Super happy with the new Bus Pirate HEX viewer! Valid ASCII and non-zero values are highlighted. Quiet mode (-q) hides addresses for easy paste into HEX editors. Dump range can be specified, and paging is enabled by default. Used in all data dump commands: DDR5 tool, SLE4442...

Grabbed some SHT3x and SHT4x temperature and humidity sensors for a Bus Pirate demo. SHT3x is a significant upgrade to the ancient SHT2x with a wider temperature and humidity range, and higher accuracy at the extremes. SHT4x slightly improves on the SHT3x specs, but is mostly...

The typical 8 pin memory chip has ground (GND, VSS) on pin 4 and power (VCC) pin 8. It doesn't appear to be a formal standard, but more a tradition. Modern EEPROMs (24x, 25x), flash (25Qx), SRAM (23x) and FRAM all have a similar power n ground pinout. However there are a couple oddities out there...

My #jumperless + #BusPirate all pimped out and ready to party! @buspirate.bsky.social @architeuthisflux.bsky.social

Has anyone used a Microchip UNI/O single wire EEPROM? Protocol looks like Manchester encoded I2C. Debuted >10 years ago (when 1-Wire was already a zombie) with talk of a bunch of devices. Today there's just a couple EEPROMs, and a few hits on GitHub. Single wire must kill it...

About twice a year I need a through hole resistor kit, but this is also fine... The Bus Pirate eeprom command is now read/write/dump/verify/testing 1-Wire EEPROMs.

The Bus Pirate I2C EEPROM command is coming along, so I wanted to see if we can use a common code base to work with SPI EEPROMs. I narrowed the list of SPI EEPROMs down to this set with common page sizes and addressing methods. Most SPI EEPROMs have write protection blocks...

Working on a command to dump, read, write, verify, erase and test I2C EEPROMs. Held off on doing this because there are so many EEPROM variations, but it should work with every 24XX EEPROM from Microchip (née ATMEL) and their major competitor, uh, also Microchip.

Picked up a handful of new breakouts recently, one was a FRAM chip. Ferroelectric RAM is a fairly new type of memory with the speed of SRAM and the persistence of EEPROM. It’s still much more expensive than EEPROM, flash or SRAM, but check out these benefits:

DDR5 UDIMM and SODIMM modules on a prototype breakout board. Motherboards detect DDR5 via a "SPD hub" chip with an I2C/I3C interface. A 128 byte register configures the hub and temperature sensor. Standard tables in a 1024 byte EEPROM describe how to configure the RAM.

Bus Pirate documentation update is complete! A new automated system captures and converts terminal output to screencasts and HTML to keep the docs up to date. Docusaurus is slow and v3 choked on a lot of Bus Pirate output, so we ported the whole site to super fast Hugo Docs.

RP2350 supports a second NOR flash or PSRAM. Trying PSRAM, but QSPI only sends 0xFF. Here it should send 0x9F and read 6 bytes to get the chip ID. Sending any value results in 0xFF on the bus. Not sure if this is a hardware or software issue.

Tom Nardi tries out the new Bus Pirate I2C sniffer feature: hackaday.com/2025/03/12/i...

A minor convenience change for the mode command. You can already bypass the mode menu by specifying the mode number. Now you can also specify the mode by name (case insensitive). This should help scripts stay stable long term, even if the order of modes changes.

Alternating between a space heater and the freezer to characterize the leakiness of some Schottky diodes.

Sniff I2C data up to 500kHz with the latest Bus Pirate firmware. The pico-i2c-sniffer project uses all four state machines of an RP2040 PIO to spy on I2C bus traffic. Useful for reverse engineering, debugging, and long duration event logging.

Forgot the set-up photo. Here's a Bus Pirate connected to a CPLD development board scanning for the JTAG pins.

Exciting integration for the Bus Pirate! bluetag automates JTAG and SWD pin finding. Easily scan for JTAG/SWD interfaces by entering JTAG mode, enabling power, and using the bluetag command. Demo video in the next post.

Using the Bus Pirate, Matt successfully used power fault injection (glitching) to bypass UART password authentication on an Arduino Uno. This is a great way to try your first glitch hack. greybeardwhitehat.blogspot.com/2025/01/succ...

Factory boss hates our button caps! Our new injection molding factory popped the Bus Pirate button caps under a microscope and found some ugly defects.

More glitching with the Bus Pirate timing and generating the glitch. This time targeting an Arduino board to better describe and explain the process. The @buspirate.bsky.social is so flexible for so many things!

The latest Bus Pirate firmware now supports AnalysIR, popular program to capture, analyze and replay infrared remote control signals. You will need an infrared demodulator and infrared diode, or use the IR Toy plank.

Here's a sneak peek at some exciting updates to the Bus Pirate infrared mode: With irrx, you can capture infrared remote control signals as a sequence of on (MARK) and off (SPACE) times in the AIR (AnalysIR) format and save them to a file. With irtx, you can replay these recorded sequences.

Check out the Bus Pirate enclosure v2 being made at the injection molding factory last week! Join us for a factory tour and find the link to order your new enclosure at the end of the post.

So we updated DirtyJTAG firmware for the Bus Pirate includes some cosmetic and usability fixes. Normally a 3.3volt power supply is activated. To Bring Your Own Voltage hold the button while plugging in the USB cable - now you can connect an external target voltage from 1.2-5volts to the VOUT pin.

