The hardware hacker adventures in making and breaking hardware kho tài liệu training

Pr a i se f or

The Hardware Hacker
“Hardware, says bunnie, is a world without secrets: if you go
deep enough, even the most important key is expressed in
silicon or fuses. bunnie’s is a world without mysteries, only
unexplored spaces. This is a look inside a mind without peer.”
—Edward Snowden
“A tour de force that combines the many genius careers
of one of the world’s great hacker-communicators: practical, theoretical, philosophical, and often mind-blowing.”
—Cory Doctorow, author of Little Brother and ­technology
activist

“bunnie lives in the world of hardware where the solder
meets the PCB. He has more practical experience and is
a better teacher of how the ecosystem of hardware works
than any other person I’ve ever met, and I know a lot of
people in this space. He has rendered this experience
and expertise into an amazing book—a hacker’s-point-ofview bible to anyone trying to work in or understand and
work in the emerging and evolving world of hardware.”
—Joi Ito, Director, MIT Media Lab


“bunnie is the ultimate tour guide of hardware hacking as it
stands today, with an eye toward the sublime art of how things
are really made. The Hardware Hacker will take you on a journey
through the factories of the world, covering both the technical
and ethical implications of the ‘stuff ’ we manufacture and buy.”
—Limor “ladyada” Fried, Founder & Engineer, Adafruit

Industries
“Curious how the devices in our daily lives come into being?
Want to manufacture your own project? In this well-written
book, bunnie describes the ins and outs of the manufacturing
process in China. A very entertaining and informative read.”
®
—Mitch Altman, inventor of TV-B-Gone
“The Hardware Hacker is, at its core, the primer for understanding the culture of making something in China, how to
build thousands of things, and why Open Hardware works.”
—Hackaday


The
Hardware
Hacker
Adventures in Making
and Breaking Hardware

Andrew “bunnie” Huang


The Hardware Hacker. Copyright © 2017 by Andrew “bunnie” Huang.
All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means,
electronic or mechanical, including photocopying, recording, or by any information storage or retrieval
system, without the prior written permission of the copyright owner and the publisher.
20 19 18 17   1 2 3 4 5 6 7 8 9
ISBN-10: 1-59327-758-X
ISBN-13: 978-1-59327-758-1

Publisher: William Pollock

Production Editor: Alison Law
Cover and Jacket Design: Hotiron Creative
Interior Design: Beth Middleworth
Developmental Editor: Jennifer Griffith-Delgado

Copyeditor: Rachel Monaghan
Compositor: Alison Law
Proofreader: Emelie Burnette
Indexer: BIM Creatives, LLC.

The images on the following pages are reproduced with permission: pages 58–59 © David Cranor; page 124
© m ss ng p eces; pages 216, 227–228 © Scott Torborg; page 248 © Joachim Strömbergson; pages 253
(bottom) and 254–255 © Jie Qi; page 256 (top) © Chibitronics; page 310 © Nadya Peek; page 326 (top) from
Eva Yus et al., “Impact of Genome Reduction on Bacterial Metabolism and Its Regulation,” Science 326,
no. 5957 (2009), reprinted with permission from AAAS; page 349 © Sakurambo, used under CC BY-SA 3.0.
The interviews on the following pages were originally published online and are reproduced with permission:
pages 190–204, originally published as “MAKE’s Exclusive Interview with Andrew (bunnie) Huang – The
End of Chumby, New” by Phillip Torrone in Make: (April 30, 2012), />makes-exclusive-interview-with-andrew-bunnie-huang-the-end-of-chumby-new-adventures/; pages
357–372, originally published in Chinese as “Andrew “bunnie” Huang：开源硬件、创客与硬件黑客” in
China Software Developer Network (July 3, 2013), />pages 372–382, originally published as “The Blueprint Talks to Andrew Huang” in The Blueprint (May
15, 2014), />For information on distribution, translations, or bulk sales, please contact No Starch Press, Inc. directly:
No Starch Press, Inc.
245 8th Street, San Francisco, CA 94103
phone: 1.415.863.9900; ; www.nostarch.com
Library of Congress Cataloging-in-Publication Data
Names: Huang, Andrew, author.
Title: The hardware hacker : adventures in making and breaking hardware /
Andrew “Bunnie” Huang.
Description: 1st ed. | San Francisco : No Starch Press, Inc., [2017]
Identifiers: LCCN 2016038846 (print) | LCCN 2016049285 (ebook) | ISBN

