Feb 6 12

iOS FAT binaries

by Mik

I just got by reverse-engineering some iOS apps and wanted to make some FAT-notes (ha ha) about the FAT binaries – and of course share them as well.

First of all, the magic numbers, here’s a quick list:

  • 0xFEEDFACE, Mach-O executable, Big Endian
  • 0xCEFAEDFE, Mach-O executable, Little Endian
  • 0xCAFEBABE, Universal Binary, FAT

Universal binaries have a header with a length of 0×1000 (4096 bytes). They are built up like (I borrowed this from http://hohle.net, though I changed the value to match a random iOS app):

cafe babe # Fat Binary Magic Number
0000 0002 # Number of archives
0000 000C # CPU Type          # Archive 1
0000 0006 # CPU Subtype
0000 1000 # Archive Offset
000C 4500 # Archive Size
0000 000C # Alignment
0000 000C # CPU Type          # Archive 2
0000 0009 # CPU Subtype
000C 6000 # Archive Offset
000C 12F0 # Archive Size
0000 000C # Alignment

The remaining places up to 0×1000 is filled up with zero’s.



Nov 15 11

Danske Bank API

by Mik

Hello! So I got this comment from Kristian in my latest post about a peak inside the Danske Bank iPhone app. To share my efforts, you can download my DanskeBankAPI in .NET here. At the time it supports checking your accounts, searching and paging through transactions etc., but not actually making an transaction.The example app to show some functionality is:

A simple example code for using the API is (actually the code for the above form):

  1. db.createSession();
  2. db.login(textBox1.Text, textBox2.Text);
  3. Models.Account[] acc = db.getAccounts();
  4. if (acc.Length > 0) label1.Text = acc[0].Balance.ToString();

The first line creates a session (required) and the next line logins using two textboxes (and the CPR and mobilbank code). The latest two lines simple gets the accounts and prints the first accounts balance to a label.

Download and test out the project if you want, all the source is right there, so take a look if you are suspicious.



Oct 24 11

Reverse engineering Jacob Jensen P-watch: Part 6

by Mik

Finally my P-watch is done! This post is the therefore hopefully the last in the small series of reverse-engineering the parking watch. Therefore it might also be a big longer than the other posts. You can see a video of the parking-watch it in action here.

Last time I reverse-engineered the dimensions of the PCB inside the parking-watch and where the screen-connectors should be. I created an EAGLE part so that I had these dimensions and LCD-pads when creating the PCB. You can download my library here (containing a few components but the JJ-PCB is theĀ  PCB-part). It also contains the parts used later on for the GSM-module.

read more…



Mar 17 11

Reverse engineering Jacob Jensen P-watch: Part 5

by Mik

So to make my own hardware work in the original casing, I have to make my own PCB board – if it doesn’t work, the last solution is to “hack” wires into the existing LCD-connectors. But the first process in making the PCB is knowing the dimensions of the board available. If I should ever get so far, I don’t know if I would let the components be in the original casing or if I should make a wire go from a hidden place to the casing. I consider the last option because I have had thieves in my car 2 times in the last three months – so all my work will be lost if they think that they can steal a parking watch worth 200$ (but actually worth a lot more in valuable time, if the project should ever work out).

The PCB should then either be designed as a complete board with microprocessor or just as a “connector” board with pads to the LCD display. The dimensions should be calculated anyways. I did so and made a model in Autodesk Inventor as designing special PCB’s is crap in CadSoft Eagle.

Here is the PCB board with only LCD connector layout reverse engineered/measured from the original board. All sizes are in millimeters.

PCB dimensions



Mar 17 11

Reverse engineering Jacob Jensen P-watch: Part 4

by Mik

I took home a little early from work today and had some spare time to do some software work on my project. I made three buttons on a breadboard, connected a speaker and finished programming the ATmega329P chip to act as a better interface. It does what the original product should have done (in my opinion):

  1. Change the parking time by pressing UP/DOWN with 15min interval
  2. Change the current time in the build in RTC module by holding SET
  3. Set the parking time to the current (the next 15min as per Danish law) by clicking on SET

This order is also demonstrated in the video of the LCD display here:



Mar 15 11

Reverse engineering Jacob Jensen P-watch: Part 3

by Mik

I got bought my AVR Dragon and started to program the microprocessor (or actually that was three weeks ago). But what I just did was to be able to write to the LCD display using my recently reverse engineered informations and the new ATmega329 microprocessor! Video below:



Mar 15 11

Reverse engineering Jacob Jensen P-watch: Part 2

by Mik

P-watch PCBSo I cracked open the box (even though the manual said “the product is designed to get broken if you open the case”) and got a good stuff for you. The PCB inside is a two-layered printed circuit board with SMD components on both sides. There is 3 protected chips in silicone. The right one is a DCF77 module getting the current time from the broadcaster in Frankfurt. The middle one is a LCD driver and the one on the left is a microprocessor (not quite sure about these two, maybe they are combined and the one on the left is something else). Besides that the most fancy components is the voltage regulation from the battery. The interesting side of the PCB is on the right (very big picture). All the silver points in the middle is the connector to the LCD display in the front window and the metal at the top is another connector to a LCD inside the car.

Only the LCD in the front is interesting to reverse engineer for me as that is watch the parking guard can see. So I took the LCD out and reverse engineered the connections. These can be seen under this text (and downloaded as a interactable PSD file here).

I have just bought an ATMEL ATmega329 microprocessor as it includes a LCD driver – now let the fun beginĀ  :-)

LCD Segments



Mar 15 11

Reverse engineering Jacob Jensen P-watch: Part 1

by Mik

Jacob Jensen's P-watchI should actually have started this serie one month ago, as I started looking into it there. But better late than never, so here it goes:

This christmas I got this Jacob Jensen’s P-watch as a gift and thought about whether or not to install it in my car. I decided to try it out – but after three weeks of hell I took it out and bought an old manual P-watch. The automatic P-watch works by measuring vibrations of the car and deciding the parking state from the internal algorithm. However it does NOT work as originally thought! Every single day when I stop at the end of the highway, the parking watch beeps and think that I have parked – no, I’m not just saying every day for fun. It was every, single, day when I stopped at the end of the highway .. I could just sit in my car and say “now it’s gonna beep” – and it would. Beside the wrong parkings the people behind the electronic P-watch have decided to “lock” the P-watch after a while, so you cannot manually set it. So often when I was out driving and needed to park I had to reset the P-watch, manually set the time correct and then manually set the parking time afterwards! This is NOT good for a parking watch costing you almost 200$.

I wrote to Jacob Jensen about my 90% error rate and irritation. I got redirected to the manufactoring company (from the design-company) and was promised an answer in a very short time – now almost two months later I have still not received the response.

So what to do with a shit-watch that is to more annoyance than help? Well.. if I could juuuust reverse engineer it :-)



Feb 23 11

Texas Instruments LaunchPad

by Mik

LaunchPadSo I saw this new product that TI had announced: the LaunchPad. A $4.30 value serie development board for MSP430 microprocessors. To the low price of $4.30 – I end up ordering two.

The package was received only 5 days after ordering – even though they said it was not in stock. I am truly amazed of the work Texas Instrument have put in this development board and their service distributing it to the world. For only $4.30 you get two microprocessors, USB cable, pin headers, a crystal and even some jumpers, if you need someone for your harddisk. For that price, you might not even be able to buy the jumpers or pin headers on the board in Denmark – and certainly not the USB cable. I cannot figure out how this should ever count as an income to TI. The last time I had something shipped with International Priority the shipping costs from USA was more than $30 bucks. At the same time I have also bought an Atmel AVR-Dragon – and this comes with nothing but a paper box for the price of $100 (and it is even the value line of AVR programmers). I know it is two completely different product and therefore only the quality and the service is compared – not the tools.

The TI LaunchPad comes preprogrammed with a temperature application and there is two different (but completely free) tools for programming it. I haven’t had the time to program it yet, but I can see there is samples for the “Hello World” / Blink.. So it should be very easy to get started.

If you want to buy one, you can get one at the TI eStore. Once again, thanks and great job Texas Instruments! *tap on your back*



Jan 5 11

A peak inside Danske Bank iPhone app

by Mik

In couriosity I have looked inside the Danske Mobilbank app for the iPho

ne, and I just wanted to share this. The first and obvious thing to do is to SSH into the phone and look inside the application folder. After having downloaded the application, I started out checking the preference folder. The only thing here interesting is the file called danskebankgroup.mobilebank.danskebank.plist, which contains some informations on which phone number to call and whether the camera is enabled or not.

Immediately after I looked inside the read more…