Inspector

Awaiting input. Drop a file or paste a hex sequence above.

Magic Byte Atlas

Entropy Heuristics

Shannon entropy in bits per byte: text averages 4.0 to 5.5, compiled code about 5.5 to 6.5, compressed or encrypted data approaches 8.0. A pure-8.0 result over a long file means either AES, /dev/urandom, or already-compressed data. A region that suddenly jumps from 5 to 8 inside an otherwise-structured file is your steg or your secret.

SPI NOR Flash (W25Q, MX25, GD25)

In-circuit reads are a coin flip. The host MCU may fight the bus. Holding the MCU in reset (or simply pulling its power while leaving the flash powered through the clip) usually works. A CH341A programmer and a Pomona SOIC-8 clip will recover most consumer-router firmware in under a minute.

JTAG Header Conventions

U-Boot Banner Anatomy

When you find UART on a consumer router or IoT device, you usually get U-Boot. The banner looks something like:

U-Boot 1.1.4 (Mar 12 2019 - 11:24:18)
Board: AR9344 (Honey Bee) U-boot
DRAM:  64 MB
Flash: 16 MB
Hit any key to stop autoboot:  3

Three seconds is the standard window. Past it, the kernel loads and you lose interactive access until next boot. Useful U-Boot commands: printenv, setenv bootargs, md.b 0x80000000 200 (memory dump byte), tftpboot, bootm.

Band Atlas

Notable Fixed Frequencies

What They Are

Shortwave stations that broadcast formatted strings of numbers, letters, or musical notes, presumed to be one-time-pad messages to clandestine field operators. They appeared during World War II, proliferated through the Cold War, and a surprising number still operate today. None have ever been officially acknowledged by their host governments. Their existence is established; their content is not.

Active and Historic Stations

Why They Persist

One-way voice link (OWVL) has properties no digital channel can match: the receiver is a $30 shortwave radio with no installation footprint, the listener cannot be identified by traffic analysis, and a one-time pad is information-theoretically unbreakable. The Cuban Five (arrested 1998) decrypted messages from V02 Atención using a software OTP, providing the FBI with the strongest public confirmation that these stations carry real traffic.

ADS-B Mode S Extended Squitter

Every cooperative aircraft above the size threshold transmits position, velocity, and identity on 1090 MHz, twice per second, unencrypted. A $30 RTL-SDR and an antenna pick them up to about 250 nm in the open. The protocol is Manchester-coded PPM at 1 Mbps.

Type codes 1–4 carry identification (call sign), 5–8 surface position, 9–18 airborne position (with altitude), 19 velocity, 20–22 fine airborne position. Position is encoded in CPR (compact position report) format and requires pairing an even and odd frame to decode globally.

AIS (Marine, 161.975 / 162.025 MHz)

AIS uses GMSK at 9600 bps. Encoded payload uses a 6-bit ASCII variant. Decoders: aisdecoder, rtl_ais, OpenCPN for visualization.

POCSAG Frame Structure

POCSAG (Post Office Code Standardization Advisory Group, 1982) is the lingua franca of one-way paging. Frames are FSK at 512, 1200, or 2400 baud. Each batch starts with a sync codeword, followed by eight pairs of address and message codewords.

FLEX (Motorola, 1993)

Successor to POCSAG. Higher capacity (1600, 3200, 6400 bps), four-level FSK above 1600, better error correction. Most modern paging systems in North America are FLEX. Decode with multimon-ng -a FLEX or PDW on Windows.

Common Frequencies

2.4 GHz Channel Allocation

Use 1, 6, 11 in the US for non-overlap with 20 MHz channels. 40 MHz channels on 2.4 GHz are a courtesy violation; deploy them on 5 GHz instead.

5 GHz UNII Bands (US FCC)

Security Generation Reference

Switching Generations

Almon Brown Strowger, a Kansas City undertaker, invented the step-by-step switch in 1891 after deciding the local operator (the wife of a competing undertaker) was diverting his calls. Hold a grudge long enough and it becomes an industry.

In-Band Signaling Heritage

Color Boxes (Heritage Reference)

The boxes are historical artifacts. None work on a modern PSTN; all of in-band signaling moved to out-of-band SS7 by the late 1980s. Read this as you would read about lock pickers in the era of Yale's original lever lock.

DTMF Workbench

DTMF Frequency Matrix

The A/B/C/D column was reserved for military AUTOVON precedence (Flash Override, Flash, Immediate, Priority). Civilian phones omitted it. Surviving in amateur trunking and some legacy mil-spec gear.

Call Progress Tones (North America)

Standards Timeline

Anatomy of a Connection

Two V.34 modems negotiate in five phases over about 25 seconds, which is exactly why the "noise" is so distinctive. Each phase has a sonic signature you can learn to recognize.

1. Phase 1, network interaction. DTMF dialing, then ringing, then the answering modem's 2100 Hz answer tone (the long beep).
2. Phase 2, probing. Calling modem sends V.8 menu; both pick the highest mutually supported standard. The brief silence and then descending dual-tone burst.
3. Phase 3, line probing. Both modems sweep tones across the audio band so each can measure frequency response and noise. The signature "warbling".
4. Phase 4, training. A pseudo-random sequence trains echo cancellers and equalizers. The "hiss".
5. Phase 5, rate negotiation and data. Final agreement on bit rate, switch to scrambled data, CONNECT message to DTE.