9781593277581 (pbk.) | ISBN 159327758X (pbk.) | ISBN 9781593278137 (epub)
| ISBN 1593278136 (epub) | ISBN 9781593278144 ( mobi) | ISBN 1593278144
(mobi)
Subjects: LCSH: Electronic apparatus and appliances--Design and construction.
| Electronic apparatus and appliances--Technological innovations. |
Computer input-output equipment--Design and construction. | Reverse
engineering. | Electronic industries. | Huang, Andrew.
Classification: LCC TK7836 .H83 2017 (print) | LCC TK7836 (ebook) | DDC
621.381092--dc23
LC record available at />
No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc.
Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using
the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of
infringement of the trademark.
The information in this book is distributed on an “As Is” basis, without warranty. While every precaution
has been taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have
any liability to any person or entity with respect to any loss or damage caused or alleged to be caused
directly or indirectly by the information contained in it.


To all the wonderful, patient, and accepting people
who have supported this eccentric hacker


ack now l e d gm e n t s

Thanks to all the hard-working staff at No Starch Press for
making this book happen. In particular, thanks to Bill Pollock
for conceiving and sponsoring the effort, and thanks to Jennifer
Griffith-Delgado for compiling, editing, and arranging my

writing into the form of this book.


brief contents
preface............................................................................................ xvii

part 1
adventures in manufacturing............................................1
chapter 1. made in china....................................................................7
chapter 2. inside three very different factories...............................43
chapter 3. the factory f loor...............................................................73

part 2
thinking differently:
intellectual property in china...................................... 115
chapter 4. gongkai innovation.......................................................119
chapter 5. fake goods......................................................................143

part 3
what open hardware means to me.............................. 175
chapter 6. the story of chumby......................................................181
chapter 7. novena: building my own laptop...................................215
chapter 8. chibitronics: creating circuit stickers...........................251


viii 

brief contents

part 4

a hacker’s perspective.................................................... 275
chapter 9. hardware hacking.........................................................279
chapter 10. biology and bioinformatics..........................................325
chapter 11. selected inter views......................................................357
epilogue...........................................................................................383
index................................................................................................384


contents in detail
prefacexvii
part 1
adventures in manufacturing

1

1. made in china

7

The Ultimate Electronic Component Flea Market...........................8
The Next Technological Revolution.................................................14
Touring Factories with Chumby......................................................16
Scale in Shenzhen............................................................................. 17
Feeding the Factory.......................................................................... 18
Dedication to Quality........................................................................20
Building Technology Without Using It.............................................23
Skilled Workers.................................................................................24
The Need for Craftspeople................................................................26
Automation for Electronics Assembly..............................................29
Precision, Injection Molding, and Patience...................................... 31

The Challenge of Quality..................................................................34

Closing Thoughts.............................................................................42

2. inside three very
different factories

43

Where Arduinos Are Born...............................................................44
Starting with a Sheet of Copper.......................................................46
Applying the PCB Pattern to the Copper.........................................49
Etching the PCBs.............................................................................. 51
Applying Soldermask and Silkscreen...............................................53
Testing and Finishing the Boards....................................................54


x 

contents in detail

Where USB Memory Sticks Are Born.............................................57
The Beginning of a USB Stick.......................................................... 57
Hand-Placing Chips on a PCB.......................................................... 59
Bonding the Chips to the PCB.......................................................... 61
A Close Look at the USB Stick Boards............................................ 61

