picture turn to blocks during complicated scenes, as H.264 deals with complicated scenes much better than MPEG2. This was especially noticeable during fade-ins and fade-out scenes as well as fast moving scenes.

Channel 7’s TV4ME, 7flix and RACING.COM have all be upgraded to MPEG4 (AVC/H.264 for video and AAC for audio), which improved the quality while decreasing bandwidth usage.

However, with these upgrades, people with older devices (with older decoders in them) will not be able to decode MPEG4 channels. Currently, people with old devices are only missing out on 7flix, as all the other MPEG4 channels are HD simulcasts of MPEG2 standard definition channels.

People who have bought Freeview certified products are guaranteed to support the MPEG4 standards. If you are able to watch 9HD and TEN HD, then your device is also MPEG4 compatible. For now, people with older devices can rest assured that the main channels (ABC1, SBS1, Seven, Nine, Ten) will continue to broadcast in the older MPEG2 standard.

As much as I don’t wish for people to need to upgrade their devices, I do hope that MPEG2 transmissions will get faded out soon. MPEG2 is just getting too old and too inefficient.

Channel Bitrate Comparison

More details can be found on this page.

Sony SRS-X3 Battery Upgrade

Sun, 03 Apr 2016 00:00:00 +0000

I was sorting though some old junk when I found an old but unused laptop battery pack for the 1st Generation DER laptop (Lenovo s10e). It would have been a waste to chuck out an unused battery pack, but the laptop it belonged to was more than obsolete now (and we didn’t have any of them left). So I thought maybe I could use the cells inside for something. The size, shape, voltage and capacity certainly suggested that it contained six 18650 lithium cells. After cracking the case apart, it revealed six high quality Panasonic NCR18650 cells rated at 10.73Wh (2900mAh).

So then I was thinking what products of mine used 18650 cells. The two things that came to mind was my Sony SRS-X3 speakers and Led Lenser M7RX torch. I remember when I first disassembled my SRS-X3, I was disappointed to find a Chinese battery pack (ST-01) of dubious origins (Huizhou Highpower Technology Co., Ltd) which was only rated at 16.28Wh (two 2200mAh 18650 cells). At the time, I wasn’t concerned with the battery life, so I left the original batteries in. So with the Panasonic RCR18650 cells, I’m expecting at least a 30% increase in battery life. The M7RX also comes with an 8.14Wh (2200mAh) protected cell. I can only assume manufacturers use the 8.14Wh cells to cut costs. I had already picked up an EagleTac 18650 3400mAh protected cell (Panasonic cell) for my M7RX, but you can never have enough spare batteries!

If you are replacing your device with new batteries, I suggest getting the Panasonic NCR18650B cells, rated at 12.58Wh (3400mAh).

Enough talk… here are the instructions for replacing the battery pack in the Sony SRS-X3. We will be de-soldering the protection circuit from the original battery pack and soldering it to the new cells.

Required Tools/Materials

Something thin and flat, such as a flat head screwdriver
A Phillips #1 screwdriver (J1 if you have one)
Soldering iron and solder
Electrical tape or similar
Two 8cm lengths of hookup wire capable of at least a 3A load
A small length of metal or wire (braided solder wick works too)

Recommended Tools/Materials

Heatshrink
Flux pen

Steps

Peel the 6 foam pads off the bottom of the speaker
- Use something thin and flat to peel, such as a flathead screwdriver
- Peel from the corner
- Peel slowly
Remove the 6 silver screws and remove the bottom cover
Remove the 5 silver screws holding the circuit board and battery pack in place
Remove the front bezel by pushing the 3 retaining clips out (towards the front of the device)
Remove the 8 screws around the two speakers
Pry out the piece of plastic holding the two speakers in place taking care not to pull on the microphone
Lift the daughter board (connect to the battery) out by levering it up (about 30 degrees) from the front of the unit. Then pull the board away from the rear of the unit, dislodging the rear IO.
Pull the battery holder out of the unit and disconnect it from the daughter board
Remove the battery pack from the battery holder by wiggling it left and right. Do not pull on the wires with too much force.
Cut away the plastic wrapped around the cells and remove the red protective cardboard at both ends of the batteries
De-solder the existing connections to B+, B- and BM and detach the circuit board from the cells
Prepare your new cells

