II II I I

*
y
o
u
*
h
a
v
e
*
b
e
e
n
*
B
S
O
D
o
m
i
z
e
d
*
y o u * h a v e * b e e n * B S O D o m i z e d *
y
/
\
\
/
\
o
|
|
\
|
|
u
|
`.
|
|
:
*
`
|
|
\|
|
h
\
| /
/ \\\
--__ \\
:
a
\
\/
_--~~
~--__| \
|
v
\
\_-~
~-_\
|
e
\_
\
_.--------.______\|
|
*
\
\______// _ ___ _ (_(__> \
|
b
\
. C ___) ______ (_(____> | /
e
/\ |
C ____)/By:
\ (_____> |_/
e
/ /\|
C_____)Kingpin| (___>
/ \
n
|
(
_C_____)\_& Zoz/ // _/ /
\
*
|
\ |__
\\_________// (__/
|
B
| \
\____)
`-----'
|
S
| \_
___\
/_
_/ | O
|
/
|
| \
| D
|
|
/
\ \
| o
|
/ /
|
| \
| m
|
/ /
\__/\___/
|
| i
|
/
|
|
|
| z
|
|
|
|
|
| e
|
|
|
|
|
| d
y o u * h a v e * b e e n * B S O D o m i z e d *
II
II
I
77?
7I7 I777
II7
+III
II?
777
I? ,III I77II:
7I
~777I777,I77I7II7777III
III
777
777
77II77I
I7 7II77II 7I777+
I77777
II77 7I7,
777 777= ,III+?II77+ ,I7II7 777
II77777
7777I:
?I7I 77I
77I777II777II7I
77I ~777= I7II
II777I7II7II77I 7II
7II7?II7I 77
I7IIII
I7II
I77
77777 III
III IIIIII7?, 777
I7I,
III
,I7I7 7I
777I77IIIII777I
I77
I7+
?I7?=
+I7I7?
7I7777+
I7I
777
=I7? 77I
IIIII
77I
~7I
I77
III
I77
III
II
?II
=7
77
:77I
77III,
II7II7
~7I77IIII7
?
I
I7
I7
I7
777I?
77
77II7I
77~
77I,777
III
777 II7+
I7I
777
7III I7I,
77I
:II77I7
77?
I77I
:I,
=I
www.kingpinempire.com * www.kingpinempire.com * www.kingpinempire.com
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMIM
N MMMMMMMMI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM.Z
..M+MMMMMMMMMI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM=.
. .=MMMMMMMMMMMI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM8M
. .O.MMMMMMMMMMMMI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM.~. .
..D8MMMMMMMMMMMMMI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO
,.MMMMMMMMMMMMMMMI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMIM .
M,,,,,,,,, .MMMMMMI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM.$
. .8.MMMMMMMMI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM~M.
. M.MMMMMMMMMMI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM.=.
.8.MMMMMMMMMMMMI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMZ.
+~MMMMMMMMMMMMMMI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM$M
.Z$MMMMMMMMMMMMMMMI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM:.
.~=DMMMMMMMMMMMMMMMMMI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
..O+MMMMMMMMMMMMMMMMMMMI
.............................~~~~~~~~==8.
.M.......................
N.
.M.
.$.
.M
+.
.M.
M .
..M. .
N
..O,..
.O.
M. .
..M.
. $.
.7 .
:+.
?.
+D .
..M
.8..
. .~ .
=~..
8.
..Z
M ..
.N..
................. .:.
.O................................................ .
MMMMMMMMMMMMMMMMMMNM
. M,MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
MMMMMMMMMMMMMMMMM.M
. .M.MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
MMMMMMMMMMMMMMMM.: .
M.MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
MMMMMMMMMMMMMM+M..