A Tale of Two Zippers......................................................................64
A Fully Automated Process.............................................................. 67
A Semiautomated Process................................................................68

The Irony of Scarcity and Demand................................................... 70

3. the factory f loor

73

How to Make a Bill of Materials.....................................................74
A Simple BOM for a Bicycle Safety Light........................................ 74
Approved Manufacturers.................................................................. 76
Tolerance, Composition, and Voltage Specification......................... 76
Electronic Component Form Factor..................................................77
Extended Part Numbers................................................................... 78
The Bicycle Safety Light BOM Revisited......................................... 79
Planning for and Coping with Change.............................................82

Process Optimization: Design for Manufacturing..........................84
Why DFM?.........................................................................................85
Tolerances to Consider......................................................................86
Following DFM Helps Your Bottom Line.........................................88
The Product Behind Your Product................................................... 91
Testing vs. Validation........................................................................97

Finding Balance in Industrial Design..........................................100
The chumby One’s Trim and Finish............................................... 101
The Arduino Uno’s Silkscreen Art................................................. 104
My Design Process.......................................................................... 105

Picking (and Maintaining) a Partner............................................107
Tips for Forming a Relationship with a Factory............................ 107
Tips on Quotations.......................................................................... 108

Miscellaneous Advice...................................................................... 111

Closing Thoughts...........................................................................113


contents in detail 

xi

part 2
thinking differently:
intellectual property in china

115

4. gongkai innovation

119

I Broke My Phone’s Screen, and It Was Awesome........................120
Shanzhai as Entrepreneurs...........................................................121
Who Are the Shanzhai?..................................................................122
More Than Copycats.......................................................................123
Community-Enforced IP Rules.......................................................124

The $12 Phone................................................................................126
Inside the $12 Phone.......................................................................128
Introducing Gongkai....................................................................... 131
From Gongkai to Open Source....................................................... 134
Engineers Have Rights, Too........................................................... 135

Closing Thoughts........................................................................... 141

5. fake goods

143

Well-Executed Counterfeit Chips..................................................143
Counterfeit Chips in US Military Hardware................................149
Types of Counterfeit Parts.............................................................. 150
Fakes and US Military Designs..................................................... 153
Anticounterfeit Measures...............................................................154

Fake MicroSD Cards......................................................................156
Visible Differences........................................................................... 157
Investigating the Cards.................................................................. 158
Were the MicroSD Cards Authentic?............................................. 159
Further Forensic Investigation....................................................... 160
Gathering Data................................................................................ 162
Summarizing My Findings............................................................. 166

Fake FPGAs...................................................................................168
The White Screen Issue.................................................................. 168
Incorrect ID Codes.......................................................................... 170
The Solution..................................................................................... 172

Closing Thoughts........................................................................... 174


xii 

contents in detail

part 3
what open hardware means to me

175

6. the story of chumby

181

A Hacker-Friendly Platform..........................................................182
Evolving chumby............................................................................184
A More Hackable Device.................................................................186
Hardware with No Secrets............................................................. 187

The End of Chumby, New Adventures..........................................189
Why the Best Days of Open Hardware Are Yet to Come.............205
Where We Came From: Open to Closed.........................................206
Where We Are: “Sit and Wait” vs. “Innovate”...............................208
Where We’re Going: Heirloom Laptops.......................................... 210
An Opportunity for Open Hardware.............................................. 211

Closing Thoughts........................................................................... 214

7. novena: building my own laptop

215

Not a Laptop for the Faint of Heart.............................................. 217
Designing the Early Novena..........................................................219
Under the Hood................................................................................ 219
The Enclosure..................................................................................224

The Heirloom Laptop’s Custom Wood Composite.........................227
Growing Novenas............................................................................228
The Mechanical Engineering Details............................................229

Changes to the Finished Product..................................................232
Case Construction and Injection-Molding Problems.....................233
Changes to the Front Bezel............................................................ 237
DIY Speakers...................................................................................238
The PVT2 Mainboard.....................................................................238
A Breakout Board for Beginners.................................................... 241
The Desktop Novena’s Power Pass-Through Board.......................242
Custom Battery Pack Problems......................................................243
Choosing a Hard Drive...................................................................244
Finalizing Firmware.......................................................................246

