How Hardware Gets Hacked (Part 10): The 'Birthday Problem' Attack
A 32-bit nonce gives over 4.3 billion possible values, which sounds like plenty, until the "birthday problem" shows that an attacker with a table of recorded (nonce, response) p...
Published Works
Articles, Videos & More
A living archive of consulting work, conference presentations, technical articles, and educational content. Filter by type, subject, or venue below.
Type
Subject
Venue
Sort
How Hardware Gets Hacked (Part 9): A Practical Security Exercise
A hands-on exercise in securing the eCTF key fob's feature-enabling process: review the design, identify the missing security requirements, forge a feature file, and defend agai...
How Hardware Gets Hacked (Part 8): Brute Force and Timing Attacks
Turning from the now-hardened unlock process to the eCTF key fob's pairing pin, which falls to a brute force attack in hours and to a timing attack in under a hundred guesses, t...
Breadboarding an STM32 (Another Teaching Moment)
How to build the minimal breadboard circuit for an STM32C0 microcontroller for only a few dollars in parts. Discusses the five key design considerations for any microcontroller ...
Nothing Is Safe: An Introduction to Hardware (In)Security (Teardown 2026)
Slides from Teardown Portland 2026: a tour of an attacker's menu of options against physical hardware, from a free datasheet read to focused ion beam edits on bare silicon.
How Hardware Gets Hacked: Authenticated Exchanges (Teardown 2026)
Workshop materials from Teardown Portland 2026: building up a badge-and-reader access control system from a bare UID check to mutual authentication with derived keys and session...
How Hardware Gets Hacked (Part 7): Freshness and Randomness
Breaking the eCTF key fob's rolling-counter-plus-MAC defense with RollJam, forced rollback, and forced rollover attacks, then closing the gap with a challenge-response nonce sch...
Comparing MicroPython, Zephyr, Lua, and Forth
MicroPython, the Zephyr shell, Lua, and Forth, evaluated head-to-head on an STM32 Nucleo board for time to a working REPL, compiled footprint, execution speed, and how hard each...
How Hardware Gets Hacked (Part 6): Authenticated Exchanges
Replacing the eCTF key fob's broken PRNG-based unlock scheme with a rolling counter and a real MAC — AES-CMAC — so the car can verify an unlock message came from a paired fob wi...
Debug Better: Take a Break
Why stepping away from a hard bug — a walk, a shower, doing the dishes — often gets you to the fix faster than staring at the screen for one more hour.
How Hardware Gets Hacked (Part 5): Replay Attacks
Exploiting the eCTF key fob's completely unauthenticated unlock message via a literal replay attack, then building — and breaking — a PRNG-based defense that looks secure right ...
How Hardware Gets Hacked (Part 4): Memory Protections
The first complete attack/defense cycle in this eCTF series: reading device secrets over an unlocked debug port, disabling it, and formalizing what was learned as a threat model...
Introduction to Hardware (In)Security with the ChipWhisperer-Nano (EOC 2026)
Workshop slides, recording, and exercise files from the Embedded Online Conference 2026: hands-on differential power analysis and fault injection using the ChipWhisperer Nano.
How Hardware Gets Hacked (Part 3): Adopting the Attacker Mindset
Part 3 is about reconnaissance: a four-step framework for building an attacker's understanding of the target before attempting any exploit.
This Isn't a Movie (Embedded.fm, Ep524)
I got to be on the Embedded.fm podcast again! We talked about hardware security, motivation, conference talks, and writing.
How Hardware Gets Hacked (Part 2): On-boarding
Part 2 rebuilds the eCTF project in four progressive builds — simulator, test commands, real hardware, automated tests — and examines what information attackers can and cannot s...
Thread-safe printf Debugging (Part 2)
Part 2 works through the race conditions in the double-buffer scheme from Part 1, categorizes three types of critical sections, and applies three tools to protect them — then no...
Thread-safe printf Debugging (Part 1)
Naive printf calls from ISRs or RTOS threads produce garbled output or worse. Part 1 works through three solutions — disabling interrupts, a mutex, and a double buffer — each be...
The Best MCU Peripheral You've Never Heard Of
Microchip's Configurable Logic Block gives you programmable digital logic inside your microcontroller — fast enough for hardware-speed tasks, flexible enough for Manchester enco...
