Saturday, August 6

DEF CON: BSODomizing In High Definition

A few years ago, [Kingpin] a.k.a. [Joe Grand] (A judge for the 2014 Hackaday Prize) designed the most beautiful electronic prank ever. The BSODomizer is a simple device with a pass-through connection for a VGA display and an infrared receiver. Plug the BSODomizer into an unsuspecting coworker’s monitor, press a button on a remote, and watch Microsoft’s blue screen of death appear. It’s brilliant, devious, and actually a pretty simple device if you pick the right microcontroller.

The original BSODomizer is getting a little long in the tooth. VGA is finally dead. The Propeller chip used to generate the video only generates text, and can’t reproduce Microsoft’s fancy new graphical error screens. HDMI is the future, and FPGAs have never been more accessible. For this year’s DEF CON, [Kingpin] and [Zoz] needed something to impress an audience that is just learning how to solder. They’ve revisited the BSODomizer, and have created the greatest hardware project at this year’s DEF CON.

Before simply deciding to add HDMI to the original BSODomizer, [Kingpin] and [Zoz] did the smart thing and figured out what the features of this new, updated display prank toy would be. Full color 1080p was a must, images should be loadable from an SD card, and animations would be a cool feature. That SD card opens up a few possibilities, so they’re also looking into taking screencaps, giving the BSODomizer HD pentesting capabilities far beyond what the original could attain. These features meant an FPGA would be needed.

The development board chosen for the prototype of the BSODomizer HD was a Cyclone V GX development board, available from the usual retailers for about $170. To this, the team added an HDMI transceiver from Analog. After that, it was only a matter of learning Verilog, FPGA development, and pushing pixels to the screen.

After creating a few test patterns, the next step was pushing an image over a HDMI cable. A 1920×1080 image at 24bbp is almost six Megabytes, which means some fast memory is needed. That memory was added to the project in the form of 512MB of LPDDR2 – more than enough for long animations. Add in a small PIC microcontroller to keep track of the battery and act as a trigger with an IR remote control, and the prototype was more of less complete.

The result of weeks of work is a sandwich of boards that’s far too expensive to be a product, far too big to be a 1337 piece of pen testing gear, and doesn’t have the valuable screen capture function. There’s still a lot – a lot – of engineering to do on the BSODomizer HD, but if there’s enough interest and demand, this may become a real product.

In keeping with the recent DEF CON tradition, this project was more of an introduction to a technique, in this case HDMI and programmable logic. Elsewhere on the Internet, people have been putting together cooler FPGA and HDMI mashups for years, including overlaying video on encrypted HDMI streams, and various ambilight clones that look at pixels before passing them through to a HDMI out port. Even building an FPGA solution with HDMI in and out is a bit overkill – this board is a complete solution for a BSODomizer HD with a bunch of Verilog. Still, the prototype for this project was exquisite, even if the demo wasn’t exactly safe for the kids in the room.

Check out this video of the original BSODomizer in action.


Filed under: cons, FPGA

No comments:

Post a Comment