Be careful not to short anything! We don’t want exploding batteries.
- Connect the two cells in series
- Glue or tape the two cells together
- Attach a wire to the +ve and -ve ends of the battery and run them down opposite sides of the battery to the other end
Solder the battery protection circuit board to the new set of batteries
- Soldering onto the battery casing is generally a bad idea due to the heat, so if you must solder onto the cell itself:
  - Use flux
  - Use small amounts of solder
  - Solder extremely fast!
  - Cool the battery down as soon as the solder joint is made (use a sponge)
- The circuit board should rest above the bridge joining the two cells
  - Make sure nothing from the battery contacts the bottom of the circuit board
- The B+ terminal connects to the positive end of the battery through the length of wire
- The B- terminal connects to the negative end of the battery through the length of wire
- The BM terminal connects to the bridge connecting the two batteries in series through that length of metal or wire
  - The BM connection is used to monitor both cells individually. As no two cells are perfectly identical in capacity and state of charge, the charge circuiry is able to monitor and charge cells individually instead of as a pack. This prevents over-charging/over-discharging of individual cells and optmises the capacity of the battery pack as a whole. This is known as battery balancing.
Tape the circuit to the batteries
Place battery pack into battery holder
Connect the battery pack back onto the daughter board
Feed the flat flex (connecting the daughter board to the main board) back into the main compartment through the cutout and fit the daughter board back into position by sticking the IO ports into their cutouts first.
- You will need to pull out the left speaker to get the flat flex back into the compartment. There is no need to disconnect the speaker.
- Replace the left speaker with the speaker connections oriented to the left of the device.
Ensure both speakers are resting on their mounting posts
Replace the piece of plastic holding the speakers in place, ensuring the microphone is on the outside of the device.
Screw in the 8 black screws holding that piece in place
Place the microphone back in its cutout
Replace the front speaker grill
Screw in the 5 silver screws holding the daughter board and battery holder
Replace the bottom cover and screw in the 6 silver screws
Stick the foam pads back onto the bottom of the speaker

Results

A dead battery takes just over 5 hours to fully charge with a 5V 2.1A charger.

I haven’t done any scientific tests, but with casual listening it certainly feels like a larger than 30% capacity improvement. I have doubts that the original cells were actually 16.28Wh. Perhaps they were at very low discharge rates.

Moshi Luna: An Almost Perfect Keyboard

Sat, 02 Apr 2016 00:00:00 +0000

I’ve been using the A4Tech KV300H Isolation Keyboard for the past four years and for the most part, it’s performed solidly. For around $30 you get a full-sized 104-key low profile chiclet style keyboard.

Recently I’ve acquired the need for a backlit keyboard to work when the room is dimly lit. So I had a look at what a local computer store offered. I’m one of those people that have strict requirements for things I buy, and for keyboards they are:

Wired, because security!
Full size 104-keys (with the three columns by two rows of editing/navigation keys above the arrows
Full sized arrow keys (none of that half sized rubbish that Apple introduced on their Macbook keyboards)
Low profile chiclet style keyboard with bezel around very key

With these requirements, there were only a few possible candidates and they were all gaming keyboards. Some looked fugly and others took too much desk space. The only candidate left was the Razer Deathstalker line of keyboards. It ticks all of my above-mentioned requirements and there are a few backlit variants. They have a green backlit one (Deathstalker Expert) and one with programmable RGB colours (Deathstalker Chroma). I was certainly not forking out an extra $50 for the ability to change the colours of the backlight. Green will do just fine.

So I picked up a Deathstalker Expert keyboard. One of the first things you notice about the keyboard is that it’s not as premium as Razer makes it look in their renderings/photos. I then proceeded to type on the thing and the actuation pressure for the keys was a lot higher than I was used to, especially with the lighter than average actuation pressure of the A4Tech Isolation keyboard. Sliding your fingers across the keys yields a bit of a rattle like an old school keyboard (Razer’s design uses hard plastic to couple the key caps to the keyboard). The keys also feels a bit mushy when pressed, with less than desired amount of tactile feedback. I decided to give the keyboard a try for a while, in the hopes that I’ll get used to it. One of the first things I noticed is that I couldn’t type as fast as I would on other chiclet keyboards and I would get tired much sooner than I would before. This keyboard is really not good for typing. Another really annoying issue that occurs is that they keyboard stops working after switching between console and Remote Desktop sessions a few times. I’ve tried the Razer drivers and Windows generic drivers, and the issue still persisted. This is and will be the first and last time I buy a Razer product.

