flat assembler
Message board for the users of flat assembler.

Index > Non-x86 architectures > Fun tricks with ARM

Goto page Previous  1, 2, 3, 4  Next
Author
Thread Post new topic Reply to topic
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20627
Location: In your JS exploiting you and your system
revolution 21 Apr 2008, 18:59
The touch does not wake up the MCU. The touch does not induce a voltage or current, it only changes the temperature. Breathing hot air will also trigger a detection. The sleep mode is needed to keep the MCU cool, if I run a full app the processor heats up and it can't measure the temperature changes from the touch very accurately. I set the wake up timer to 0.3 seconds, which gives a reasonably quick response to the touch. After waking up it then does the temperature measurement and compares to the previous reading. If the reading is less than last time (with some hysteresis) then the temperature has risen and it prints "don't touch me" and later, when it cools again, it prints "touch me again and I'll complain".

A clue: the readings I get are around 300000 counts when cool, and drop to 290000 counts for 1° increase. I set a trigger threshold of 100 counts/reading just to make it less sensitive to small gusts of air and general thermal noise.
Post 21 Apr 2008, 18:59
View user's profile Send private message Visit poster's website Reply with quote
edfed



Joined: 20 Feb 2006
Posts: 4354
Location: Now
edfed 21 Apr 2008, 19:31
it means there is a temperature sensor in the MCU.
no?
then, it have a sensor.

interresting trick indeed. Very Happy
Post 21 Apr 2008, 19:31
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20627
Location: In your JS exploiting you and your system
revolution 22 Apr 2008, 02:32
The MCU does not have a temperature sensor in the normal sense, that is, it is not designed with a sensor inside. But there are some things that can be done to make it detect changes in temperature. It is not reliable for absolute readings, only relative readings.
Post 22 Apr 2008, 02:32
View user's profile Send private message Visit poster's website Reply with quote
edfed



Joined: 20 Feb 2006
Posts: 4354
Location: Now
edfed 22 Apr 2008, 03:15
ok, now i understand, i didn't know it was present in the mcu.
for me, mcu is 68HC11 you know. and this is impossible to do with this kind of µC... i need to update my electronics. maybe a job or studes...

what kind of things? can you be more precise? read a reguister i suppose, but connected to what?

i tortured my mind since the start of this thread, now i want to understand and be able to reproduce this on a MCU. Evil or Very Mad

thanks for the news. Laughing
me too i'll post some funny tricks soon like a revenge....Very Happy
Post 22 Apr 2008, 03:15
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20627
Location: In your JS exploiting you and your system
revolution 22 Apr 2008, 03:24
edfed wrote:
read a reguister i suppose
Yes, a combination of registers. Timing is important. Some things happen faster when the electronics are warmer.
Post 22 Apr 2008, 03:24
View user's profile Send private message Visit poster's website Reply with quote
edfed



Joined: 20 Feb 2006
Posts: 4354
Location: Now
edfed 22 Apr 2008, 03:47
then, the MCU shall be a fast one. if the clk is very low, like 4MHz, it will not work i suppose.

i like it. it is a fronteer between analog and digital that i'd like to use one day. the real world becoming mesurable by the physics inside the chip, without specific circuitry.
very very interresting trick.

welcome in the Z world i can say...
Post 22 Apr 2008, 03:47
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20627
Location: In your JS exploiting you and your system
revolution 22 Apr 2008, 03:49
My clock counter is 13M, not very fast by today's standards. 4MHz would also work, just that the sensitivity would be reduced a little.
Post 22 Apr 2008, 03:49
View user's profile Send private message Visit poster's website Reply with quote
edfed



Joined: 20 Feb 2006
Posts: 4354
Location: Now
edfed 22 Apr 2008, 03:56
how did you have the idea of this? was it a document read on the net? some analyses of specifications? if you're a girl, do you want to mary me?? : D
Post 22 Apr 2008, 03:56
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20627
Location: In your JS exploiting you and your system
revolution 22 Apr 2008, 04:18
Analyses of specifications and a realisation about what IC designers do (and don't do) when making different versions of the same base chip.
Post 22 Apr 2008, 04:18
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20627
Location: In your JS exploiting you and your system
revolution 23 Apr 2008, 04:51
I shall reveal the 'trick':

The PXA27x range is designed with 121 GPIOs (numbered 0-120). The MCU is packaged in a few variants, each with differing amounts of internal SDRAM and FLASH. Correspondingly the packaging is also different, namely using VFBGA or PBGA. So, when packaged it seems the 270 version loses two GPIOs (119 and 120 are gone). I don't know why, I guess Intel had their reasons.

Now, while the GPIOs are not present on the external solder balls, in fact the two GPIOs are still present and working inside the chip, but just don't get connected to the outside world.

Therefore we can see with the software that these two IOs can still be controlled and return results. Selecting one of the two IOs at random (they both work the same) I start by programming it as an output with a low level (I output zero). Then I switch it back to input and read the value (I get zero back). But due to inherent leakage (a few nano amps) and parasitic capacitance (a few picofarads) the input IO will slowly leak current into the capacitor and charge it. By reading the input and timing how long it takes to charge I can measure the C/I ratio. This leakage is not uniform across temperature, when the temperature increases CMOS becomes more leaky, meaning the capacitor will charge quicker.

It is then a simple matter of seeing how long until a 'one' is returned on the unconnected input and use that as a basis for estimating changes in temperature.

