Some of my projects:
Restored a Xerox Alto.
Wrote the Arduino IRremote library for infrared remotes.
Attempted Bitcoin mining on a 55 year old IBM 1401 punch card mainframe.
Got six symbols added to Unicode including the Bitcoin symbol (₿).
Wrote an article on the first microprocessors for IEEE Spectrum.
Gave a talk on reverse-engineering old integrated circuits at the Hackaday Superconference (YouTube).
Contact
Email me at [email protected]. You can follow me on Twitter at kenshirriff to get blog updates. The RSS feed is here.
Site Index
The index below categorizes my pages by topic. Pages are listed oldest-first in each topic.Intel 8086 processor
- A look at the die of the 8086 processor
- Die shrink: How Intel scaled down the 8086 processor
- The Intel 8086 processor's registers: from chip to transistors
- Inside the 8086 processor, tiny charge pumps create a negative voltage
- Reverse-engineering the adder inside the Intel 8086
- Latches inside: Reverse-engineering the Intel 8086's instruction register
- How the 8086 processor handles power and clock internally
- Inside a counterfeit 8086 processor
- Reverse-engineering the 8086's Arithmetic/Logic Unit from die photos
- The unusual bootstrap drivers inside the 8086 microprocessor chip
- A bug fix in the 8086 microprocessor, revealed in the die's silicon
- How the 8086 processor's microcode engine works
- Inside the 8086 processor's instruction prefetch circuitry
- The 8086 processor's microcode pipeline from die analysis
- Counting the transistors in the 8086 processor: it's harder than you might think
- Reverse-engineering the conditional jump circuitry in the 8086 processor
- Reverse-engineering the Intel 8086 processor's HALT circuits
- Understanding the x86's Decimal Adjust after Addition (DAA) instruction
- Silicon reverse-engineering: the Intel 8086 processor's flag circuitry
- Reverse-engineering the interrupt circuitry in the Intel 8086 processor
- Reverse-engineering the ModR/M addressing microcode in the Intel 8086 processor
- How the 8086 processor determines the length of an instruction
- Reverse-engineering the register codes for the 8086 processor's microcode
- Reverse-engineering the multiplication algorithm in the Intel 8086 processor
- The microcode and hardware in the 8086 processor that perform string operations
- Reverse-engineering the division microcode in the Intel 8086 processor
- The Group Decode ROM: The 8086 processor's first step of instruction decoding
- Reverse-engineering the 8086 processor's address and data pin circuits
- Undocumented 8086 instructions, explained by the microcode
- A close look at the 8086 processor's bus hold circuitry
- Tracing the roots of the 8086 instruction set to the Datapoint 2200 minicomputer
Intel 8087 floating point unit
- Inside the die of Intel's 8087 coprocessor chip, root of modern floating point
- Two bits per transistor: high-density ROM in Intel's 8087 floating point chip
- Extracting ROM constants from the 8087 math coprocessor's die
- Die analysis of the 8087 math coprocessor's fast bit shifter
Zilog Z80 processor
- Reverse-engineering the Z-80: the silicon for two interesting gates explained
- The Z-80's 16-bit increment/decrement circuit reverse engineered
- Why the Z-80's data pins are scrambled
- Down to the silicon: how the Z80's registers are implemented
- Reverse engineering ARM1 instruction sequencing, compared with the Z-80 and 6502
Intel 8085 processor
- Notes on the PLA on the 8085 chip
- Inside the ALU of the 8085 microprocessor
- Silicon reverse engineering: The 8085's undocumented flags
- 8085 instruction set: the octal table
- The 8085's register file reverse engineered
- Reverse-engineering the flag circuits in the 8085 processor
- Reverse-engineering the 8085's ALU and its hidden registers
- Reverse-engineering the 8085's decimal adjust circuitry
- The Z-80 has a 4-bit ALU. Here's how it works.