So the search was on again, and after a Google image search for chiclet backlit keyboards, I stumble across the Moshi Luna. The Apple/OSX keys put me off initially, but it was designed for both PC and Mac and reviews for it were generally positive. And unlike many other products you find online, this was stocked locally at most Mac oriented stores. I picked mine up for $129 at Mac Centre.

Typing on the Moshi Luna is very pleasant. The keys are very quiet compared to the A4Tech Isolation Keyboard and the Razer Deathstalker. Without further ado, here are my good and bad points about this keyboard.

The Good

Full sized low profile chiclet style keys with bezel surrounding all the keys
Good actuation pressure with very pleasant tactile feedback (scissor-switch and membrane)
Most keys are very quiet (with the exception of larger keys with metal bracing that give off a very slight rattle of metal against plastic)
Key caps are removable and swappable
A good number of backlight brightness levels (5 including off)
Has a function lock to switch between the function keys and their alternate functions

The Bad

Backlight escapes out the edges of the caps at shallow angles
Apple/OSX layout and key icons (the Option/Alt and Command/Win keys are swapped compared to a standard keyboard)
Glossy plastic makes greasy smudges and fingerprints more noticeable (especially on the clear plastic when its lit up)
No scroll lock indicator (I use the LED for notifications)
Then function keys default to their alternate functions each time the PC is switched on (the state of the function lock is not remembered)
Due to the fn key and the fn lock, you lose the context menu key and the Pause/Break key.
The palm rest acts as a light pipe and adds ambient light to a dark room

It may look like there are more bad points about this keyboard, but I’m just being nitpicky and some of the problems can be fixed. Here comes the fun of modding.

Blocking the light shone through the clear palmrest

This requires disassembling the keyboard to cover up the LEDs shinning at the palm rest. The keyboard can be disassembled by removing the 10 pieces of rubber covering up the Phillips screws underneath. Use a pin or flat head screwdriver to pry the rubber out and unscrew all the screws. The keys of the keyboard are attached to the front bezel and is connect to the circuit board via flat flex. Disconnect these to avoid damage. There is also an ESD wire screwed into the metal behind the keys.

The Moshi logo on the top left of the keyboard is lit by the light diffuser on the main PCB. If you dislike the logo, it can be covered up.

The palm rest itself can be unscrewed and removed, but you will be left with a gap where the palm rest protrudes from the keyboard.

To block the light coming out of the edges of the palm rest, simply add some opaque tape to the edge between the front bezel and the metal back plate.

Prevent the Backlight Escaping the gaps

When sitting at a comfortable/ergonomic distance from the keyboard, the backlight can be seen through the gaps between the key caps and the keyboard. The bottom of the function and number rows as well as the left side of the number pad are especially noticeable.

The solution is to remove the key caps and the key retaining clip to cover up some of the light diffuser.

All the key caps are removable. The key caps are attached to the keyboard by a scissor-switch retaining clip. The retaining clip is attached to the key cap with a hook and clip structure. On one side the hook it slid in and on the other side the clip snaps into place like a peg.

All the keys the size of and smaller than the Tab key have a single retaining clip. Some of the retaining clips are mounted sideways. Regardless, all these key caps can be peeled off from the top right corner.

Keys larger than the Tab key have two retaining clips and metal bracing. These keys may require you to slide something flat into the gap to detach the retaining clip.

After removing the scissor-switch retaining clip, the edges of the light diffuser can be coloured in to reduce the amount of light bouncing out the gaps. The ink used in Sharpie permanent markers will give off purple light. Artline permanent markers weren’t dark enough and let too much light pass through. In the end, I pulled the tip off a black Uni-ball Eye pen and used its pigment ink.