This could also be used for an external IO pin, if it is not connected. Most chip makers will simply recommend unused IO be set to output and forgotten about. So if any of you have a MCU system around you might like to test it out and see how sensitive it is to temperature changes.
Post 23 Apr 2008, 04:51
View user's profile Send private message Visit poster's website Reply with quote
Alphonso



Joined: 16 Jan 2007
Posts: 295
Alphonso 23 Apr 2008, 05:41
How about that. Thanks for sharing Revolution. So are you constantly reading the port until it shows a one ? I wonder if part of the charging effect is because of your accessing the unterminated GPIO? ie if you increase your polling time significantly, does it charge at a slower rate?
Post 23 Apr 2008, 05:41
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20627
Location: In your JS exploiting you and your system
revolution 23 Apr 2008, 05:47
Reading it or ignoring it will not change the charging time. The input buffer is still there monitoring the IO.

But I don't actually continually 'read' the port, I use the GPIO level change interrupt and then read the elapsed time. This allows me the put the MCU into standby and not contribute to the temperature increase by running code.
Post 23 Apr 2008, 05:47
View user's profile Send private message Visit poster's website Reply with quote
f0dder



Joined: 19 Feb 2004
Posts: 3175
Location: Denmark
f0dder 23 Apr 2008, 06:27
Wow, that's some pretty hardcore stuff!

It's been a pretty interesting read Smile
Post 23 Apr 2008, 06:27
View user's profile Send private message Reply with quote
Alphonso



Joined: 16 Jan 2007
Posts: 295
Alphonso 24 Apr 2008, 07:01
revolution wrote:
But I don't actually continually 'read' the port, I use the GPIO level change interrupt and then read the elapsed time. This allows me the put the MCU into standby and not contribute to the temperature increase by running code.
Ok, I just saw
PXA270_UM.PDF wrote:
GPIO<120:117, 115:114, 112:103, 92, 89:84, 82:54, 52:41, 33:32, 30:18, 2>
These additional GPIO signals cannot be configured to generate wake-up events.
and thought you couldn't do it like that. I guess from what you've said, that you can do GPIO level transition interrupts to cause the wake-up event, or have I misunderstood?

Thanks for the insight to ARM MCU. From the tiny information I have learned because of this thread, it seems a very interesting processor.
Post 24 Apr 2008, 07:01
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20627
Location: In your JS exploiting you and your system
revolution 24 Apr 2008, 07:52
My bad, I get confused with the terminology used in the Intel manual. Instead of Standby mode (which is the term I used) Intel call it Idle mode. In "Idle mode" any configured interrupt can be used to restart the CPU.

Also, instead of Sleep mode (which is the term I used above) Intel call it Standby mode, where general timers and a few other things can restart the CPU.

And the Intel "Sleep mode" (which I don't use and have not mentioned above) I would have called it Comatose mode, because pretty much nothing happens unless you firmly kick it in the right place and even then it jumps to the reset vector.

And as for the Intel "Deep sleep" mode, well now the thing is so locked down that I would have called it Dead mode, since only the RTC is running, the light is on but nobody is home.

I didn't mean to confuse matters with the terms I used, it is just the terms I have got used to using because of the various CPU I have programmed. It seems to be normal for each different manufacturer to use a different term for the same thing.
Post 24 Apr 2008, 07:52
View user's profile Send private message Visit poster's website Reply with quote
Madis731



Joined: 25 Sep 2003
Posts: 2139
Location: Estonia
Madis731 24 Apr 2008, 08:18
Actually it seems that its not the temperature you're reading, because the exchange of temp between PCB and human body isn't so rapid when we've got things like skin and textolite as insulators.

The effect you get is actually human body acting as a HUGE capacitor. But as we know when capacitors are serially connected, their capacity decreases (not like with resistors). This is why you get the faster reading time (in theory). Actually the calculation can't be this simple. The capacity should logically increase while also resistance increases and the results are not very believable.

The third idea I got thinking about this was the voltage a human being generates is somewhere between 1-15mV and this might be enough to charge "the-inner-capacitor" that eventually tells you, that something happened.
The problem here is again the fine insulating properties of textolite and skin. This problem might be overcome relating to static charges colleting on ONLY insulating materials. This way we come back to capacitors.

The solution to this problem might most probably be human voltage source+capacitive properties of the board+I/O capable of reading that capacitor.

Tel me, revolution, did that board react immediately or it took some time from the touch? Also, do you need to have a firm grip (temperature) or a gentle touch (capacitor)?
Post 24 Apr 2008, 08:18
View user's profile Send private message Visit poster's website Yahoo Messenger MSN Messenger Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20627
Location: In your JS exploiting you and your system
revolution 24 Apr 2008, 08:37
It is definitely temperature. Breathing hot air will trigger it. It you like to think of the charging element (the leaky transistor) being a resistor then you can think of the resistance decreasing with temperature increasing (NTC). At higher temperatures (45 degrees+) the charge time is considerably less, and gradually that time increases as the IC cools down with no one touching it and no application code running.
Post 24 Apr 2008, 08:37
View user's profile Send private message Visit poster's website Reply with quote
edfed



Joined: 20 Feb 2006
Posts: 4354
Location: Now
edfed 24 Apr 2008, 11:34
what happens if the sun light touch the board?

the sun light is not a capacitor...
Post 24 Apr 2008, 11:34
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20627
Location: In your JS exploiting you and your system
revolution 24 Apr 2008, 13:49
edfed wrote:
what happens if the sun light touch the board?

the sun light is not a capacitor...
I will try this next time the sun is out.
Post 24 Apr 2008, 13:49
View user's profile Send private message Visit poster's website Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4624
Location: Argentina
LocoDelAssembly 28 Apr 2008, 17:12
The sun is very shy there? Razz

BTW, excellent reading, thanks a lot for sharing. Don't forget to issue a "lawsuit preventing" patent in order to being able to still using your own idea Razz
Post 28 Apr 2008, 17:12
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page Previous  1, 2, 3, 4  Next

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2025, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.