M.MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
MMMMMMMMMMMMM.O
M.MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
MMMMMMMMMMMM~. .Z.MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
MMMMMMMMMM7M
:=NMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
MMMMMMMMM.+ $.MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
MMMMMMMN$. :+MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
MMMMMM,M..8$MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
MMMMM Z.M~MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
MMMIN.D$MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
MM.MM:MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
M.M.MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM7
(1) Hardware
(2) Firmware
(3) Results
*** ALL DESIGN DOCUMENTATION ON DEFCON 16 CD FO' FREE
The
Propeller
*** COMPLETELY CUSTOM, GROUND UP DESIGN BY CHIP GRACEY/PARALLAX
*** ALL ON-CHIP STRUCTURES BUILT FROM SCRATCH
*** EIGHT YEARS OF DEVELOPMENT/TESTING
*** CAN BE PROGRAMMED IN SPIN, ASSEMBLY, OR C
*** EIGHT INDEPENDENT COGS (20 MIPS EACH)
*** DEVELOPMENT TOOLS: www.parallax.com/tabid/442/Default.aspx
*** DISCUSSION FORUMS: http://forums.parallax.com/forums
*** OBJECT EXCHANGE: http://obex.parallax.com
*** DIP-40, QFP-44, QFN-44
The
Propeller 2
The
Propeller 3
***
***
***
***
***
***
POWER REQUIREMENT = 3.3V DC
EXTERNAL CLOCK SPEED = DC to 80 MHz
INTERNAL RC OSCILLATOR = 12 MHz or 20 KHz
GLOBAL RAM/ROM = 64KB (32KB RAM, 32KB ROM)
I/O PINS = 32 (40mA SINK/SOURCE PER PIN)
PROGRAM CODE LOADED FROM EXTERNAL EEPROM ON POWER-UP
Early Design Notes
Early Design Notes 2
Schematic
1
2
3
4
5
6
C
10
5
3.3V
1
P0Y101
8 P0U108
VDD
18P0U1018
VDD
30P0U1030
VDD
40P0U1040
VDD
U3
AT24C512B
1
2
3
6
7
4
E0
E1
E2
SCL
WC
3.3V
8
VCC
P0U301
2
1
2
3
4
P0U308
P0U302
28
P0U1028
P0Y102
Y1
5MHz
P1
DNP
P0P101
P0P102
P0P103
P0P104
29P0U1029
N0/RES
/RES
N0TX
TX
N0RX
RX
7
SDAP0U306
5
N0SDA
SDA
N0SCL
SCL
P0U305
P0U307
GND
P0U304
P0C102 P0C101
N0G
B
240
R6
470
R7
240
R8
P0R801
470
P0R802
R9
240
H
R10
240
V
P0R701
P0R901
0.1uF
P0R1001
1
2
3
VCC
OUT
GND
R4
P0R601
P0C201 P0C202
C2
470
P0R302
P0R401
N0B
P0R501
47uF, 6V
P0R502
C1
G
R5
47
R3
P0R301
P0R602
P0R702
P0R902
XO
P0R109
P0R108
P0R107
P0R106
P0R104
P0R105
P0R103
P0SW101
P0SW102
P0U1042
SW2
218-4LPST
P0U1043
1
P0SW202
2
P0SW203
3
P0SW204
4
RES
5V
8
P0SW207
7
P0SW206
6
P0SW205
5
P0SW208
P0SW201
3.3V
P8
P9
P10
P11
P12
P13
P14
P15
BOE
VSS
VSS
VSS
VSS
9
P0U1010
10
P0U1011
11
P0U1012
12
P0U1013
13
P0U1014
14
P0U1015
15
P0U1016
16
U2
MAX4885
11P0U2011
V+
21P0U2021
V+
30P0U2030
V+
10P0U2010
VCL
31
P0U2031
Configuration Switches
P0U107
26P0U1026
P23
25P0U1025
P22
24P0U1024
P21
23P0U1023
P20
22P0U1022
P19
21P0U1021
P18
20P0U1020
P17
19P0U1019
P16
P0R402
P0R1002
XI
41
42
43
P0U1044
44
P0U101
1
P0U102
2
P0U103
3
P0U104
4
P0U1041
P0U109
VGA Female to Target Monitor
M
SEL
26P0U2026
R1
25P0U2025
G1
24P0U2024
B1
23P0U2023
H1
22P0U2022
V1
28 P0U2028
DDCA1
27 P0U2027
DDCB1
N0VGA0SEL
VGA_SEL
R0
G0
B0
H0
V0
P0U207
DDCA0
P0U208
DDCB0
15P0U2015
R2
16P0U2016
G2
17P0U2017
B2
18P0U2018
H2
19P0U2019
V2
13 P0U2013
DDCA2
14 P0U2014
DDCB2
6
P0U106
5
17
P0U1027
27
P0U1039
39
P0U105
P0U1017
32
J1
AMP1734344-1
P0U2032
2
3
4
P0U205
5
P0U206
6
7
8
1
2
3
4
P0J104
5
P0J105
6
P0J106
7
P0J107
P0J108
8
P0U202
P0J101
P0U203
P0J102
P0U204
P0J103
9
10
11
P0J1012
12
P0J1013
13
P0J1014
14
P0J1015
15
P0J109
P0J1010
P0J1011
P0U2011
QP P0U209
9
EN
P0U2033
33
EPP0U2012
12
GNDP0U2020
20
GNDP0U2029
29
GND
N0H
R
3.3V
240
P0R202
SW1
EVP-AA002K
N0V
N0R
N0IR0IN
IR_IN
R2
P0R201
P0
P1
P2
P3
P4
P5
P6
P7
38P0U1038
P31
37P0U1037
P30
36P0U1036
P29
35P0U1035
P28
34P0U1034
P27
33P0U1033
P26
32P0U1032
P25
31P0U1031
P24
P0U303
Mode Test Button
U1
PROPELLER
3.3V
Prop Clip I/F
P0R102
P0R101
P0R1010
1
2
3
4
6
7
8
9
R1
10k
1V, 75 ohm, 2-bit DACs
P0U401
P0U402
J2
AMP5749767-1
P0U403
U4
GP1US301XP
8
7
6
5
P0J205
4
P0J204
3
P0J203
2
P0J202
1
P0J201
P0J208
P0J207
Infrared Receiver
P0J206
15
14
13
12
P0J2011
11
P0J2010
10
P0J209
9
P0J2015
P0J2014
P0J2013
P0J2012
VGA Male to Target Computer
NOTE: RESISTORS ARE IN OHMS +/- 5a AND CAPACITORS ARE IN MICROFARADS, X7R UNLESS
OTHERWISE NOTED. SEE BOM FOR ACTUAL VOLTAGE AND SPECIFICATION.
