I've obtained one of these "EMP generators" that are intended to cause glitches in gaming machines, either for free gaming or to dump coins.
It's pretty odd.
Most prominent is the 3-pin device on top.
It's an NPN transistor for RF.
It's socketed and comes with a spare....
Superficially... when you press the button, it generates a field that can light up a fluorescent tube...
The instructions are... well... interesting.
Peeling the shrink wrap off, we can see how homebrew this is.
There's some kind of transformer on the top, with a large coil with a smaller one. Almost Tesla coil like.
There is a button to trigger it, two DIP switches (which I think you should only turn one on) and a trimmer pot. I can't tell what the trimmer pot does.
Really oddly, it has three (3!!!) charging ports. I think you need to charge each one in turn. So three batteries and no charge controller?
Oddly the PSU is 12.5V... so it could really have nothing controlling charge.
Each one is hovering at about 12V - so possibly 36V in series? Not sure.
One DIP switch is continuous, the other is pulse.
A little bit of smoke came out just now. The transistor does get very hot very fast.
It's so hot glued together that taking it apart further is going to be risky...
Holy fuck nugget, that is really janky.
So yeah, it's 3*3 Li-Ion packs with each jack cross 3 of them. Dodgy.
The little board has a 555. Contacts are labelled VCC, GND, OUT-
So with the main transistor out, the little 555 board is simply pulling the output low at around 12kHz. Duty cycle is about 60%.
Trimmer changes this frequency from about 8Hz to 25Hz.
So the top part must just be self-resonant, and this turns it on and off.
So with the dip switches set to "constant" (i.e. 36V applied to the resonant board, you end up with an approximately 58MHz signal on the base of the transistor.
And a crazy 230V on the collector!
I've tried to quickly reverse it... but what?
Surely I have made a mistake here?
The bigger coil is on the left of the transformer, the thinner many windings on the right.
Does this make any sense to anyone?
@synx508 has found someone who has looked at these before.
Schematics are almost identical. Very surprised these really oscillate so much and don't nuke themselves, given they are shorting the transistor across the rails.
On the spectrum analyser, with just a short length of wire we are seeing powerful emissions at 50MHz and many harmonics.
Would be interesting to see what this does to electronics.
I wonder why "150MHz" is in the title? I mean, it is making noise on 150MHz, but also every other harmonic of 50MHz.
I mean, it seems to have some impact on electronics.
No resets, but then this is a modern microcontroller in here.
In this position, it's not doing much to the game... but check out the bench PSU!
It certainly causes things to happened that you don't expect!
I suspect this may be causing issues with the video memory.
I don't really have any targets to hand that I want to risk breaking currently. It may be interesting to see what this does to bootloaders on various devices.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
After the #FlipperZero threads, there's been a few people questioning the ethics and legality of these devices, particularly with respect to NFC cloning.
I think explaining some of the history of NFC security - particularly Mifare Classic - attacks might help.
Mifare Classic cards are everywhere.
In the UK and US, most hotels and a very large proportion of commercial access control systems will use Mifare Classic.
We've known that they have serious security weaknesses in these cards for over a decade, yet they are still used.
The cards have a number of "sectors" of memory, and to be able to read or write these, you need to know a 48 bit key for that sector.
For a Mifare Classic 1K, there are 16 sectors, with two keys per sector, so possibly 32 keys!
The sub-GHz part of the Flipper is driven by a TI CC1101 RF transceiver. This is in the same family as the CC1110 that was famously turned into a spectrum analyser in the IM-ME instant messenger toy.