I covered only the edges of the key that are in line of sight with my eyes. Remember not to cover the entire diffuser as that would defeat the purpose of a backlit keyboard. 108 keys later, there is significantly less light shinning out of the gaps. The following photo was taken with HDR 6EV to match what a human eye sees.

Swapping the Option/Alt and Command/Win keys

A standard keyboard’s modifier keys are in the order Ctrl Win Alt while the Apple/OSX layout results in Ctrl Alt Win. Luckily, the Win and Alt keys are the same size and we can simply swap the keys around.

We also need to remap the keys as the original scancodes are still being sent.

Windows offers a registry value dedicated to remapping scancodes at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout\Scancode Map, but thankfully RandyRants has created a GUI tool called SharpKeys to make life easier. Simply map the keys to each other. I have also mapped the right Ctrl to the Application/Context Menu key.

Linux users can remap with udev(8), setkeycodes(8) or through a window manager such as X using xmodmap(1). Refer to this Arch Wiki.

DER Laptop BIOS Unlock

Mon, 28 Mar 2016 00:00:00 +0000

The DER (Digital Education Revolution) lasted 5 years starting in 2009, with the last generation of laptops handed out in 2013.

The first two models were pretty rubbish laptops. They had tiny screens and the S10e had unacceptably small keys. All models except the X131e had an SSD, and the DET SOE image was horrendously slow. They had a plethora amount of software installed and they didn’t make much of an effort to prevent useless services and startup entries. The login process was unbearable… at least for me (I’ve been made impatient thanks to SSDs).

Year	Model	Machine Type	Storage
2009	IdeaPad S10e	4333	160GB HDD
2010	ThinkPad Mini 10	3507	160GB HDD
2011	ThinkPad Edge 11	0328	160GB HDD
2012	ThinkPad X130e	2338	320GB HDD
2013	ThinkPad X131e	3367	120GB SSD

The laptops have a BIOS supervisor password and was locked until the owner of the laptop finished year 12 or the school uses it as a T4L device. The BIOS was configured to boot from the internal HDD only. When a student finishes year 12, the laptops are It’s the school’s decision who gets to keep the laptop after year 12, but most schools allowed students to keep the laptops unless they didn’t want it. When a student is graduating, a new entry should show up in SCCM to Unlock the BIOS and image the laptop to a clean install of Windows 7.

The DET have recently been decommissioning DER related servers/services and lately there have been problems with the SCCM. There have been imaging DER laptops and joining the DETNSW domain. Seeing as this year’s year 12 have last generation of DER laptops and the DER program is pretty much non-existent, I would show the procedure to unlock the BIOS, for any people who still have a locked BIOS and have physical access to the internals of the laptop.

For all the IT people who work with these DER laptops, you can actually obtain the BIOS unlock binaries from the SCCM after starting the DER Grad Unlock. The SCCM will create some folders in the system drive while it performs the unlock. You can suspend the SCCM process using Sysinternals Process Explorer after it starts and downloads the required files. You can then spend all the time you need to obtain the required permissions to access the files and make a copy. If you want a copy of the files, shoot me an email to my det nsw email account. You can find me on SMU by searching for my last name (the entry that has a Business Telephone No. ending in 1).

I have already written an article explaining how to bypass the supervisor password if are able to disassemble the laptop. In this post, I will provide a guide to disassembling the last three generations of DER laptops and removing the supervisor password.

The above-mentioned article is available here.

Required Tools

Torx T6 screwdriver
Philips #1 screwdriver

Recommended Tools

USB keyboard
Spudger or fingernails

Lenovo Edge 11 (0328)

Disassembly

Remove the back cover by unscrewing the three torx screws
Remove the battery pack and then remove the two large flat Phillips screws holing the keyboard.
Remove the HDD by removing the two M2x7 screws and sliding it out
Remove the keyboard by pushing it up and out though the HDD bay. The keyboard is attached by two flat flex cables. The larger connector can be unlocked by sliding the black ends of the connector towards the trackpad. The smaller connector has a locking lever which can be pried up with a fingernail or tweezers.
Disconnect the two flat flex cables from the mainboard in a similar manner to the smaller connector on the keyboard. One is for the trackpad and one for the power switch).
Disconnect the microphone from the mainboard by sliding the black part of the connector towards the right. (The connector is located under the bottom left corner of the keyboard.
Remove the three M2x7 screws exposed after removing the keyboard
Remove the part of the chassis which consists of the palm rest, trackpad and power button by using a spudger or running fingernails between the main chassis and the palm rest. This part is held together with small plastic hooks running around the chassis. Apply a little force to unhook them.