MOS 6502 processor
- The 6502 overflow flag explained mathematically
- The 6502 CPU's overflow flag explained at the silicon level
- Intel x86 documentation has more pages than the 6502 has transistors
Intel 8008 processor
- The Texas Instruments TMX 1795: the (almost) first, forgotten microprocessor
- Die photos and analysis of the revolutionary 8008 microprocessor, 45 years old
- Reverse-engineering the surprisingly advanced ALU of the 8008 microprocessor
- Analyzing the vintage 8008 processor from die photos: its unusual counters
- How the bootstrap load made the historic Intel 8008 processor possible
- Reverse-engineering the carry-lookahead circuit in the Intel 8008 processor
The ARM processor
- Reverse engineering the ARM1, ancestor of the iPhone's processor
- Counting bits in hardware: reverse engineering the silicon in the ARM1 processor
- More ARM1 processor reverse engineering: the priority encoder
- Conditional instructions in the ARM1 processor, reverse engineered
- The ARM1 processor's flags, reverse engineered
- Reverse engineering the ARM1 processor's microinstructions
Yamaha DX7 synthesizer
- Reverse-engineering the Yamaha DX7 synthesizer's sound chip from die photos
- The Yamaha DX7 synthesizer's clever exponential circuit, reverse-engineered
- Yamaha DX7 reverse-engineering, part III: Inside the log-sine ROM
- Yamaha DX7 chip reverse-engineering, part 4: how algorithms are implemented
- Yamaha DX7 chip reverse-engineering, part V: the output circuitry
- Yamaha DX7 chip reverse-engineering, part 6: the control registers
Restoring a Xerox Alto
- Y Combinator's Xerox Alto: restoring the legendary 1970s GUI computer
- Restoring Y Combinator's Xerox Alto, day 1: Power supplies and disk interface
- "Hello world" in the BCPL language on the Xerox Alto simulator
- Restoring Y Combinator's Xerox Alto, day 2: Repairing the display
- Restoring Y Combinator's Xerox Alto, day 3: Inside the disk drive
- Restoring Y Combinator's Xerox Alto, day 4: What's running on the system
- Restoring YCombinator's Xerox Alto day 5: Microcode tracing with a logic analyzer
- Restoring YCombinator's Xerox Alto day 6: Fixed a chip, data read from disk
- Restoring YC's Xerox Alto: how our boot disk was trashed with random data
- Restoring a Xerox Alto day 7: experiments with disk and Ethernet emulators
- Restoring a vintage Xerox Alto day 8: it boots!
- Restoring YC's Xerox Alto day 9: tracing a crash through software and hardware
- Restoring YC's Xerox Alto day 10: New boards, running programs, mouse problems
- Simulating a Xerox Alto with the ContrAlto simulator: games and Smalltalk
- One-hour Mandelbrot: Creating a fractal on the vintage Xerox Alto
- Improvements to the Xerox Alto Mandelbrot drop runtime from 1 hour to 9 minutes
- Bitcoin mining on a vintage Xerox Alto: very slow at 1.5 hashes/second
- Inside the vintage Xerox Alto's display, a tiny lightbulb keeps it working
- The Xerox Alto, Smalltalk, and rewriting a running GUI
- Steve Jobs, the Xerox Alto, and computer typography
- Fixing the Ethernet board from a vintage Xerox Alto
- Xerox Alto zero-day: cracking disk password protection on a 45 year old system
- Xerox Alto's 3 Mb/s Ethernet: Building a gateway with a BeagleBone
- A 1970s disk drive that wouldn't seek: getting our Xerox Alto running again
Apollo and other space hardware
- The Endeavour delay: Complexity, the APU, and the Load Control Assembly
- Inside the Apollo Guidance Computer's core memory
- Software woven into wire: Core rope and the Apollo Guidance Computer
- Bitcoin mining on an Apollo Guidance Computer: 10.3 seconds per hash
- Apollo Guidance Computer: Dipstiks and reverse engineering the core rope simulator
- Reliable after 50 years: The Apollo Guidance Computer's switching power supplies
- A computer built from NOR gates: inside the Apollo Guidance Computer
- Inside the digital clock from a Soyuz spacecraft
- The core memory inside a Saturn V rocket's computer
- Looking inside a vintage Soviet TTL logic integrated circuit
- The Delco Magic line of aerospace computers
- Inside a Titan missile guidance computer
- A circuit board from the Saturn V rocket, reverse-engineered and explained
- Inside a transistorized shift register box, built in 1965 for Apollo testing
- "Space age electronics": Inside a GE thin-film paperweight from the 1960s
- Inside a 20-Watt Traveling Wave Tube Amplifier from Apollo
- The digital ranging system that measured the distance to the Apollo spacecraft