Hayes AT Command Reference

CIDR Calculator

Prefix Length Reference

Well-Known Ports

DNS Record Types

Encapsulation

An HTTPS request lives at the center of nested headers. Each layer prepends its own metadata. Reading a packet capture is reading from outside in.

TCP Flag Cheat

HTTP Status Bestiary

Protocol Anatomy

IRC is line-oriented, plain ASCII, port 6667 (or 6697 for TLS). Every message ends in CRLF. The protocol is RFC 1459 (1993) with extensions in 2810-2813 (2000). Modern servers add capabilities via the IRCv3 spec set.

NICK acid_burn
USER acid 0 * :Kate Libby
JOIN #gibson
PRIVMSG #gibson :hack the planet
:server.example 332 acid_burn #gibson :Hack the planet
:[email protected] PRIVMSG #gibson :anyone home?

Common Commands

The Networks

Major US Residential Keyways

Bitting Code Convention

A bitting code is the depth of each cut, expressed bow-to-tip. Schlage uses depths 0 through 9 (0 is shallow, 9 is deep). Kwikset uses 1 through 7. A Schlage SC1 key with bitting 12345 reads tip-side-up: pin 1 at depth 1 nearest the bow, pin 5 at depth 5 at the tip.

MACS, Maximum Adjacent Cut Specification, limits how steep the cut between two adjacent pins can be. Exceeding it produces a key that cannot be cut on a code machine without breaking the bit.

DIN 66399 Shred Classes

The German standard supersedes the older DIN 32757. Three protection classes (P-1 to P-7 for paper, more letters for film, optical, hard drive, electronic). For paper, P-1 is the cheapest office strip cut; P-7 is what intelligence agencies use.

NSA/CSS Specification 02-01 governs US federal classified destruction; NSA EPL lists approved devices. For magnetic media the relevant document is NSA/CSS Storage Device Sanitization Manual.

What People Throw Out

From a defender's perspective, the high-value trash categories are: pre-shred staging bins (the unlocked rolling cart waiting for the shredder), printer waste (test prints, misprints), shipping cartons with addresses and routing numbers, mailed solicitations (full name, address, sometimes preapproved credit instruments), and old hardware with intact storage media. The countermeasure for each is procedural, not technical: lock the rolling carts, shred all printer waste, deface cartons before disposal, opt out where possible, sanitize media before discard.

Social Engineering Pretext Catalog

Steganography Category Atlas

Where to Look First

1. Run exiftool on the file. Eighty percent of "hidden" data is in metadata.
2. Run binwalk. Embedded files (ZIPs inside PNGs, etc.) jump out.
3. Open in a hex editor. Look at the file tail past the format's terminator.
4. For images, view bit planes separately. The LSB plane of a clean image looks like static; an LSB-stego'd image has structure visible to the eye in flat areas.
5. For PNGs, compare the IDAT chunk's expected vs actual decompressed size.
6. For PDFs, dump objects with qpdf --qdf. Hidden streams, JS, or embedded files surface.
7. For audio, open in Audacity. Spectrogram view reveals payloads encoded in high frequencies (a common CTF trick).

Tooling

The Order of Operations

1. Capture before you touch. Hash the source. Image with dd, dc3dd, or a write-blocker plus ewfacquire. Verify the image hash matches.
2. Memory first if the box is live. Memory dies when power dies; disk waits. Use LiME on Linux, WinPmem on Windows, osxpmem on macOS (where still supported).
3. Triage the timeline. mactime or plaso against the filesystem metadata. Sort by time. The story is in the order.
4. Carve the unallocated. Deleted files often survive intact in slack until a new allocation overwrites them. photorec, scalpel, foremost.
5. Reconstruct the user. Browser history, shellbags, jumplists, prefetch, ~/.bash_history, recent docs. The OS keeps more diaries than the user knows.

Filesystem Artifact Atlas

Memory Forensics Vocabulary

Tooling

Hash Identifier

Hash Family Reference

Password Hashes (KDFs)

A password hash is not a hash. It is a slow hash with a salt, designed to make brute force unaffordable. Cost parameters are part of the output.

The Length Tell

Length alone narrows the candidate set fast. 32 hex chars is almost always MD5, MD4, or NTLM. 40 is SHA-1 or RIPEMD-160. 64 is SHA-256, SHA3-256, or BLAKE2s. 128 is SHA-512 or SHA3-512. Anything starting with $ is a KDF and tells you which one.

Enigma Simulator

Output appears here.

Rotor Wirings (Enigma I)

How the Machine Sees a Keypress

1. Right rotor steps. (And sometimes middle, sometimes left, via the double-stepping anomaly.)
2. Current enters the plugboard. If the key is paired (e.g. A↔M), substitute.
3. Through the right rotor (forward wiring), offset by its current position and ring setting.
4. Through the middle rotor.
5. Through the left rotor.
6. Into the reflector. The signal reverses direction.
7. Back through left, middle, right (reverse wiring).
8. Back through the plugboard.
9. Lamp lights.

A letter never enciphers to itself. This property was the leverage Bletchley used.

Operational Mistakes That Sank It

• Cribs. Standardized headers (weather reports always opened with WETTERBERICHT) gave known plaintext. With a known plaintext segment, the Bombe could test rotor positions.
• Doubled message keys. The 1930s German practice of sending the message key twice at the start. Polish cryptanalysts (Rejewski, Różycki, Zygalski) exploited this pre-war.
• Operator habit. Reused indicators, predictable rotor choices, sloppy plugboard. The Kriegsmarine was disciplined; the Luftwaffe was not.
• The reflector property. The "never to itself" rule eliminated possible alignments instantly. A free 1-in-26 advantage on every position tested.