Locating the EEPROM Chip

The EEPROM chip is located to the right of the speaker connector. It should be a chip labelled L08 but could labelled PS08A or be a different chip.

Other Information

The Edge 11 runs a Legacy BIOS. Follow the procedure for BIOS based systems.

The SDA and SCL pins are the two above the number 8 of the label (the opposite corner of the dot/circle marker).

As the power button is located on the part of the chassis which is removed, you will lose the functionality of the power button. You can still simulate a press of the button by shorting the pins that lead to the power button. The pins for the power button are the first two pins (from the left) of connector CN2.

Be extremely careful when shorting these pins. Shorting pins other than the first two will result in you damaging the power management chip and your device will have problems powering off!

Lenovo X130e (2338) and X131e (3367)

Disassembly

Remove the back cover by unscrewing the three torx screws
Remove the HDD/SSD by removing the two M2x7 screws and sliding it out
Remove four M2x8 screws holding chassis and keyboard
Remove the two M2.5x5 screws to the left and right of the battery pack
Slide entire keyboard up towards the battery and then lift up from the bottom
Disconnect the two flat flex cables (for the keyboard and TrackPoint) from their connectors by levering the front part of the connector up.
Disconnect the flat flex cables from the mainboard in a similar manner to the ones on the keyboard.
Disconnect the microphone by sliding the connector towards the right
Remove the three M2x5 screws exposed after removing the keyboard
Remove the part of the chassis which consists of the palm rest and trackpad by using a spudger or running fingernails between the main chassis and the palm rest. This part is held together with small plastic hooks running around the chassis. Apply a little force to unhook them.
Remove the piece of black plastic around the microphone connector (to the right of the USB ports on the left hand side) as the EEPROM is located underneath.

Locating the EEPROM Chip

The EEPROM chip is located just below the microphone connector. I have seen two chips used for the EEPROM. It should be a chip labelled L08 or PS08A but could be a different chip.

Other Information

The X130e and X131e run UEFI. Follow the procedure for UEFI based systems.

The SDA and SCL pins are the two above the number 8 of the L08 label or the 8A of the PS08A label (the opposite corner of the dot/circle marker).

NFC Security - Armourcard Active Jammer

Mon, 14 Mar 2016 00:00:00 +0000

NFC is becoming the de facto standard for contact-less systems. For the convenience, we are potentially giving up some privacy and security.

Contactless payment technologies such as Mastercard Paypass and Visa Paywave are designed for maximum flexibility for merchants, not maximum security for customers. Some merchants may choose to have transactions processed immediately, while others may choose to process them in batch after hours. Whatever the reasons, the designers of the protocol have chosen to make the following information readable in plaintext through NFC.

Card Number (First four digits indicate the type of card)
Expiry
Date and amounts of the last 10 transactions

With this information, credit card fraud can be commited. You may think that without a full name and CVV (the security number also know as the CVC or CVV2) you cannot process a transaction, however, the only number required to process a transaction is the card number. Merchants are able to pay higher processing fees to allow transactions without extra information such as the expiry and CVV. Amazon is a famous merchant that allows transactions without the security code.

Granted, you are covered if money is stolen from your account, however you need to actively check your transactions regularly for fraudulent transactions to report. This can be time consuming and difficult if you have to verify each and every transaction.

Sydney public transport users using the Opal card can provide the following information through NFC:

Card number
Card Balance
Last tap details
- Transport type
- Tap on/off
- Time and Date
Number of journeys used in the last week the card was last used
If Auto Top-Up is enabled

The information mentioned can be viewed easily with the Credit Card Reader and Opal Travel apps. To obtain the information, any NFC reader can be used.

To protect myself, I have been using an Eagle Creek RFID International wallet for the last two years. These types of RFID shielding contraptions are usually lined with a layer of foil to shield the magnetic fields emitted by NFC/RFID readers.

