Intel promotion thingy

Hi, the gadget you're holding actually wants you to go to http://www.intel.com/jobs. I just took the liberty to reprogram the I2C flash chip on it to point to my own website instead. Enjoy!

The device contains two ICs: one standard 8-pin 256 Byte I2C flash (datasheet) and some sort of epoxied microcontroller (dunno what kind). The original flash contents were as follows:

00000000 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |................|
00000010 54 4F 4E 54 45 58 05 77 77 77 2E 69 6E 74 65 6C |TONTEX.www.intel|
00000020 2E 63 6F 6D 2F 6A 6F 62 73 2F 67 65 72 6D 61 6E |.com/jobs/german|
00000030 79 00 0A 20 FF FF FF FF FF FF FF FF FF FF FF FF |y.. ............|
00000040 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |................|
00000050 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |................|
00000060 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |................|
00000070 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |................|
00000080 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |................|
00000090 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |................|
000000A0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |................|
000000B0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |................|
000000C0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |................|
000000D0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |................|
000000E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |................|
000000F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF |................|

I assume the microcontroller is mass programmed (or even special purpose), and the flash is programmed on a per-customer basis, hence the two ICs.

The controller starts reading at address 0x10. The TONTEX string is probably some sort of magic number to check whether the flash is valid. The 0x05 at address 0x16 might be some kind of mode selection feature (maybe the controller can do other things, too. How about downloading and executing arbitrary programs?).

Beginning at address 0x17, there's the variable-length payload, followed by a zero byte and the 16-bit sum of the mode selector and all the characters in the payload (big endian, in this case 0x0A20).

Addresses outside this range are filled with 0xFF and never read by the controller (according to my oscilloscope)

If you got here without plugging in a strange USB device

At my univeristy I found a little USB gadget, branded with the Intel Logo.

If you plug it in, it connects as a USB keyboard, waits a couple of seconds (while for some unknown reason continuously toggling the scroll lock key), then hits win-R (which brings up the run command dialog on windows) and then types an URL, followed by the return key. Once I saw what's inside I couldn't resist the urge to modify it, and I plan to leave the hacked version lying around where I found it to see if somebody else plugs it in :-)

More data

Some more information, just for completeness:

lsusb output

Bus 002 Device 025: ID 05ac:020b Apple, Inc. Pro Keyboard [Mitsumi, A1048/US layout]
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.10
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0         8
  idVendor           0x05ac Apple, Inc.
  idProduct          0x020b Pro Keyboard [Mitsumi, A1048/US layout]
  bcdDevice            3.01
  iManufacturer           1 WebKey
  iProduct                2 WebKey
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           34
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0x80
      (Bus Powered)
    MaxPower               32mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      1 Boot Interface Subclass
      bInterfaceProtocol      1 Keyboard
      iInterface              0 
        HID Device Descriptor:
          bLength                 9
          bDescriptorType        33
          bcdHID               1.10
          bCountryCode            0 Not supported
          bNumDescriptors         1
          bDescriptorType        34 Report
          wDescriptorLength      65
         Report Descriptors: 
           ** UNAVAILABLE **
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval              10
Device Status:     0x0000
  (Bus Powered)

usbmon output

From the output of usbmon one can extract each keyboard report sent to the computer. From the decoded sequence below you can see what it does:

1. Press the scroll lock key 250 times. From experimenting with USB HID devices I know that it takes some time after enumeration before the OS actually accepts keyboard input from the device, so waiting a while seems reasonable. I don't know why it toggles the scroll lock key.
2. Hit win-r, home, shift-end and backspace. Note how they avoid using ctrl-a and its dependency on the keyboard layout
3. Enter the domain (or any command) using the keypad (alt+<decimal unicode codepoint> yields the corresponding character). This is actually quite clever, because the controller doesn't have to care about the keyboard layout (it probably doesn't even know what layout the OS uses) and can still enter any unicode character.
4. Hit space and enter.