Pad Generator

Press GENERATE to draw from crypto.getRandomValues().

The Vernam Cipher

Gilbert Vernam, AT&T, 1917. Originally a teleprinter loop: punched-tape key XORed with punched-tape message. Joseph Mauborgne added the "use it once, then destroy" rule. Claude Shannon proved in 1949 that this construction achieves perfect secrecy: the ciphertext gives an adversary with unlimited compute zero information about the plaintext beyond its length.

The catch is the four requirements.

The Four Rules. All Four. Always.

Operational Ceremony

1. Generate the pad on an air-gapped machine with a hardware RNG. Print two copies. Destroy the digital original (DBAN, then physical destruction of the drive).
2. Number every page. Number every group.
3. Sender and recipient hold one copy each. Physical custody only. Never transmitted, ever.
4. Each page is used for exactly one message. After use, burn the page.
5. Indicator at the top of each transmission tells the recipient which page and group to start from.

Where OTPs Are Actually Used

• Diplomatic traffic. Numbers stations (HA-007) broadcast OTP-enciphered messages to deployed agents. The pad lives with the agent.
• Hotline. The Moscow-Washington direct teletype link, established after the Cuban Missile Crisis, used OTPs through the 1980s.
• High-value strategic. Anywhere the threat model includes future quantum adversaries and the medium can carry the bandwidth (which is rarely).

Vigenère & Kasiski Analyzer

Index of Coincidence Reference

English Letter Frequencies (% in typical text)

Kasiski Examination (1863)

Friedrich Kasiski's method, published in Die Geheimschriften und die Dechiffrir-Kunst: find repeated trigrams or longer sequences in the ciphertext. The distances between repetitions are usually multiples of the key length (when the same plaintext fragment aligns with the same key fragment by coincidence). Take the GCDs of those distances. The most common factor is your key length.

Once you know the key length, split the ciphertext into that many cosets. Each coset is a Caesar shift. Solve each by frequency analysis, lining up the cipher's frequency profile against English. The key falls out letter by letter.

Friedman Test (1922)

William Friedman, working for the US Army Signal Intelligence Service, formalized the Index of Coincidence into a key-length estimate: L ≈ 0.027·N / ((N-1)·IC - 0.038·N + 0.065). Less reliable than Kasiski on short texts but useful as a cross-check.

Pattern, Channel, Row

A tracker file is a list of patterns. A pattern is a grid: rows down, channels across. Each cell holds at most a note, an instrument number, a volume, and an effect command. The player walks the rows at a tempo and pumps samples out of each channel. The result is music written as a spreadsheet.

Format Lineage

Effect Command Atlas (Protracker / common subset)

The Demoscene Connection

Trackers and demos grew up together. A demo group needed code, art, and music. The musician used a tracker; the coder bolted its replayer into the demo binary. The Amiga sound chip (Paula) had 4 hardware DMA channels at 8-bit, and the entire scene worked within that envelope. Later PC trackers added channels and resolution but the cultural shape carried over: small files, sample-based, music that fits in 4KB intros if it has to.

Where the Files Live Now

• The Mod Archive (modarchive.org), 175,000+ modules, browseable by format and group.
• Scene.org, the demoscene archive, hosts party releases and individual artist directories.
• AMP (Amiga Music Preservation), focused on Amiga-era authors.

The Quarter-Block Trick

Code page 437 contains four glyphs that subdivide a character cell into halves: ▀ (upper half), ▄ (lower half), █ (full), ▌ (left half), ▐ (right half). With foreground and background each able to take any of 16 colors, two adjacent halves of a cell can be drawn as independently-colored quarters. The "blocky" ANSI aesthetic is artists working in this two-color-per-cell, half-character resolution.

CP437 High Half (the box-draw region)

ANSI Color Codes

Escape sequence ESC[ (i.e. \x1b[) followed by parameters and a final letter. For color, the final letter is m.

Art Group Heritage

Tools

• PabloDraw. The de-facto modern ANSI editor. Cross-platform, supports collaboration.
• Moebius. Newer (Electron) editor with a kinder UI for newcomers.
• TheDraw. The classic DOS editor most BBS ANSIs were drawn in.
• ACiDView / ANSILove. Renderers. ANSILove is the canonical PNG converter for archival display.

The Pack as a Format

An "art pack" is a monthly ZIP from a group containing every member's work for that period, with a file_id.diz, group news, and member roster. The structure persists: blocktronics still releases packs the same way ACiD did in 1991. The largest archive of packs is sixteencolors.net, with thousands going back to the late 1980s.

The Two Lineages

Two architectures, both introduced in 1975-1976, sit under most of the consumer 8-bit era. The MOS 6502 (Apple II, Commodore PET / VIC-20 / 64, Atari 8-bit and 2600, BBC Micro, Nintendo NES) was cheap and elegant: three registers, well-thought-out addressing modes. The Zilog Z80 (TRS-80, ZX Spectrum, Amstrad CPC, MSX, Game Boy variant) was more capacious: more registers, more instructions, a shadow register set. The 6502 had ruthless simplicity; the Z80 had inventory.