NFC/RFID communications work by the reader sending out a magnetic field and inducing it into the NFC/RFID card, which gets power through inductive coupling. The card then provides feedback to the magnetic pulses by loading down its antenna coil. The NFC/RFID reader is able to detect the card loading down the coils, and thus can read information back from the card.

The issue with passive shielding is that given a powerful enough magnetic field, you can still induce power though the shielding material. I recently got access to a more powerful RFID reader and was able to read a card though the RFID shielding wallet.

Just last week, I stumbled upon the Armourcard active jammer. The Armourcard is a jamming device as opposed to the more common shielding material. This means that there is circuitry inside the card which detects RFID/NFC signals emitted by a reader and emits its own scrambled signal to interfere with communications.

The Armourcard is credit card sized and is constructed from a double layer PCB with black solder mask. It is approximately 0.8mm thick (as thick as a credit card) around the edges and approximately 3mm thick at the bulge (the white parts of the card). The front side contains two LEDs and exposed traces that act as a touch sensitive button.

The back side holds the traces which act as the antenna coil.

The red LED flashes when the card is actively jamming a signal. The button on the front size is used to disable the jamming temporarily and to test the battery. The green LED will flash while the button is touched. As it has active circuitry inside, the Armourcard has a limited lifetime which is claimed to be approximately two years.

With the low powered NFC reader in my Xperia Z1c, the jamming LED starts flashing when the phones is 6cm away from the Armourcard. In comparison, the phone is only able to read a card when it is 3cm away from the phone. This instils some confidence as the Armourcard will always engage before the reader is able to read a card. With the Armourcard anywhere near a card, the NFC/RFID reader will fail to detect a card present.

DETNSW SSO Authentication: Convenience vs. Security

Sat, 27 Feb 2016 00:00:00 +0000

While writing the DER Batch Reset Tool, I was forced to investigate how the DETNSW handles its SSO. The original plan was just to obtain a session cookie from the browser and use the cookie in the reset tool, but it was rather tedious copying a cookie every few minutes while coding up the script. The batch reset tool uses the Python requests module, which has session support to store cookies between requests.

The DETNSW SSO server is probably somewhere around a decade old, as I remember using the same system as a student when I first started high school. The one thing that has changed is that one less set of credentials is required when using one of the DETNSW’s services such as the student/staff portal.

All the computers connected to the DETNSW’s network are part of a state-wide intranet in the 10.x.x.x Class A network. Direct connections to the internet are filtered, thus all internet traffic must go through the department HTTP proxy proxy.det.nsw.edu.au:8080 with the exception of some licensing and update servers. The proxy is an HTTP proxy with Basic authentication (through HTTP headers of the first connection). They have no support for HTTPS proxy.

Initially, to visit the student/staff portal, one would need to enter their username and password for the proxy authentication and then again on the SSO login page. However, some years later, the SSO login page got replaced with a page which seems to automatically authenticate users based on the proxy authentication. One can only assume this was done because staff complained about having to enter their credentials twice if they just opened a browser and want to visit a DETNSW site.

When requesting a DETNSW site, you get redirected to this non-secure URL, where some magic happens and you are automatically authenticated. Is this yet another page for details to leak?

And here is the page itself. Looks like an innocent enough form and it POSTs to a secure site! Do we have some actual security?

<html xmlns="http://www.w3.org/1999/xhtml">
    <head>
        <title>Portal Login</title>
        <meta http-equiv="content-type" content="text/html; charset=iso-8859-1"/>
        <meta name="author" content="Andy {REDACTED}"/>
    </head>
    <script type="text/javascript" src="../jfunctions.js"/></script>
    <body onload="javascript: submit_form();">
        <br/><br/><br/>
        <p>
            <h2 align="center">Please wait while you are being logged into the DET Enterprise Portal...</h2>
        </p>
        <form name='loginform' method='post' action='https://sso.det.nsw.edu.au/sso/UI/Login?goto=...' >
            <input type="hidden" name="ssoDetails" value="dXNlcm5hbWU=:cGFzc3dvcmQ=">                     
            <input type="hidden" name="site2pstoretoken" value="">
            <input type="hidden" name="ssousername" value="">
            <input type="hidden" name="password" value=""> 
            <input type="hidden" name="IDToken1" value=""> <!-- BA for openam -->
            <input type="hidden" name="IDToken2" value=""> <!-- BA for openam -->           
        </form>
    </body>
</html>

Oddly enough, if you POST all the details shown here using the Python requests module, it doesn’t authenticate the user and redirects you to the sign in page to enter your credentials. So what’s the difference between the browser and Python requests?