Smaller printf Debugging
Printf adds over 4 kB of flash just for a single call. This article benchmarks a range of techniques for shrinking that footprint, from compiler flags already on by default to s...
A Direct, Sensible Podcast (Embedded.fm, Ep517)
I got to be on the Embedded.fm podcast again! We talked about Elecia and Chris's annual performance review and raised money for Elevate Tutoring.
Project Log: Pixelblaze Christmas Lights
A project log for building outdoor addressable LED Christmas lights using the Pixelblaze ESP32-based controller — covering power delivery, weatherproofing, mounting, and the har...
How Hardware Gets Hacked (Part 1)
Introduction to the series: the MITRE Embedded Capture the Flag competition, the insecure car-and-key-fob system that serves as the target, and what flags are at stake across it...
All Your Bytes are Belong to Us
A survey of hardware attack techniques organized as six levels of cost and invasiveness — from researching a device online to decapping its IC and editing the silicon with a foc...
Enter the Matrix: Simulate Your Embedded System (Hackaday Supercon 2025)
Slides from Hackaday Supercon 2025: a survey of practical techniques for running embedded firmware on a desktop computer, from simple printf/scanf stubs all the way to virtual h...
Faster printf Debugging (Part 3)
Part 3 replaces human-readable text with binary serialization, reaching 38.9k–117.8k messages per second using MessagePack, FlatBuffers, and bitproto — a 274–829× improvement ov...
Faster printf Debugging (Part 2)
Part 2 pushes from 140 µs to 88 µs per debug message using asynchronous transmission and buffered USB — roughly 80× faster than the original baseline, though with significantly ...
Can an ADC Be Just a Random Number Generator?
A 16-bit ADC doesn't always give you 16 bits of useful information — noise can reduce effective resolution dramatically. This article shows how to measure it and recover lost bi...
An Introduction to Hardware (In)Security with the ChipWhisperer-Nano (Embedded Systems Summit 2025)
Workshop slides from Embedded Systems Summit 2025: hands-on differential power analysis and fault injection using the ChipWhisperer Nano.
Nothing Is Safe: An Introduction to Hardware (In)Security (JawnCon 0x2)
Slides and recording from JawnCon 0x2: a survey of hardware attack techniques organized as a spectrum from cheap and easy reconnaissance all the way to focused ion beam surgery ...
Why is This Code Bad?
A Python function for parsing GCC dependency files becomes a case study in what separates "barely working" code from simple code — and why simplicity is worth pursuing deliberat...
Faster printf Debugging (Part 1)
Part 1 of a three-part series: hardware settings and one library swap reduce a 22-character debug message from 7,030 µs to 140 µs on a Nucleo-F042K6 — a 50× speedup with three c...
Breaking AES with an Oscilloscope
A step-by-step walkthrough of differential power analysis (DPA) — using an oscilloscope and statistics to extract a private AES128 key from a running device — with practical cou...
Improved printf Debugging
Two additions that make printf debugging significantly more useful: automatic source location tagging via C macros, and severity-level filtering with compile-time removal of the...
You Don't Need an RTOS (Teardown 2025)
Slides and recording from Teardown Portland 2025: a data-driven case that the super loop has a much bigger place in multitasking firmware than we give it credit for — and that p...
In Defense of printf Debugging
The case for printf debugging as a complement to single-step debugging, not an inferior substitute — and the class of problems where it's actually the better tool.
Message Passing with Pointers
Why passing large structs by pointer instead of by value saves memory copies and instruction cycles in RTOS task communication — and the three ownership patterns that make it sa...
Exception Handling (EOC 2025)
Workshop slides and recording from the Embedded Online Conference 2025, covering how to cleanly and simply detect, propagate, and handle exceptions in embedded C/C++.
Octopus Army (Embedded.fm, Ep492)
I got to be on the Embedded.fm podcast again! We talked about my proposal for a computer architecture book based on a 4-bit computer (the Hackaday Supercon 2022 badge, affection...
Pay It Forward
A call for engineers to pay forward the experiences that first drew them to the field — a short list of organizations giving more young people access to coding and electronics e...
Simulating Your Embedded Project on Your Computer (Part 2)
Two more sophisticated simulation options: virtual hardware tools (Wokwi, Renode, QEMU, Proteus) that mimic the MCU itself, and a PyQt GUI as a richer front end — with practical...
