first break

My coffee started to freeze, so it must be time for our first break of the event. After a stop at the school this morning for Lars to brief his sub, we arrived at Ice Park with just about enough time to set up our scaffolding before the starting horn sounded. Since then we've been drilling the axle holes and marking the block for the imminent attack of the giant chainsaw.

The webcams are not accessible from the Ice Alaska web site yet, but you haven't missed much. All we've done to our block so far is to drill holes into it from the rear and mark up the sides. When the webcam is up, it should be accessible from here. Hey, it looks like Junichi and Heather are carving an octopus. I bet they made sucker bits too! Weird. Last year it seemed that everybody was carving birds, including us, so I guess we've been assimilated into the collective consciousness.

bed time

Some joker at Belfair added to our model. Lars is still working on lesson plans, but I'm going to bed.

site 40

Lars and I will be carving in site 40 which is the closest site to the warming hut and most of the other facilities at Ice Park. Watch us on our webcam at icealaska.com starting Tuesday at 9:00 AM AKST.

a long Monday

I was glad to be able to go back to bed for a while after Lars went to work. A couple hours later I had breakfast with Sharon and then spent some time preparing a new official sketch (to submit to Ice Alaska) from the clay model. I also drew side and front block layout diagrams so that we will know where to start cutting Tuesday morning. Later in the day I made the smallest two sucker bits and tested and tuned the entire set. The two largest bits were considerably out of alignment, so they chattered a great deal, causing terrible destruction to the ice. I was able to straighten out their shafts with a hand file, and this improved their performance greatly.

Lars returned to Belfair in the afternoon. We disassembled Sleipnir and the lathe, loaded up the trailer, and headed to ice park. Just past UAF, a neighborly driver informed us that the trailer had a flat tire! Since were were only a mile from Ice Park, Lars decided to drive on slowly. Thankfully it turned out that the tire did not suffer any additional damage; Lars was able to re-inflate it for the short trip from the parking lot to our site later in the evening.

Registration was quick and easy, and we found out that, since we are now five year veterans, we are eligible for Ice Alaska jackets! My ears perked up when I heard this as I really could use a new coat right now. Alas, it turns out that it is likely to be a while (like years) before we receive them.

We went to our site and found that it was already set up with power, lights, sawhorses, a bucket, and a working webcam. Nice! Jasper expertly tweaked our block for us with a zoom boom so that the smaller face is turned toward the road, and we were off to the warming hut for dinner and the safety meeting.

After dinner Lars moved the trailer while I carried scaffolding parts to our site. Then we set up Sleipner and the lathe and a few other things. Our site happens to be at the end of a row, so we had plenty of room to set up the trailer and the big equipment, though it will probably out of view of the webcam.

Now Lars and I are sitting in his classroom. I'm blogging while he finishes lesson plans for his sub. We'll be in bed at Belfair before long (I hope).

modeling

After my arrival at Belfair Sunday night, Lars and I looked over all our equipment and started planning the activities of the next 36 hours before the start of the Single Block Classic. Before going to bed we had a design session, reviewing several sketches we had made and modeling some of them with clay. He ended up with a model that I liked but didn't love, and I made a model that he liked but didn't love. We decided to go with his model, but I wasn't thrilled with the overall look. The core features of the monster were great, but the tentacles extending upward and outward from the base of the sculpture had a look that was sort of, well, floral. I was hoping for something more menacing.

Inspiration struck as I was brushing my teeth, and I ran back upstairs to make a new model. I made the main body and head similar to Lars' design, but I extended tentacles down through the snow and back out some distance away from the body. This makes great use of space and ice, allowing the piece to extend well beyond the original block, and it doesn't even require much ice welding. The fence posts in front of the sculpture will be additional tentacles that are a part of the creature.

Lars was already in bed, but I left it out for him to see in the morning. As he was leaving for school at 5:30 AM, I happened to be up on a call from work (gah!). He hadn't noticed the new model, so I told him to take a peek. He approved!

