Caralynx
@sudo.caralynx.com
Reverse engineering, Japanese toy hacking, constantly distracted. Is ordinarily a tufty cat. Icon by @rokuromon.bsky.social, banner by @hackmonthegoat.bsky.social
Teardowns: @teardowns.caralynx.com | Ko-fi: https://ko-fi.com/caralynx
Teardowns: @teardowns.caralynx.com | Ko-fi: https://ko-fi.com/caralynx
It snowy outside
🎨: @ponah.bsky.social
#furryart
Seriously though, I had to shovel half a foot of snow in the past couple of days, and the forecast says it's going to go below -33°C today.
🎨: @ponah.bsky.social
#furryart
Seriously though, I had to shovel half a foot of snow in the past couple of days, and the forecast says it's going to go below -33°C today.
December 20, 2025 at 6:59 AM
It snowy outside
🎨: @ponah.bsky.social
#furryart
Seriously though, I had to shovel half a foot of snow in the past couple of days, and the forecast says it's going to go below -33°C today.
🎨: @ponah.bsky.social
#furryart
Seriously though, I had to shovel half a foot of snow in the past couple of days, and the forecast says it's going to go below -33°C today.
I received a virtual prepaid debit card as a part of a promo, and selected to convert it to plastic. In the meantime, I spent it, and apparently they issued the card after that, because they printed a value of $0.00 on the card. Funniest thing I've seen all day.
October 29, 2025 at 4:06 PM
I received a virtual prepaid debit card as a part of a promo, and selected to convert it to plastic. In the meantime, I spent it, and apparently they issued the card after that, because they printed a value of $0.00 on the card. Funniest thing I've seen all day.
I tried to turn on my PowerEdge R630 that has been sitting around turned off for like half a year, and it is no longer turning on. Getting a ton of errors about voltage levels and CPU thermal trip when trying to turn it on. I think it might be a system board issue. Anyone got any ideas?
October 26, 2025 at 7:18 PM
I tried to turn on my PowerEdge R630 that has been sitting around turned off for like half a year, and it is no longer turning on. Getting a ton of errors about voltage levels and CPU thermal trip when trying to turn it on. I think it might be a system board issue. Anyone got any ideas?
Here's the code for generating that hash. Way too much SHA256 and SHA512 IMO, they could probably have made this simpler. Or used an HMAC.
September 26, 2025 at 3:57 PM
Here's the code for generating that hash. Way too much SHA256 and SHA512 IMO, they could probably have made this simpler. Or used an HMAC.
Finally, we get into the actual scrambling logic. First is a generator function that returns the X/Y coordinate (in terms of tiles, not pixels) of the tiles to swap. It passes the array [0, 1, ..., numTiles ** 2] to the generate scramble map function, and generates which tile to copy in dest order.
![Snippet of JavaScript
function* scrambleIterate(numTiles, scrambleSeed) {
yield* generateScrambleMap([...Array(numTiles ** 2)].map((element, index) => index), scrambleSeed).map( (element, index) => ({
source: {
x: element % numTiles,
y: Math.floor(element / numTiles)
},
dest: {
x: index % numTiles,
y: Math.floor(index / numTiles)
}
}))
}
function generateScrambleMap(tileIndexes, scrambleSeed) {
const rng = xorshift32(scrambleSeed);
// tileIndexes is [0, 1, 2, ..., numTiles ** 2 - 1]
return tileIndexes.map(element => [rng.next().value, element])
.sort( (a, b) => +(a[0] > b[0]) - +(b[0] > a[0])) // ascending order
.map(r => r[1])
}
function* xorshift32(scrambleSeed) {
const arr = Uint32Array.of(scrambleSeed);
while (true) {
arr[0] ^= arr[0] << 13,
arr[0] ^= arr[0] >>> 17,
arr[0] ^= arr[0] << 5,
yield arr[0]
}
}](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fj6chd4gphz6lnn5pwvqhwzc/bafkreib6cb6mlevaohtnf2cypu2yhbhpamdca7mtd2leobwwxmlrdj6oru@jpeg)
September 26, 2025 at 3:57 PM
Finally, we get into the actual scrambling logic. First is a generator function that returns the X/Y coordinate (in terms of tiles, not pixels) of the tiles to swap. It passes the array [0, 1, ..., numTiles ** 2] to the generate scramble map function, and generates which tile to copy in dest order.