MOS 6502 Register File

6502 Addressing Modes

6502 Instruction Categories (56 official opcodes)

Zilog Z80 Register File

Z80 Notable Instructions

Status Flag Conventions

The Shape of a BBS

A BBS was a personal computer with a modem on a dedicated phone line, running software that answered the phone, asked for a username, and presented a menu. Message bases. File areas. Door games. One user at a time, almost always. Sysop in the kitchen, board in the basement, family complaints when someone called during dinner.

The Software

File-Transfer Protocols

FidoNet

Tom Jennings, 1984. A store-and-forward network using BBSes as nodes. Each system had an address like 1:135/20 (zone:net/node). Messages and files (echomail) propagated overnight via "zone mail hour," 0900-1000 UTC, when nodes were required to be available for inbound mail polls. By 1995 FidoNet had more than 35,000 nodes worldwide. The protocols (FTS-0001, FTS-0006) are still implemented in Synchronet and Mystic and the network still exists, smaller.

Door Games

A "door" was a program the BBS launched on behalf of the user. The BBS handed the door the serial port (via a FOSSIL driver or DOORWAY) and the door ran until the user logged off. The classics:

• Tradewars 2002 (1986). Space trader, persistent universe, the door game.
• Legend of the Red Dragon (1989). Fantasy RPG with one turn per day. Seth Robinson.
• Usurper (1989). Rasmus Lindelöw. LORD's grim cousin.
• BRE / Barren Realms Elite (1992). 4X strategy in turns.
• Operation Overkill II (1990). Post-apoc shooter with great ANSI.

Vocabulary

Phrack Magazine

Founded November 17, 1985 by Taran King and Knight Lightning on Metal Shop BBS, Phrack was the underground's journal of record. The format was a plain-text electronic magazine, distributed via BBS and email, structured as numbered articles in numbered issues. Most issues opened with a Prophile (an interview with a notable scene figure) and closed with the World News and Pirate's Cove. The technical content sat between.

Selected Issues, From the Long Index

2600: The Hacker Quarterly

Founded January 1984 by Emmanuel Goldstein (Eric Corley). Print magazine, still publishing, four issues a year. The title refers to the 2600 Hz tone Cap'n Crunch used to seize trunks (HA-011). 2600 hosts the annual HOPE conference at Hotel Pennsylvania (now elsewhere) in New York City. The magazine's letters section is its own institution.

Other Zines of Record

The ASCII Art Magazine Tradition

A zine in this lineage had a title block, a contents page, and articles numbered in plain text. Headers were drawn in CP437 box-draw or 7-bit ASCII art. Every issue had a "rant" article and a "scene news" article. Many had a "world news" digest of arrests, raids, and busts (HA-027's BLOCKCRAFT and the zine tradition share visual ancestry).

Where to Read Now

• phrack.org. The complete Phrack archive, every issue, plain text and as PDFs for recent ones.
• 2600.com. Current issue is print/digital; back issues sold individually.
• archive.org. Computer Underground Digest is mirrored. Many smaller zines are preserved here.
• textfiles.com. Jason Scott's archive. Decades of BBS-era text files, organized.
• cdc.textfiles.com. The cDc archive.

Where the Field Begins

The Morris worm (November 2, 1988) exploited a stack overflow in BSD's fingerd. The technique was not new; the consequence was. Robert T. Morris Jr. became the first person convicted under the 1986 Computer Fraud and Abuse Act. The bug class became permanent industry vocabulary. Eight years later, in Phrack 49, Aleph One wrote "Smashing the Stack for Fun and Profit," which made the technique broadly comprehensible. Everything that followed is commentary on those two events.

Vocabulary Atlas (Read These Names, Then Read the Mitigations Below)

The Defense Stack (What Actually Stops This)

The Arms-Race Shape

Every mitigation above was introduced because the prior set was insufficient. Stack canaries were defeated by skipping them via direct write further up the stack. NX was defeated by ROP. ASLR was defeated by info leaks. Each step has raised the cost. Modern exploitation against fully-mitigated binaries is a research-level activity that often chains multiple bugs (an info leak plus a write primitive plus a control-flow target) into a single working payload. The cost has not stopped attackers, but it has pushed the price up by orders of magnitude.

Books You Should Read (Defensive Curriculum)

• The Shellcoder's Handbook, Anley, Heasman, Lindner, Richarte. The standard educational text on the bug classes.
• Hacking: The Art of Exploitation, Jon Erickson. Excellent walk through the foundations.
• A Bug Hunter's Diary, Tobias Klein. Real bugs, with the chain of discovery preserved.
• Practical Reverse Engineering, Dang, Gazet, Bachaalany. The companion volume on how to read other people's binaries.

The Five Layers

A rootkit's category is defined by where it sits relative to the kernel and firmware. Each layer down is harder to install, harder to detect, and harder to remove.

Persistence Mechanisms (Where the Hooks Go)

Historical Cases You Should Recognize

Detection: Where Defenders Look

1. Cross-view scanning. Ask the system the same question two ways. Compare a process list from the API with a list reconstructed from kernel structures (psscan, VAD walk). Discrepancies are the find.
2. Boot integrity. TPM-backed measured boot. The TPM records hashes of each stage; an unexpected hash means an unexpected component. Tools: tpm2_pcrread, Windows Device Health Attestation.
3. Firmware integrity. Read SPI flash with a hardware programmer (CH341A, etc.), compare to vendor-released images. Intel's CHIPSEC framework automates much of this.
4. EDR telemetry. Modern endpoint products watch for unusual driver loads, unsigned modules, kernel callback registrations, and abnormal cross-process activity. The high-value signals are the rare events.
5. Offline scanning. Boot from a known-good live image (e.g. a forensic distro), mount the suspect disk read-only, scan from outside. A rootkit cannot lie about a filesystem it is not running on.
6. Network behavior. Beacons. DNS to unusual TLDs. C2 traffic patterns. Sometimes the only ground truth is what packets leave the network interface, observed from outside the host.