- Talking with the Moon: Inside Apollo's premodulation processor
- X-ray reverse-engineering a hybrid module from 1960s Apollo test equipment
- Reverse-engineering the Apollo spacecraft's FM radio
- Reverse-engineering an airspeed/Mach indicator from 1977
- Inside the Globus INK: a mechanical navigation computer for Soviet spaceflight
- Reverse-engineering an electromechanical Central Air Data Computer
- Reverse-engineering the electronics in the Globus analog navigational computer
- Reverse-engineering the Globus INK, a Soviet spaceflight navigation computer
A look at various chips
- Reverse engineering a
counterfeit7805 voltage regulator - Inside the Intel 1405: die photos of a shift register memory from 1970
- Understanding silicon circuits: inside the ubiquitous 741 op amp
- 555 timer teardown: inside the world's most popular IC
- Reverse engineering the popular 555 timer chip (CMOS version)
- Inside the tiny RFID chip that runs San Francisco's "Bay to Breakers" race
- Inside a RFID race timing chip: die photos of the Monza R6
- Superbeta transistors inside: Die photos and analysis of the LM108 op amp
- Inside the 74181 ALU chip: die photos and reverse engineering
- Inside the vintage 74181 ALU chip: how it works and why it's so strange
- Reverse engineering the 76477 "Space Invaders" sound effect chip from die photos
- Inside Intel's first product: the 3101 RAM chip held just 64 bits
- Examining a vintage RAM chip, I find a counterfeit with an entirely different die inside
- Inside the 76477 Space Invaders sound effect chip: digital logic implemented with I2L
- Silicon die analysis: inside an op amp with interesting "butterfly" transistors
- Looking inside a 1970s PROM chip that stores data in microscopic fuses
- Inside the Am2901: AMD's 1970s bit-slice processor
- Reverse-engineering the audio amplifier chip in the Nintendo Game Boy Color
- Reverse-engineering and comparing two Game Boy audio amplifier chips
- Inside the HP Nanoprocessor: a high-speed processor that can't even add
- Reverse-engineering the first FPGA chip, the XC2064
- HP Nanoprocessor part II: Reverse-engineering the circuits from the masks
- How to multiply currents: Inside a counterfeit analog multiplier
- Inside the stacked RAM modules used in the Apple III
- Reverse-engineering the classic MK4116 16-kilobit DRAM chip
- Reverse engineering RAM storage in early Texas Instruments calculator chips
- Reverse-engineering the clock chip in the first MOS calculator
- Reverse-engineering an early calculator chip with four-phase logic
- Reverse-engineering a low-power LED flasher chip
- Examining a technology sample kit: IBM components from 1948 to 1986
- IBM paperweight teardown: Reverse-engineering 1970s memory chips
- A one-bit processor explained: reverse-engineering the vintage MC14500B
- Teardown of a quartz crystal oscillator and the tiny IC inside
- Strange chip: Teardown of a vintage IBM token ring controller
- Reverse-engineering the standard-cell logic inside a vintage IBM chip
- Two dies in one package: Teardown of a vintage ROM with double the storage
- Teardown of a logic chip from a vintage IBM ES/9000 mainframe
- Reverse-engineering a vintage comparator chip
- Reverse-engineering a vintage OR/NOR chip
- Deep dive into how the Teensy microcontroller interacts with the Arduino library
- Reverse-engineering a vintage power supply chip from die photos
- Reverse-engineering a tiny 1980s chip that plays Christmas tunes
- Silicon die teardown: a look inside an early 555 timer chip
- A look inside the chips that powered the landmark Polaroid SX-70 instant camera
- Inside the Apple-1's unusual MOS clock driver chip
- Inside the Apple-1's shift-register memory
- Reverse-engineering the LM185 voltage reference chip and its bandgap reference
- Reverse-engineering a 1960s cordwood flip flop module with X-ray CT scans
- The complex history of the Intel i960 RISC processor
Chargers and power supplies
- Apple didn't revolutionize power supplies; new transistors did
- Tiny, cheap, and dangerous: Inside a (fake) iPhone charger
- Apple iPhone charger teardown: quality in a tiny expensive package
- A dozen USB chargers in the lab: Apple is very good, but not quite the best
- Teardown of the mysterious KMS 4-port USB charger
- Teardown and exploration of Apple's Magsafe connector
- The Mili universal car/wall USB charger, tested in the lab
- I wouldn't have given a nickel for their stock: Visiting Apple in 1976