The tile size is calculated by first finding the LCM of the number of tiles horizontally and vertically (defined as 4 by the caller) and 8. Not sure why it needs to be a multiple of 8, but that's what they specified.
September 26, 2025 at 3:57 PM
The tile size is calculated by first finding the LCM of the number of tiles horizontally and vertically (defined as 4 by the caller) and 8. Not sure why it needs to be a multiple of 8, but that's what they specified.
Let's look at the unscramble function. It draws the scrambled image, gets the tile size and checks whether it and the scramble seed (supplied by the web API) is valid, clears the scrambled region (we'll see why it draws the image first later), then draws each tile according to a generator.
September 26, 2025 at 3:57 PM
Let's look at the unscramble function. It draws the scrambled image, gets the tile size and checks whether it and the scramble seed (supplied by the web API) is valid, clears the scrambled region (we'll see why it draws the image first later), then draws each tile according to a generator.
The page sets up a Vue component for displaying a canvas of the unscrambled image. That then creates a class that generates said canvas, and exposes functions for loading the scrambled image and drawing to the unscrambled canvas. Here's the code for drawing the canvas.
September 26, 2025 at 3:57 PM
The page sets up a Vue component for displaying a canvas of the unscrambled image. That then creates a class that generates said canvas, and exposes functions for loading the scrambled image and drawing to the unscrambled canvas. Here's the code for drawing the canvas.
Sudo has a winter coat too
September 17, 2025 at 5:02 AM
Sudo has a winter coat too
Converted the full color textures to masks
September 17, 2025 at 5:02 AM
Converted the full color textures to masks
I made a mod for @crittercove.bsky.social for loading custom skins. The loading part is easy; next step is to figure out how to export the model and texture from the current body parts selection so people can have a reference to work from.
September 11, 2025 at 2:14 PM
I made a mod for @crittercove.bsky.social for loading custom skins. The loading part is easy; next step is to figure out how to export the model and texture from the current body parts selection so people can have a reference to work from.
Here's what the help command prints. You can see it trailing with a prompt, except that gets clobbered by the success message at the end of command processing.
September 8, 2025 at 11:30 PM
Here's what the help command prints. You can see it trailing with a prompt, except that gets clobbered by the success message at the end of command processing.
For some reason if the command is one character, it checks the character directly, but if it's two, it uses memcmp(). I'm not sure if the compiler optimized the one-character the case, but using memcmp() is pretty wasteful when you could just check two characters directly.
![Snippet of C code
// 08004db4
UART_WriteByte(UART_PORT_0, '\r');
UART_WriteByte(UART_PORT_0, '\n');
if (arg_offsets[0] == 1) {
switch (uart_buffer[0]) {
case '?':
// 08004e30
uart_console_cmd_help();
goto cmd_done;
case 'R':
// 08004e0e
UART_WriteMultiBytes(UART_PORT_0, "CMD Done.\r\n", 10);
NVIC_SystemReset();
// no return
case 'w':
// 08004e00
*(uint32_t *)args_parsed[1] = args_parsed[2];
goto cmd_done;
case 'r':
// 08004e4c
uart_console_cmd_read_memory(args_parsed[1], args_parsed[2]);
goto cmd_done;
case 'e':
// 08004e74
uart_console_cmd_spifc_erase(args_parsed[1], args_parsed[2], args_parsed[3]);
goto cmd_done;
case 'j':
// 08004f18
Program_ForceJump(args_parsed[1]);
goto cmd_done;
case 'q':
break;
}](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fj6chd4gphz6lnn5pwvqhwzc/bafkreic6ijkwjhgzns4bllqyifmpwddilei7uvc2u62sc24njgxmf7hse4@jpeg)
![Snippet of C code
} else if (arg_offsets[0] == 2) {
if (!memcmp(uart_buffer, "xw", 2)) {