Tooling, Defender-Side

Resistor Color Code Decoder

SMD Resistor Code Decoder

Resistor Color Reference

SMD Code Conventions

E-Series Values (per Decade)

SMD Package Sizes

Capacitor Markings

Ceramic SMD (no markings, mostly): consult the BOM. 0402 and 0603 ceramics are too small for legible marking. Color is meaningless. Use a capacitance meter or trust the reel.

Ceramic through-hole (disc, monolithic): three-digit code in pF. 104 = 10 × 10⁴ pF = 100 nF. Letter suffix is tolerance (K = ±10%, M = ±20%, J = ±5%).

Electrolytic: capacitance and voltage printed directly. Negative lead marked (stripe on the can). Polarity matters; backwards installation will fail loudly.

Tantalum SMD: case letters (A/B/C/D/E/X) indicate physical size. Voltage rating coded as a letter (e.g. A = 10 V, C = 16 V, D = 20 V). Polarity marked by a stripe on the positive end (opposite convention from electrolytic; a known pitfall).

The Core Idea

A microprocessor operates inside an envelope of voltage, temperature, clock period, and electromagnetic conditions. Push briefly outside that envelope at the right moment and the processor may compute the wrong result, often deterministically: it skips an instruction, mis-loads a register, fails to take a branch. If the affected instruction is a security check, the consequence is a bypass. Glitching is the disciplined exploration of when, how, and how briefly to step outside the envelope.

Glitch Categories

Parameters You Tune

• Trigger offset. Time from a reference event (reset deassertion, GPIO toggle, UART byte) to the glitch. Often the dominant search dimension; sweep it.
• Glitch width. How long the upset lasts. Picoseconds matter for clock glitching; nanoseconds for voltage; microseconds for EM coil discharge.
• Glitch amplitude. How far below Vcc you pull, how strong the EM pulse is, how hot the laser.
• Repetition / multiplicity. A double glitch is a different attack from a single. Some targets harden against one but not the other.

Historical Successes (Defender's Heritage)

Defense in Depth

• Double checks. The same security comparison performed twice, with different code paths, makes single-glitch bypass harder. Pair with a delay between checks.
• Glitch detectors. Voltage and clock monitors that latch a fault flag when a transient is detected. Mandatory on modern smart cards.
• Random delays. Insert pseudorandom NOPs around sensitive operations so the trigger offset becomes a moving target.
• Sensitive variable redundancy. Store a flag and its complement. Verify both. Catches single-bit flips.
• Lifetime fuses / RDP escalation. Modern STM32 (RDP level 2) and some other MCUs make readout protection one-way; downgrade requires die-level work.
• Physical mesh / passive shield. Top-metal mesh on the die that, when disturbed, triggers tamper. Used on high-security SE/SC chips.
• Move secrets to a Secure Element. Hardware wallets that delegate to a real SE (CC EAL5+ or similar) raise the cost meaningfully. Pure MCU-based designs are softer.

The ChipWhisperer Ecosystem

Colin O'Flynn's open-source platform (NewAE Technology) democratized glitching and side-channel research in the 2010s. The Lite/Pro/Husky boards, the chipwhisperer Python package, and the published courseware (NSA-2024-funded curriculum, university adoptions, Black Hat trainings) are the canonical learning path. The associated GitHub repo includes signed-off lab exercises that walk through real bypasses on real targets, conducted on the researcher's own hardware. Worth a winter to work through.

The Premise

A cryptosystem proved secure on paper may still leak its secrets through the physical implementation. Power consumption depends on the data being processed. Execution time depends on the branches taken. Electromagnetic emanations carry the same data signature as the bits flowing across the bus. The mathematical proof assumes a black box; the implementation is not a black box, and a patient attacker can read what leaks through its walls.

Channel Atlas

Power Analysis Techniques

Historical Lineage

Defenses

• Constant-time code. No data-dependent branches, no data-dependent table indexing. The standard countermeasure for timing attacks; harder than it sounds (compilers re-introduce branches).
• Masking. XOR every intermediate value with fresh randomness; do the crypto on shares; combine at the end. Defeats first-order DPA. Higher-order masking defeats higher-order analysis at proportional cost.
• Hiding. Randomize execution order, insert dummy operations, randomize the clock. Reduces SNR rather than eliminating leakage.
• Blinding. Multiply RSA exponent by random factor before operation; divide out after. Bernstein-style remote timing defenses.
• Cache partitioning / flushing. Intel CAT, ARM MPAM. Limits cross-domain cache reuse. Mitigation against Prime+Probe family.
• Physical shielding. Faraday enclosures for TEMPEST. Smart-card top-metal mesh as both glitch and EM shield.
• Microarchitecture redesign. The Spectre family forced a decade of speculation-safe primitives. Indirect branch restricted speculation, IBPB, eIBRS, retpolines. The cost is real and ongoing.