- iPad charger teardown: inside Apple's charger and a risky phony
- Reverse-engineering the TL431: the most common chip you've never heard of
- Fixing the core memory in a vintage IBM 1401 mainframe
- Counterfeit Macbook charger teardown: convincing outside but dangerous inside
- Lacking safety features, cheap MacBook chargers create big sparks
- Repairing a 1960s mainframe: Fixing the IBM 1401's core memory and power supply
- Glowing mercury thyratrons: inside a 1940s Teletype switching power supply
- Understanding and repairing the power supply from a 1969 analog computer
- Tiny transformer inside: Decapping an isolated power transfer chip
- Teardown of a PC power supply
The vintage IBM 1401 computer
- A database of SMS cards: The technology inside IBM's 1960s mainframes
- 12-minute Mandelbrot: fractals on a 50 year old IBM 1401 mainframe
- Bitcoin mining on a 55 year old IBM 1401 mainframe: 80 seconds per hash
- Examining the core memory module inside a vintage IBM 1401 mainframe
- Qui-binary arithmetic: how a 1960s IBM mainframe does math
- Inside card sorters: 1920s data processing with punched cards and relays
- 1950's tax preparation: plugboard programming with an IBM 403 Accounting Machine
- Identifying the "Early IBM Computer" in a Twitter photo: a 405 Accounting Machine
- Creating a Christmas card on a vintage IBM 1401 mainframe
- Repairing a 1960s-era IBM keypunch: controlled by mechanical tabs and bars
- An 8-tube module from a 1954 IBM mainframe examined: it's a key debouncer
- Repairing the card reader for a 1960s mainframe: cams, relays and a clutch
- The printer that wouldn't print: Fixing an IBM 1401 mainframe from the 1960s
- Bad relay: Fixing the card reader for a vintage IBM 1401 mainframe
- Hammer time: fixing the printer on a vintage IBM 1401 mainframe
- Accounting machines, the IBM 1403, and why printers standardized on 132 columns
- Risky line printer music on a vintage IBM mainframe
- Booting the IBM 1401: How a 1959 punch-card computer loads a program
- Germanium transistors: logic circuits in the IBM 1401 computer
- Christmas shopping the IBM way: computerized gift selection in 1962
IBM System/360
- Iconic consoles of the IBM System/360 mainframes, 55 years old
- A look at IBM S/360 core memory: In the 1960s, 128 kilobytes weighed 610 pounds
- IBM, sonic delay lines, and the history of the 80×24 display
- TROS: How IBM mainframes stored microcode in transformers
- Simulating the IBM 360/50 mainframe from its microcode
Arduino
- Arduino + SheevaPlug = Cool Hardware Platform
- Secrets of Arduino PWM
- Arc + Arduino + ARM: Temperature monitoring
- A Multi-Protocol Infrared Remote Library for the Arduino
- An Arduino universal remote: record and playback IR signals
- IR Bubbles: Controlling a relay with an Arduino and an IR remote
- Controlling your stereo over the web with the Arduino infrared library
- TV-B-Gone for the Arduino
- Arc beats Python for a web-controlled stereo
- Using arbitrary remotes with the Arduino IRremote library
- Don't walk! Controlling a pedestrian sign with an Arduino
- Detecting an IR Beam Break with the Arduino IR Library
- Understanding Sony IR remote codes, LIRC files, and the Arduino library
- Getting the (literal) bugs out of a driveway gate controller
- Improved Arduino TV-B-Gone
- Testing the Arduino IR remote library
- IRremote library now runs on the Teensy, Arduino Mega, and Sanguino
- Control your mouse with an IR remote
- 64-bit RC6 codes, Arduino, and Xbox remotes
- My 0.015 minutes of fame on CNN
- Decoding an air conditioner control's checksum with differential cryptanalysis
Miscellaneous teardowns and reverse engineering
- Fixing my Concertmate MG-1 Synth
- Inside the Firesheep code: how it steals your identity
- Tenma 72-7740 multimeter: review and teardown
- Simulating a TI calculator with crazy 11-bit opcodes
- Reverse-engineering and simulating Sinclair's amazing 1974 calculator with half the ROM of the HP-35
- How Hacker News ranking really works: scoring, controversy, and penalties
- Macbook charger teardown: The surprising complexity inside Apple's power adapter
- Creating high resolution integrated circuit die photos with Hugin or ICE
- Sonicare toothbrush teardown: microcontroller, H bridge, and inductive charging
- IBM mainframe tube module part II: Powering up and using a 1950s key debouncer
- Op amp on the Moon: Reverse-engineering a hybrid op amp module
- Reverse-engineering precision op amps from a 1969 analog computer