if (arg_offsets[1] != 0 && uart_console_cmd_xwrite(args_parsed[1]) == 0) {
goto cmd_done;
}
} else if (!memcmp(uart_buffer, "xr", 2)) {
if (arg_offsets[2] != 0 && uart_console_cmd_xread(args_parsed[1], args_parsed[2]) == 0) {
goto cmd_done;
}
} else if (!memcmp(uart_buffer, "sw", 2)) {
if (arg_offsets[1] != 0) {
uart_console_cmd_spifc_write_sr(args_parsed[1]);
goto cmd_done;
}
} else if (!memcmp(uart_buffer, "sr", 2)) {
uart_console_cmd_spifc_read_sr(&args_parsed[1]);
goto cmd_done;
} else if (!memcmp(uart_buffer, "id", 2)) {
uart_console_cmd_spifc_read_id();
goto cmd_done;
} else if (!memcmp(uart_buffer, "dd", 2)) {
args_parsed[1] -= '0';
SN_GPIO0->DRVCTRL_b.DRV15 = args_parsed[1];
SN_GPIO1->DRVCTRL_b.DRV00 = args_parsed[1];
SN_GPIO1->DRVCTRL_b.DRV01 = args_parsed[1];
SN_GPIO1->DRVCTRL_b.DRV02 = args_parsed[1];
SN_GPIO1->DRVCTRL_b.DRV03 = args_parsed[1];
SN_GPIO1->DRVCTRL_b.DRV04 = args_parsed[1];
goto cmd_done;
}
}
UART_WriteMultiBytes(UART_PORT_0, "\r\nErr\r\n", 8);
return 1;
cmd_done:
uart_buffer_index = 0;
UART_WriteMultiBytes(UART_PORT_0, "\r\nCMD Done\r\n", 13);
return 0;
}](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fj6chd4gphz6lnn5pwvqhwzc/bafkreiamg3j7wtz5shtjawqy5jetf445lkuvqhj52aylobry2r2xpqr2iu@jpeg)
September 8, 2025 at 11:30 PM
For some reason if the command is one character, it checks the character directly, but if it's two, it uses memcmp(). I'm not sure if the compiler optimized the one-character the case, but using memcmp() is pretty wasteful when you could just check two characters directly.
The number length is capped to 8 characters, which is fine, but it'll be truncated counting from the left, which isn't exactly how numbers usually work. Here's hex2int(), which doesn't seem to check whether you enter letters above F.
![Snippet of C code
uint32_t hex2int(char *str, int len)
{
uint32_t value = 0;
for (int i = 0; i < len; ++i) {
char ch = str[i];
if (ch >= 'a') {
ch = ch - 'a' + 10;
} else if (ch >= 'A') {
ch = ch - 'A' + 10;
} else {
ch = ch - '0';
}
value |= ch << (len - 1 - i) * 4;
}
return value;
}](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fj6chd4gphz6lnn5pwvqhwzc/bafkreiezdsdtrcdtqyb6qr2mpgze4egj67qlytukhp67uissjuikrg3znm@jpeg)
September 8, 2025 at 11:30 PM
The number length is capped to 8 characters, which is fine, but it'll be truncated counting from the left, which isn't exactly how numbers usually work. Here's hex2int(), which doesn't seem to check whether you enter letters above F.
Now let's look at argument handling. Nifty code, though still buggy. The code splits arguments by spaces, and records the index of each space. It's a pretty naive approach, though. If multiple spaces are entered in a row, they count as blank arguments.
![Snippet of C code
for (int i = 0; i < uart_buffer_index; ++i) {
if (uart_buffer[i] == ' ') {
arg_offsets[num_args++] = i;
}
}
arg_offsets[num_args] = uart_buffer_index - 1;
uint32_t args_parsed[5] = {0};
for (unsigned int i = 0; i < num_args + 1; ++i) {
uint8_t parse_len;
if (i == 0) {
parse_len = arg_offsets[i];
} else {
parse_len = arg_offsets[i] - arg_offsets[i - 1] - 1;
}
if (parse_len > 8) parse_len = 8;
args_parsed[i] = hex2int(&uart_buffer[arg_offsets[i - 1] + 1], parse_len);
}](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fj6chd4gphz6lnn5pwvqhwzc/bafkreieob4mrxl3zyzglg4qsfpo7pqqgjspox6zlakdlpdm6n2gp2hxm6u@jpeg)
September 8, 2025 at 11:30 PM
Now let's look at argument handling. Nifty code, though still buggy. The code splits arguments by spaces, and records the index of each space. It's a pretty naive approach, though. If multiple spaces are entered in a row, they count as blank arguments.
Here's the start of the function. The buffer is 4KB. No idea why it's so large, because none of the commands use that much space. First thing to note in the code is it immediately accessing a negative array index. For some reason whoever that wrote the console code is allergic to bounds checking.