Building a Community...................................................................247
Closing Thoughts...........................................................................249


contents in detail 

8. chibitronics: creating circuit stickers

xiii

251

Crafting with Circuits...................................................................257
Developing a New Process..............................................................259
Visiting the Factory.........................................................................260
Performing a Process Capability Test............................................261

Delivering on a Promise.................................................................264
Why On-Time Delivery Is Important............................................266
Lessons Learned............................................................................266
Not All Simple Requests Are Simple for Everyone........................267
Never Skip a Check Plot.................................................................268
If a Component Can Be Placed Incorrectly, It Will Be..................268
Some Concepts Don’t Translate into Chinese Well....................... 270
Eliminate Single Points of Failure................................................. 271
Some Last-Minute Changes Are Worth It..................................... 271
Chinese New Year Impacts the Supply Chain............................... 272
Shipping Is Expensive and Difficult.............................................. 273
You’re Not Out of the Woods Until You Ship................................. 274

Closing Thoughts...........................................................................274

part 4
a hacker’s perspective

275

9. hardware hacking

279

Hacking the PIC18F1320...............................................................281
Decapping the IC.............................................................................282
Taking a Closer Look......................................................................283
Erasing the Flash Memory.............................................................284
Erasing the Security Bits...............................................................285
Protecting the Other Data..............................................................287

Hacking SD Cards.........................................................................289
How SD Cards Work........................................................................290
Reverse Engineering the Card’s Microcontroller..........................293
Potential Security Issues................................................................298
A Resource for Hobbyists................................................................298

Hacking HDCP-Secured Links to Allow Custom Overlays.........298
Background and Context................................................................300
How NeTV Worked..........................................................................302


xiv 

contents in detail

Hacking a Shanzhai Phone...........................................................306
The System Architecture................................................................306
Reverse Engineering the Boot Structure....................................... 311
Building a Beachhead..................................................................... 315
Attaching a Debugger..................................................................... 317
Booting an OS................................................................................. 321
Building a New Toolchain............................................................... 321

Fernvale Results..............................................................................323

Closing Thoughts...........................................................................324

10. biology and bioinformatics

325

Comparing H1N1 to a Computer Virus........................................327
DNA and RNA as Bits.....................................................................328
Organisms Have Unique Access Ports...........................................330
Hacking Swine Flu.......................................................................... 331
Adaptable Influenza........................................................................333
A Silver Lining................................................................................335

Reverse Engineering Superbugs...................................................335
The O104:H4 DNA Sequence..........................................................336
Reversing Tools for Biology.............................................................338
Answering Biological Questions with UNIX Shell Scripts...........340
More Questions Than Answers......................................................342

Mythbusting Personalized Genomics............................................344
Myth: Having Your Genome Read Is Like Hex-Dumping
the ROM of Your Computer......................................................344
Myth: We Know Which Mutations Predict Disease......................345
Myth: The Reference Genome Is an Accurate Reference..............345

Patching a Genome........................................................................346
CRISPRs in Bacteria...................................................................... 347
Determining Where to Cut a Gene................................................350

Implications for Engineering Humans........................................... 351
Hacking Evolution with Gene Drive..............................................352

Closing Thoughts...........................................................................354


contents in detail 

11. selected inter views

xv

357

Andrew “bunnie” Huang: Hardware Hacker (CSDN)..................357
About Open Hardware and the Maker Movement........................358
About Hardware Hackers...............................................................367

The Blueprint Talks to Andrew Huang........................................372

epilogue383
index384



preface
When Bill Pollock, founder of No Starch Press, first contacted
me with the idea of publishing a compilation of my writings, I
was skeptical. I didn’t think there would be enough material
to fill a hundred pages. It seems I was wrong.