LDO Power Dissipation

LDO vs Switcher

LDO Selection Criteria

Bypass Capacitor Stack

Real-world capacitors are not ideal. Each has an ESL (series inductance) that gives it a self-resonant frequency, above which it stops behaving as a capacitor. The standard answer is a stack of different values, each handling a different frequency band.

Place caps adjacent to the IC power pin, with the shortest possible loop to ground. Loop area (not trace length) sets the parasitic inductance. Via-in-pad with stitching to a ground plane is the textbook layout.

Brown-Out and Reset Supervisors

The job of a supervisor is to hold the MCU in reset until Vcc is high enough for deterministic operation. Most modern MCUs have an integrated BOD/BOR; external supervisors are still useful for multi-rail boards (assert reset until both 1.2 V and 3.3 V are valid).

Power Sequencing

Multi-rail SoCs (FPGAs, application processors, RF chips) often require rails to come up in a specific order, sometimes with timing windows. Datasheets specify allowable inter-rail skew, monotonic ramp requirements, and which rail must rise first. Violating sequencing can latchup the chip or stress internal ESD structures. PMICs exist primarily to enforce sequencing across many rails from one shared control plane.

Follow the Rails (Reverse Engineering)

When you crack open an unfamiliar board, the power tree is usually the easiest map to draw first:

1. Identify the input. DC jack, battery connector, USB power, or a buck-boost off a wall-wart. Read the rail voltage and current expectation.
2. Spot the regulators. SOT-23-5 with a coil nearby is a buck. SOT-23-3/SOT-89 with no inductor is an LDO. PMICs are bigger QFN/BGA with many surrounding caps.
3. Trace the output of each regulator. The bulk capacitor next to the regulator marks the rail; follow the largest copper region attached to it.
4. Note which ICs sit on which rail by following the bulk cap to nearby chips' VCC pins. Rails to MCU, RAM, flash, RF, analog often differ.
5. Confirm with a multimeter on a powered-up board: hover the probe over the bulk cap, read the rail voltage. Match against expected (1.8, 3.3, 5, 12 V, etc.).

By the time you have annotated the power tree, you know where the analog domain is, where the radio is, where the digital core is, and which chip is the master. The schematic almost draws itself from there.

Why Anyone Decaps

A modern IC's package hides everything interesting: the die, the bond wires, the pad ring, the layout, and ultimately the function. Decapsulation, removing the molding compound or lid while preserving the silicon, lets you photograph the chip, study its architecture, and in some cases reverse engineer its function. This is hobby archaeology for vintage parts (the Visual6502 project), commercial competitive analysis for modern parts (TechInsights), and the foundation of hardware reverse engineering in security research.

Method Atlas (Increasing Difficulty)

Microscopy

Delineation Etches

After decap, the die's metallization layers can be removed sequentially with selective etches, exposing the layers beneath. The full-stack reverse engineering workflow is decap → top-metal photo → strip M_top → photo M_top-1 → repeat, all the way down to diffusion and polysilicon.

Die-Shot Lineage

Image Stitching at Gigapixel Scale

A modern IC die at the resolution needed to identify individual transistors is too large to capture in one frame; the field of view of a 100× objective is ~150 μm, and a die can be 10 mm on a side. The standard workflow takes a grid of overlapping images on a motorized X-Y stage, then stitches them in software (Hugin, Fiji, custom Python). Focus stacking across the depth of the metallization layers is often required. The output is typically a multi-gigapixel image, browsable in tiled viewers like OpenSeadragon.

Tools at Hobbyist Scale

• USB digital microscopes (Dino-Lite, Plugable, generic) for 50× – 250× optical, enough for vintage process nodes and pad/bond inspection.
• Used metallurgical microscopes (Olympus BX, Nikon Optiphot) appear on the used market; pair with a CMOS camera adapter.
• Mechanical lid removal on ceramic-packaged vintage parts is genuinely accessible. EPROMs (with their UV window), older Intel/Motorola CPUs in CERDIP, and military-grade RAM all open with patience and a hot plate.
• Hot-air rework station for plastic-package decap. Heat to ~350°C, the lid often releases.
• Polishing wheels and diamond paste for backside thinning of plastic-encapsulated parts that have already had their tops removed.

The Two Halves of EMC

EMC is the dual problem of "what you emit" and "what you tolerate." Regulators care about both. A device that radiates too much keeps other devices from working; a device that fails when a neighbor radiates is not fit for purpose. Compliance testing exercises both directions.

Emissions Limits Overview

FCC Part 15 Class B Quasi-Peak Limits (Radiated, 3 m)

Susceptibility Test Battery

Where Emissions Come From

1. Switching power supplies. The fundamental of fsw and its harmonics. The mitigation is input/output filtering plus careful loop area.
2. Clock harmonics. A 25 MHz crystal generates emissions at 25, 50, 75, 100... MHz. Spread-spectrum clocks broaden the peaks; series termination softens edges.
3. Common-mode currents on cables. A cable that looks like an antenna at some harmonic of an internal clock will radiate. Common-mode chokes (split ferrite, integrated bead arrays) damp this.
4. Slot antennas. A poorly-stitched ground plane has slots; those slots radiate like antennas at frequencies whose wavelength matches the slot length. Stitch ground at via spacing < λ/20.
5. Heatsinks. A large unbonded heatsink over an MCU acts as a monopole. Ground the heatsink, or accept the emissions tax.