![Snippet of C code
int uart_console_run(void)
{
int arg_offsets[5] = {0};
int num_args = 0;
uart_console_echo = 1;
uart_buffer_index = 0;
uart_buffer[0] = '\0';
while (uart_buffer[uart_buffer_index - 1] != '\r') {
if (uart_buffer[0] == '\e') {
UART_WriteByte(UART_PORT_0, '\r');
UART_WriteByte(UART_PORT_0, '\n');
uart_buffer_index = 0;
uart_buffer[0] = '\0';
}
uint32_t index = uart_buffer_index;
if (uart_console_proc_index != index) {
uart_console_proc_index = index;
uint8_t ch = uart_buffer[uart_buffer_index - 1];
if (ch == '\b') {
if (uart_buffer_index < 2) {
uart_console_proc_index = 0;
uart_buffer_index = 0;
} else {
uart_buffer_index -= 2;
uart_console_proc_index = index - 2;
}
}
if (uart_console_echo && (ch >= ' ' || ch == '\b')) {
UART_WriteByte(UART_PORT_0, ch);
}
}
}](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fj6chd4gphz6lnn5pwvqhwzc/bafkreifcpbxh2pgqv7fn7saeafeznbwxrszg5awot22thxefpyfikvbuue@jpeg)
September 8, 2025 at 11:30 PM
Here's the start of the function. The buffer is 4KB. No idea why it's so large, because none of the commands use that much space. First thing to note in the code is it immediately accessing a negative array index. For some reason whoever that wrote the console code is allergic to bounds checking.
Continued looking through SNC7330's bootrom, and here's a perplexing piece of code that I reconstructed. It's supposed to return the block (or page?) to read the load table from (basically a bad block table), but I'm pretty sure it doesn't actually work.
![Screenshot of C code:
uint32_t boot_load_table_offset_from_bb(const uint32_t *tbl)
{
if ((*tbl & 0xffff) == 0x4242) {
uint16_t count = *tbl >> 16;
for (int i = 0; i < count; ++i) {
uint8_t entry = tbl[i];
for (int j = 0; j < 32; j += 2) {
if ((entry >> j & 0x3) == 1) {
return i * 4 + j;
}
}
}
}
return 0;
}](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fj6chd4gphz6lnn5pwvqhwzc/bafkreiajr2jp2tsxbzfvfvzf3iugwv3m6iteoub3hc5qbedlr5l2ile2ii@jpeg)
September 1, 2025 at 4:54 AM
Continued looking through SNC7330's bootrom, and here's a perplexing piece of code that I reconstructed. It's supposed to return the block (or page?) to read the load table from (basically a bad block table), but I'm pretty sure it doesn't actually work.
Managed to find the code in question in the SDK. `over_sampling` is a power of 2, so they could have easily done a shift with one less bit, checked that bit, and rounded up instead of doing any floating point operations.
September 1, 2025 at 4:53 AM
Managed to find the code in question in the SDK. `over_sampling` is a power of 2, so they could have easily done a shift with one less bit, checked that bit, and rounded up instead of doing any floating point operations.
What I've been working on recently: figuring out how to create custom items for Tamagotchi Paradise
Download icon by @ponah.bsky.social, dot sprite by @rayjt9.bsky.social
Download icon by @ponah.bsky.social, dot sprite by @rayjt9.bsky.social
August 16, 2025 at 9:00 PM
What I've been working on recently: figuring out how to create custom items for Tamagotchi Paradise
Download icon by @ponah.bsky.social, dot sprite by @rayjt9.bsky.social
Download icon by @ponah.bsky.social, dot sprite by @rayjt9.bsky.social
Stupid code found in the runtime for a course produced with Articulate Rise 360. This is not minimized. What's wrong with `arr.indexOf(val) !== -1`?
August 1, 2025 at 12:05 AM
Stupid code found in the runtime for a course produced with Articulate Rise 360. This is not minimized. What's wrong with `arr.indexOf(val) !== -1`?
No cheating, post your lock screen!
July 26, 2025 at 7:42 PM
No cheating, post your lock screen!
I played Critter Cove Demo (@crittercove.bsky.social) yesterday, and the character customization is pretty good. Was able to make a fairly good approximation of Sudo (colors adjusted manually in the save file). Wish it was possible to import custom textures for exact markings.
June 22, 2025 at 8:08 PM
I played Critter Cove Demo (@crittercove.bsky.social) yesterday, and the character customization is pretty good. Was able to make a fairly good approximation of Sudo (colors adjusted manually in the save file). Wish it was possible to import custom textures for exact markings.
Who TF returns an exception instead of throwing it?
May 23, 2025 at 4:20 PM
Who TF returns an exception instead of throwing it?