2x CR2032 Lithium Coin Cells a6V nominal)
2
C4
1uF
1P0U601
EN
3 P0U603
GND
NC
2
P0U602
C5
1uF
C6
0.1uF
5V
C7
0.1uF
5V
C8
0.1uF
5V
C9
0.1uF
P0C1001 P0C1002
P0U502
P0U503
3.3V
P0C901 P0C902
GND
3.3V
P0C801 P0C802
NC
P0U501
EN
3.3V
P0C701 P0C702
3
VO
U6
MIC5213-3.3YC5
P0U604
5P0U605
4
VIN
VO
P0C601 P0C602
1
5V
4
P0U504
P0C401 P0C402
C3
0.1uF
VIN
P0U505
P0C501 P0C502
U5
MIC5213-5.0YC5
5
P0C301 P0C302
BT1
BH800S
P0BT102
P0BT101
VBATT
C10
0.1uF
TITLE
DEFCON 16: BSODomizer
DaTE
6/25/2008
FILENaME
SIZE
DRaWN BY
SHT
1
OF
1
Joe Grand
R
Schematic
(modification!)
*** FORGOT TO ADD VIDEO ACTIVITY/DETECT LINE FOR TARGET COMPUTER
Bill-ofMaterials
PCB Layout
Inner
Top
Bottom
***
***
***
***
FOUR LAYER PCB, THREE USED
ROUTED BY HAND W/ ALTIUM DXP
DESIGNED FOR SMALLEST FOOTPRINT
2.32" X 1.32"
Assembly
Drawings
Firmware
*** VGA DRIVER: 2 COGS
1024x768 XGA TEXT OUTPUT
*** IR DECODER: 1 COG
“THREAD” FILLS FIFO WITH IR CODES RECEIVED
*** PARALLAX OBJECT EXCHANGE SOURCE
*** FIRMWARE GOAL: POWER SAVING
VGA DRIVER & IR DECODER NEED 80 MHz
~43mA AT 80 MHz - pi mA AT 5 MHz
2 Hz MAIN LOOP
50 ms AT 80 MHz TO ACCEPT IR CODES
REST OF VIDEO PASSTHROUGH MODE 5 MHz
AVERAGE CURRENT IN PASSTHROUGH MODE 3.5 mA
(APPROX. 78 HOUR RUNTIME W/ CR2032 CELLS)
PROPELLER CAN SWITCH OSCILLATORS/PLL ON THE FLY
10 ms FOR OSCILLATOR TO RAMP UP
75 us TO PERFORM CLOCK SWITCH
Firmware 2
*** BSOD TIMER
32 BIT SYSTEM COUNTER - WRAPS IN 53 SECONDS AT 80 MHz
COUNT SECONDS OFF SYSTEM COUNTER IN MAIN LOOP
*** REBOOT BEHAVIOR MIMICRY
MONITOR TARGET COMPUTER'S VIDEO HSYNC
NORMALLY HIGH, LOW PULSE EVERY 20 us
SAMPLE 3 TIMES 10 us & 5 us SEPARATED
*** DIP SWITCH SETTINGS
1: WINDOWS/MAC BSODs
2,3: TIMEOUTS: (mins) INF, 5, 10, 30 [extra sadism mode]
4: BGOD MODE (blue goatse of death)
*** IR COMMANDS (SONY TV REMOTE CONTROL)
POWER: BSOD (FROM PASSTHROUGH)
CH UP: PASSTHROUGH (FROM BSOD)
CH DN: BGOD OVERLAY (FROM BSOD)
DEFCON 16 BADGE CAN INITIATE BSOD ON POWERUP!
panic(cpu 0): Couldn't register to modules
backtrace: 0x000894c0 0x0002doe8 0x000dbe68 0x000dc03c 0x88188fd3 0x0003d264 0x0003b404 0x0003b330
No debugger configured - dumping debug information
version string : Darwin Kernel Version 8.11.1:
Wed Oct 10 18:23:28 PDT 2007; root:xnu-792.25.20~1/RELEASE_I386
DBAT0: 00000000 00000000
DBAT1: 00000000 00000000
DBAT2: 80001FFE 8000003A
DBAT3: 90001FFE 9000003A
MSR=00001030
backtrace: 0x000895ec 0x0002dee8 0x000dbe68 0x000dc03c 0x00188fd0 0x0003d264 0x0003b404 0x0003b338
panic: We are hanging here...