Simulating Your Embedded Project on Your Computer (Part 1)
The case for simulating your embedded project on a desktop machine — and how to do it with the simplest possible approach: swapping hardware I/O for printf and scanf, with pract...
What I Learned From Crashing and Burning in Grad School
A candid personal essay about struggling with perfectionism and overachievement in graduate school — and the unexpected lessons it unlocked about motivation, limits, and what it...
Write Better Code with Block Diagrams and Flowcharts
Two graphical tools every embedded engineer should be using — software block diagrams for system architecture and flowcharts for algorithm logic — plus a tour of free tools (Mer...
You Don't Need an RTOS (Part 4)
The concluding installment: implementing mailboxes, queues, counting semaphores, and the Observer pattern on top of the Superduperloop, plus a dispatch-queue scheduler — complet...
Retro Computing with the Hackaday Supercon Badge (Teardown 2024)
Workshop slides from Teardown Portland 2024: an introduction to the Voja4 retro computer badge, its 4-bit architecture and instruction set, and hands-on assembly programming.
Building a Simple Command-Line Interface (Teardown 2024)
Slides and recording from Teardown Portland 2024: how to add a lightweight command-line interface to an embedded system over UART, from parsing input to dispatching commands and...
You Don't Need an RTOS (Part 3)
A survey of ready-to-use cooperative schedulers — Protothreads, ULWOS2, cocoOS, SST0/QV — alongside a walkthrough of how to implement thread flags, binary semaphores, and event ...
You Don't Need an RTOS (Part 2)
Three targeted improvements to the basic superloop — task priorities, interrupt-driven tasks, and finite state machines — that bring worst-case response time close to a preempti...
The Power of a Look-up Table (EOC 2024)
Slides from the Embedded Online Conference 2024: what happens when you think of an array as a fixed-size O(1)-access structure rather than just a collection of values — and how ...
You Don't Need an RTOS (Part 1)
The case for the humble superloop as a serious scheduler — how to measure task deadlines and worst-case execution times, determine schedulability, and assign priorities before r...
Embedded Systems Roadmaps
A curated survey of skill roadmaps for embedded systems engineers — from ACM curriculum guidelines to book recommendations — to help practitioners assess their current knowledge...
Inside the Voja4 (Hackaday Supercon 2023)
Slides and recording from Hackaday Supercon 2023: an exploration of the elegant architecture behind the Voja4, the custom 4-bit retro computer badge designed by Voja Antonić.
What Does It Mean to Be "Turing Complete"?
A tour through Alan Turing's 1936 thought experiments — what a "Turing machine" is, why it matters, and what it actually means when a programming language or system is called "T...
Build HackerBox #0040 and Wield the PIC of Destiny! (Teardown 2023)
Workshop materials from Teardown Portland 2023: guided assembly and programming of HackerBox #0040, a PIC microcontroller kit with a PICkit 3 programmer, LCD display, and GPS mo...
Make Your Own MCU Boards (Teardown 2023)
Slides and recording from Teardown Portland 2023: the five things every MCU board needs, why the minimal circuit is simpler than you think, and how to source, lay out, and build...
Too Dumb to Quit (Embedded.fm, Ep453)
I got to be on the Embedded.fm podcast! We talked about building command line interfaces, good design practices in C, creating MCU boards, wielding the PIC of destiny, and going...
Building a Simple Command-Line Interface (EOC 2023)
Slides from the Embedded Online Conference 2023: how to add a lightweight command-line interface to an embedded system over UART, from parsing input to dispatching commands and ...
Object-oriented Programming in C (EOC 2023)
Slides from the Embedded Online Conference 2023: a systematic tour of OOP techniques in C, from opaque structs and singletons through compile-time and link-time polymorphism, up...
Beyond Arduino (Hackaday Supercon 2022)
Workshop materials from Hackaday Supercon 2022: a hands-on introduction to STM32 development with CubeIDE and the HAL, aimed at makers comfortable with Arduino who want to step ...
EE375: Computer Architecture (West Point)
A complete undergraduate computer architecture course built around the LC-3 and designed to take students from logic gates all the way to a working 16-bit computer with I/O and ...