- Repairing a vintage 40-kilovolt xenon lamp igniter
- Reverse-engineering an unusual IBM modem board from 1965
- Reverse-engineering the waveform generator in a 1969 breadboard
- Reverse-engineering a mysterious Univac computer board
Miscellaneous electronics
- Spectral analysis with the Tektronix 5000 oscilloscope
- How to create a new schematic symbol in the Eagle editor
- Twelve tips for using the Rigol DS1052E Oscilloscope
- Four Rigol oscilloscope hacks with Python
- The BeagleBone's I/O pins: inside the software stack that makes them work
- PRU tips: Understanding the BeagleBone's built-in microcontrollers
- How to run C programs on the BeagleBone's PRU microcontrollers
- Hands-on with the PocketBeagle: a $25 Linux computer with lots of I/O pins
- Implementing FizzBuzz on an FPGA
- Reading a VGA monitor's configuration data with I2C and a PocketBeagle
- Using an FPGA to generate raw VGA video:FizzBuzz with animation
Bitcoin
- Bitcoins the hard way: Using the raw Bitcoin protocol
- Bitcoin transaction malleability: looking at the bytes
- The Bitcoin malleability attack graphed hour by hour
- Hidden surprises in the Bitcoin blockchain and how they are stored: Nelson Mandela, Wikileaks, photos, and Python software
- Bitcoin mining the hard way: the algorithms, protocols, and bytes
- The programming error that cost Mt Gox 2609 bitcoins
- Mining Bitcoin with pencil and paper: 0.67 hashes per day
- How to display the Bitcoin symbol using a webfont
- How I added 6 characters to Unicode (and you can too)
The Arc language
- Arc Internals, Part 1
- The foundation of Arc: Documentation
- What's new in arc2
- Git and the Anarki Arc repository: a brief guide
- Arc template documentation
- Arc internals part 2: Macros
- Arc assignment and places documentation
- Arc documentation table of contents
- Internals of places and setforms
- I/O in the Arc language
- Lots more documentation
- Arc continuation puzzle
- Arc: popular since 2004!
- Documentation for (almost) all of Arc
- Continuations made difficult
- Documentation of HTML generation in the Arc language
- Ajax and Arc
- Many Arc compilers and interpreters
- Idioms for programming in Arc
- Why Arc is bad for exploratory programming
- Using OpenGL with Arc
- Why Arc is good for video games
- Why your favorite language is unpopular
- Simple Cryptanalysis with Arc
- Readline support for Arc
- The Y Combinator in Arc and Java
- F# for Cheapskates
- Arc errors (slightly) demystified
- What's new in arc3?
- Inside the news.yc ranking formula
- World's smallest Arc server
- Simple genome analysis with Arc: In which I examine the XMRV genome and discover little of interest
- Decoding the secret DNA code in Venter's synthetic bacterium
- Using Arc to decode Venter's secret DNA watermark
- Solving edge-match puzzles with Arc and backtracking
- Solving a math problem of Schrödinger with Arc and Python
- IPv6 web serving with Arc or Python: adventures in IPv6
- The Mathematics of Volleyball
Other random stuff
- "Even tried multi" error explained
- The importance of software testing
- "Maxwell's equations of software" examined
- The rise of scripting languages and the fall of Java
- QR codes in Lego
- Why Unicode is important
- Notes on dual-booting Windows 7 and Linux
- Lorem Ipsue: when internationalization goes bad
- Some similar and confusing Spanish words
- Viking Dishwasher Fault Codes
- Spanish vocabulary from "Harry Potter y la piedra filosofal"
- USB Panic Button with Linux and Python
- Your relationship: mathematically doomed or not?
- Car radio repair made difficult
- A visit from The Great Internet Migratory Box of Electronics Junk
- IPv6 killed my computer: Adventures in IPv6
- Solving a math problem of Schrödinger (Part II)
- My Knuth reward check
- Cells are very fast and crowded places
- A new multi-branch algorithm to render rational-exponent Mandelbrot fractals: Part I
- JavaScript secrets of Bret Victor's homepage
- Obama on sorting 1M integers: Bubble sort the wrong way to go
- JavaScript on the go: Programming from your phone
- Wealth distribution in the United States
- 9 Hacker News comments I'm tired of seeing
- A visit to the Large Scale Systems Museum
- How "special register groups" invaded computer dictionaries for decades
1 comment:
reccism told me about you, airgapped ethernet, could LANCE type chips be programed to transmit over unused cables, made into transmitter antenna?
Post a Comment