IOATAPIDVDDrive: Using DMA transfers
IOUSBHub: USB Generic Hub @ 2
IOUSBHub: Hub attached - Bus powered
IOUSBHub: USB Generic Hub @ 3
IOUSBHub: Hub attached - Self/Bus powered, power supply good
AppleKeyboard: USB Generic Keyboard @ 4
AppleMouse: USB Generic Mouse @ 6
IOSATAHDDRIVE: Using U-DMA/133 transfers
IOSATAHDDrive: Using U-DMA/133 transfers
panic(cpu 0): Couldn't register to modules
backtrace: 0x000894c0 0x0002doe8 0x000dbe68 0x000dc03c 0x88188fd3 0x0003d264 0x0003b404 0x0003b330
No debugger configured - dumping debug information
* y o u * h a v e * b e e n * B S O D o m i z e d *
version string : Darwin
y
Kernel Version 8.11.1:
y
Wed Oct 10 18:23:28o PDT
/ 2007;
\ root:xnu-792.25.20~1/RELEASE_I386
\
/
\
o
u |
|
\
|
|
u
* |
`.
|
|
:
*
DBAT0: 00000000 00000000
h `
|
|
\|
|
h
DBAT1: 00000000 00000000
a \
| /
/ \\\
--__ \\
:
a
DBAT2: 80001FFE 8000003A
v
\
\/
_--~~
~--__| \
|
v
DBAT3: 90001FFE 9000003A
e
\
\_-~
~-_\
|
e
MSR=00001030
*
\_
\
_.--------.______\|
|
*
backtrace: 0x000895ec
b
0x0002dee8
\
\______//
0x000dbe68_ 0x000dc03c
___ _ (_(__>
0x00188fd0
\
|
0x0003d264
b
0x0003b404 0x0003b338
panic: We are hanging
e
here...
\
. C ___) ______ (_(____> | /
e
IOATAPIDVDDrive: Using
e
DMA transfers
/\ |
C ____)/
\ (_____> |_/
e
IOUSBHub: USB Generic
n
Hub @/ 2/\|
C_____)
| (___>
/ \
n
IOUSBHub: Hub attached
*
- Bus
|
powered
(
_C_____)\______/ // _/ /
\
*
IOUSBHub: USB Generic
B
Hub |@ 3 \ |__
\\_________// (__/
|
B
IOUSBHub: Hub attached
S
- |Self/Bus
\
\____)
powered,
`---power --'
supply good
|
S
AppleKeyboard: USB OGeneric
| Keyboard
\_
@ 4 ___\
/_
_/ | O
AppleMouse: USB Generic
D
|Mouse @ 6
/
|
| \
| D
IOSATAHDDRIVE: Using
o U-DMA/133
|
transfers
|
/
\ \
| o
IOSATAHDDrive: Using
m U-DMA/133
|
transfers
/ /
|
| \
| m
i
|
/ /
\__/\___/
|
| i
z
|
/
|
|
|
| z
e
|
|
|
|
|
| e
d
|
|
|
|
|
| d
* y o u * h a v e * b e e n * B S O D o m i z e d *
Insert funny video here...
The Future of BSODomy
*** PARASITIC MODULES THAT CAN...
STORE SCREENSHOTS
TRANSMIT IMAGES/VIDEO ON DEMAND
SURVIVE ON MICROAMPS OF MONITOR SIGNAL POWER
BE SMALLER THAN A CONNECTOR
*** ASSEMBLED UNITS WILL BE AVAILABLE FROM
WWW.BSODOMIZER.COM WHEN WE RECOVER FROM DEFCON
NEVER TRUST A CABLE AGAIN
A problem has been detected and Windows has been shut down to prevent damage
to your computer.
The problem seems to be caused by the following file: SPCMDCON.SYS
PAGE_FAULT_IN_NONPAGED_AREA
If this is the first time you've seen this Stop error screen,
restart your computer. If this screen appears again, follow
these steps:
Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.
If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use Safe Mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode. Goto www.kingpinempire.com.
Technical information:
*** STOP: 0x00000050 (0xFD3094C2,0x00000001,0xFBFE7617,0x00000000)
*** SPCMDCON.SYS - Address FBFE7617 base at FBFE5000, DateStamp 3d6dd67c