Caralynx

25 Jan

Watch my 39C3 talk on modding the Vital Bracelet series YouTube: www.youtube.com/watch?v=ry2Q... Slides available at cfp.cccv.de/39c3/talk/GM... CCC media site: media.ccc.de/v/39c3-be-mo...

Caralynx reposted

Mab

@artmab.bsky.social

First five brush tests, mixed pencil busts this month. @ucbronzewing.bsky.social @sudo.caralynx.com @ladydarksphynx.bsky.social @snowmiaux.bsky.social #furryart #furry #commissions

CW: AI slop If you keep up with Discord's quests, you may have noticed some of them where you launch an activity to play some minigames or do a scavenger hunt. One recent one is for Forgotten Island, and I found an interesting texture. It looks like a ref sheet for a spork. What's it doing here?

You can sort of tell certain projects were made primarily with AI from how uninteresting they are, like the Forgotten Island and Gaming for Cause ones. It's all pretty unfortunate, because I really love deeply interactive sites and I go out of my way to archive a copy when I come across them.

So now you know, if you see a quest on Discord that says "launch activity", AI was probably involved in its creation, and sometimes it's just complete slop.

If you look at the scripts in the PlayCanvas builds, you can see rather verbose descriptions for every parameter, something no human would have the time to do. Sometimes you can even find documentation they uploaded as assets, which are clearly AI-written.

developer.playcanvas.comDeveloping with AI | PlayCanvas Developer SiteUse AI coding assistants, documentation, and browser tools to build and verify standalone PlayCanvas Engine applications.

And of course, instances of AI art, like what was seen in this case. And all of this is easy, because PlayCanvas explicitly supports AI-assisted development. developer.playcanvas.com/user-manual/...

So who's behind this? It turns out it's a company called Those Beyond (see information panel in the top right menu when you're in-game), powered by a framework they call ARISE Engine. The actual gameplay is run with PlayCanvas.

Those Beyond's goal is to create interactive experiences for brands, usually video game publishers and media companies. There's also one for a charitable cause released just yesterday. They sometimes make genuinely fun experiences, but they seem to churn them out fairly quickly.

Well it turns out to literally be the texture for the model of said spork. You can see the pointer lines on it. Absolutely incredible.

And yes, it shows in-game too. Normal artists wouldn't write "wrorid", much less map textures directly using the ref sheet. It has all the hallmarks of AI slop.

Still looking at SNC7320. The only variant with built-in flash, SNC73285M4, exposes its SPIFC_CS pin. So in all likelihood, you can dump this variant by holding the pin high, then connecting to SWD or UART console and read it out through its memory mapped region.

Seems like the bootrom only recognizes up to 32MB SPI NOR flash in general. Anything larger gets treated as a failure.

Sonix, WTF are you doing? Found in SNC7320 bootrom (used in a couple of Precure toys and later wave Tamagotchi Pix)

i.e. if the flash isn't filled and at 0x64616F6C it reads with 0xff bytes, and you submit some memory where the first word also points to a random place in flash that reads 0xff, and the addresses in the rest of that table happen to fall in valid memory regions.

Probably the reason QA missed this is no one tried negative test cases, and flash is pretty permissive about where you try to read since it just truncates the address to what is available.

Sonix, WTF are you doing? Found in SNC7320 bootrom (used in a couple of Precure toys and later wave Tamagotchi Pix)

Probably should explain since it might not be obvious, load_str is a 32-bit integer marker (not intended to be pointer), and the second number is what that marker should contain, but as-written it's some random location in SPI flash.

FWIW, this probably does work if you set everything up as expected, i.e. make sure load_str is 0x64616F6C and call the setup function to enable the feature, however this also would pass if you give garbage that happens to line up with what it checks for,

Sonix, WTF are you doing? Found in SNC7320 bootrom (used in a couple of Precure toys and later wave Tamagotchi Pix)

Thankfully this isn't on the main boot path, but it is if you try to use deep power down.

Compiling chip vendor SDKs on Debian aarch64 is really fun, because you get to find out about all the ancient toolchains and packages they use and you have to somehow source, plus a bunch of assumptions about stuff that exist on a system, such as xxd.

I do not look forward to the day Rosetta 2 is removed, a ton of other stuff is going to randomly break because you know vendors love their opaque executables too.

Something I just learned while poking around at a MIFARE Classic hotel key card from my most recent trip (why are people still using those) is that you're not supposed to be able to read a sector if its key B is readable and you authenticate with key B.