My mother often said, “It doesn’t matter what’s in your
head if you can’t tell people what’s in it,” and when I was in
seventh grade, she enrolled me in an after-school essay writing class. I hated the class at the time, but in retrospect, I’m
thankful. Starting with my college application essays and up
to this day, I’ve found the ability to organize my thoughts into
prose invaluable.


xviii 

preface

Most of the material in this book was originally published
on my blog, but as you’ll soon see, those posts weren’t puff
pieces written to drive ad revenue. One reason I write is to
solidify my own understanding of complicated subjects. It’s
easy to believe you understand a topic until you try to explain
it to someone else in a rigorous fashion. Writing is how I distill
my intuition into structured knowledge; I only write when I
find something interesting to write about, and then I post it
with a CC BY-SA license to encourage others to share it.
This book includes a selection of my writings on manufacturing, intellectual property (with a focus on comparing
Western versus Chinese perspectives), open hardware, reverse
engineering, and biology and bioinformatics. The good editors
at No Starch Press also curated a couple of interviews I’ve done
in the past that were particularly informational or insightful. The common thread throughout these diverse topics is
hardware: how it’s made, the legal frameworks around it, and
how it’s unmade. And yes, biological systems are hardware.
I’ve always gravitated toward hardware because while I’m
not particularly gifted when it comes to abstract thought (hence

the need to write to organize my thoughts), I am pretty good
with my hands. I have a much better chance of understanding
things that I can see with my own two eyes.
My entire understanding of the world has always been
built on a series of simple, physical experiences, starting from
when I stacked blocks and knocked them over as a child. This
book shares some of my more recent experiences. I hope that
by reading them, you will gain a deeper understanding of the
world of hardware, without having to spend decades stacking
blocks and knocking them over.
Happy hacking,
—b.


Part 1
adventures in
manufacturing
I first set foot in China in November 2006. I had no idea what I
was walking into. When I told my mother I was going to visit
Shenzhen, she exclaimed, “Why are you going there? It’s just a
fishing village!” She wasn’t wrong: Shenzhen was just a town
of 300,000 back in 1980, but it had exploded into a megacity of
10 million in less than 30 years. Between my first visit and
the time I wrote this book, Shenzhen gained an estimated
4 million people—more than the population of Los Angeles.
In a way, my understanding of manufacturing over the
years has mirrored Shenzhen’s growth. Before going to China,
I had never mass-produced anything. I didn’t know anything
about supply chains. I had no idea what “operations and logistics” meant. To me, it sounded like something out of a math
or programming textbook.

Still, Steve Tomlin, my boss at the time, charged me with
figuring out how to build a supply chain suitable for our hardware startup, Chumby. Sending a novice into China was a
big risk, but my lack of preconceived notions was more of an
asset than a liability. Back then, venture capitalists shunned


2 

part 1

hardware, and China was only for established companies looking to build hundreds of thousands of units of a given product.
My first set of tours in China certainly supported that notion,
as I primarily toured mega-factories serving the Fortune 500.
Chumby was lucky to be taken under the wing of PCH
International as its first startup customer. At PCH, I was
mentored by some of the finest engineers and supply chain
specialists. I was also fortunate to be allowed to share my
experiences on my blog, as Chumby was one of the world’s
first open hardware startups.
Although meeting the minimum order volumes of our conventional manufacturing partners was a constant struggle,
I kept noticing small things that didn’t square with conventional wisdom. Somehow, local Chinese companies were able
to remix technology into boutique products. The so-called
shanzhai integrated cell phones into all kinds of whimsical
forms, from cigarette lighters to ornamental golden Buddha
statuettes (more on this in Chapter 4). The niche nature of
these products meant they had to be economical to produce in
smaller volumes. I also noticed that somehow factories were
able to rapidly produce bespoke adapter circuits and testing
apparatuses of surprisingly high quality in single-unit volumes.
I felt there was more to the ecosystem—a story that was being

told over and over again—but few had the time to listen, and
those who did heard only the parts they wanted to hear.
The financial crisis of 2008 changed everything. The consumer electronics market was crushed, and factories that were
once too busy printing money were now swimming in excess
capacity. I made friends at several medium-sized factories
in the area. I started to inquire about how, exactly, these
factories were able to so nimbly produce their internal test
equipment, and how shanzhai were able to prototype and build
such bespoke phones.