A glitch hack with Bus Pirate!

A scratch and sniff "genuine" sticker seals every Bus Pirate anti-static bag. The custom scent evokes fresh green paint on factory floors, PVC plastics, and oily/diesel notes. After a year the supply is almost gone. Should we keep doing this? Did you know about it and/or smell it? 😆

PixMob concert bracelets have RGB LEDs that synchronize across thousands of people in a stadium show. Not just color syncing, but detailed patterns such as the heart in the photo are possible. Cra0 tore one apart to see how it works, and dumped the EEPROM with a Bus Pirate. cra0.net/blog/posts/r...

Oh man. They leaned in hard on the security aspects. They knew in September it was faulty. Wanted the disclosure delayed until January. No notice of a 0 day. Whose IP has been vulnerable for months? Hack my stuff please, but if you want a secure platform is any of this ok?

RP2350 security cracked? CCC live stream starting now: streaming.media.ccc.de/38c3/zigzag

For the next few days the latest Bus Pirate firmware is in holiday mode. Pin labels are a very Grinchy green.

There is a new chip dump helper command in the latest build. The idea is to repeat the r read command of the current mode and save the contents to a file. Simple, but an effective way to dump a ton of memory devices..➡️

Some chips, like 93LC66 EEPROMs, use an SPI-like protocol but have funky start bits and opcodes before switching to standard SPI. 3WIRE is a new mode with independent control of the clock and data pins to create these sequences. The read timing diagram shows we need to send 110,

Check out these four new injection molding samples made from three different blends of PP materials. We received six different sets of samples in total..

A CMSIS-DAP 2 wire debugger, Pico debugprobe, is now working on the Bus Pirate. A 3.3volt supply is enabled by default. If your target runs on a different voltage disable the supply by holding the button at start-up, then attach the Vin/Vref pin to the target power.

DirtyJtag is the first 3rd party firmware port to the Bus Pirate. It creates a JTAG cable compatible with UrJTAG, openFPGALoader, and other software. There is also the typical spare UART. Feedback is appreciated as I don't have many targets to test.

Tooling samples of the new case! We received two sets of samples from the injection molding factory. These are only for structure and fit tests. Once this is confirmed the tooling is ready for surface treatment...

Fraxinas flashed a vac: My cousin's vacuum cleaner refused to start after replacing the battery...the original firmware actively prevents the battery from being replaced. Luckily, eager hackers have already written an alternative firmware! For programming, I used PCBites and a Buspirate 5...

MattyB is using simple tools to make glitch hacking accessible to first time, uh, glitchers :) An overview of the setup and goals here: forum.buspirate.com/t/any-tutori...

Transmit & receive RC5 and NEC remote control protocols in the latest BP firmware update. This mode uses the IR Toy "Plank" with a load of goodies. Four IR sensors: 20-60kHz learner, 38kHz barrier, 36-40kHz demodulator, and 56kHz demodulator. Two IR LEDs transmit with 100/200/300mA+ selectable power

Injection molding tooling updates! Let's start with the mould steel. Both cavity insert and core insert are made of S718H(pre-hardened, hardness 30-33HRC). Photos and videos came from the factory boss.

Working on the infrared RX/TX mode. The IR Toy Plank has a constant current 100/200/300+mA IR transmitter, and 4 IR detectors (20-60kHz learner, 38kHz barrier, 36-40kHz demodulator, 56kHz demod). Mode setup and RC5 transmitting are done, now on to receiving..

Debugging a TSL2561 (LUX sensor) and SI7021 (temperature, humidity) on a shared I2C bus. The Y splitter cables in the AUX cable kit really come in handy when I need to connect multiple devices with minimal fuss.

Rev1 carry case! Our second sample. This version is a bit thicker, and we wanted to try a metal zipper. The increase in width is nice. The selection of 40mm metal zippers 0.5m long is not great, so our only option was black. The plastic zipper actually works a bit nicer than the metal.

Blank plank board update! Removed the LEDs and switches for now. Will add back in one power indicator LED and a footprint for a capacitor on VOUT.

We are working on a blank plank in the forum! It's a wire-free proto board that works for 2.54mm through hole parts as well as mani SMD parts. It might have a bidirectional LED, button and slide switch. Any suggestions? forum.buspirate.com/t/blank-plan...

REV0 carry case for the Bus Pirate and accessories. There are two layers, each has one large and three small pockets. The pocket net material catches on leads and stuff, and should have been high contrast yellow. The three zipper pockets are pretty awful too

Update! You can use Micropython on Bus Pirate 5 with thestumbler's experimental port. The repo has MP modules for working with the Bus Pirate hardware, such as the LCD. Clone the repo, program the firmware and then copy the flash directory on the Micropython disk: github.com/thestumbler/...

Reading flash memory chips is a breeze with the Bus Pirate @buspirate.bsky.social . Seriously, if you're a firmware, embedded, or hardware engineer, or a hardware hacker, you would find the BP to be really useful. Added bonus: great support and an amazing community.

Great to see so many friends joining :) I'm Ian at Dangerous Prototypes. We make the Bus Pirate, an open source hardware debug tool. We also do stupid manufacturing tricks like anodizing capacitors, dying ABS plastic, and custom scratch n' sniff stickers. Here's a podcast I did in the spring: