Posts on Giddi's space

Emulating QNAPs IT8528 EC in QEMU

hello@giddi.net (Giddi) — Sat, 21 Mar 2026 00:00:00 +0000

If you have read some of my previous posts you’ll know that my QNAP TS-473A has been keeping me busy for a while. I added a serial port to it, replaced QuTS with Debian, wrote a custom kernel module qnap8528 to expose the embedded controllers features via standard Linux subsystems, I even wrote a custom GRUB module (repo) to set the status LED during boot. At this point, the NAS has more of my fingerprints on it than QNAPs.

Talking Dirty (Dishes): Sniffing the Rinse Cycle

hello@giddi.net (Giddi) — Thu, 19 Feb 2026 00:00:00 +0000

Background

Last November I got myself a small dishwasher, a counter-top model from a local vendor. I was emptying the contents of the dishwasher one evening, and curiosity got the better of me and I ended up unscrewing all the screws in the front panel, just to take a small peek at what’s inside.

Writing custom GRUB2 modules

hello@giddi.net (Giddi) — Sun, 16 Feb 2025 00:00:00 +0000

A few months ago, I updated a kernel module I wrote (qnap8528) to expose an interface to the LEDs on my QNAP TS-473A NAS. I use the LEDs on the device to indicate the system state. For example, when shutting down, I set the status LED to blink in an alternating green-red pattern, visually indicating that a shutdown sequence has been initiated.

Monitoring and sending notifications via a Telegram bot

hello@giddi.net (Giddi) — Sat, 21 Sep 2024 00:00:00 +0000

I was running some unattended tasks on my computer and wanted a quick and easy way to monitor the state of the tasks and other parameters while away from my local network. I have the option of tunneling to my local network via a VPN and then using a SSH session to view my computer remotely, however, I wanted the notifications to be convenient oon the go. I was at first thinking about using something such as a self-hosted ntfy server or even integrate with a home-assistant instance I have running to push notifications to my phone, but why make it so complicated when I already have messaging apps installed?

Creating a Debian 12 (Bookworm) live USB w/ serial support

hello@giddi.net (Giddi) — Tue, 13 Feb 2024 00:00:00 +0000

UPDATE 19/09/2024: Added the ISO mount process and the recursive copy to the flash drive I mistakenly ommited. Thank you Josep.

In my project of replacing the QNAP operating system (QTS/QuTS) I needed to create a bootable Debian USB drive to boot a live environment. While under normal circumstances this is as simple as writing the ISO file to a flash drive, I needed to edit the boot and kernel configuration/parameters to allow booting over the serial console. This post is just part of my ongoing documentation on the process.

Adding a serial port to a QNAP TS-473A NAS

hello@giddi.net (Giddi) — Mon, 12 Feb 2024 00:00:00 +0000

When I got my NAS, I also got two NVME drives and some extra memory to fit in it, while fitting in the NVME drives I noticed a bunch of connectors on the top of the motherboard and one on the bottom. The only TWO connectors that were labeled in any meaningful way that I could guess their function LPC_CN1 and EC_SPI1. LPC_CN1 probably stands for Low-Pin-Count (connector 1), which is a general bus used for data storage, debugging, TPM modules and more, the second is an SPI bus maybe to program the BIOS flash?. While looking online for any information about internal connectors on QNAP devices, I stumbled upon many articles talking about serial ports on their QNAP devices. The QNAP website even has a guide on how to connect to a serial port, but for a different model and with an exposed serial connector on the back of the device.

Replacing a Roborock Ultra dock PSU (Error 35)

hello@giddi.net (Giddi) — Mon, 05 Feb 2024 00:00:00 +0000

Background

Almost two years ago, I purchased the Roborock S7 MaxV Ultra, a vacuum and mopping robot with an “Ultra” docking station for filling its moping water tank, cleaning the mop, and emptying the dustbin into a larger bag. For almost two years, both the robot and dock functioned flawlessly, with no issues. However, two months ago, a notification on my phone disrupted the routine - “Error 35: Auto empty Dock voltage error.” Upon manually running the dustbin emptying cycle, everything seemed fine. Two weeks later, the same error surfaced, but this time during the cleaning cycle, the robot declared loudly to the room “Voltage error, cannot empty dustbin.” The app indicated a power issue with the dock, even though the robot’s mop routine worked seamlessly just moments before, the problem seemed confined to the dock vacuum.

Circumventing unRAIDs physical USB requirement on VMs

hello@giddi.net (Giddi) — Tue, 23 May 2023 00:00:00 +0000

unRAID requires a physical USB to boot and I hate that. It all started when I decided to upgrade my home server, I’m currently looking for a better solution to manage my growing media and home services storage requirements. I’m considering NAS software like unRAID, TrueNAS, or OMV to properly handle storage, either by replacing Proxmox or by running it as a virtual machine with pass-through for a PCI HBA.

Format your light bulbs!

hello@giddi.net (Giddi) — Wed, 17 Mar 2021 00:00:00 +0000

Approximately 2 years ago, I bought a Xiaomi YeeLight bulb (color) for my bedroom. It is one of those IoT smart bulbs that connect to the WiFi and can be controlled with a phone app / Google assistant. I never really used the color features of the bulb, it was always on a warm white setting but it was a convenient way of turning off the lights without needing to get out of the bed to the light switch.

Fun with an oscilloscope, ESP32 DACs and the DVD logo

hello@giddi.net (Giddi) — Sun, 10 Jan 2021 00:00:00 +0000

A few months back I finally bought an oscilloscope, I bought it off a friend that was not really using it anymore (which was evident by the sheer amount of spiders inside the case). It’s a LeCroy 9314L which, I don’t really know the manufacturing date of it (no info plate/sticker), but if to go by the software version date in the EEPROM, it’s from 1995 however software can be updated, the main PCB date-code though is from 1993. It’s a 300MHz 4 channel digital (yes, digital!) scope capable of 10Msp/s and 1Mpt/ch, it should have an effective rate of 10GS/s, however due to some memory issues it cannot reach it’s max sampling rate, crashes here and there and has some auto-calibration issues.

Dissecting a Mailgun credentials phishing attack

hello@giddi.net (Giddi) — Wed, 09 Dec 2020 00:00:00 +0000

Ever since I made my blog public, I started getting spam emails to my “@giddi.net” account. Interestingly, most of the spam emails I get to that account are not just standard spam or phishing, but specific phishing attempts for my Mailgun credentials. This is interesting as Mailgun is the service I use for my personal domain email handling, I can only assume they scraped my email address from the blog and then, by looking at my MX DNS records found out I use Mailgun as my backend. To satisfy my curiosity, I tend to follow the links to the phishing sites and just see what’s up with them. By time I get around to going to those sites, I find that they have been taken down (which is good).

A look inside a digital pregnancy test

hello@giddi.net (Giddi) — Thu, 26 Nov 2020 00:00:00 +0000

While searching my local pharmacy shelves for a product, I came across some pregnancy tests, I normally don’t really pay attention to this kind of stuff since, as a boy, I don’t thing I can get pregnant. However, one of the tests on the shelf said it can not only detect a pregnancy, but indicate the pregnancy week to, then, I noticed it was a digital test, not a simple color changing stripe type, so I picked one up to see how it works. The device is a “ClearBlue pregnancy test with weeks indicator”. Taking the device out of the box and wrapping, it has a outer plastic shell with a cap on one end with fibrous hard-sponge stick thing to pee on. In the middle of the plastic shell there was a small window with an LCD screen.

Reversing a CANbus odometer filter/manipulator

hello@giddi.net (Giddi) — Fri, 31 Jul 2020 00:00:00 +0000

Intorduction

A while back, I watched a video on YouTube by Big Clive in which he showed and tore down a device that is used to manipulate the mileage displayed on an odometer of a car. The teardown was very interesting and was very informative on the design of the device. The video, titled Naughty CANbus odometer “interface”. (Fakes mileage.) did a great job of looking at the hardware side of the device, but the software functionality of the device was only based on speculation. When I saw the video, I decided to find the device for sale, order one and take it apart and take a look at the software side dof things. As I did not have any information on how to purchase the device, I started by searching Google for various keywords that fit the devices functionality and the silk screen printed car models that appeared in the video. I got multiple, different devices in the search results, I switched to using the image search results and tried to find a device which visually matched the the one in Big Clive’s video as close as possible. After some searching, I found that the device is commonly sold on eBay under the name “MB CAN Filter 18 in 1”, there are a few versions of the device for sale, but the images helped identify the specific device featured in the video. After I was positive I had the correct device, I ordered one off of eBay and waited for it to arrive. I guess I was not the only one to order this device off of eBay as when the device was shipping, a significant amount of eBay listings for the device had been taken down, maybe due to the exposure Big Clive’s video. In case you want to look for the device yourself, I have posted an image of the purchase order that I made, as the listing itself is no longer available.

Breaking bad CD-ROM DRM Protection

hello@giddi.net (Giddi) — Sun, 12 Apr 2020 00:00:00 +0000

While everybody in my area are preparing for Passover and doing some cleaning, I came across a bunch of CD-ROMs that have be left on a wall near my house for the public. These CDs contained movies that are directed at the Jewish orthodox community in my area. I really did not have an interest in these CDs, as they are very poor quality and have an atrocious plot. But while browsing through the titles, I noticed a small anti-piracy warning printed on the cover stating that “Any attempt at copying this disk will cause damage to the disk drive”. How will that work exactly? Since I was not near my computer (yes, it has a CD drive) I inspected the disk visually. I found that some of the CDs had 1-4 dimples on the reflective side and some didn’t. I picked a few with and without the dimples and decided to take a look at them at home.

First attempt downloading and decoding NOAA images

hello@giddi.net (Giddi) — Sun, 23 Feb 2020 00:00:00 +0000

Introduction

In the past few years I have wanted to explore the world of different signals from space. Now, I know that my phone can pickup signals from space, and I use it every day… it’s called GPS. Unfortunate as much as GPS is an intriguing and marvelous system it’s a very simple signal that does not very interesting data. For a few years now, I have been aware of meteorological satellites using the APT system (mostly US NOAA satellites) that transmit many types of information.

Commercial pulse oximeter teardown

hello@giddi.net (Giddi) — Sun, 02 Feb 2020 00:00:00 +0000

In the past few days, I have been playing around with some hobby pulse sensors (pulsesensor.com) and ECG (AD8232) modules. I remembered I got a finger clip pulse-oximeter a while back that was too broken to use (broken - physically, glued back together). I decided to take the pulse oximeter apart and take a look at how it’s constructed and what makes it tick. The first thing I did was to break apart the case and free the small PCB inside, as this was a finger clamp, I did have to battle with some sharp springs (that now are somewhere on the floor) and use a pair of pliers to rip the small photo-sensor that was well glued into the case.

Inside a Switcher V2 - Part 2, Mapping and Extracting

hello@giddi.net (Giddi) — Fri, 05 Jul 2019 00:00:00 +0000

After going over the Switcher’s overview and internal components in part 1 it was time to take a closer look at the specifics of each component. The first thing on the list was to map out the main functions of the I/O pins on each of the chips (the Espressif ESP8266 and the Nuvoton N76E003). As I determined in the previous post, the N76E003 is used as a controller some of the components such as the power monitoring chip and relay. I took some images of the boards, and with the help of the images and a multimeter and logic analyzer I mapped out the function of each I/O pin on the microcontrollers. In order to understand the type of I/O used, I referenced the Nuvoton N76E003 data-sheet [pdf, 3.3 MB] (page 10, figure 4-1), and the Espressif ESP8266 data-sheet (page 4, figure 2-1). I created the following table, describing the major I/O lines on the logic board:

Visually reading magnetic stripes with iron oxide

hello@giddi.net (Giddi) — Sat, 22 Jun 2019 00:00:00 +0000

On 03/12/2017 I attempted to read a magnetic card strip using iron oxdie (FeO) powder created by decomposing steel wool with a blowtorch. At the time, I had not way of getting the powder fine enough, and was girding it by smashing it between various construction tools. As you can see from the image below, the attempt was a failure since the particle weren’t small enough and the resolution was terrible. A few months ago, I had gone to IKEA and found a pestle and mortar in their kitchen section, this was the perfect tool to grind my powder to a fine dust that might just work, so I bought one.

Inside a Switcher V2 - Part 1, Overview

hello@giddi.net (Giddi) — Thu, 16 May 2019 00:00:00 +0000

On advice from a friend, I ended up buying a Swticher V2 to connect to an immersion heater and replace the analog timer with a more modern digital one, which contains features such as timer mode, scheduler and power consumption calculator. The device itself uses WiFi to connect to the home network and has a complementary phone app o control it. The device costs approximately 70 US$ and to my opinion is no more than a glorified Sonoff with a few extra LEDs. In this post, I’ll take apart he device and have a peek inside it. Before I dive any deeper I would like to make two things clear:

Testing PCB Etching at home

hello@giddi.net (Giddi) — Wed, 13 Feb 2019 00:00:00 +0000

For far to long I have wanted to make PCBs at home. Even though there are many cheap PCB manufacturing plants in china, it takes time for the order to complete, and without paying an extra 20$ for expedited shipping (which can be 10 times the cost of the PCB), it takes weeks to arrive in the mail. For these reasons, I really want to find a way to create basic POC PCBs at home for, even if they cost a bit more than the cheap china ones, and are poorer in quality.

Using an ESP8266 to interface with HDDs

hello@giddi.net (Giddi) — Mon, 25 Dec 2017 00:00:00 +0000

In one of my draws, I have a bunch of old HDDs from over the years, I was looking for a file related to an ond project I had created back in 2009, when I realized that old my older HDDs have an IDE/PATA interface and I will not be able to read them with my SATA adaptor. Since I wanted my files right away, and did not have a store nearby to get an adapter, I decided to make my own IDE/PATA reader and ended up hooking it up to an ESP8266 too.

Windows on DigitalOcean droplets - Part 2

hello@giddi.net (Giddi) — Thu, 16 Jun 2016 00:00:00 +0000

In the previous part of this project I found that it is possible to boot a custom image on DigitalOcean droplets by writing a new MBR to the disk and the corresponding files. In this part, I will go over how I got a sort of working Windows to boot on the droplet.

Windows on DigitalOcean droplets - Part 1

hello@giddi.net (Giddi) — Mon, 13 Jun 2016 00:00:00 +0000

A while back I signed up to DigitalOcean and setup a droplet (DO speak for VPS) and was happy to have a service that will allow me to deploy Linux test machines in a matter of seconds. I’m not entirely sure why, but I needed a Windows machine to test something and was frustrated that DO do not supply Windows images. That’s how he quest for Windows on DO begun.