adventures in manufacturing  3

The bosses and engineers were initially reticent, not because
they wanted to hide potential competitive advantages from
me, but because they were ashamed of their practices. Foreign
clients were full of corporate process, documentation, and quality procedures, but they also paid dearly for such overhead.
Local companies were much more informal and pragmatic. So
what if a bin is labeled “scrap”? If the bits inside are suitable
for a job, then use them!
I wanted in. As an engineer, tinkerer, and hacker, I cared
a lot about the cost to produce a few units, and a couple of
minor assembly defects was nothing compared to the design
issues I had to debug. I eventually managed to coax a factory
into letting me build a part using its low-quality but ultracheap assembly process.
The trick was to guarantee that I would pay for all the
product, including defective units. Most customers refuse to
pay for imperfect goods, forcing the factory to eat the cost of
any part that isn’t exactly to specification. Thus, factories
strongly dissuade customers from using cheaper but lowquality processes.

Of course, my promise to pay for defective product meant
there was no incentive for the factory to do a good job. It could
have, in theory, just handed me a box of scrap parts and I’d
still have had to pay for it. But in reality, nobody had such ill
intentions; as long as everyone simply tried their best, they
got it right about 80 percent of the time. Since small-volume
production costs are dominated by setup and assembly, my
bottom line was still better despite throwing away 20 percent
of my parts, and I got parts in just a couple of days instead of
a couple of weeks.
Having options to trade cost, schedule, and quality against
each other changes everything. I’ve made it a point to discover
more alternative production methods and continue shortening


4 

part 1

the path between ideas and products, with ever more options
along the cost-schedule-quality spectrum.
After Chumby, I decided to remain unemployed, partly to
give myself time for discovery. For example, every January,
instead of going to the frenzied Consumer Electronics Show
(CES) in Las Vegas, I rented a cheap apartment in Shenzhen
and engaged in the “monastic study of manufacturing”; for
the price of one night in Las Vegas, I lived in Shenzhen for a
month. I deliberately picked neighborhoods with no English
speakers and forced myself to learn the language and customs
to survive. (Although I’m ethnically Chinese, my parents prioritized accent-free fluency in English over learning Chinese.)

I wandered the streets at night and observed the back alleys,
trying to make sense of all the strange and wonderful things
I saw going on during the daytime. Business continues in
Shenzhen until the wee hours of the morning, but at a much
slower pace. At night, I could make out lone agents acting out
their interests and intentions.
If there’s one thing those studies taught me, it’s that I
have a lot more to learn. The Pearl River Delta ecosystem is
incomprehensibly vast. As with the Grand Canyon, simply
hiking one trail from rim to base doesn’t mean you’ve seen it
all. I have, however, picked up enough knowledge to build a
custom laptop and to develop a new process for peel-and-stick
electronic circuits.
In this part of the book, you’ll follow my journey as I learned
the Shenzhen ecosystem over the years, via a remix of blog
posts that I wrote along the way. Some of the essays are reflections on particular aspects of Chinese culture; others are case
studies of specific manufacturing practices. I conclude with a
chapter called “The Factory Floor,” a set of summary recommendations for anyone considering outsourced manufacturing.
If you’re in a hurry, you can skip all the background and go
directly there.


adventures in manufacturing  5

However, hindsight is 20/20. Once you’ve walked a path,
it’s easy to point out the shortcuts and hazards along the
way; it’s even easier to forget all of the wrong turns and bad
assumptions. There’s no one-size-fits-all method for approaching China, and my hope is that by reading these stories, you
can come to your own (perhaps different) conclusions that
better serve your unique needs.