In fact the sector trailer access for the FM chip is very weird. If key A is allowed to do something, key B is allowed to as well. It seems key B has a lot more authority here, and you can't exactly use it for user data.

stackoverflow.comWhy is Mifare Classic data readable with KeyB in transport configuration?The Mifare Classic specification from NXP explicitly states, that data should not be readable using KeyB when using transport configuration (factory default), because KeyB is readable (having KeyA)...

So if you're implementing a MIFARE Classic system (why?), verify what cards are going to be used with it and implement accordingly.

This makes sense since you can configure key B as user data if you don't need it as a second key, and user data should not be authenticatable. However, for FM11RF08/S chips (why are people still using those), they missed the memo during implementation. stackoverflow.com/questions/73...

Caralynx reposted

Mab

@artmab.bsky.social

First three brush tests, settled on Green Man portraits. #furryart #furry #commissions @sudo.caralynx.com @thorsvision.bsky.social @snowmiaux.bsky.social

22 Sept

I'm currently working on something that uses the LSI Zevio architecture, and I've discovered that the PTX texture format (as seen on V-Tech's V.Flash) implemented in FFmpeg is incomplete/probably incorrect. Might try to fix the implementation/documentation later.

because it assumes all fields are 16-bit, which is not actually the case based on the code in the thing I'm looking at that actually reads the format.

22 Sept

The format supports indexed pixels as well as raw bitmaps, and can do both ABGR1555 (alpha is inverted) and ABGR4444.

Like a bunch of formats from the day, it loads the header directly as a struct and fills some fields in at runtime, so a few fields aren't useful for conversion. For the fields it looks like whoever put it on MultimediaWiki didn't actually disassemble the code for reading it,

Caralynx reposted

revenant

@notrevenant.bsky.social

16 Sept

yeah i use "A.I." for reverse engineering A pirated copy of IDA Pro 7.5

Day 2 of owning a Pixel 11 Pro: - Botched camera lens protector installation, have to buy a new one - Got even more dust under the screen protector when trying to reinstall one that got a bunch of dust under it - Received Pixelsnap Charger, it works worse than a random Amazon charger

For the most part I just need a better macro camera, none of the other features really matter to me. Phones have pretty much stagnated for the past few years. The HiLight thing is dumb, who can actually even see it? Plus it makes the flashlight a bit more diffuse and dimmer than on my old phone.

1 Sept

Half my push notifications are no longer working after I had the audacity to go into town on Sunday. I guess the new modem constantly dropping out for a minute at a time as it switches between 5G and 5G+ really messed with the push registration.

Caralynx reposted

Mab

@artmab.bsky.social

1 Sept

Last three brush tests. just in time for the month to end. Phew. Pushed harder on facet shapes this time, I really like it. Limited palette really makes colour choices intentional. @sudo.caralynx.com @thorsvision.bsky.social #furryart #furry #commissions

28 Aug

Why is it that my following feed doesn't contain my quiet posters feed? Isn't the point to get a chronological feed of everything your followers post? (No I don't really customize this place much)

People you follow*

Anyway, the phone itself: feels the same as my old Pixel 7 Pro, aside from being a little bit smaller. Both have Android 17, and this new phone has the same bugs, plus a bit more. It also has a ludicrous corner radius. Why is it rounder than an iPhone?

Screen's higher resolution, and text is a bit smaller. Wish I could make it the same size as my old phone, but it's like half a size bigger rather than one size bigger.

Fine in theory, but the backing sheet absolutely did not pull off properly on my first attempt, and it left a bunch of dust at the bottom.

Second attempt I pulled the sheet off ahead of the time, and apparently bad idea, because there's now dust spread across the glass. Got another order on for tomorrow, hopefully no dust next time.

I got one that had the least holes, and unfortunately it's only on Google Store, so I'm waiting a week for it because I don't want to spend more on fast shipping.

For the screen protector, apparently the current meta is a positioning frame with a suspended glass panel, and you pull the backing sheet off while the frame is on, so it attracts any remaining dust off.

The charger has been RMA'd, hope the next one works, or I'm just going to return it.

For the camera lens protector, it didn't come with those stickers for positioning, so I had to peel it off a bunch of times to reposition and I accidentally got a nail under the adhesive, so now a corner doesn't stick right. Will definitely provide my own positioning tape next time.