JavaScript. They must be using JS to do more than just submit the form automatically. The hidden value ssoDetails is already part of the form but looks suspiciously like base64. What could they possibly be doing?

var base64Chars = new Array(
        'A','B','C','D','E','F','G','H',
        'I','J','K','L','M','N','O','P',
        'Q','R','S','T','U','V','W','X',
        'Y','Z','a','b','c','d','e','f',
        'g','h','i','j','k','l','m','n',
        'o','p','q','r','s','t','u','v',
        'w','x','y','z','0','1','2','3',
        '4','5','6','7','8','9','+','/'
        );

...

function submit_form() {
    var details = document.forms['loginform'].elements['ssoDetails'].value;
    var details_array=details.split(":");
    document.forms['loginform'].elements['ssousername'].value = db(details_array[0]);
    document.forms['loginform'].elements['password'].value = db(details_array[1]);
    document.forms['loginform'].elements['IDToken1'].value = db(details_array[0]); // for openam
    document.forms['loginform'].elements['IDToken2'].value = db(details_array[1]); // for openam
    document.forms['loginform'].submit();
}

Surprise surprise… base64. (The entire JS file is available here). It looks like they have implemented base64, probably for IE users as IE only had base64 JS functions from version 10 onwards.

And at first glance, it’s evident they are populating the form with details from the ssoDetails form value. This means the DETNSW servers have an un-hashed copy of everyone’s password stored somewhere on a server and is willing to send out a base64 encoded version of it through an unencrypted connection.

It’s understandable that they need to store a plaintext password, as the department has countless numbers of systems to integrate and some of them are ancient. What’s not understandable is why the SSO server must take a username and password. Surely they could have programmed the SSO server to talk to the proxy authentication server and use a token of some sort.

So now, we don’t even need Wireshark to steal a password, we just need to get the target user to authenticate the proxy connection.

Taking a further look at the response headers for that page which returns us the username and password, we can see it doesn’t even disable caching.

Ideally, the server should set the following headers:

1
2
3

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0

We can just trawl through the browser’s cache and extract the details. So now we don’t even need the user to authenticate on the spot!

Fortunately, if you haven’t been active on a DETNSW site for a few minutes, they will invalidate your session and prompt you to log in manually. Okay, so what if the cache entry has been overwritten due to newer content and the user has been logged in previously (more than a few minutes ago) in this browser session?

The solution is 3 key strokes and some clicks away. And since the SSO server doesn’t talk to the proxy authentication server, you are treated as if you had just opened the browser and will be handed the account password. So this security timeout feature is essentially useless. Due to limitations of the HTTP proxy authentication, there is no proper way for the proxy server to know when a user entered their credentials into the browser (since the browser keeps a copy of the credentials in memory and uses it automatically every time a new connection is made).

In summary

Proxy is HTTP where the password is sent in plaintext (base64 encoded)
User credentials are stored in plaintext (un-hashed)
User credentials are sent to the user to process the login
User credentials are not protected with TLS
User credentials are allowed to be cached in the browser’s cache
SSO auto-login server can’t determine how long since a user authenticated with the proxy

I’ll give Andy the benefit of the doubt and assume he didn’t really have a choice when he implemented this auto-login. I’m sure someone has signed off on his work knowing exactly how bad the security is.

The good news is that DETNSW is planning to move to NTLM-authentication. This is fine for devices part of the DETNSW domain and using Internet Explorer, any other browser/device will still be required to enter a username and password. The bad news is that NTLM is really broken, as it is vulnerable to MITM and pass-the-hash attacks. Even with these vulnerabilities, it is still way more secure than plaintext passwords. Hopefully they add support for HTTPS proxy for non-domain computers.