Mitigation Toolkit

The USB Port Problem

A USB cable plugged into a device makes the cable shield part of the device's ground system, and the cable becomes a quarter-wave radiator at any clock harmonic that matches its length. A 1 m cable resonates near 75 MHz. Many designs fail FCC Part 15 the first time at exactly that frequency. Common fixes:

• Common-mode choke on USB D+/D- (impedance up at 100 MHz, transparent at signal rates).
• Properly bond the USB shield to chassis ground at the connector with a 360° clamp, not a pigtail.
• Avoid running noisy clock-bearing traces near the USB connector or its return path.
• Add a small bead or LCL filter on the device's internal ground reference to the USB shell.

Pre-Compliance Testing

A real FCC / CISPR chamber day costs four-figures-plus. Pre-compliance lets you find most problems before booking the chamber.

• Near-field probes over the powered DUT, into a spectrum analyzer, will point you at the worst radiators.
• LISN (line impedance stabilization network) in series with mains lets you measure conducted emissions on a benchtop spectrum analyzer.
• ESD gun (handheld, $1500 used) lets you ESD-zap the DUT at every accessible point until you find the failure path.
• TEM cell or open-area test bench for cheap radiated measurements; correlation to a real chamber is imperfect but useful for relative changes.

The SPICE Family

Berkeley SPICE (1973) was the original. The descendants split into commercial (PSpice, HSPICE, Tina, Saber) and open (ngspice, Qucs-S, LTspice from Analog Devices though closed-source, Xyce from Sandia). Most still take the same netlist syntax with vendor extensions.

Analysis Types

Netlist Vocabulary

Where Convergence Goes Wrong

1. Missing DC path. Floating capacitors with no resistive return to ground. Add a high-value (1 MΩ) resistor across them or to GND. SPICE solves DC first; if the solver can't find a unique DC solution, .tran will fail to start.
2. Initial conditions. Capacitor or inductor with unknown initial state. Add ic= on the element or .ic v(node)=... globally.
3. Discontinuous behavioral source. A B-source with a step function (heaviside) confuses the integrator. Smooth with tanh() or interpolate.
4. Stiff models with bad timestep. SMPS at 1 MHz with a 1 ms simulation: 1000 cycles to compute. Set .tran with a sensible tstep; for some models add uic (use initial conditions, skip op-point).
5. Vendor model issues. Free SPICE models often have bugs or assume a specific dialect. Read the .lib comments. Try a simpler equivalent first.

Model Libraries

• Vendor SPICE models. TI, ADI, Maxim, ON Semiconductor, ROHM, Vishay, Linear Tech (now ADI), Microchip all publish models. ADI's LTspice ships with hundreds of their parts built in.
• Generic models. Standard 1N4148, 2N3904, 2N2222, BC547 all have decent generic models that converge well.
• BSIM models. The industry-standard MOSFET model family for IC design. BSIM3, BSIM4, BSIM-CMG. Foundries supply PDKs (process design kits) with thousands of parameters per device.
• Verilog-A and SystemVerilog-A. For models too complex or too proprietary for SPICE syntax. Most commercial simulators accept these.
• EM-augmented models. S-parameter blocks from a real measurement (Touchstone .s2p, .s4p files) plug into SPICE as black-box elements.

When to Simulate, When to Prototype

• Simulate first: control loops (compensator design for SMPS), filter response, noise budgets, gain stage stability, anything with a stability margin you need to prove.
• Simulate alongside prototyping: EMI prediction (correlation only), thermal transients, system-level signal integrity, RF matching networks (where the model and reality usually disagree by a measurable amount).
• Skip simulation: simple digital glue, breadboards of well-understood blocks, hand-soldered debugging where you can probe directly.
• Trust nothing 100%: SPICE results assume the model is correct, the parameters are right, the parasitics are accounted for, and convergence is real. All four are routinely false.

Reading-Order Conventions

• Signal flow left to right. Inputs at the left edge, outputs at the right. The reader's eye is trained.
• Power up, ground down. VCC/+ supplies leave parts upward; GND leaves downward. Power flags at the top of each sheet, ground bars at the bottom.
• One sheet, one function. Power supply on its own sheet. MCU and its bypass network on its own. Sensor front-end on its own. Hierarchical labels connect them.
• Title block always populated. Project name, sheet name, sheet number ("Page 3 of 7"), revision, date, designer initials, file path. The reader from the future is grateful.
• White space is information. Crowded schematics are unreadable. If a sheet feels tight, split it.

Naming Conventions

Hierarchical Design

Hierarchical schematics carry their structure in the form of sub-sheets and hierarchical labels. A top sheet shows the block diagram (Power → MCU → Sensor Front-End → RF Module → IO); each block is a sub-sheet with its own page-local nets. Off-sheet connectors are explicit and few.

ERC: What It Actually Catches

Footprint Discipline

• Every symbol has a footprint assigned. ERC catches missing; design rules check should too.
• Footprints come from a controlled library, not from the chip vendor's CAD download unverified. Vendor footprints have land patterns; verify against IPC-7351 for your assembly process.
• 3D models attached to footprints catch mechanical interference before fabrication. Especially valuable for connectors and shielding cans.
• Polarity matters: diode cathode, electrolytic + terminal, BGA pin A1, connector pin 1. The footprint silkscreen and the schematic symbol must agree. The mismatch shows up as an unsolderable board, not a design error.