Lars has been busy

I arrived at Belfair excited to see all of the improvements Lars has made to various tools this year. There are many! The first thing he showed me was the housing that he built for the lathe motor. He bought a riveter this year, so he was able to make it quite light (unlike many of his inventions that feature thick, welded steel). He also improved the lathe chucks by adding permanent bits of rubber that cushion the ice against the chuck screws. In the past we've had to insert loose pieces of rubber every time we mounted a blank.

Next he showed me Sleipnir's new skateboard wheel tensioner which stabilizes the band action enough to make the beast considerably less frightening. He also installed a built-in jack to raise and lower the table, making cutting depth adjustments faster and more precise.

The trailer has been upgraded with an exterior, fold-down workbench.

I found a couple antique 2 inch gouges a year or two ago and gave one to Lars. Unfortunately it had a tendency to fall out of the handle I made for it, so he welded on a hockey stick socket.

You might think that using a jackhammer on an ice sculpture would be a bad idea. You might be right, but so far this bit Lars made for his reciprocating saw has performed admirably. We may use it to clear away the ice between suckers, but we aren't sure yet if it is any better for this task than small hand chisels or a die grinder.

Bob the Boiler has been completely rebuilt. He used to suck propane, but now he's switched to electrons.

Bob's various new bits, including the long "Intruder", can be used for heat cutting of all sorts of crazy shapes.

The Senator has been upgraded with the simple addition of some silicone on his base plate. This saves us the trouble of having to hold pieces of rubber between the device and the ice. His interior series of tubes has also been soldered together which should help speed drilling operations.

My own new contribution, a set of seven sucker bits ranging from one half inch to four inches, seems rather miniscule in comparison!

Big thanks to Evan, a long-time Belfarian, for the use of his camera. Mine died today, but it was old and beat up anyway.

en route

Yesterday was a very, very bad day. On Friday night I had a couple hours to work on sucker bits in the garage before heading to the airport to pick up Emily. At some point during that time, Charley, our Rhodesian Ridgeback, went outside and got stuck in the backyard. I looked for him as I was getting ready to leave and finally found him prone in the snow next to the chicken coop at the bottom of the slope in the dog yard. He was unable to stand, so I carried him inside and sat with him by the fire for a while. After twenty minutes or so, he showed a slight interest in food and managed to get up and walk by himself, but it wasn't pretty. He only made it a few feet, and it was clear that his legs were not working correctly.

I decided to put him in the car and take him with me to the airport. Since he hadn't shown any improvement by the time we were heading back up the hill, we took him to the emergency vet. She thought it might be something neurological, perhaps a tumor or spinal injury, and sent Charley home after midnight with a steroid shot and a follow-up appointment scheduled for early the next morning.

Charley didn't respond to the shot, and the vet at our Saturday morning appointment discovered that he had a new and significant heart murmur. He determined that Charley's inability to walk was due to general weakness from his heart condition and that little could be done for him. We had to say goodbye to Charley just a few days prior to his twelfth birthday.

On the way home from the vet, we stopped by the cleaners to pick up my heavy coat for the trip. I had left it there a week ago to have its zipper replaced. They didn't have it. Apparently it was in the possession of their seamstress in Aurora, and she hadn't returned their calls for the past two days. Fortunately the Fairbanks forecast looks fairly warm (mostly above zero F) for the coming week, so I should be fine with a lesser coat.

After getting home, I finally turned my attention to my right eye which had been irritated since the drive to the airport. It didn't take long to find a small bit of steel stuck in my cornea. I had been wearing safety glasses while making the sucker bits, but that one piece somehow found its way around them. The only good news I had all day was that my ophthalmologist would be able to return from Colorado Springs and see me in the afternoon. He popped the tiny chunk out with the tip of a syringe and then removed the remaining rust ring with a drill.

Needless to say, I didn't have as much time for trip preparations on Saturday as I had hoped, but I was able to get everything packed in time for a few hours sleep before my early morning flight. I'll probably have time at Belfair on Monday to test and touch up the sucker bits and finish sharpening chisels and saw chains. Meanwhile, I'm spending a long day of travel, an odd calm amid days of storm.

sharpening, sharpening, sharpening

When Lars and I first started carving ice, we underestimated the value of some of the more traditional ice carving tools. Chainsaws would be essential, we knew, but we didn't figure that chisels would be so important to the mechanical ice sculptor as they are to the traditional ice sculptor. We only had a few, small, one-handed chisels on hand that first year, but wasn't long before we realized that we needed more chisels, sharper chisels, bigger chisels, and better chisels.

We found that professional ice carving chisels are rather expensive, so we tried making some of our own or refurbishing antiques found on eBay. These efforts weren't terribly successful until one day a couple years ago when Lars found a nice, large, 3/8 inch thick piece of tool steel. He cut it up into several chisel blades (up to 4 inches wide) and welded on sockets for hockey stick handles. These chisels have been an outstanding addition to our arsenal.

When they were new, Lars had them professionally sharpened. They cut ice much better than any chisel we had used before, but some of them lost their edges fairly quickly. After learning a thing or two about sharpening chisels I came to realize that the reason some of them were better than others was that they had flatter backs. The professional sharpener had done a terrific job on the bezels but hadn't flattened the backs. Since the cutting edge is the intersection of two planes, the bezel and the back, it is important that both be very flat. Over time, I've tried to flatten the backs of these chisels, but it is a great deal of work. Last year I took a particularly troublesome one home with me, and I have been trying to flatten it this week, starting with a belt sander and moving up to a coarse diamond stone.

big suckers

Making sucker bits out of spade bits turned out to be pretty easy, but we need to make some bigger suckers. The largest spade bit I have found is 1.5 inches. I'd like to be able to make suckers at least twice that large, so I made a prototype 3 inch sucker bit out of a flat piece of 1/4 inch aluminum.

It worked quite well, so I'm now working on a set of bits in made in this style out of 1/4 inch steel. Tonight I drink a toast to whoever invented the angle grinder.

suckers!

In one week I'll head to Fairbanks for the World Ice Art Championships. This year Lars and I have decided to carve a windmill as seen through the eyes of Don Quixote. There isn't much in the text that describes how he perceives them, so we have a lot of freedom. Don Quixote calls them "monstrous giants" and says that they have many arms, so we are carving our windmill in the form of an octopus-like monster.

Inspired by the bubble bits that Steve Brice has used to great effect in past events, I decided to try making a sucker bit. I used an off-the-shelf spade bit and modified it with a bench grinder and some hand filing. With bits in this shape, we should be able to quickly carve long tentacles with many suckers.

My first test went well! While I've been working on sucker bits, Lars has done ten times as much, making improvements on various machines including the lathe, the eight-legged slab-cutting bandsaw (now known as "Sleipnir"), and "Bob the Boiler," a heat cutting tool.

ShmooCon live!

I'm giving a talk on Bluetooth keyboard security at ShmooCon this year. Live video of the talk will be provided. My talk will be at 3:00 PM EST on Saturday, February 6th in the Break It! track.

KillerBee on a budget

At ToorCon 11, Joshua Wright handed out a pre-release version of his KillerBee framework, a set of tools for analysis of 802.15.4 and ZigBee wireless networks.

KillerBee requires a particular hardware device, Atmel's AVR RZUSBSTICK, an inexpensive USB dongle with a programmable microcontroller. Many of the KillerBee functions require custom firmware (written by Joshua) to be flashed onto the stick. While most Atmel products feature In-System Programming (ISP) which can be done with a low-cost programming device, the RZUSBSTICK unfortunately only provides a JTAG header for programming, and the JTAG debugger/programmer costs about $300.

The good news is that ISP can be used to program the RZUSBSTICK. The bad news is that it requires some tricky soldering to get it working. With a little guidance from those who have gone before me and SparkFun's excellent surface mount soldering tutorials under my belt, I was able to attach a 10-pin ISP header to my RZUSBSTICK and successfully flash it with the KillerBee firmware.

There are two kinds of AVR ISP headers, a 6-pin and a 10-pin version. I chose the 10-pin variety because my programmer has a 10-pin connector, but a simple adapter can allow you to use either. Both varieties use the same 6 signals: GND, V_CC, RESET, SCK, MISO, and MOSI. I connected them with colored wire (28 or 30 AWG wirewrap wire) as follows:

signal	color	header pin	source
GND	black	4,6,8,10	JTAG header pin 2
VCC	red	2	JTAG header pin 4
RESET	white	5	JTAG header pin 6
SCK	purple	7	AT90USB1287 pin 11
MISO	brown	9	AT90USB1287 pin 13
MOSI	orange	1	AT86RF230 pin 22

I ran all six wires through the unused holes of the (unpopulated) JTAG header in order to provide some strain relief. Those connections to the individual chip pins are fragile! From there I ran them across the back of the board to a 10-pin header glued to the end of the stick.

My serial programmer works great when connected to an on-board serial port on an old PC, but its bit-banging technique is incredibly slow (about 3 bits per second) and unreliable when connected to a USB/serial adapter. I believe that trying to use it via USB was the cause of death of an ATtiny85 while working on a previous project. Anyway, with a good serial port, AVRDUDE does a fine job programming the RZUSBSTICK over ISP:

avrdude -c ponyser -p usb1287 -P /dev/ttyS0 -U flash:w:kb-rzusbstick1.hex

Now to find some target devices. . .

worst malware analysis ever

Symantec has decided that Lose/Lose is a trojan. It is, in fact, a video game that deletes files. The game's web site warns that the game deletes files. The game itself warns the player that it deletes files. There is nothing whatsoever malicious about a program deleting files after warning the user that it will delete files.

Why does Symantec (oh, Trend too) think this is malware? Because "there’s nothing stopping someone with more malicious intentions from modifying it slightly and then passing it on to unsuspecting users, causing significant damage to a computer." By that logic, rm should be considered malware because it could be modified (say, by renaming it) to delete files contrary to a user's expectation. Frozen Bubble must be malware too, because it could easily be modified to delete files!

ToorCon workshop

I'll be running a software radio workshop at ToorCon in October. It will be similar to the workshop at ToorCamp but with more electricity and less volcanic ash! With a more pleasant environment and more structured lessons, a greater amount of material will be covered.

building an all-channel Bluetooth monitor

video (179M) of my presentation with Dominic Spill at ShmooCon 2009 has been posted.

toorcamp badge hacking

The badges at Toorcamp were solder-yourself passive RFID detectors. With the jumper in one position, an LED lights up in the presence of 125 kHz signals (used by low frequency RFID tags). With the jumper in the other position, a second LED indicates the presence of 13.56 MHz signals (used by high frequency RFID tags and Near Field Communication).

The circuit is very simple. Each side consists of an inductive loop (of traces on the circuit board), a tuning capacitor (forming a tank circuit with the loop), and an LED. It is powered by the received signals (as are passive RFID tags). I've tested my badge by holding it up to both types of RFID readers, and it works perfectly. Unfortunately it only works at very close range, so it isn't the most useful device on its own. As a component in other circuits, however, the unit has great potential.

Thanks to some spare parts and excellent soldering equipment provided by my friends at the Dorkbot campsite, I was able not only to assemble the badge but to perform a simple modification that turned it into a low frequency RFID decoder (in conjunction with a laptop computer). All I had to do was attach a cable with an audio plug in place of the jumper. At the camp, I soldered the audio cable directly to the board, but I have since reworked it with a plug that can be removed or repositioned on the header.

125 kHz RFID tags (at least the ones I've had an opportunity to play with) use a double modulation scheme. The data signal is frequency modulated (FSK) in the neighborhood of 14 kHz, and then the resulting signal is amplitude modulated up to 125 kHz. One way to demodulate the over-the-air signal is to perform the whole process in reverse: undo the amplitude modulation to get back to 14 kHz FSK, and then FM demodulate back to the baseband signal.

The fist step can be done with a small analog circuit. The simplest way to demodulate an AM signal is to rectify the signal (only allowing current to pass in one direction) with a diode and then smooth the resulting signal with a low pass filter (which can be as simple as a single capacitor). This results in a waveform that represents the envelope, the amplitude variations over time, of the original signal. Lucky for me, the LED on the Toorcamp badge is a diode that rectifies the signal! With the badge plugged into a laptop's microphone jack, the sound card's anti-aliasing filter does the smoothing, and the resulting signal of approximately 14 kHz is within the range that the sound card can record.

The FSK demodulation can then be done in software, allowing the whole setup to act as a close-range RFID decoder. You could even plug the badge into a small audio recorder and decode recorded signals later on a computer.

This simple modification just scratches the surface of what can be done with the Toorcamp badges. Having RFID frequency tuned loops available to plug into your own circuits makes it easy to play with both reception and transmission of RFID and NFC signals. For example, at the camp I used a second badge plugged into a USRP in order to transmit the 125 kHz signal needed to excite an RFID tag for testing the decoder.

Thanks again to everyone who made Toorcamp possible and to all the new friends I made there, especially the Dorkbot campers. It was an incredible experience.

toorcamp awaits

Next week Dominic and I will reprise our ShmooCon Bluetooth talk at Toorcamp, North America's first hacker camp (which happens to be taking place at a defunct Titan-1 missile silo). The nice folks from DorkbotPDX have allowed us to join their campsite. While we're there we also plan to run a software radio workshop. It is high time that more hackers learn how to use this technology.

Black Hat video up

Video (warning! 283 MB!) of my talk, Software Radio and the Future of Wireless Security, at Black Hat USA 2008 is now available along with all the other presentations from the event.

Star Crossed

After four years of developing tools and techniques, three gloves and mittens cut by angle grinders, two broken slabs of ice intended for moving parts, one tool confiscated by the TSA, and zero broken beaks, we completed Star Crossed. The sculpture features a realistic penguin on the left and a mechanical penguin on the right. It is the first working mechanical ice sculpture that we have completed in the Single Block Classic.

The head of the realistic penguin is shown in this detail photo. We used two textures: scratched and transparent.

This shot shows the mechanism on edge. The head piece rotates on the upper axle and has a long slot that extends downward. The key on the lower axle turns a cam with a lug that rides along the slot. You can watch a video of the mechanism in action.

We carved Star Crossed in three days and had a great time doing it. Thanks to all the volunteers and sculptors at Ice Alaska who make the experience a fun one every year. Thanks to Sharon Hansen for the shooting the photos and video.

night

Throughout the final day of competition we worked primarily on converting the rough penguin bodies into finished sculptures. The first step was a thorough scratching with the devil's back scratcher. This removed all the chainsaw and chisel marks, refined the shape of the piece, and left only small scratches to be polished away. We decided to use the scratched texture for the black portion of the realistic penguin and a transparent texture for the white portion and for the entire mechanical penguin (in order to make the machine parts visible).

For the transparent texture, we removed the scratches by polishing with a Scotch Brite pad on an angle grinder and applied heat with a weed burner and hair dryer for the final finish. "Scratch, buff, burn" was our mantra for the day. By dinner, both penguins were finished as were all of the machine parts.

After a quick dinner, our first priority was assembly of the machine. We had done a trial assembly the day before to verify fit and clearance for all the parts, but the final assembly was a bit different. For one thing, we had to add bushings to keep parts from sliding along the length of axles. We also had to waterglue parts together, eliminating a bit of play between various parts. Once we had everything welded into place, the mechanism didn't work! There wasn't enough clearance for the cam's lug at one end of the slot in the head piece. Fortunately we had anticipated that this might happen, so Lars was able to correct the problem by thinning the lug while I worked on finishing the beak of the realistic bird. The rest of the penguin was done, but we had left the beak for last in order to avoid breaking it. I trimmed an inch or so of diameter with a small chisel and added a beak line and eyes.

By the time I was done, Lars had the mechanism working, but he had only tested it with his hands guiding the interior parts. He hadn't actually turned the entire mechanism from the key on the front. We decided to try it together, rotating it a few times just before the final horn sounded. It worked!

During clean-up, several people, including sculptors and the event director, stopped by to try it out. We constructed fence posts within reach of the key and a sign instructing people to turn it gently. Sharon made a short video of Lars and I turning it as well. When we left, the mechanism was still working, but we didn't know how long it would last.

We crashed at Belfair that night and woke up the next day in time to thaw and dry our equipment before heading out for an 11 mile hike-and-sled to remote Tolovana Hot Springs. It was a delightful weekend of snow, sun, and good company.