Tool Landscape

What the Fabric Actually Is

An FPGA is a grid of look-up tables (LUTs), flip-flops (FFs), and interconnect, surrounded by dedicated blocks for memory (BRAM), arithmetic (DSP slices), and I/O (IOBs). Modern parts add hard CPUs (ARM Cortex-A or RISC-V), gigabit serial transceivers, PCIe blocks, Ethernet MACs, and high-bandwidth memory controllers. The LUT-and-FF lattice computes; the dedicated blocks accelerate.

Major Vendors and Families

Toolchain Landscape

HDLs

The Design Flow

1. Specification. Block diagram, interface description, performance targets, resource budget. Skipped at one's peril.
2. RTL. Write Verilog / VHDL / Chisel / Amaranth describing the digital behavior.
3. Simulation. Verify functional correctness on a testbench. Open-source tools: iverilog, Verilator, cocotb. Commercial: ModelSim/QuestaSim, VCS, Xcelium.
4. Synthesis. Translate RTL into a netlist of LUTs and FFs for the target fabric. The synthesizer makes timing-vs-area tradeoffs.
5. Place and route. Map the netlist onto specific LUT positions; route the interconnect. The hardest step computationally; iterative.
6. Static timing analysis. Verify that all paths meet the clock frequency. Setup and hold checks against constraints.
7. Bitstream generation. The binary file that programs the FPGA.
8. Programming and on-target test. JTAG or SPI flash. The first time the design runs on real silicon, expect surprises.

The Common Gotchas

• Inferred latches. An if without an else in a combinational block creates a latch in synthesis. Almost always a bug. Synthesis tools warn; do not ignore the warnings.
• Clock domain crossings. Signals crossing between unrelated clocks need synchronizers (two FFs) or FIFOs. Skipping this produces non-reproducible metastability bugs.
• Hold violations. Less common than setup, more painful when they appear. Often caused by clock skew on a fast path; can require manual placement constraints.
• Reset strategy. Synchronous reset is the modern default. Asynchronous reset deassertion must be synchronized. Reset trees are themselves a design.
• Resource over-budget. Designs that exceed LUTs, BRAM, or DSP slices on the target part. Easy to discover late. Plan with rough estimates early.
• Toolchain quirks. Vivado's incremental flow caches stale results. Quartus has known bugs in specific releases. Yosys is excellent but newer; the open flow has fewer years of "wisdom" accumulated.

Capacity and C-Rate Calculator

Chemistry Atlas

Charge Profiles

BMS (Battery Management System) Functions

• Cell balancing. Passive (bleed strongest cells through resistor) or active (shuttle charge). Required for multi-cell Li packs; cells drift apart over time.
• Overvoltage protection. Cuts charging current when any cell exceeds the chemistry's max. Required for Li chemistries to prevent runaway.
• Undervoltage protection. Disconnects load when cells fall below safe minimum. Li-ion below ~2.5V experiences copper dissolution.
• Overcurrent / short circuit. Fast cutoff on excessive discharge current. Often via a series FET pair.
• Temperature monitoring. Thermistors per pack region. Both charge and discharge have temperature windows (typically 0 to 45°C for charge, -20 to 60°C for discharge).
• SoC and SoH estimation. State of Charge from coulomb counting, voltage modeling, or impedance tracking. State of Health from capacity fade and resistance growth.
• Authentication. Many proprietary packs (laptop, drone) include crypto to refuse off-brand chargers or hosts.

Fuel Gauge Approaches

Stepper Step-Rate Calculator

Motor Type Atlas

BLDC Commutation

Driver IC Atlas

Feedback Devices

Common Gotchas

• Stepper resonance. Mid-speed range (often 200-1000 PPS) where the rotor's natural frequency matches step rate; stalls. Microstepping mitigates; closed-loop steppers (with encoder) defeat entirely.
• Back-EMF on sudden stop. A spinning motor is a generator; abrupt H-bridge open lets the kinetic energy spike onto the rail. Use a TVS or brake resistor; do not float the bridge mid-rotation.
• PWM frequency vs motor inductance. Higher inductance wants higher PWM frequency to keep current ripple small. Audible whine in 1-20 kHz range; above ~20 kHz is silent but switching losses rise.
• Microstep accuracy is not microstep position. A 1/256 microstep driver does not move 1/256 of a step; it interpolates current. Real position resolution may be 4-8x worse than the microstep count suggests, due to torque ripple and detent torque.
• Sensorless BLDC at low speed. Below the minimum BEMF detection threshold (often 5-10% rated speed), sensorless commutation does not work. Open-loop "kick start" or sensored startup is required.
• Brushless DC commutation alignment. If the controller doesn't know rotor position at startup, it can spin the wrong way or stall. Halls or initial position detection (high-frequency injection) solves this.

NTC Thermistor Calculator

MEMS Inertial & Environmental

Optical and ToF

Magnetic

Capacitive and Touch

Temperature

Gas, Air Quality, Particulate

Force, Strain, Pressure

Position, Distance, Ultrasonic

dB Converter and Link Budget

The Building Blocks

Receiver Architectures

Vocabulary You Have to Speak

The Friis Equation

For a cascade of stages: total noise figure F = F1 + (F2-1)/G1 + (F3-1)/(G1·G2) + ... in linear terms. The first stage's noise figure dominates; the first stage's gain divides every subsequent stage's contribution. This is why the LNA is the first block in any receiver. Free-space path loss: FSPL_dB = 20·log(d) + 20·log(f) + 32.44 (d in km, f in MHz). The link budget widget uses this.

Common RF ICs